5 ms·

Create New Stripe Invoice with Invoice.new

46 points by zuhayeer 5y ago

DrinkWater 5y ago
Requires a login to read. What exactly is newsworthy about this ?
- jstummbillig 5y ago
  There is nothing to read, it's a shortcut to creating a new invoice with stripe invoice. (To create a stripe invoice, you have to login into stripe.)
omeze 5y ago
this is an interesting experiment in "web ui". If you can do common business operations by invoking CLI-esque or programming-esque commands into your address bar, I'd say Stripe's mission of "raising the GDP of the internet" is pretty damn near. Imagine: - business.new (create a US-based C or S corp) - equity.plan.new (create an equity plan for above corp) - employment.contract.new (get your first hires on above corp) or, if you want to dive more into the product-y world: - api.new (create a new API backed by the serverless provider of your choice) - saas.new (create a new saas with a landing page and default layout, maybe backed by a low-code platform like Bubble) Essentially, turn the URL bar into a general "command bar for productivity on the web".
- hayksaakian 5y ago
  docs.new creates a new google document
- jeswin 5y ago
  I think it's a terrible idea, which works against small startups who can't afford these high value domain names. It's been around for years, most famously Google's docs.new, sheets.new etc.
  - tuwtuwtuwtuw 5y ago
    Even it it's been around for years it will never get some actual use and will remain a marketing gimmick.
  - sigg3 5y ago
    You can achieve the same thing with a hosts file. If your users use remote VPN and your local DNS anyway, just redirect it internally and block off the true destinations of the TLDs. Not sure it amounts to much though. But looks great in a meeting with suits.
  - anoncake 5y ago
    Those small startups are Google's competition.
- franky47 5y ago
  Along with repo.new to create a new GitHub repository.
- vidarh 5y ago
  Or just stripe.new/action and not having to pollute the domain space with a huge range of names.
chrismorgan 5y ago
Kinda funny that this was submitted with an http: URL, given that .new is one of the very few HTTPS-only TLDs. (That is, the whole TLD it’s on the HSTS preload list.) .new is altogether a weird TLD experiment. Over $400 per year, and you can basically only use it as a short URL to somewhere on your own site that creates something. (See the rules at https://www.registry.google/policies/registration/new/ https://www.registry.google/policies/registration/new/.) If you don’t think https://dashboard.stripe.com/invoices/create https://dashboard.stripe.com/invoices/create is nice enough (that being what https://invoice.new https://invoice.new redirects to), why not instead do something like https://stripe.com/new/invoice https://stripe.com/new/invoice? It’s cheaper, probably requires less maintenance, and is a URL that I can be confident about, because it’s on stripe.com rather than “invoice.new” which could be considered an untrustworthy domain. When I say untrustworthy: how can you tell whether invoice.new is controlled by Stripe? The only two possibilities I can think of are whois records and name servers. Whois is unsurprisingly completely useless here (it’s all “REDACTED FOR PRIVACY”). Name servers are of the form ns-*.awsdns-*.* which I presume is AWS. I’m not familiar with what AWS DNS servers are, but it’s the same set of four as stripe.com, which is a good sign. So I’m going to assume that yes, this is run by Stripe. But a phishing attack is quite plausible: someone registers invoice.new, making it redirect to Stripe, socially engineers a lowly employee they have connections with into making mention of it in docs or product or something, increasing in scale over time until it’s common knowledge and thought to be official by employees and public alike (still trying to sneak under the radar a bit to avoid notice by someone who actually controls Stripe’s domains); and then finally, stop redirecting and start serving a counterfeit login page. (On the HTTP point, there are typically 0–2 http: links on the HN front page out of 30, with old things overrepresented. Plus the Legal and Apply to YC links in the footer are http: but should be https:. On the topic of unwisely-http: links, it’s very common in marketing/transactional emails, which is sometimes concerning when you have sensitive information and potentially auth tokens in the URLs. I notice these things because I have Firefox’s HTTPS-only mode enabled and a user stylesheet via Stylus, `:link[href^="http:"]::after { content: " [http]"; color: red; text-decoration: none; }`, because I’m curious.)
- emteycz 5y ago
  I didn't think it's controlled by Stripe, I thought it's some micro-SaaS. Not a bad thing. Now I know that it's Stripe after trying to open it.
dchest 5y ago
Years of education about phishing are canceled with these fancy *.new domains.
gregoriol 5y ago
This feels so wrong (and the fact that Google has been doing it for some time makes it feel even more wrong): this kind of address doesn't show explicitly which service is targeted, so it's a great target for phishing and completely fails all the prevention we have been doing. Also, the domain could change hands and provide a different service. Finally, it makes it look like it's a "service" (people will ask, is it provided by the browser?) but it's actually just a marketing trick, because someone paid some money to have it. Instead of making the internet a better place, this makes it an even more awkward place for us tech and an even more dangerous place for every normal user.
- manigandham 5y ago
  This TLD is run by Google, and is explicitly marketed as "shortcuts to your favorite actions on the websites you love" Here's a list of all the current shortcuts: https://whats.new/shortcuts/ https://whats.new/shortcuts/
  - beckman466 5y ago
    > "shortcuts to your favorite actions on the websites you love" You can't make this stuff up
    - tuwtuwtuwtuw 5y ago
      It just seems stupid to me, or maybe I just don't get it. If I need to create a github repo should I then remember this extremely special "shortcut" rather than just clicking "new repo" in the github UI?
      - vidarh 5y ago
        I just have a bookmarks menu on the bookmarks bar for frequent actions. That, incidentally also means I get straight to e.g. the correct Google account (I have a work one, one for my personal company, and a private one, and I have menus for each of them)
    - 5y ago
deleted 5y ago
[deleted]
rajasimon 5y ago
Request for a product: Place where to see who owned the dot new domain.

46 points by zuhayeer 5y ago

DrinkWater 5y ago

Requires a login to read. What exactly is newsworthy about this ?

jstummbillig 5y ago
There is nothing to read, it's a shortcut to creating a new invoice with stripe invoice. (To create a stripe invoice, you have to login into stripe.)

omeze 5y ago

this is an interesting experiment in "web ui". If you can do common business operations by invoking CLI-esque or programming-esque commands into your address bar, I'd say Stripe's mission of "raising the GDP of the internet" is pretty damn near. Imagine: - business.new (create a US-based C or S corp) - equity.plan.new (create an equity plan for above corp) - employment.contract.new (get your first hires on above corp) or, if you want to dive more into the product-y world: - api.new (create a new API backed by the serverless provider of your choice) - saas.new (create a new saas with a landing page and default layout, maybe backed by a low-code platform like Bubble) Essentially, turn the URL bar into a general "command bar for productivity on the web".

hayksaakian 5y ago
docs.new creates a new google document
jeswin 5y ago
I think it's a terrible idea, which works against small startups who can't afford these high value domain names. It's been around for years, most famously Google's docs.new, sheets.new etc.
- tuwtuwtuwtuw 5y ago
  Even it it's been around for years it will never get some actual use and will remain a marketing gimmick.
- sigg3 5y ago
  You can achieve the same thing with a hosts file. If your users use remote VPN and your local DNS anyway, just redirect it internally and block off the true destinations of the TLDs. Not sure it amounts to much though. But looks great in a meeting with suits.
- anoncake 5y ago
  Those small startups are Google's competition.
franky47 5y ago
Along with repo.new to create a new GitHub repository.
vidarh 5y ago
Or just stripe.new/action and not having to pollute the domain space with a huge range of names.

chrismorgan 5y ago

Kinda funny that this was submitted with an http: URL, given that .new is one of the very few HTTPS-only TLDs. (That is, the whole TLD it’s on the HSTS preload list.) .new is altogether a weird TLD experiment. Over $400 per year, and you can basically only use it as a short URL to somewhere on your own site that creates something. (See the rules at https://www.registry.google/policies/registration/new/ https://www.registry.google/policies/registration/new/.) If you don’t think https://dashboard.stripe.com/invoices/create https://dashboard.stripe.com/invoices/create is nice enough (that being what https://invoice.new https://invoice.new redirects to), why not instead do something like https://stripe.com/new/invoice https://stripe.com/new/invoice? It’s cheaper, probably requires less maintenance, and is a URL that I can be confident about, because it’s on stripe.com rather than “invoice.new” which could be considered an untrustworthy domain. When I say untrustworthy: how can you tell whether invoice.new is controlled by Stripe? The only two possibilities I can think of are whois records and name servers. Whois is unsurprisingly completely useless here (it’s all “REDACTED FOR PRIVACY”). Name servers are of the form ns-*.awsdns-*.* which I presume is AWS. I’m not familiar with what AWS DNS servers are, but it’s the same set of four as stripe.com, which is a good sign. So I’m going to assume that yes, this is run by Stripe. But a phishing attack is quite plausible: someone registers invoice.new, making it redirect to Stripe, socially engineers a lowly employee they have connections with into making mention of it in docs or product or something, increasing in scale over time until it’s common knowledge and thought to be official by employees and public alike (still trying to sneak under the radar a bit to avoid notice by someone who actually controls Stripe’s domains); and then finally, stop redirecting and start serving a counterfeit login page. (On the HTTP point, there are typically 0–2 http: links on the HN front page out of 30, with old things overrepresented. Plus the Legal and Apply to YC links in the footer are http: but should be https:. On the topic of unwisely-http: links, it’s very common in marketing/transactional emails, which is sometimes concerning when you have sensitive information and potentially auth tokens in the URLs. I notice these things because I have Firefox’s HTTPS-only mode enabled and a user stylesheet via Stylus, `:link[href^="http:"]::after { content: " [http]"; color: red; text-decoration: none; }`, because I’m curious.)

emteycz 5y ago
I didn't think it's controlled by Stripe, I thought it's some micro-SaaS. Not a bad thing. Now I know that it's Stripe after trying to open it.

dchest 5y ago

Years of education about phishing are canceled with these fancy *.new domains.

gregoriol 5y ago

This feels so wrong (and the fact that Google has been doing it for some time makes it feel even more wrong): this kind of address doesn't show explicitly which service is targeted, so it's a great target for phishing and completely fails all the prevention we have been doing. Also, the domain could change hands and provide a different service. Finally, it makes it look like it's a "service" (people will ask, is it provided by the browser?) but it's actually just a marketing trick, because someone paid some money to have it. Instead of making the internet a better place, this makes it an even more awkward place for us tech and an even more dangerous place for every normal user.

manigandham 5y ago
This TLD is run by Google, and is explicitly marketed as "shortcuts to your favorite actions on the websites you love" Here's a list of all the current shortcuts: https://whats.new/shortcuts/ https://whats.new/shortcuts/
- beckman466 5y ago
  > "shortcuts to your favorite actions on the websites you love" You can't make this stuff up
  - tuwtuwtuwtuw 5y ago
    It just seems stupid to me, or maybe I just don't get it. If I need to create a github repo should I then remember this extremely special "shortcut" rather than just clicking "new repo" in the github UI?
    - vidarh 5y ago
      I just have a bookmarks menu on the bookmarks bar for frequent actions. That, incidentally also means I get straight to e.g. the correct Google account (I have a work one, one for my personal company, and a private one, and I have menus for each of them)
  - 5y ago

deleted 5y ago

[deleted]

rajasimon 5y ago

Request for a product: Place where to see who owned the dot new domain.