Amazing product, just curious about which font was used in the stripe logo?
Stripe: instant payment processing for developers
251–260 of 369 posts
Re: Stripe: instant payment processing for developers
#252Earlier quoted context omitted.
The exemption you are talking about is not legitimate, because of the way browser security works.
Perhaps you could elaborate, rather than posting vague innuendo about "how browser security works"? What specific danger do you see in the embedding scenario that could not arise anyway if the host system were compromised sufficiently to interfere with the embedded material?
I'm obviously not tptacek, but I take his statement to mean that currently, PCI finds the following scenario acceptable:
You have a site that takes payment info. Rather than process that information directly and store it you decide to use a service like this to silo out payment processing. This keeps your main environment outside of the scope of a PCI audit (as the only systems in scope for PCI are systems which either process or store payment card information).
You are now not under any obligation to ensure that your application isn't riddled with security vulnerabilities, including vulnerabilities like cross-site scripting which would completely undermine the security of using a third-party javascript library to handle payment processing. This isn't some sci-fi scenario either, I see this every day in the applications I test (mostly e-commerce and online banking applications).
Using the library hasn't introduced any "new" vulnerabilities into your environment, but it has given you an opt-out to actually trying to have a secure system.
He seems to take exception to the fact that PCI doesn't see any problem with this. It's basically a loophole to continue to deploy hole-riddled applications that once hacked, you can say "We are PCI compliant, what are you gonna do."
This gives credence to the people who argue that PCI isn't really a security standard, but just a way to shift blame after a breach.
Re: Stripe: instant payment processing for developers
#253Congratulations on your official launch. I've been using Stripe for a while now and have chatted with several of you in the campfire room. You have always been extremely helpful, no matter what wildass time of the night I may decide to poke my head into the room.
I have nothing but good things to say about your service.
Thank you.
Re: Stripe: instant payment processing for developers
#254Earlier quoted context omitted.
Perhaps you could elaborate, rather than posting vague innuendo about "how browser security works"? What specific danger do you see in the embedding scenario that could not arise anyway if the host system were compromised sufficiently to interfere with the embedded material?
I'm obviously not tptacek, but I take his statement to mean that currently, PCI finds the following scenario acceptable: You have a site that takes payment info. Rather than process that information directly and store it you decide to use a service like this to silo out payment processing. This keeps your main environment outside of the scope of a PCI audit (as the only systems in scope for PCI are systems which eith…
What he said. :)
Re: Stripe: instant payment processing for developers
#255Earlier quoted context omitted.
Unfortunately, there are just a lot of regulations when dealing with payments across international borders.
Seriously, I really need to know something about this. It's driving me mad to keep seeing promising payment services only to find out they won't deal with me. Yours is the most compelling one I've seen.
The Patriot Act.
Re: Stripe: instant payment processing for developers
#256US only at the moment. Anyone know if they have plans for the UK? I would dearly love to say goodbye to PayPal forever.
We're definitely working on expanding to other countries. There's no definite timeline just yet, but it's one of our top priorities.
Don't forget "third world" countries like South Africa :)
Re: Stripe: instant payment processing for developers
#257Earlier quoted context omitted.
We'll happily export your card data to another provider if you ever want to move away.
Are you legally allowed to even do that? Do you store card data yourself?
Yes and yes. We are a PCI Level 1 Service Provider. More information on our security practices: https://stripe.com/security
Re: Stripe: instant payment processing for developers
#258Earlier quoted context omitted.
I've held off developing / launching a few small biz ideas because of the state of payment providers in the UK - ready and waiting to help you test when you're over here :)
I concur entirely (and have spoken with my MP about it). However, as far as I can tell, anyone using any of the more established "big name" billing services to collect payments for a UK company is almost certainly breaking at least one law on a "your business is at risk" scale. Stripe would have to be very special to do better. The usual culprits are VAT (I have yet to find a billing service that would actually allow…
I don't see the problem with VAT. Just keep rack of where your customers are and pay the VAT on those in Europe. Where does the payment processor come into it? If you owe VAT then pay it.
Re: Stripe: instant payment processing for developers
#259CANADA!!
Re: Stripe: instant payment processing for developers
#260Earlier quoted context omitted.
Something just occurred to me. FastSpring, which is a US company, can actually work with non-US companies just fine. Why is that? Also, at some point I asked them why they could, and BrainTree couldn't, and they said they can't really think of a reason why. So.. What exactly is the deal? I'm dying to know.
I don't think it is easy to expand to many countries with products that are sensitive to regulations, e.g. payment, and music streaming. A lot of these services are not available outside the US. Last time I checked Google Checkout was limited to the US as well. It is really annoying as I live in Canada and I cannot use many of these services.
google checkout works in the uk