Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My kid choked on a toy, so I built this

recallbee.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Show HN: My kid choked on a toy, so I built this

#81

Post by scott_karana »

thebeardisred wrote: post #72
twrobel wrote: post #59

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection. Infosec 101

Admittedly that's all happening with javascript passthrough to stripe's API using https.

Ugh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies.

What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself?

EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed:

  Do I need to use SSL/TLS on my payment pages?

  Yes, for a couple of reasons:

    * It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack.
    * Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too.
1 https://stripe.com/help/ssl

Re: Show HN: My kid choked on a toy, so I built this

#82

Post by mholt »

thebeardisred wrote: post #72
twrobel wrote: post #59

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection. Infosec 101

Admittedly that's all happening with javascript passthrough to stripe's API using https.

I think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to an attacker. HTTPS is a 100% must on all pages for a business.

Re: Show HN: My kid choked on a toy, so I built this

#85

Post by pbhjpbhj »

I can't see me listing all the stuff I bought (not much!) for the kids on your site/app or whatever - this is increasingly an issue.

Perhaps you can sell a service to Walmart/Amazon/etc. whereby you maintain a list of recalled toys and then monitor their products (and eg Amazon marketplace) to make sure the toys're not being sold there?

Also supermarkets and other retailers have histories of goods purchased seems that there should be some way to use that to gather the ownership data rather than have users enter it themselves.

Re: Show HN: My kid choked on a toy, so I built this

#86

Post by pbhjpbhj »

heelhook wrote: post #18
williamjackson wrote: post #15

Earlier quoted context omitted.

I hope you don't buy a toy that is already recalled. It is against the law in the US to sell a product that has been publicly recalled. http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-...

This was recalled last week. http://www.amazon.com/Dream-Me-Layla-Bassinet-Cradle/dp/B004...

Crazy that Amazon don't have a report facility for product pages - like reporting inappropriate content (cf Google SERPS or eBay auctions).

Re: Show HN: My kid choked on a toy, so I built this

#87

Post by iamvfl »

winter_blue wrote: post #74
hughstephens wrote: post #53

Earlier quoted context omitted.

I suspect he's just grabbed this template: https://wrapbootstrap.com/theme/triangle-multi-purpose-templ... but yes, you make an excellent point. Equally I agree with his approach of using a $9 template before validating w customers and working out the business model...not sure what the theme site says about the images licence wise but it's not necessarily a bad abstraction to assume that images included with a templa…

In light of the fact that the template you've linked looks exactly like recallbee.com, the author's comment "Thanks, I actually copied the image to see what it'd look like in place and forgot to take it out" seems disingenuous.

Not really. He just bought the template and customized it, and I imagine he wrote his own back-end as well. After all, it's just a bootstrap theme.

Re: Show HN: My kid choked on a toy, so I built this

#89

Post by benologist »

simcop2387 wrote: post #54
fishnchips wrote: post #52

Earlier quoted context omitted.

Sure, as a parent you should be able to decide what the appropriate response is. But at least to me this particular class of problems does not need an app but simple common sense.

Not a parent yet, but I'd probably use something like this less as something to find out if there's a choking hazard, but in case there's something I don't think of that might be a problem. Fire hazard because it shipped with a faulty power regulator the overheats? Exploding batteries? Those are things that I wouldn't be able to tell at first glance that they'd necessarily be a problem.

We don't need to do that and can't because the technology is incredibly complex and even if you understand that stuff your curtains could be the real fire hazard in your room.

All of this is covered by consumer protection laws very successfully - recalls.gov has just a handful a day across everything, Amazon alone sell over 200 million different products.

Re: Show HN: My kid choked on a toy, so I built this

#90

Post by uptown »

heelhook wrote: post #34
orkj wrote: post #31

I really like the landing page, but I feel I have to point out one obvious thing: Your sign-up page[0] not only resembles the one of Basecamp[1], but you chose to actually copy (not like copy from it, but _copy_) the graphics from it? And the graphics features a dude wearing a Basecamp sweater? I can see why you want to find design inspiration in Basecamp, but for me that stuff is just too close to the original ;) As…

Thanks, I actually copied the image to see what it'd look like in place and forgot to take it out. I'll address that first thing! Again. Thanks so much for that!

5 hours later ... still there.
Post reply on HN