7 ms·

I hate Stripe, so I'm going to build my own payment processor

91 points by lopkeny12ko 2y ago

talldayo 2y ago
One must imagine Sisyphus happy.
- cranberryturkey 2y ago
  how so?
  - talldayo 2y ago
    Regression pulls things towards the same point after a long enough time, like gravity pulling a boulder from the top of the mountain to the bottom. Resisting that regression, although pointless, has to be enticing enough or else you would simply give up. So Sisyphus had to have a positive or satisfied mindset to see the meaningless result of his actions and repeat it.
    - cranberryturkey 2y ago
      neat
fragmede 2y ago
They don't say why the hate Stripe, but presumably Stripe closed their account for fraud/spam/PBL reasons and took "their" money and won't give it to them. Whether or not this person/team succeeds, the real point is that spite is a powerful motivator. We all find motivation, in our own places, in our own ways, and spite is up there.
- deleted 2y ago
  [deleted]
- hughesjj 2y ago
  Yeah, you nailed it. They claim that their Japanese online Coffee shop was hit by a BIN attack and strip wouldn't let them back in, but didn't exactly give any details https://old.reddit.com/r/SaaS/comments/1f762xf/i_hate_stripe_so_im_going_to_build_my_own_payment/ll5920a/ https://old.reddit.com/r/SaaS/comments/1f762xf/i_hate_stripe...
  - Dalewyn 2y ago
    [flagged]
  - hypeatei 2y ago
    I didn't know what BIN attack was until now but it seems to be essentially brute forcing card details until one succeeds. How is that even feasible and why would the sellers account be banned in the case someone got the right combo? Very strange and suspicious.
    - makeitdouble 2y ago
      A BIN attack is feasible if the entry point lets you endlessly try card info. There's not that many, and issuers will give leeway on the card details (some won't care if the card holder's name is botched or completely wrong for instance) That's also why a PSP will ban the seller if they let that happen on their payment page.
      - hypeatei 2y ago
        > A BIN attack is feasible if the entry point lets you endlessly try card info Yeah, I just figured with all these fraud detection systems in place that rate limiting would be figured out and implemented. Regardless if the seller has a custom page or not, I still would think that PSP APIs would inherently disallow this to protect their customers.
        makeitdouble 2y ago
        The complicating factor is that every business is different, and there are legitimate cases where an influx of random card just happens, or a slow trickle of payments goes on at a steady pace. In particular the PSP usually have no window on the seller's system (the seller handles the client and transparently passes the info to the PSP, contractually promising it won't peek into it). So they can't decide on their own if a set of payment requests come from a single end user or multiple ones. There usually will be additional services and hooks to protect from these issues, but with additional fees attached to it, and a bit of dev to do on the seller side. Which means some smaller shops will forgo them and get bitten.
- Ferret7446 2y ago
  Good luck to them, but this is the "reason" crypto exists. I don't think we need (or can sustain) dozens of payment processors all with their own flavor of politics/dispute resolution quirks.
  - b112 2y ago
    Crypto is going no where, as an end user payment option, until consumers can do chargebacks. There are ways to solve this, but they involve gatekeeping, which of course puts us back at step one.
  - Etheryte 2y ago
    I'm not sure this is a convincing take on crypto. At the end of the day, you still need an on ramp and off ramp to deal in it, regardless of whether that's a bank or some other third party. We've already seen multiple times that e.g. certain blockchain assets are blacklisted. If you ever tried to move or cash them, the most likely outcome is a SWAT team at your door once there's a link to your name, similarly any financial institutions or corporations mediating it would face severe punishment. So effectively those assets are fenced off, no one wants the risk, and the end result is not different from regular finance.
  - bschmidt1 2y ago
    Crypto as in: - Decentralized finance (not even Coinbase) - Decentralized internet (everyone has servers) - New currencies / economies (niche-specific wealth) - Stop macro exploitation of intl economies - Information available to all - Sanity restored to money system / no more theft - Sanity restored to content / no more censorship Then sign me up! Or actually don't... I'll sign me up! Crypto as in: - Centralized exchanges - Centralized content hubs and "vaults" - Crypto twitter celeb ICOs and pump/dumps - NFTs ZKPs PePes and emojis - More corruption than ever - More theft than ever - Information obfuscated by memes and schemes Then no thanks, I'm good. Crypto was cool in the beginning, just got steered into a mess that nobody wants anything to do with anymore (probably intentionally).
    - simplify 2y ago
- PeterisP 2y ago
  If they think the response from Stripe for fraud/spam/PBL was too harsh, wait until they see how their banking partners (Deutsche+Fargo) will handle that; if they can't even keep up a level of due diligence that's "clean" enough for Stripe, they'll eventually end up owing the whole company to the banks due to contractual penalties and cost of fraud. A big reason why companies use an outsourced card payment service instead of going directly for a merchant account with banks is the difficulty of handling fraud & spam well, which is horribly expensive unless you have got a major economy of scale. As a payment processor, your potential risk is larger than your turnover. And while Stripe might freeze part of your incoming funds, in this business you'll need significant upfront capital as collateral - which you'll lose if you're mediocre at handling fraud.
jongjong 2y ago
These days, it's probably easier to obtain a share of big tech profits by engaging in government regulatory shenanigans than to compete against big tech and 'earn' the same amount of money 'on the free market'. If I was OP, I would just try to get a job as a financial regulator and create more regulations in exchange for a cushy job after.
cowsup 2y ago
They seem against any nay-sayers, so I’ll respect that and bite my tongue. The silver lining is that, their idea (which they later reveal that they “forgot to mention” will also include full banking support and the issuance of cards) is very complicated and will require years of non-stop planning and paperwork before a single customer can be onboarded. This isn’t handing your friend the keys to a jet and letting them fly a plane, this is your friend wanting to enroll in pilot school. It’s good to try, and, if you realize it’s not for you, there’s nobody harmed as a result.
memset 2y ago
Stripe used to have really simple docs: paste in some js, paste in some example code on the backend, and you’re good to go. Now it’s really really confusing. Payment intents are confusing. Figuring out which part of the docs I need is confusing. Figuring out the limitations of the self hosted checkout pages is confusing. The pricing is confusing. There’s narrative for one-click checkout that is comparable to PayPal (I guess there is “link” but seems like a separate thing?) Give me a thing I can copy and paste. Give me a hosted subscription management page. Finding a way to allow legal businesses to operate would be huge, though my impression is that you get yanked around by banks a lot. Don’t nickle and dime me on features. Make it easy to get reports out.
- m11a 2y ago
  Although I agree with all the issues you raise, I think the confusing nature of the pricing is by design. Stripe's fee model probably makes serious bank, because it's quite non-transparent and basically nothing is provided for free. Want even the slightest extra feature? +1% of your revenue (and repeat)
  - b112 2y ago
    Ah, the "we're out of ideas and have nothing, time to squeeze until the company dies, to chase stock price" phase of a business. Like your cable company!
    - vidanay 2y ago
      It's worked for 45+ years for cable companies.
      - dghlsakjg 2y ago
        Negotiating for medium and high volume sales isn’t exactly unheard of… It’s kind of the rule rather than the exception in B2B. Hell, a lot of businesses will give you better terms just for opening a business account.
      - 2y ago
TheSmoke 2y ago
In case they need to figure out what exactly they need to do: https://news.ycombinator.com/item?id=30650828 https://news.ycombinator.com/item?id=30650828
egypturnash 2y ago
seven years from now, this person will have become everything they hate about current payment processing methods.
- geodel 2y ago
  If they are successful and its a big 'IF'.
kulahan 2y ago
Didn’t the creator of stripe have it written in like, a few months? Iirc, he spent years dealing with regulations, not tech issues.
- intelVISA 2y ago
  Yep, you could write your own Stripe in a weekend - the pain is regulatory hurdles.
lancecotingkeh 2y ago
I'm one of the founders of OpenPay (getopenpay.com) and we offer comprehensive subscription management and analytics, and our customers can bring in any payment processor they want. We don't lock people into only using one payment processor like Stripe so we support a lot of businesses that have gotten banned from Stripe Would love to partner together to support all the subscription + hosted pages + analytics functionality
lakomen 2y ago
That guy can't even remove tracking from his posted link, how is he even remotely going to build anything blah blah
- cabbageicefruit 2y ago
  Good lord. The god nitpick.
- 0x64x 2y ago
  I don't want to remove anything from my link; I don't care if it's with tracking or without. So, if you want to remove tracking, just right-click on the link, and you'll see 'Copy Link Without site tracking.'
spamizbad 2y ago
I work in this space. Good luck! It’s extremely difficult and can be expensive getting off the ground (in addition to high CAC) BUT it’s doable. Buckle up!
- TheChaplain 2y ago
  I like this attitude, and I wish there was more of it. We should not grow fear to take on challenges, but support and cheer on those who go head on even if it is the most steepest climb. Most attempts will end in failure but that is fine, it is not the end of the world. Get back up, brush off the dust, enjoy the experience and knowledge you gained from it then get going again.
deleted 2y ago
[deleted]
assimpleaspossi 2y ago
They posted that on reddit. How far do you think they can go? People post all kinds of things on reddit. Most of them aren't true at all. Most people who post on reddit are people no one would listen to otherwise. That's why they post on reddit cause reddit will let anyone post there.
- 0x64x 2y ago
  I posted this because I passed regulatory requirements through partner banks and institutions. Reddit is Reddit; that’s what I realized they are just limited.
phendrenad2 2y ago
How many "Stripe problems" are really financial systems problems just being passed through to the user? I like the Indian system: no protections, just direct bank-to-bank transfers.
synicalx 2y ago
I can't wait to hear the fallout from their first PCI audit; "what the f** is a tamper proof bag?", "Key ceremony? No, sorry I'm not religious" But seriously I wish them luck, and I sincerely hope they know what they're getting themselves into and are receiving good advice/support from SME's. EDIT: Ok I retract that statement of goodwill, OP in that thread just comes across as a jerk. Enjoy the audits.
krick 2y ago
This is kinda a broad topic, but I'm kinda uncomfortable about the fact I still don't really understand how all this payments stuff works. Can somebody enlighten me, what does it take, exactly, to build a payment processor? Can anybody do that, theoretically? Do you have to implement some payments API for every bank your customers will use? In every country? I assume, the API's are not entirely open and are more than just a number of SWIFT conventions, so why would the banks work with you, how would you convince them? What really is a payment system, anyway, what's the difference between using a card and making a bank transfer? Why are there so few credit card providers, how are they different from, well, your future payment system? There are many questions beyond that, but it should be enough to judge the level of my ignorance. So, maybe somebody knows a book, a set of good blogposts, a really long YouTube video? Something?
- longdustytrail 2y ago
  I think patio11’s blog is exactly what you’re looking for. Probably scroll back to the earlier posts to find more fundamental stuff like what you’re asking: https://www.bitsaboutmoney.com/archive/ https://www.bitsaboutmoney.com/archive/
segmondy 2y ago
If they are going through the bank then they are not a true payment processor but a payfac. To be a processor they need direct link to the card networks like visa, amex,MC, etc. It's a tough space that requires solid domain knowledge to be profitable and not eaten alive by fraudsters.
tazu 2y ago
I actually have the code written for my own payment processor (including crypto)--that's the easy part. The hard part is the money transmitter license fees, which are insane and make it impossible to bootstrap.
latchkey 2y ago
Imagine building and owning the platform, but not being in control of it. That is what Stripe has become. The only way to get Stripe Express to stop emailing you during an incomplete registration with a third party, is to change your email address. I used root@127.0.0.1 in the hopes that it fills up a disk somewhere. This is the response to my support requests... ----------------------------------------------------- We want to express our sincere apologies if we were not able to respond to your email on time and I understand how important it is to get it resolved for you. Jumping right in, I would like to inform you that, as you have a Stripe Express account, which is being controlled and managed by the platform (XXXX Inc.) and we do not have any control over it. Also, the only option to delete your account is with the help of API, which can only be done by your platform. For context, with Express accounts, the platform has the ability to specify charge types and set the connected account's payout settings programmatically. The platform is responsible for handling payments, disputes, charges, account deletion, payouts and refunds. However, as you mentioned that you're not getting any response from your platform, the other option to stop receiving email is by changing the email address on the account, which I am able to see, you have already changed it. -----------------------------------------------------
0x64x 2y ago
I posted this yesterday: Reddit really hates VPNs, in my opinion, so my Reddit account got banned.

91 points by lopkeny12ko 2y ago

talldayo 2y ago

One must imagine Sisyphus happy.

cranberryturkey 2y ago
how so?
- talldayo 2y ago
  Regression pulls things towards the same point after a long enough time, like gravity pulling a boulder from the top of the mountain to the bottom. Resisting that regression, although pointless, has to be enticing enough or else you would simply give up. So Sisyphus had to have a positive or satisfied mindset to see the meaningless result of his actions and repeat it.
  - cranberryturkey 2y ago
    neat

fragmede 2y ago

They don't say why the hate Stripe, but presumably Stripe closed their account for fraud/spam/PBL reasons and took "their" money and won't give it to them. Whether or not this person/team succeeds, the real point is that spite is a powerful motivator. We all find motivation, in our own places, in our own ways, and spite is up there.

deleted 2y ago
[deleted]
hughesjj 2y ago
Yeah, you nailed it. They claim that their Japanese online Coffee shop was hit by a BIN attack and strip wouldn't let them back in, but didn't exactly give any details https://old.reddit.com/r/SaaS/comments/1f762xf/i_hate_stripe_so_im_going_to_build_my_own_payment/ll5920a/ https://old.reddit.com/r/SaaS/comments/1f762xf/i_hate_stripe...
- Dalewyn 2y ago
  [flagged]
- hypeatei 2y ago
  I didn't know what BIN attack was until now but it seems to be essentially brute forcing card details until one succeeds. How is that even feasible and why would the sellers account be banned in the case someone got the right combo? Very strange and suspicious.
  - makeitdouble 2y ago
    A BIN attack is feasible if the entry point lets you endlessly try card info. There's not that many, and issuers will give leeway on the card details (some won't care if the card holder's name is botched or completely wrong for instance) That's also why a PSP will ban the seller if they let that happen on their payment page.
    - hypeatei 2y ago
      > A BIN attack is feasible if the entry point lets you endlessly try card info Yeah, I just figured with all these fraud detection systems in place that rate limiting would be figured out and implemented. Regardless if the seller has a custom page or not, I still would think that PSP APIs would inherently disallow this to protect their customers.
      - makeitdouble 2y ago
        The complicating factor is that every business is different, and there are legitimate cases where an influx of random card just happens, or a slow trickle of payments goes on at a steady pace. In particular the PSP usually have no window on the seller's system (the seller handles the client and transparently passes the info to the PSP, contractually promising it won't peek into it). So they can't decide on their own if a set of payment requests come from a single end user or multiple ones. There usually will be additional services and hooks to protect from these issues, but with additional fees attached to it, and a bit of dev to do on the seller side. Which means some smaller shops will forgo them and get bitten.
Ferret7446 2y ago
Good luck to them, but this is the "reason" crypto exists. I don't think we need (or can sustain) dozens of payment processors all with their own flavor of politics/dispute resolution quirks.
- b112 2y ago
  Crypto is going no where, as an end user payment option, until consumers can do chargebacks. There are ways to solve this, but they involve gatekeeping, which of course puts us back at step one.
- Etheryte 2y ago
  I'm not sure this is a convincing take on crypto. At the end of the day, you still need an on ramp and off ramp to deal in it, regardless of whether that's a bank or some other third party. We've already seen multiple times that e.g. certain blockchain assets are blacklisted. If you ever tried to move or cash them, the most likely outcome is a SWAT team at your door once there's a link to your name, similarly any financial institutions or corporations mediating it would face severe punishment. So effectively those assets are fenced off, no one wants the risk, and the end result is not different from regular finance.
- bschmidt1 2y ago
  Crypto as in: - Decentralized finance (not even Coinbase) - Decentralized internet (everyone has servers) - New currencies / economies (niche-specific wealth) - Stop macro exploitation of intl economies - Information available to all - Sanity restored to money system / no more theft - Sanity restored to content / no more censorship Then sign me up! Or actually don't... I'll sign me up! Crypto as in: - Centralized exchanges - Centralized content hubs and "vaults" - Crypto twitter celeb ICOs and pump/dumps - NFTs ZKPs PePes and emojis - More corruption than ever - More theft than ever - Information obfuscated by memes and schemes Then no thanks, I'm good. Crypto was cool in the beginning, just got steered into a mess that nobody wants anything to do with anymore (probably intentionally).
  - simplify 2y ago
PeterisP 2y ago
If they think the response from Stripe for fraud/spam/PBL was too harsh, wait until they see how their banking partners (Deutsche+Fargo) will handle that; if they can't even keep up a level of due diligence that's "clean" enough for Stripe, they'll eventually end up owing the whole company to the banks due to contractual penalties and cost of fraud. A big reason why companies use an outsourced card payment service instead of going directly for a merchant account with banks is the difficulty of handling fraud & spam well, which is horribly expensive unless you have got a major economy of scale. As a payment processor, your potential risk is larger than your turnover. And while Stripe might freeze part of your incoming funds, in this business you'll need significant upfront capital as collateral - which you'll lose if you're mediocre at handling fraud.

jongjong 2y ago

These days, it's probably easier to obtain a share of big tech profits by engaging in government regulatory shenanigans than to compete against big tech and 'earn' the same amount of money 'on the free market'. If I was OP, I would just try to get a job as a financial regulator and create more regulations in exchange for a cushy job after.

cowsup 2y ago

They seem against any nay-sayers, so I’ll respect that and bite my tongue. The silver lining is that, their idea (which they later reveal that they “forgot to mention” will also include full banking support and the issuance of cards) is very complicated and will require years of non-stop planning and paperwork before a single customer can be onboarded. This isn’t handing your friend the keys to a jet and letting them fly a plane, this is your friend wanting to enroll in pilot school. It’s good to try, and, if you realize it’s not for you, there’s nobody harmed as a result.

memset 2y ago

Stripe used to have really simple docs: paste in some js, paste in some example code on the backend, and you’re good to go. Now it’s really really confusing. Payment intents are confusing. Figuring out which part of the docs I need is confusing. Figuring out the limitations of the self hosted checkout pages is confusing. The pricing is confusing. There’s narrative for one-click checkout that is comparable to PayPal (I guess there is “link” but seems like a separate thing?) Give me a thing I can copy and paste. Give me a hosted subscription management page. Finding a way to allow legal businesses to operate would be huge, though my impression is that you get yanked around by banks a lot. Don’t nickle and dime me on features. Make it easy to get reports out.

m11a 2y ago
Although I agree with all the issues you raise, I think the confusing nature of the pricing is by design. Stripe's fee model probably makes serious bank, because it's quite non-transparent and basically nothing is provided for free. Want even the slightest extra feature? +1% of your revenue (and repeat)
- b112 2y ago
  Ah, the "we're out of ideas and have nothing, time to squeeze until the company dies, to chase stock price" phase of a business. Like your cable company!
  - vidanay 2y ago
    It's worked for 45+ years for cable companies.
    - dghlsakjg 2y ago
      Negotiating for medium and high volume sales isn’t exactly unheard of… It’s kind of the rule rather than the exception in B2B. Hell, a lot of businesses will give you better terms just for opening a business account.
    - 2y ago

TheSmoke 2y ago

In case they need to figure out what exactly they need to do: https://news.ycombinator.com/item?id=30650828 https://news.ycombinator.com/item?id=30650828

egypturnash 2y ago

seven years from now, this person will have become everything they hate about current payment processing methods.

geodel 2y ago
If they are successful and its a big 'IF'.

kulahan 2y ago

Didn’t the creator of stripe have it written in like, a few months? Iirc, he spent years dealing with regulations, not tech issues.

intelVISA 2y ago
Yep, you could write your own Stripe in a weekend - the pain is regulatory hurdles.

lancecotingkeh 2y ago

I'm one of the founders of OpenPay (getopenpay.com) and we offer comprehensive subscription management and analytics, and our customers can bring in any payment processor they want. We don't lock people into only using one payment processor like Stripe so we support a lot of businesses that have gotten banned from Stripe Would love to partner together to support all the subscription + hosted pages + analytics functionality

lakomen 2y ago

That guy can't even remove tracking from his posted link, how is he even remotely going to build anything blah blah

cabbageicefruit 2y ago
Good lord. The god nitpick.
0x64x 2y ago
I don't want to remove anything from my link; I don't care if it's with tracking or without. So, if you want to remove tracking, just right-click on the link, and you'll see 'Copy Link Without site tracking.'

spamizbad 2y ago

I work in this space. Good luck! It’s extremely difficult and can be expensive getting off the ground (in addition to high CAC) BUT it’s doable. Buckle up!

TheChaplain 2y ago
I like this attitude, and I wish there was more of it. We should not grow fear to take on challenges, but support and cheer on those who go head on even if it is the most steepest climb. Most attempts will end in failure but that is fine, it is not the end of the world. Get back up, brush off the dust, enjoy the experience and knowledge you gained from it then get going again.

deleted 2y ago

[deleted]

assimpleaspossi 2y ago

They posted that on reddit. How far do you think they can go? People post all kinds of things on reddit. Most of them aren't true at all. Most people who post on reddit are people no one would listen to otherwise. That's why they post on reddit cause reddit will let anyone post there.

0x64x 2y ago
I posted this because I passed regulatory requirements through partner banks and institutions. Reddit is Reddit; that’s what I realized they are just limited.

phendrenad2 2y ago

How many "Stripe problems" are really financial systems problems just being passed through to the user? I like the Indian system: no protections, just direct bank-to-bank transfers.

synicalx 2y ago

I can't wait to hear the fallout from their first PCI audit; "what the f** is a tamper proof bag?", "Key ceremony? No, sorry I'm not religious" But seriously I wish them luck, and I sincerely hope they know what they're getting themselves into and are receiving good advice/support from SME's. EDIT: Ok I retract that statement of goodwill, OP in that thread just comes across as a jerk. Enjoy the audits.

krick 2y ago

This is kinda a broad topic, but I'm kinda uncomfortable about the fact I still don't really understand how all this payments stuff works. Can somebody enlighten me, what does it take, exactly, to build a payment processor? Can anybody do that, theoretically? Do you have to implement some payments API for every bank your customers will use? In every country? I assume, the API's are not entirely open and are more than just a number of SWIFT conventions, so why would the banks work with you, how would you convince them? What really is a payment system, anyway, what's the difference between using a card and making a bank transfer? Why are there so few credit card providers, how are they different from, well, your future payment system? There are many questions beyond that, but it should be enough to judge the level of my ignorance. So, maybe somebody knows a book, a set of good blogposts, a really long YouTube video? Something?

longdustytrail 2y ago
I think patio11’s blog is exactly what you’re looking for. Probably scroll back to the earlier posts to find more fundamental stuff like what you’re asking: https://www.bitsaboutmoney.com/archive/ https://www.bitsaboutmoney.com/archive/

segmondy 2y ago

If they are going through the bank then they are not a true payment processor but a payfac. To be a processor they need direct link to the card networks like visa, amex,MC, etc. It's a tough space that requires solid domain knowledge to be profitable and not eaten alive by fraudsters.

tazu 2y ago

I actually have the code written for my own payment processor (including crypto)--that's the easy part. The hard part is the money transmitter license fees, which are insane and make it impossible to bootstrap.

latchkey 2y ago

Imagine building and owning the platform, but not being in control of it. That is what Stripe has become. The only way to get Stripe Express to stop emailing you during an incomplete registration with a third party, is to change your email address. I used root@127.0.0.1 in the hopes that it fills up a disk somewhere. This is the response to my support requests... ----------------------------------------------------- We want to express our sincere apologies if we were not able to respond to your email on time and I understand how important it is to get it resolved for you. Jumping right in, I would like to inform you that, as you have a Stripe Express account, which is being controlled and managed by the platform (XXXX Inc.) and we do not have any control over it. Also, the only option to delete your account is with the help of API, which can only be done by your platform. For context, with Express accounts, the platform has the ability to specify charge types and set the connected account's payout settings programmatically. The platform is responsible for handling payments, disputes, charges, account deletion, payouts and refunds. However, as you mentioned that you're not getting any response from your platform, the other option to stop receiving email is by changing the email address on the account, which I am able to see, you have already changed it. -----------------------------------------------------

0x64x 2y ago

I posted this yesterday: Reddit really hates VPNs, in my opinion, so my Reddit account got banned.