Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

401–410 of 430 posts

Re: New startup sells coffee through SSH

#401

Post by alt227 »

jjeaff wrote: post #310
hn_throwaway_99 wrote: post #268

Earlier quoted context omitted.

The fact that the card number data is stored at Stripe doesn't matter that much. As parent commenter says, the card numbers are still visible on terminal.shop's network because it all goes over their SSH connection. For most websites that use the Stripe widget, the website owner can never see the full card number, because the credit card number entry fields are iframed in on the page. That means website owners in thi…

it's been a while since I did the full pci compliance rigamarole, but I don't recall it being that difficult. you basically just answer a bunch of questions correctly about how you are transmitting and storing the data using sufficient encryption and then they run some automated pen tests on your site and then you are done.

>run some automated pen tests on your site and then you are done

Haha you are obviously choosing to hide some pain away from your memories.

I agree that you run automated pen tests, but then securing up all networks servers with the results of those pentests can be incredibly time consuming and awkward.

Re: New startup sells coffee through SSH

#402

Post by alt227 »

thescriptkiddie wrote: post #261
miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

The burden of PCI compliance is a lot lighter than you might think. You basically just have to fill out a bunch of forms, there's no inspection or anything.

You obviously havent had to manage PCI compliance for a company which takes credit card numbers directly onto their site or over the phone.

Re: New startup sells coffee through SSH

#404

Post by dwhly »

thdxr wrote: post #107

hey! i'm one of the people who worked on this, we actually launched a few days ago and sold out quite quickly - we'll remove the email capture so you can poke around we'll be back in a few weeks with proper inventory and fulfillment we'll also be opensourcing the project and i can answer any questions people have about this

"Strong keys, Strong coffee" There, you're welcome. :)

Re: New startup sells coffee through SSH

#405

Post by Perz1val »

konschubert wrote: post #379
miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

Wouldn’t it be amazing if there was a simpler way to pay money online.

I don't know if this is sarcasm or not, but in Poland we have BLIK and it is amazing. Paying online is as simple as entering a 6 digit code from the app and confirming transaction in the app. Afaik every major bank supports it too

Re: New startup sells coffee through SSH

#406

Post by Justsignedup »

efreak wrote: post #291
Justsignedup wrote: post #91

Earlier quoted context omitted.

Command line dominates in quick flexibility. But is awful when it comes to discoverability. Most people can't even find the turn off ads button in windows 11. And people hate that. So what hope do they have at a terminal.

To be fair, would the button isn't hidden away too badly, most people have no reason to go into settings for anything . They go through the wizard at the beginning (if that) to do first-time setup, then when they decide they don't like something they just deal with it or complain incessantly until someone fixes it for them. Someone complained to me a while back about the size of icons on the windows desktop being too…

Talking to people, settings terrifies them.

Re: New startup sells coffee through SSH

#407

Post by konschubert »

Perz1val wrote: post #405
konschubert wrote: post #379

Earlier quoted context omitted.

Wouldn’t it be amazing if there was a simpler way to pay money online.

I don't know if this is sarcasm or not, but in Poland we have BLIK and it is amazing. Paying online is as simple as entering a 6 digit code from the app and confirming transaction in the app. Afaik every major bank supports it too

I would prefer if these systems worked internationally and didn’t exclude foreigners.

But yea…

Re: New startup sells coffee through SSH

#409

Post by hn_throwaway_99 »

RobMurray wrote: post #372
rhysmdnz wrote: post #367

Earlier quoted context omitted.

The parent documents JS engine can replace the iframe with their own that looks the same

That wouldn't help, at least with my bank in the UK, the iframe just shows a message to open the mobile app to approve the payment. The payment details are then shown in the app, you don't interact with the page in the iframe at all.

But that would still require an eagle-eyed consumer, which (coming from experience working in the fintech space) is quite rare.. I.e., you may know the iframe is supposed to just ask you to open your mobile app, but I think the vast, vast majority of users wouldn't think twice if that iframe had been hijacked and instead asked them to enter their credit card information directly.

Re: New startup sells coffee through SSH

#410

Post by thescriptkiddie »

alt227 wrote: post #402
thescriptkiddie wrote: post #261

Earlier quoted context omitted.

The burden of PCI compliance is a lot lighter than you might think. You basically just have to fill out a bunch of forms, there's no inspection or anything.

You obviously havent had to manage PCI compliance for a company which takes credit card numbers directly onto their site or over the phone.

No I'm not a manager, I'm a programmer. I haven't personally had to fill out the forms, we have a guy for that. Actually that's not his main job, but he used to work as a paralegal so he got volunteered for it.
Post reply on HN