Appstore Security

[Trip]

With the Pandora having a keyboard, I really can't see the problem with putting in password every time.
The first time it might be annoying as you'll probably go on a downloading spree but once you have all your main programs downloaded, you'll be installing stuff a lot less anyway.

 

[marshal]

I voted for *yes*. I don't mind entering my password.
The most important for me is that you use SSL properly and that the site is secure.

I do like the idea of a a central place to download app for the Pandora. I think the most important is to have a good website where ppl can easily find, rate, comment and download software. Good description and screenshot of software are a must too.

I believe I'll be mostly using Open source software on my Pandora. I definitely don't mind commercial software though and I'll be interested to see some good commercial software (mostly game). As far as open source app and freeware stay free and can be easily downloaded everything is fine for me.

The problem I see with the appstore is that I don't see a lot of commercial software appearing anytime soon. The hardware hasn't shipped yet and even when the first batch is over it's only 4000 unit. I believe it will be quite difficult to have some interesting commercial software with less 10'000 units out there.

I really don't think that appstore credit are a good idea for now. Unless you have a decent selection of software to buy people will probably only want to want 1 app or 2. Appstore credit also makes thing too complicated IMO. At first you should keep things simple IMO.

If paypal fees are a problem maybe you could add them to the price of the software. Or maybe charge extra fee for small order (<$2 or <5$ for example). Or a combination of both.
Or maybe you have reduction for larger order (or appstore credit). For list price includes some kind of extra paypal fee but if you buy 20$ worth of software at one time you get a discount. And maybe a slightly bigger discount for $50. That would also work for buying appstore credit.


There is a feature I would like to see on the website: being able to see the new and updated software. with RSS feed if possible.
Also you could have some sort of mail notification. For example you could have a weekly mail with a list of new and updated software.
Another idea is to have a notification when a new version of an app you downloaded is available. The problem with this would be that just because you downloaded an app doesn't mean you're using it. So I guess the user would have to choose witch sofware he wants to be notified about.

 

[juniorm33]

Is it only for commercial app's?
What about donations, etc?
Make it easy and centralised and it add's to the polish of Pandora.
Keep costs down, make it easy and people will pay. So may not be millions to a dev, but nice none the less.
That's why I can see the benifit of keeping transaction costs down.

 

[adtbm]

buying yes. downloading no

just as a confirmation. the pandora keyboard will make it less troublesome anyway.

And the possibility for the lazy ones to "tick" "Remember Password" (But, of course, on their own risc)

 

[mali]

If paypal fees are a problem maybe you could add them to the price of the software. Or maybe charge extra fee for small order (<$2 or <5$ for example). Or a combination of both.
Or maybe you have reduction for larger order (or appstore credit). For list price includes some kind of extra paypal fee but if you buy 20$ worth of software at one time you get a discount. And maybe a slightly bigger discount for $50. That would also work for buying appstore credit.

It's not allowed to charge extra for Paypal fees. The main problem I see is VAT. If a homebrewer wants to have a few bucks for his app, but isn't liable to pay VAT, because he is below a certain amount of yearly income, OP would still have to pay VAT and so add that amount to the price. In Germany its 19% VAT right now. It depends on how you structurise that app store. Maybe it's possible to do it like eBay, where OP just offers the platform and charges some fees and the deal is made between the software creator and the users directly. OP would have to pay VAT only for their income through fees. The whole matter is too complex and you _need_ a consultant with in-depth knowledge to find the best solution, imo.

 

[EvilDragon]

How neat. Going to dump the open source part and put an encryption on the software that will eventually fail anyway?

Hm. Where does it say something about encryption? GOG.COM also sells games - unencrypted and without DRM.

Feel a need to make up that lost money by selling user preferences?

Huh? I con't even have a clue what you're talking about?

How many developers have abandoned this project already due to a lack of hardware to test on?

None I do know of? Though I do know a lot that do code for this project?

How does an appstore matter?

It's a way to easily sell more complex games and apps, like Apple and Wii does?
Good for Indie game developers. Think of World of Goo and similar games.

Also, this could be used for a replacement of the current archives, as those have some annoying things (like updating needs to be approved, etc.)
With our own system, each devs can update his own programs whenever he wants, charge what he wants or give it away for free.

On the Pandora, there's a one-click-install for the games. Easy for the user.

Still working on those cases, boards, and software?

Cases: Nope, just waiting for them to be finished, no work to be done from us.
Boards: No work needs to be done, just waiting for the cases.
Software: Work will never be finished, as it should be with an up-to-date system.

Haunted by holidays that are occurring a second time?

Nope. Not even haunted by trolls like you that appear from time to time, sorry about that.

 

[EvilDragon]

If paypal fees are a problem maybe you could add them to the price of the software. Or maybe charge extra fee for small order (<$2 or <5$ for example). Or a combination of both.
Or maybe you have reduction for larger order (or appstore credit). For list price includes some kind of extra paypal fee but if you buy 20$ worth of software at one time you get a discount. And maybe a slightly bigger discount for $50. That would also work for buying appstore credit.

It's not allowed to charge extra for Paypal fees. The main problem I see is VAT. If a homebrewer wants to have a few bucks for his app, but isn't liable to pay VAT, because he is below a certain amount of yearly income, OP would still have to pay VAT and so add that amount to the price. In Germany its 19% VAT right now. It depends on how you structurise that app store. Maybe it's possible to do it like eBay, where OP just offers the platform and charges some fees and the deal is made between the software creator and the users directly. OP would have to pay VAT only for their income through fees. The whole matter is too complex and you _need_ a consultant with in-depth knowledge to find the best solution, imo.

Well, within Europe, you have to pay the VAT where the store is located. So if you buy from GBAX, you have to pay the VAT for UK if you're living within the EU.
If you're outside of Europe, you don't have to pay VAT.
The store should show the prices accordingly after login.

A different approach would be that OP is only the agent for the developer. Then the VAT rules of the country where the developer sits would the valid ones.
I did the same with a game for the GP2X within my country. I was the agent, the dev was in US, so no VAT had to be paid.

 

[mali]

Well, within Europe, you have to pay the VAT where the store is located. So if you buy from GBAX, you have to pay the VAT for UK if you're living within the EU.
If you're outside of Europe, you don't have to pay VAT.
The store should show the prices accordingly after login.

I know how that stuff works as I do business myself

A different approach would be that OP is only the agent for the developer. Then the VAT rules of the country where the developer sits would the valid ones.
I did the same with a game for the GP2X within my country. I was the agent, the dev was in US, so no VAT had to be paid.

That's what I meant with my eBay analogy

 

[laurens]

I think on Sony's PSN there is an option for this, where you can toggle whether or not you want to enter your password each time you want to buy something; this could work here quite nicely too I think.

 

[Dimacus]

...
I believe I'll be mostly using Open source software on my Pandora. I definitely don't mind commercial software though and I'll be interested to see some good commercial software (mostly game). As far as open source app and freeware stay free and can be easily downloaded everything is fine for me.

The problem I see with the appstore is that I don't see a lot of commercial software appearing anytime soon. The hardware hasn't shipped yet and even when the first batch is over it's only 4000 unit. I believe it will be quite difficult to have some interesting commercial software with less 10'000 units out there.

...

Im not sure if you realize that open source software can be commercial, just because it's open source doesn't mean it's free.

I really don't think that appstore credit are a good idea for now. Unless you have a decent selection of software to buy people will probably only want to want 1 app or 2.
...

Remember that probably more than a few will want to be able to donate to dev's, and if we wan't the appstore to handle that and enable the 'spare change donations' there was talk about, some sort of point system would probably be preferred over direct micro-transactions.

 

[Tobs]

Definitely you should. We had a talk from a bank's security researchers about an attack that exploits sites that don't, about a month ago (on a computer forensics and security course)
1) User logs in, clicking "remember me" option.
2) User goes to a different site, without logging out
3) Some other site (Evil.com we'll call it) picks up on cookies or w/e used to remember login
4) Evil.com procedes to take control of your account using JS.
I think it was Reddit the other week came under attack; someone posted a site that invoked JS that auto replied to the thread saying something like "Wow, go to this site![link to evil.com]". When users clicked it, it of course replied to the thread with the same text.
So for a store, the comment could contain a "view video" link could link to a site with some JS that clicked on the buy button, but because it doesn't need a password, the sale goes through. Then other ramifications like paypal and users no longer trusting you come about.

A pretty new attack, but well worth protecting against.
Also, if you want more advice on web security, I have a heap of books and experts I can ask.

Tobs

 

[Javacat]

I'd make it so that you have some sort of basket (mentioned earlier) and then ask for a password to authenticate all purchases. Or make it a user preference, with it defaulting to always asking for a password. Put some huge disclaimer on and if the account holder changes it then it's their own problem if someone else buys a load of pr0n games using it.

Semi related questions to the appstore: Does the appstore keep a record of everything you store? (I'm guessing it will)
Could I log onto the appstore on my computer, buy a bunch of games and then log onto the Pandora and download them all to it?
Is there going to be a limit to the number of times you can download an app?
If a user has multiple Pandoras, could they buy an app and install it on all of them or is it going to be one individual purchase == usage for one Pandora?
Have you sorted out some sort of DRM to stop users pirating copies of commercial games?

 

[Giepi]

Have you sorted out some sort of DRM to stop users pirating copies of commercial games?

1) I do not believe DRM is in the spirit of Open Pandora, no offense. BTW, NO ONE has ever stopped piracy, no matter what technology are you using, so strange blocking techs would just bother regular and honest buyer (because other would just use the pirated version). My Opinion is against any use of such a kind of approach

2) You, sir, have an AWESOME Avatar system!

 

[mali]

There is no DRM, but it does have the ability to track who leaked anything. Although I hope the Pandora scene might be basically honest and support itself.

The appstore can be accessed by the Pandora or a browser on your pc/mac/etc. You get a PND file, and it does keep track of your history.

Anyone can upload, there are options exactly for our scene like 'previous version free, current version pay for' and 'spare change auto donate', which if you have less than 99c in your account will donate it to a free bit of software (randomly or you can choose). I'm quit excited about that feature.

You can charge your account via paypal or card.

The first version will be invite only from this weekend - it's likely it will be dev tested for a while.

It also supports the wiz and dingoo to some extent.

You charge the account with either $20, $30 or $50 at a time (max balance allowed $100). This is to avoid constant bank/paypal charges.

So you could often have a spare 1c-90c (or set it to more) to throw to a dev.

 

[Jourdy288]

I think of Sony's PSN there is an option for this, where you can toggle whether or not you want to enter your password each time you want to buy something; this could work here quite nicely too I think.

1+

I also think the appstore credit is a brilliant idea, but I think there should be the option to pay for something with money or credit, and let's say you put an item up for sale you decide to be paid with cred or money (or both).

 

[WizardStan]

Have a password for final purchase, yes, sounds good. Not for each individual, because that could get annoying, but at the end of the transaction when purchasing 3 or 4 games, maybe. If it's possible, of course. If such a cart system doesn't exist, just make it per purchase.
If you then set up an option to never ask for password DO NOT SAVE IT! If the person clicks "remember me forever" in their options, just give them a cookie or something that never expires. So they come back on their home computer, time and again, and you remember their setting because it was in the cookie. If they then log in from a different computer, there's no cookie, so you ask for their password. Or if they do one day decide to log out, this invalidates the cookie so when they log in again, they need to set the "forever" option again. You get more robust security, especially at public computers, without perpetual annoyance while at home.

 

[Tempel]

I voted yes just to prevent my own stupidity. I can imagine someone logging into their account on my computer and not logging out again afterwards; I then go in and don't realize I'm buying things on someone else's account. That would be a piss off.

But the other mentioned reasons (prank purchases, cross-site scripting) are good ones too.

 

[Farox]

Giepi
My humble suggestion is letting choose everything you want to buy without any tedious password insertion and THEN insert the password as a cart checkout.

+1

 

[mindlord]

I voted yes. But, really it's one of those "Should I cover my own ass?" questions that should always be answered "Yes. Yes, you should."

Regardless of whether or not you're using a shopping cart (Why wouldn't you?) Security is a #1 proirity when money is involved, and I'd be pissed if you weren't doing everything you could to protect my account and information. I want my cookie to expire after 15 minutes of inactivity.

 

[kloplop321]

Giepi
My humble suggestion is letting choose everything you want to buy without any tedious password insertion and THEN insert the password as a cart checkout.

+1

+2
I think it would not only be most convenient but also secure as well instead of after EVERY single app the person wants to have.