Readit News logoReadit News
CyanLite4 commented on Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?    · Posted by u/OnuRC
Nextgrid · a year ago
Think standard oAuth. Github has multiple flows that should cover most purposes here: https://docs.github.com/en/apps/oauth-apps/building-oauth-ap.... The key is that payment data is encoded in oAuth-like scopes, so all authorizations are scoped by amount and lifetime, and are implicitly merchant-specific.

Browser-based flow, where you're already logged into the bank in an existing browser tab:

* Amazon redirects you to oauth-proxy.visa.com where you select your bank (if you've done it already once, it remembers and redirects straight to your bank)

* Visa redirects you to your bank - if you're not logged in, you do a login - this is up to your bank on how to do that - authorize with an existing phone, WebAuthn, etc. On OSes supporting it, this URL can be hooked and handled directly by a native app which may use the device's secure element to store its auth credentials for the bank

* Bank displays you the payment request details (which include your Amazon account email, order ID, etc - all info you need to confirm it's indeed your payment request and not someone else's) and allows you to change them (maybe you want to authorize more or less, or make it one-time/recurring with a daily/weekly/monthly/yearly cap, or set an expiry after which the authorization is no longer valid)

* In the background, Amazon gets a success webhook from Visa (or their processor) saying that this authorization request has been granted, or they can poll an endpoint - this eliminates the need for a final redirect back to them like in normal oAuth

* If this is a recurring charge scenario, Amazon can store this payment request token against your account and use it multiple times, as long as the charges fall within the policy set during initial payment request establishment (if you set a max of $20, they can do as many transactions as they want up to a total of $20).

Device-based flow, where you aren't/don't want to login in to the bank the same browser:

* Amazon redirects to oauth.visa.com as above

* Instead of clicking on your bank directly, you say "authorize via phone", it just encodes the URL of the current page in a QR code so you can scan it on the phone - you then do the above flow there. Because the success/failure of a payment request is already communicated directly between the merchant and Visa, there is no need for your phone to pass any data back to the browser, so no need for a "reverse channel" to be set up.

* On your phone, you may have your banking app installed, so it takes over the domain name of your bank and automatically opens the payment request authorization there, using your existing session within the app.

Point is, not only is there no longer a concept of a card number that can be copied, stolen, or leaked, but the user also remains in control - they can control whether the payment is one-time or recurring, set limits on recurring payments, and be able to cancel these authorizations at any time, after which they're guaranteed that nobody can take more money without going through this auth process again. This eliminates many reasons for chargebacks, and reduces fraud risks for merchants too (merchants are no longer vulnerable since the auth to authorize a new payment request is between the user and their bank directly), so things like behavioral fraud detection or captchas on payment pages are no longer needed.

Downside (for scammers): business models based on a free trial that rely on the user forgetting to cancel, or those who intentionally make cancellation annoying or impossible wouldn't work, because payment requests should list upfront the max amount they can take, and the user can adjust that and make sure the unwanted charge just won't go through even if they tried.

CyanLite4 · a year ago
This is no different than chip+pin for physical purchases. There are still other major areas of fraud that has to be addressed.

It doesn’t cover credit risk-even on a debit card, there can be a “hold” period of an arbitrary amount before the final transaction clears. When you swipe a card at a gas station, they often run a $50 authorization hold on your account.

It also doesn’t cover merchant fraud—- Visa/MC covers you if the merchant doesn’t ship the product because they’re a fake company.

Then there are value-added warranty services that higher end cards offer. These are easily worth the 1%+ fee.

CyanLite4 commented on The first commercial carbon-sucking facility in the US opens in California   bloomberg.com/news/articl... · Posted by u/LastNevadan
CyanLite4 · 2 years ago
Did it cost more in carbon just for the construction workers to drive their pickup trucks to build this plant than what the plant will actually remove?
CyanLite4 commented on Kafka is dead, long live Kafka   warpstream.com/blog/kafka... · Posted by u/richieartoul
ryanworl · 2 years ago
[WarpStream co-founder and CTO here]

1. Each WarpStream Agent flushes a file to S3 with all the data for every topic-partition it has received requests for in the last ~100ms or so. This means the S3 PUT operations costs scales with the number of Agents you run and the flushing interval, not the number of topic-partitions. We do not acknowledge Produce requests until data has been durably persisted in S3 and our cloud control plane.

2. We think people shouldn't have to choose between reliability and costs. WarpStream gives you the reliability and availability of running in three AZs but with the cost of one.

3. We have a custom metadata database running in our cloud control plane which handles ordering.

CyanLite4 · 2 years ago
Does Azure’s Append Blob support (and AWS’ lack thereof) provide any inherent performance advantages for Azure vs. AWS?
CyanLite4 commented on Kafka is dead, long live Kafka   warpstream.com/blog/kafka... · Posted by u/richieartoul
bob1029 · 2 years ago
We use a table called "Messages" in our SQL Server database. Everyone talks to the same database. Turns out we don't really need to push extreme message rates or meet aggressive single-digit millisecond budgets, so this works out well in practice. It is also the easiest thing on earth to develop & debug, because you can monitor the table/log and instantly understand the state of the whole system and how it got there. Oh - it is also magically included in our DR strategy. No extra infra. We don't have to have a totally separate procedure to recover this thing.

We primarily use it as a backhaul between parts of our infrastructure in order to perform RPC. The approach is for the users of the broker (our services) to poll it at whatever rate is required. This is actually a little bit clever if you think about it - Users that don't really care about liveliness can poll for their messages every minute or so. Users that are in the hot path of a web UI could poll every 50~100ms.

Polling sounds kinda shitty (at least to me) but I argue it's the best default engineering solution until proven otherwise (assuming its not somehow harder than the other magic async event bubbling things). We don't have a lot of services doing this so contention isn't really a problem for us. Even if it did get to that point, I would reach for a read replica before I refactored how all of messaging worked. Most of polling is just a read operation that does nothing, so we can go horizontal on that part pretty easily.

CyanLite4 · 2 years ago
fyi, SQL Server has a message broker built-in.

https://learn.microsoft.com/en-us/sql/database-engine/config...

CyanLite4 commented on The EV Transition Is Harder Than Anyone Thinks   spectrum.ieee.org/the-ev-... · Posted by u/jnord
rootusrootus · 2 years ago
Everyone says things like this thinking "Tesla" in their head, while in the real world there are all sorts of EVs that are just cars that happen to be electric.
CyanLite4 · 2 years ago
Tesla is just a generation ahead of other EVs. They’re an Apple iPhone and everybody else is the cheap knockoff Android phones from 2011.
CyanLite4 commented on The EV Transition Is Harder Than Anyone Thinks   spectrum.ieee.org/the-ev-... · Posted by u/jnord
thegrim33 · 2 years ago
Some* people are buying EVs because they're "better". Other people, like me, have zero interest in most modern vehicles, whether EV or not. I have zero interest in a vehicle that gets software updates, or that can choose for itself to slam the breaks on, or that has the ability to upload my data for collection, or that can be remotely disabled, or that isn't built to be maintained easily in my garage, or that has giant touchscreen nonsense. I realize I might be in the minority, but that's OK.

I feel that most modern vehicles are designed and built purely to make as much money as possible, rather than to actually a good, reliable, maintainable vehicle. And it works, because the average consume either doesn't care or is easily to manipulate.

If you want to convert more people to EVs, start building some that I'm remotely interested in. That and invest into solid state batteries, I'm mostly waiting for that too. Solid state batteries would solve most of the issues with EV tech.

CyanLite4 · 2 years ago
Recent article (forgot the link, but I’m sure it’s on google) basically said BMW, VW, and many others are abandoning solid state batteries because of its negligible performance compared to LiFePo4 and regular NMC batteries that are easier to produce and are slowly improving their density and stability.
CyanLite4 commented on Making a loudness monitor for online meetings   rolisz.ro/2023/02/02/maki... · Posted by u/rolisz
bentcorner · 3 years ago
I don't have one of these but I do own a USB microphone that probably functions very similarly - it appears as a "Speaker" (and obviously, a microphone device), and if you plug headphones into the microphone itself, you'll hear the monitor audio and if you route your PC's audio through the "Speaker" the microphone will mix your audio output with the monitor output.

This is a long way of saying that the monitor latency is practically 0.

If your mic doesn't have a monitor, you can do this on PC itself by using something like Voicemeeter but you'll incur a small amount of latency and many people have a hard time talking when they hear themselves on a delay.

CyanLite4 · 3 years ago
Correct. You set the microphone as your “speaker” and there’s zero latency.
CyanLite4 commented on Making a loudness monitor for online meetings   rolisz.ro/2023/02/02/maki... · Posted by u/rolisz
digitallyfree · 3 years ago
While this requires some investment, I've found that having a good broadcast monitoring solution helps a lot during online calls. Whether you're on headphones, in-ears, or using a full wedge, having your own voice echoing back at you allows you to easily know if you're speaking clearly at the correct volume. You can also tell if you're backing away from the mic, whether background noise is audible on the far side, and so on.

Professional public speakers and radio personalities monitor themselves, so why shouldn't you?

A cheap analog mixer or audio interface will let you do this, and obviously the sky's the limit if you want a full digital mixer with DSP and all the bells and whistles. There are software options but the latency can be jarring if you aren't used to it.

CyanLite4 commented on Making a loudness monitor for online meetings   rolisz.ro/2023/02/02/maki... · Posted by u/rolisz
CyanLite4 · 3 years ago
Cheap alternative: BestBuy sells an Insignia brand external microphone that allows you to connect headphones to it so you can hear your own voice included with the audio signal from the meeting.

Best $35 I’ve ever spent and spouse is happier that I’m not too loud anymore.

CyanLite4 commented on Chinese surveillance balloon spotted over U.S., Pentagon says   washingtonpost.com/nation... · Posted by u/jaboutboul
bigmattystyles · 3 years ago
What can be done with a balloon that a satellite cannot?
CyanLite4 · 3 years ago
Probably some sensors to see what we’re doing with our nuke bases in Montana.

u/CyanLite4

KarmaCake day406November 20, 2018View Original