Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: my weekend project, Gumroad

gumroad.com

Post reply on HN
Print view View original

141–150 of 215 posts

Re: Show HN: my weekend project, Gumroad

#141

Post by triviatise »

JoachimSchipper wrote: post #52
phoboslab wrote: post #47

Earlier quoted context omitted.

I love the idea! This makes it really easy to sell scripts (e.g. your own jQuery plugins or whatever) for $5 where it would normally be too much work to set up some payment processing. The 30% cut is way too high though. Especially for higher priced links - I wouldn't want to sell my $99 game engine[1] through your service. I think something like "5%, but at least $0.30" would make more sense. But maybe having such "…

Paypal already takes $0.30 plus a small percentage. I think the service is a neat idea, but microtransactions are not a solved problem.

Paypal released a micropayment platform this year http://www.readwriteweb.com/archives/paypals_micropayment_so...

>

Re: Show HN: my weekend project, Gumroad

#142

Post by jasonlotito »

pixeloution wrote: post #89
jasonlotito wrote: post #81

Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content) I'm really interested if Stripe is aware of what you are doing and fine with it.

PCI compliance is only an issue if he's storing CC data.

That's not true. If CC data is passing through his system, their are things he needs to be aware of. You'd be surprised at the logs that are generated by people who don't store credit card information. Somehow, that unstored CC information winds up in a random logs directory, unencrypted and open for anyone to see.

Re: Show HN: my weekend project, Gumroad

#144

Post by DanI-S »

JoachimSchipper wrote: post #136
phoboslab wrote: post #78

Earlier quoted context omitted.

Sure, at the moment only nerds use Bitcoins, but this _could_ become as universal as PayPal is today. But yes, it probably doesn't make much (commercial) sense right now.

> Bitcoins [...] _could_ become as universal as PayPal is today Putting aside numerous other issues, bitcoin.org states "The total eventual circulation will be 21 million bitcoins". [EDIT: DanI-S pointed out that bitcoins can already be subdivided. So this was switched from "there are too few bitcoins to support even American e-commerce" to "bitcoins are not valuable enough to support even American e-commerce". The n…

Bitcoins are already subdivisable to a whole bunch of decimal places.

Re: Show HN: my weekend project, Gumroad

#145

Post by apgwoz »

JoshTriplett wrote: post #36

Interesting idea, but I see two main issues with this. First, anyone who pays and gets to the resulting link can trivially share that link; of course, you can always ask them nicely not to do so, and in some contexts that will work, but in general the security model just doesn't work unless you authenticate each paid user at the destination. You need to come up with an answer to this. Second, if you market this as a…

I haven't thought much about this solution, but wouldn't it be simple to just proxy the content back to the user? This would work fine for downloadable goods, maybe not so much for secret links to sites.

Re: Show HN: my weekend project, Gumroad

#146

Post by Geee »

sahillavingia wrote: post #43
aw3c2 wrote: post #29

Earlier quoted context omitted.

And 2 minutes later the "secret" link is shared on Twitter.

I think people who use Gumroad won't really have that as a concern - but if enough people bring it up, I'll see what I can do about it!

Disable direct links and proxy the content, that way you can create unique URIs for every buyer. Then you can do all sorts of things like add a watermark on the content page containing the credit card number of the buyer or just add expiration time to the links. That'll limit sharing somewhat, although I don't think it's a huge problem.

Re: Show HN: my weekend project, Gumroad

#147

Post by rprasad »

pixeloution wrote: post #89
jasonlotito wrote: post #81

Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content) I'm really interested if Stripe is aware of what you are doing and fine with it.

PCI compliance is only an issue if he's storing CC data.

True, but "storing" is very broadly defined. "Storing" CC data in logs or temporary folders is enough to fall under the purview of the PCI rules.

Re: Show HN: my weekend project, Gumroad

#148

Post by Secure128 »

pixeloution wrote: post #89
jasonlotito wrote: post #81

Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content) I'm really interested if Stripe is aware of what you are doing and fine with it.

PCI compliance is only an issue if he's storing CC data.

Coming from direct QSA experience, you can be liable for CC data if you are collecting, transmitting, or storing the data. Basically any touchpoint in the flow of CC data you're involved in holds you legally liable for PCI-DSS. Kind of like speeding on the freeway... doesn't really matter until you get nailed doing it, and PCI council fines are devastating. I'm glad to discount our product extensively for any bloggers here... https://www.secure128.com/trustwave-trustkeeper-pci-complian... Just drop me a line to say hello and I'll give you whatever price you feel reasonable.

Re: Show HN: my weekend project, Gumroad

#149

Post by jimminy »

First off, I like the idea, but there are some noticeable flaws, many which have been brought up.

One interesting one for me, which is more an oversight, is that anyone can make money off of the sale of a link. There is no way to validate that the person posting the link, is the owner of the content. So someone could sell links to a page on HN, Reddit, Techcrunch, etc. at no expense to them.

If this did occur, I think it would cause a quite negative view of Gumroad links, as being scammy. In which case, people would begin to avoid them, reducing their effectiveness as a possible sales medium. Without oversight, as to who is selling a link, this might end up smothering itself out.

Re: Show HN: my weekend project, Gumroad

#150

Post by aw3c2 »

PStamatiou wrote: post #126
aw3c2 wrote: post #29

Earlier quoted context omitted.

And 2 minutes later the "secret" link is shared on Twitter.

have the asset be hosted on S3 with a signed url that expires quickly

Then you would need to do that for every customer individually as I understand the system.
Post reply on HN