Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Made $350 In Two Days With Three Pages and Some Payment Code

dshipper.posterous.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#61

Post by MichaelGG »

Confusion wrote: post #60
InclinedPlane wrote: post #51

Earlier quoted context omitted.

SSL can't be MITMed because SSL certs need to be signed by a certificate authority, and those signatures can be checked against pre-loaded public keys in the browser (CA certs). However, if the serving page is non-SSL that then posts via SSL then it's possible for a MITM attack to hijack the connection and display a new page that posts to some other location (where the credit card numbers are collected, etc.) without…

In theory, yes. In practice, many CA authorities have probably leaked their keys. The recent publicly known cases are only the tip of the iceberg.

Interesting - can you link to some information about CA actually losing their private key? I've read about Comodo and others allowing people to improperly sign stuff, but nothing about a CA actually losing their key.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#62

Post by ig1 »

Feedback Army (which was actually built by HN user raffi when he was inspired by a comment on HN) has been doing this for a while.

The comment that inspired it:

http://news.ycombinator.com/item?id=362459

Various other HN discussions about it:

http://www.google.co.uk/search?q=feedback%2Barmy%2Bsite%3Ane...

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#63

Post by pwzeus »

mtogo wrote: post #24

That was a great read! I hate to nitpick, but this part caught my eye: I needed to fix about the site – SSL (even though all of the payments are secured through Stripe) . If the checkout page isn't loaded over SSL, my credit card number isn't secure since the page is still vulnerable to a MITM attack completely removing the Stripe code.

sorry to be blunt but r u kidding me...he forgot to remove the test code..who knows what kind of data is being stored...is credit card data even encrypted ?...instead of writing these blogs and getting this kind of publicity on HN...please have responsibility to use SSL before providing credit card functionality..

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#65

Post by Confusion »

MichaelGG wrote: post #61
Confusion wrote: post #60

Earlier quoted context omitted.

In theory, yes. In practice, many CA authorities have probably leaked their keys. The recent publicly known cases are only the tip of the iceberg.

Interesting - can you link to some information about CA actually losing their private key? I've read about Comodo and others allowing people to improperly sign stuff, but nothing about a CA actually losing their key.

Sorry, I didn't mean to say that it was publicly known that CA's had lost their private keys. I meant that the publicly known security problems, about Comodo and others, is probably the tip of the iceberg. With all the hacks going on, I don't doubt for a second that private keys have been compromised, without the CA's knowing it themselves.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#66

Post by ColinWright »

That was a great read, very interesting.

I have to take issue with one point. It says:

    I've made $350 to date. All from three pages
    and some payment code.
Sounds brilliant, and it's the title here. Earlier, however, it says:

    I was scrambling to fill orders. I had a huge TextEdit
    file open with customer names, site URLs, and email
    addresses. I sent every email, and set up every survey
    by hand.
So, the three pages and the payment code were the structure, and in truth, you were doing the work.

    By 6 am I had completed processing every order and went
    to bed. I got up an hour later for work at 7 am. 

    ... 

    So now I’m sitting here writing this blog post with a
    bunch of orders to fill, features to build, and
    customers to help.
So this is a continuing requirement, that you service the requests from your customers via your web site.

It's a service, and it's making you money, and it's successful. For those things alone you deserve to feel happy and a little smug. But I felt misled by the title.

But having said that - all power to your elbow, and well done.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#67

Post by InclinedPlane »

Confusion wrote: post #65
MichaelGG wrote: post #61

Earlier quoted context omitted.

Interesting - can you link to some information about CA actually losing their private key? I've read about Comodo and others allowing people to improperly sign stuff, but nothing about a CA actually losing their key.

Sorry, I didn't mean to say that it was publicly known that CA's had lost their private keys. I meant that the publicly known security problems, about Comodo and others, is probably the tip of the iceberg. With all the hacks going on, I don't doubt for a second that private keys have been compromised, without the CA's knowing it themselves.

Don't most (all?) CA's use hardware based private keys that can't be compromised without loosing physical possession?

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#69

Post by econgeeker »

I've noticed a recent trend of self-promotion that I don't understand. I'm not writing to criticize, I just want to know why you say some of the things you do.

For instance, you call yourself a "rising sophomore". What does this mean? How is it different from any other sophomore? Can you explain why you chose that word and what the impression you intended to convey is?

Also, I love that you made a product like this quickly. In reading your story I noticed something you did right that I totally would have done wrong, and I appreciate being reminded of it. I applaud your gumption.

But then I clicked thru to the website and saw: "Our team of web usability experts has put together a comprehensive survey". So, do you have a team of web usability experts behind domain polish? I'm assuming it is your solo project. Why not say "Our carefully crafted, comprehensive survey" instead? Do you think that would really kill your sales that much? Do you have any qualms about saying you have a "team" of "experts"?

Notice, I'm not passing judgement... I'm asking questions because I want to understand your thinking, and also I find this alien culture of the "kids today" baffling and mystifying. :-)

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#70

Post by OstiaAntica »

econgeeker wrote: post #69

I've noticed a recent trend of self-promotion that I don't understand. I'm not writing to criticize, I just want to know why you say some of the things you do. For instance, you call yourself a "rising sophomore". What does this mean? How is it different from any other sophomore? Can you explain why you chose that word and what the impression you intended to convey is? Also, I love that you made a product like this q…

"Rising" sophomore (or junior or senior) is a common U.S. expression. It just means he'll be a sophomore when school resumes this fall. There's no self-promotion, it is just used by students during the summer break.
Post reply on HN