4 ms·

> In short, just making your own payment processor is hilariously difficult and far beyond the means of Valve let alone Itch. Depending on what the speaker mean

> In short, just making your own payment processor is hilariously difficult and far beyond the means of Valve let alone Itch. Depending on what the speaker means by "Payment Processor", they may be suggesting making your own bank, or somehow convincing a bank to let Itch shove payments through them; who will eventually do the exact same thing as what happened here. There's no winning play there. PCI-DSS compliance wasn't even mentioned and it is easily able to overwhelm organizations like Valve and Itch on its own. The hardest part of payment processing is the network. Connecting the acquirers to the issuers in such a way that everyone is happy with the arrangement. Just like the hardest part of the power grid is the transmission infrastructure. The endpoints are far more trivial to replace. If you want to use the existing network, you have to play by all of the rules. The only real way out of this system is to use a completely different kind of currency.

ta12653421 1y ago
For shops like Valve only if they need SAQ-D in case they want to store the credit card numbers on their own, I'd say? SAQ-A til SAQ-C is doable for any e-commerce company.
- notpushkin 1y ago
  Yeah, but assuming they want to build everything from scratch it would get way harder very quickly.
- bob1029 1y ago
  It's likely they would need on-site visits from a QSA if they wanted to go all the way into this. Valve would fall into the Level 1 compliance category. Self-reporting won't work for that kind of transaction volume.
CamouflagedKiwi 1y ago
PCI-DSS can be tough but it is also very specifically scoped and so if done well you can keep it very limited. From the way the article describes Itch (1 person + some part time help - which isn't totally ideal for PCI either), it absolutely could overwhelm them, but Valve are certainly a big enough organisation to handle it just fine - assuming, of course, they they wanted to.

ta12653421 1y ago

For shops like Valve only if they need SAQ-D in case they want to store the credit card numbers on their own, I'd say? SAQ-A til SAQ-C is doable for any e-commerce company.

notpushkin 1y ago
Yeah, but assuming they want to build everything from scratch it would get way harder very quickly.
bob1029 1y ago
It's likely they would need on-site visits from a QSA if they wanted to go all the way into this. Valve would fall into the Level 1 compliance category. Self-reporting won't work for that kind of transaction volume.

CamouflagedKiwi 1y ago

PCI-DSS can be tough but it is also very specifically scoped and so if done well you can keep it very limited. From the way the article describes Itch (1 person + some part time help - which isn't totally ideal for PCI either), it absolutely could overwhelm them, but Valve are certainly a big enough organisation to handle it just fine - assuming, of course, they they wanted to.