Captain McAteer

Creator of @firnprotocol.

The thing is to matter.

[Captain McAteer @captainmcateer]

@wylfcen how clear are you on the phonetics / phonology / sound system of Old English? how do you go about obtaining that information?

[Captain McAteer @captainmcateer]

@wylfcen what do you think of The Anglo-Saxons, by Marc Morris?

I'm a huge fan

[Captain McAteer @captainmcateer]

@LizWolfeReason hahah seriously.

[Captain McAteer @captainmcateer]

@valkenburgh by "maintain", I initially thought they meant, e.g., "store in 𝚕𝚘𝚌𝚊𝚕𝚂𝚝𝚘𝚛𝚊𝚐𝚎 for later access." or something.

an idea this bad, and worded so badly, didn't even occur to me.

[Captain McAteer @captainmcateer]

@valkenburgh it took me a while to grasp that by "UI maintain", they actually meant exfiltrate / export the user's secret key in the clear, away from the user's machine, into somewhere centralized.

(after all, the UI is fundamentally code that runs 𝘭𝘰𝘤𝘢𝘭𝘭𝘺 in the user's browser.)

[Captain McAteer @captainmcateer]

@wylfcen but german "glück" means "joy", which is almost the opposite drift.

[Captain McAteer @captainmcateer]

@alpeh_v all 4 of these choices are awful, wrong and meaningless.

[Captain McAteer @captainmcateer]

@plain_simon @TaliaRinger completely agreed. i do this routinely, and have no regrets.

what else are we supposed to do? calling it "Reference [13]" is extremely lame and pedantic IMO.

[Captain McAteer @captainmcateer]

@uwwgo beast

[Captain McAteer @captainmcateer]

@uwwgo @firnprotocol why not use 4337? the short answer is we can't. they forbid certain opcodes: like block.timestamp, for example.

[Captain McAteer @captainmcateer]

@uwwgo we use one at @firnprotocol, for obvious privacy reasons. source code: https://t.co/72M6Zmv8ZN

our is also publicly exposed (so that Firn users can hit it); but is not general-purpose.

[Captain McAteer @captainmcateer]

@wylfcen wait, what? you better not stop doing what you're doing.

[Captain McAteer @captainmcateer]

@TonyTheLion2500 you're totally correct, and in fact people use this to dismiss mathematicians when they [the mathematicians] are not able to magically get them [the audience] to understand something extremely complicated.

[Captain McAteer @captainmcateer]

@web3privacy @firnprotocol @nymproject @coincenter @PimEyesOfficial cool! doxxer PimEyes is misspelled unfortunately

[Captain McAteer @captainmcateer]

@michae1becker seriously, this guy (i.e., @henryheffernan) is the most hirable person i've seen. would hire him to work on @firnprotocol if i had the $

[Captain McAteer @captainmcateer]

@myers_jaz completely missed the point! this is a literary reference, to Pride and Prejudice.

author is a legend.

[Captain McAteer @captainmcateer]

a legend among us achieves a satisfactory ending, due to an abundance of diligence, honesty and hard work.

[Bruno Simon @bruno_simon]

Final update for this story (I hope).
If you are selling something online (not only with Stripe), read the tweet 👇

After 8 days, all payments had been refunded. It took too long, but Stripe assured me that it was unusual and will make sure it doesn't happen again.
After 11 days, Stripe calculated all the fees (payment fees, dispute fees, currency conversion between payment and refund) and reimbursed me the FULL AMOUNT! 🎉
Everything is back to normal, thank you @stripe

Still, there are a few lessons I've learned and I though I should share those.

1. First, "card testing" is a thing. I discovered that the hard way. Quick summary, it's when people test stolen cards through VPN to test if they work and from what country they will most likely work.
In my case, they attempted to purchase for 8.000.000 USD worth in a matter of a few hours, Stripe blocked most of it but 170.000 USD went through.

2. When you create your business and the purchase tunnel, try to figure out if someone with bad intentions can easily use your website to test cards. If so, make it harder. I'm not going to explain in public the various security features I've setup, but if you need, contact me in private.
Still, I can tell you one, CAPTCHA. And the CAPTCHA could show up only when there is an unusual amount of payments.

3. If you get card tested, call the payment solution immediately and while you're on hold, try to block the payments, even if it means putting the whole website offline for a few hours.
Stripe support answers really fast. It's a matter of minutes before you have someone on the phone.

4. Deactivate the payouts. If the money is wired to your bank account, you won't be able to refund the payments and it's going to get worse.

5. Refund all the payments immediately. If you feel like doing a script, go ahead, but be careful, you are probably not in a state where you can write good code and you might end up making mistakes. I remember needing to be pro-active but totally crushed at the same time. Just go through them manually, even if it takes hours.
If you do it fast enough, card owners might not even perceive the payment.
If you take too long, it might end up in disputes that will result in more fees.

6. Always keep an eye on your sales. It happened to me on Sunday evening around 9PM and I saw it around 10:30PM. Fortunately, I check multiple times a day, even the weekend, but how many businesses do that?

7. In the case of Stripe, you can't rely on Radar. Radar is a feature that analyse the payments and help you prevent fraudulent payments. Sounds great, but there is a cost for each payment intent. I'm talking about "intent", not actual completed payment. Meaning that if you receive thousands and thousands of payment intents, you are going to be ruined.
Yet, there is a 30 days free trial that I immediately activated. It's a good temporary solution, but make sure to deactivate it after before the end of the trial.

Final word about Stripe.
Although, I find the Radar feature a bit shady, I'm still very happy with Stripe. It's so easy to implement, the interface and the documentation are so clear, they keep on improving the service, it works in most countries around the globe.
The problem I had could have happened with other solutions, and maybe it wouldn't have gone this well in the end.

Glad it's sorted out.
Thank you for all the comments and support I received. Always happy to see there are good people ready to help.

[Captain McAteer @captainmcateer]

@uwwgo love this kind of day

[Captain McAteer @captainmcateer]

@bruno_simon @stripe keep your head up—not many people out there are as talented and honest as you are, and that shows plainly.

[Captain McAteer @captainmcateer]

no company has declined more pathetically than @coinbase.

first, they threaten to lock me out unless I upload documents. next—guess it—their upload process has a bug and fails.

in the console, there are CORS errors w/ the 3rd party id verification service. just shameful.