Congratulations to all at Stripe on the milestone. It’s nice to see a good idea being well executed and leading to the success it deserves. There can’t be many new businesses that have had such a positive effect on so many other new businesses in such a short time.
Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
71–80 of 131 posts
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#72Was just watching the old prototype day recordings from the s09 batch. Impressively focused on the same problem since day 1: "We're like Authorize.net, but we're easier and faster." Lots of progress - congrats!
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#73Earlier quoted context omitted.
Instead of just down voting this post, it would be helpful to know what specific parts of it are incorrect. This is the first I've heard of these objections.
These posts are probably being downvoted because they come from a new account, which has been attacking Stripe repeatedly in multiple discussions now, including making some assumptions/claims that are readily confirmed to be false (and are obviously so to anyone who's actually integrated Stripe) and citing supporting web pages that don't necessarily support the claims made. While the PCI compliance issue may not be q…
I am simply pointing out that unlike what is covered in the Stripe documentation, a merchant is not absolved of PCI compliance by simply implementing Stripe.js in their HTTP response & turning on SSL/TLS. The PCI DSS and related materials cover this fact quite well. This "dispute" if you could even call it that came about when Pete Keen inadvertently also over simplified the compliance issue in one of his posts, for which he has since rectified:
https://www.petekeen.net/life-of-a-stripe-charge
Subsequent discussion here:
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#74Earlier quoted context omitted.
Not ridiculously easy, rather slightly easier as the merchant still must maintain aspects of their environment covered by the PCI DSS as they are still delivering Stripe.js from their server environment. Here's a bit more information on that: http://pciguru.wordpress.com/2013/06/30/developers-beware-st...
This post is inaccurate. (Check out Darragh's response in the comments.) It's also worth noting that 1) Stripe and its processes are audited every year (we're a PCI-certified service provider), and 2) that MasterCard has actually followed a very similar strategy with their Stripe competitor.
Stripe's level one service provider which is independent of the merchants PCI compliance. The merchant is presenting the form for which the user enters their credit card information from within the context (same origin) of their domain: e.g., https://merchant.com/payment... As a result, under the PCI DSS they are obligated to protect that component of the transaction because if they don't a criminal could change it so that the card data doesn't POST to Stripe.com but instead goes to the criminal. Implementing a bit of Javascript and enabling SSL/TLS is far from all that is needed to be PCI compliant as a merchant so long as the payment form itself, whether delivered via an iFrame or a bit of Javascript is hosted within the merchant domain.
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#75Stripe cofounder here. As this news breaks, I want to say thanks to the HN community. Stripe is in large part the result of the feedback and advice we've received here since we launched on HN back in Sept 2011 -- https://news.ycombinator.com/item?id=3053883 .
Seeing this comment makes me realise how much of a crazy technical risk I made choosing to use Stripe when I did. My company started charging for things in April 2012, but I made the decision to use Stripe months before that, something like January 2012. Only 4 months after you launched! We only did 1500 transactions on our launch day, yet at the time it was enough to break your service for a little while due to load…
Large companies tend to have arbitrary size requirements for potential vendors before allowing them to become an approved vendor. But I think companies should consciously choose startups as vendors for precisely that reason. Startups care more about figuring out what it takes to make customers happy.
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#76This is both amazing and scary. The amazing part is obvious. The scary part is we now have companies that are worth a billion dollars that are unlisted and have no public scrutiny. Either a billion is not a very large number to the American people today, or we believe that public scrutiny is unnecessary for large companies today. I don't think at all that Stripe is one of them, but wouldn't a billion dollar company b…
> we believe that public scrutiny is unnecessary for large companies today
It's a valuation, not a statement of turnover. Makes a big, big difference.
And for the record I don't think a company requires more or less scrutiny because of the turnover or valuation.
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#77Earlier quoted context omitted.
Not ridiculously easy, rather slightly easier as the merchant still must maintain aspects of their environment covered by the PCI DSS as they are still delivering Stripe.js from their server environment. Here's a bit more information on that: http://pciguru.wordpress.com/2013/06/30/developers-beware-st...
(Stripe Developer) - tl;dr -- This claims that Stripe.js runs on the merchant's server environment, causing the server to be subject to PCI DSS. In reality, Stripe.js is served from Stripe's servers, and runs only in the browser, and this has always been the case.
In order to get Stripe.js to execute within the same origin of the merchant environment the merchant must include code like this: within their HTTP response. This can be modified by a criminal on the merchant server to go to if the merchant has not implemented proper controls as outlined in the PCI DSS. The same can happen if they implement weak crypto. At the end of the day the merchant is responsible for this PCI related component because it's executing within the context of their merchant domain.
Adding a bit more to be crystal clear here. The merchants customer will only see the address in the address bar for the merchant and will be able to validate the merchants public cert. No customer I know of would view the source to make sure that the reference to Stripe.js is in the source.
Additional edit to address Silhouette's point. Yes, an attacker can modify the "Stripe minimizes the scope of PCI DSS by removing the need to implement and audit security controls surrounding the transmission, processing, and storage of card-holder data. This does not; however, absolve Merchants from compliance with the PCI DSS & in order to assist with that we offer the following..."
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#78Earlier quoted context omitted.
I think the downvotes have to do with what is a pretty serious accusation and not apparently backed up with facts. What would be helpful is if the accuser produced a better description of what he feels is out of compliance, wrong or misleading.
Because the PCI guidance isn't factual enough? An essay could be written about the problems with broad statements like merchants only needing to worry about the inclusion of Stripe.JS and the use of HTTPS to be PCI compliant. Luckily those already exist. This one covers it pretty well: http://pciguru.wordpress.com/2013/06/30/developers-beware-st...
I read that and am still far from clear on whether or not your accusations have merit.
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#79I am a developer interested in integrating a payment system into one of my sites where my target customers are mainly in the US. Could someone outline the major differences between Stripe and Balanced?
Steve from Balanced here. I'm in charge of the API.
You can look at this comparison in a few ways. We share a lot of the same investors: Both YC, SV Angel, a16z, etc. They've gotten a lot more funding than we have, and so have a bigger team.
You get paid faster with Balanced: we have _same day_ payouts to Wells Fargo customers, and _next day_ payouts to any other bank. Stripe is seven days.
Feature wise, we provide a lot of the same things, but Balanced has more. We support ACH debits AND credits, for example, and Stripe only supports credits. We're soon adding push-to-card as well. We have escrow, and let you choose how long to hold funds in it.
Speaking of escrow, in general, we have lots of extra features for marketplaces, since that's our bread and butter. Stripe now has a marketplace product, Connect, but it basically requires all of your sellers to sign up for Stripe. Our customers tell us that white label is important, and so Balanced is 100% white labeled. We individually underwrite all sellers, and we give you full control over your descriptor, on a per-transaction basis.
Our fee structure is 100% transparent, and the same for everyone. You can negotiate with Stripe on your rates, ours are just published publicly: https://www.balancedpayments.com/pricing
In general, Balanced is striving to be as open and transparent as possible: new feature discussion is done in the open, on GitHub. As I just mentioned, our pricing is transparent. We're working with Gittip and several other companies to start the Open Company Initiative[1] to help promote general open-ness. Loving that internal transparency from Stripe with their emails. [2]
To say some more good things about Stripe, they have launched in a few places internationally, and we are still US only. We can accept foreign credit cards, but merchants need to be in the US.[3] Hoping to fix that, regulations are hard.
Stripe has a loyal fanbase for a reason: they do a great job. I really appreciate the clarity of their docs, for example. Patrick, I know you're as much of an HN junkie as I am: congrats on the raise. Let's all keep dragging the payments industry kicking and screaming into the future. ;)
Here's some links from others, comparing the two of us:
* http://blog.localon.com/2013/11/21/why-we-switched-from-stri...
* http://blog.apixchange.com/2013/10/why-api-xchange-uses-bala...
* http://www.quora.com/Balanced/How-does-Balanced-compare-agai...
* http://stackoverflow.com/questions/14289347/stripe-vs-balanc...
As always, you can reach me here on at steve@balancedpayments.com to talk about any of this more.
1: http://opencompany.biz , though we just chipped in for .org: https://github.com/opencompany/www.opencompany.org/issues/59
Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club
#80Would love if someone could paste the contents of the article.