3 ms·

So instead of supplying a credit card, which already causes people to bounce, ask them to learn and use crypto? At that point just factor being abused into you

by corobo 5y ago

So instead of supplying a credit card, which already causes people to bounce, ask them to learn and use crypto? At that point just factor being abused into your prices honestly

3np 5y ago
> As a complement and alternative for CC That is, allow either. As an alternative to credit card, not instead of. Again, I'm pretty sure that a majority of legitimate users who can't or won't link a credit card will already be familiar with, or at least open to, cryptocurrencies. Just make the minimum amount large enough that abusers would have better payoff from directly using it as payment for compute/IP elsewhere. I'd guess that even 10$ equivalent would suffice for that - there is no shortage of places that will rent you a month of decent resources for less than that. Consider also that more and more SaaSes require an increasing amount of PII for new sign-ups (no doubt related to solving for abuse, fraud, and spam) while an increasing number of individuals either reject surveillance capitalism and won't participate, or simply can't due to being flagged as false positives by the arbitrary ML and rules at payment providers. Solving for them will give you goodwill and leads from an underserved market segment.
- corobo 5y ago
  I missed the quoted line, sorry!
- js4ever 5y ago
  It's not about the money, it's about KYC! Paying with Crypto is not solving anything for bad actors trying to do DDOS, send spam or host child porn on our servers ...
  - 3np 5y ago
    Part of my point is, demanding a lock up of funds should raise the barrier high enough that you won't need KYC - legitimate users will get their funds back (or use them to continue service) while it will be cost-prohibitive for abusers. If you want to play it safer, increase the minimum required amount and/or lock-up time accordingly. If you had a way to get this integrated easily, would it be interesting?
    - js4ever 5y ago
      The thing is some abusers will be happy to pay $10 in crypto (or even $100) to be able to ddos/spam/abuse under our name ... So I'm not sure it would be enough to prevent hackers
      - 3np 5y ago
        Hmm, it sounds like there is some part of your offering that I was overlooking as I failed to see how that would happen. Perhaps that is something that should be addressed, regardless of what you decide on KYC/credit cards/cryptocurrencies/etc? Random thoughts after a little closer look, may or may not be relevant: I see now that you host mailu/mailcow. If you give customers an e-mail address under a (sub-) domain of yours - stop that. Make customers bring their own domain, even for a trial. Or keep outgoing public SMTP out of the trial; even they do not use your domain, you probably don't want to risk polluting IP space reputation. If you still really want to let them try it and want to spend some time on it, you could spend some time restricting outgoing mail to a whitelisted email address (not domain) per account. If you're also referring to hosting scam websites and you don't want to require trials to bring their own domain, consider making the subdomain you provide autogenerated, long, unattractive, and verbose. If you haven't addressed all of the above, it should hopefully improve things. For ddos/hosting illegal content, there is no shortage of places where people can get VMs and VPSes with connectivity, storage and compute for reasonable prices in various jurisdiction anonymously just a quick web search away - so even for those who don't know where they can get it for way cheaper underground, I'd assume that criminals wouldn't have a reason to burn even close to that much money for such things?

by corobo 5y ago

So instead of supplying a credit card, which already causes people to bounce, ask them to learn and use crypto? At that point just factor being abused into your prices honestly

3np 5y ago

> As a complement and alternative for CC That is, allow either. As an alternative to credit card, not instead of. Again, I'm pretty sure that a majority of legitimate users who can't or won't link a credit card will already be familiar with, or at least open to, cryptocurrencies. Just make the minimum amount large enough that abusers would have better payoff from directly using it as payment for compute/IP elsewhere. I'd guess that even 10$ equivalent would suffice for that - there is no shortage of places that will rent you a month of decent resources for less than that. Consider also that more and more SaaSes require an increasing amount of PII for new sign-ups (no doubt related to solving for abuse, fraud, and spam) while an increasing number of individuals either reject surveillance capitalism and won't participate, or simply can't due to being flagged as false positives by the arbitrary ML and rules at payment providers. Solving for them will give you goodwill and leads from an underserved market segment.

corobo 5y ago
I missed the quoted line, sorry!
js4ever 5y ago
It's not about the money, it's about KYC! Paying with Crypto is not solving anything for bad actors trying to do DDOS, send spam or host child porn on our servers ...
- 3np 5y ago
  Part of my point is, demanding a lock up of funds should raise the barrier high enough that you won't need KYC - legitimate users will get their funds back (or use them to continue service) while it will be cost-prohibitive for abusers. If you want to play it safer, increase the minimum required amount and/or lock-up time accordingly. If you had a way to get this integrated easily, would it be interesting?
  - js4ever 5y ago
    The thing is some abusers will be happy to pay $10 in crypto (or even $100) to be able to ddos/spam/abuse under our name ... So I'm not sure it would be enough to prevent hackers
    - 3np 5y ago
      Hmm, it sounds like there is some part of your offering that I was overlooking as I failed to see how that would happen. Perhaps that is something that should be addressed, regardless of what you decide on KYC/credit cards/cryptocurrencies/etc? Random thoughts after a little closer look, may or may not be relevant: I see now that you host mailu/mailcow. If you give customers an e-mail address under a (sub-) domain of yours - stop that. Make customers bring their own domain, even for a trial. Or keep outgoing public SMTP out of the trial; even they do not use your domain, you probably don't want to risk polluting IP space reputation. If you still really want to let them try it and want to spend some time on it, you could spend some time restricting outgoing mail to a whitelisted email address (not domain) per account. If you're also referring to hosting scam websites and you don't want to require trials to bring their own domain, consider making the subdomain you provide autogenerated, long, unattractive, and verbose. If you haven't addressed all of the above, it should hopefully improve things. For ddos/hosting illegal content, there is no shortage of places where people can get VMs and VPSes with connectivity, storage and compute for reasonable prices in various jurisdiction anonymously just a quick web search away - so even for those who don't know where they can get it for way cheaper underground, I'd assume that criminals wouldn't have a reason to burn even close to that much money for such things?