Slashdot Mirror

You can't get into the venue in the first place without putting a $500 authorization (or "hold") on your credit card. If you're thrown out, they capture the authorization.

And if the reasons for getting thrown out are fraudulent, you can file a credit card chargeback. At that point, they could sue you, assuming they would actually want to bring the issue to court.

You can't get into the venue in the first place without putting a $500 authorization (or "hold") on your credit card. If you're thrown out, they capture the authorization.

Yeah, because eBay banned them. And all alternatives to PayPal, one by one. The parent company that had bought BidPay from Western Union (who had previously purchased BP) closed them down for good on Dec 31, 2007.

That whole argument is a bunch of bull. Two minutes with Google found these:

Avalara
CyberSource
CCH Group


Just as my mortgage holder doesn't calculate or pay my real estate taxes (they outsource it to a specialized third party), retailers don't need to calculate my sales tax. The "it's too hard and confusing" argument is just a weak attempt to justify keeping a competitive advantages. Walmart, Target, Sears, Home Depot, Toys 'R' Us, et al operate in all 50 states (or nearly so) and they're all capable of collecting sales tax on their internet transactions. If they can do it, Amazon can do it.

The point is that my state (RI) has a law that says if I live here and I buy something I owe sales/use tax on it, no matter where I buy it from. Since enforcement against taxpayers is nearly impossible, going after the big retailers makes sense. Even if I don't much like it.

That is absolutely untrue. It is required by law that companies selling certain products (and practiced by many more companies hoping to have a defense in case they are sued), provide FULL AND DETAILED purchase information, including every item cost, description, and full category. This is used by the credit card authorization company to determine whether the transaction is allowed based on the name, address, phone number, and email and IP addresses (if applicable) of the purchaser and the types of items being purchased.

I implemented such a solution for my employer, against my better judgement. This is the US government overstepping their authority because they scared their citizens enough to let them get away with this.

If you'd like to see the API for such a system, see Cybersource's Implementation Guide for Export Compliance. Note that this is done in combination with a credit card authorization.

In addition, American Express has for a long time gotten detailed information from their merchants regarding every transaction, including the exact type of item being purchased, and every line item.

When you calculate tax you use the shipping address, not billing address. The tax is not paid based on where the money is coming from, which always seemed very weird to me.

"it would be too onerous for e-tailers to calculate all the permutations of differing state and local tax rates"

Very much true. The way it is now it's already tricky. I you have nexus (presence, be it a store, storage or even servers co-located) somewhere you aleady need to charge tax for shipping there. Then you need to consider that some places have state tax, county tax and/ or city tax. You can't just use the zip code to break up state/county and city since some zip codes span more than one area.

Plus, legislation and tax rates fluctuate and you have to keep databases in sync with laws. C'mon!

Some vendors like Cybersource offer tax calculation services. That may be the only practical solution, but then not only you have to interface with their APIs but also you get yet another cut in your profit.

We all remember the Twilight Zone episodes about the Earth being dominated by cold, unthinking, uncaring machines that take over and establish an Orwellian rule, or the Terminator who speaks of "Skynet" becoming self-aware.

Yet this is not how machine intelligence has been evolving. Think Google, think Visa's fraud detection system, think the learning DSPAM which simulates learning so effectively.

Machine intelligence will not replace human intelligence - like the cerebrum augmenting the "lizard brain" at the base of the brain, our extrasomatic information technologies and machinery augment, enhance, and extend the capabilities of our cerebrum.

What's interesting is that the evolution of machine intelligence has hit a point where it surpasses, or will soon surpass, the thinking performed in our collective cerebrums.

We are becoming the Borg of Star Trek tales, armed with our cell phones, Internet access terminals, (I write this from a Hotel 2 blocks from Disneyland, in Anaheim, CA with my Linux laptop - where are you?) telephones, pagers, walkie-talkies, and other inter-personal communication devices.

And I find no end of fascination in watching the birth of this machine intelligence, and watching it become so tightly integrated with our humanity.

I can now perform in minutes research that just a few decades ago would have taken hours or days. This is the result of machine intelligence, and it will get far better, not worse.

Sit back and enjoy the ride - it's going to be a fun one!

Check out this whitepaper from CyberSource that describes a good solution for your problem. I'd add to this approach that you should use a keyed hash, and a hardware encryption device for both hashes and encryption/decryption so the keys are not readily available to someone with a login on the machine. I'd recommend Ncipher. Finally, use Tripwire or some such thing to monitor the machines for unauthorized programs that might gain access to both the database and the crypto HW.

There is a documented approach to storing of sensitive customer information that I think makes a lot of sense. It is brought to you by Cybersource and the SIIA and is available here