From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp11.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 8OoeJNgJG2J2jAAAgWs5BA (envelope-from ) for ; Sun, 27 Feb 2022 06:19:20 +0100 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp11.migadu.com with LMTPS id IJNnIdgJG2I3awEA9RJhRA (envelope-from ) for ; Sun, 27 Feb 2022 06:19:20 +0100 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 25F1C38703 for ; Sun, 27 Feb 2022 06:19:20 +0100 (CET) Received: from localhost ([::1]:49858 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nOBxm-0000Ad-BE for larch@yhetil.org; Sun, 27 Feb 2022 00:19:18 -0500 Received: from eggs.gnu.org ([209.51.188.92]:60594) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nOBwW-0000AK-FO for Emacs-orgmode@gnu.org; Sun, 27 Feb 2022 00:18:00 -0500 Received: from protestant.ebb.org ([50.56.179.12]:53631) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nOBwU-0005tS-I0 for Emacs-orgmode@gnu.org; Sun, 27 Feb 2022 00:18:00 -0500 Received: from localhost (unknown [216.161.86.18]) (Authenticated sender: bkuhn) by protestant.ebb.org (Postfix) with ESMTPSA id F36438208A; Sat, 26 Feb 2022 21:17:56 -0800 (PST) Date: Sat, 26 Feb 2022 20:43:57 -0800 From: "Bradley M. Kuhn" To: Emacs orgmode Subject: Re: Links to javascript-based websites from orgmode.org: Paypal and Github Message-ID: References: <0472f849f3ae42df68b0f031d61594d9@posteo.de> <87ilt3yvqj.fsf@localhost> <877d9j3u91.fsf@localhost> <17c95e5a298c213c63b6f7ac9f05aac4@posteo.de> <87y21z2d2b.fsf@localhost> <871qzqg81c.fsf@gnu.org> <87r17q2n3i.fsf@localhost> <877d9ij990.fsf@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <877d9ij990.fsf@gnu.org> Received-SPF: pass client-ip=50.56.179.12; envelope-from=bkuhn@ebb.org; helo=protestant.ebb.org X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-orgmode@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "General discussions about Org-mode." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-orgmode-bounces+larch=yhetil.org@gnu.org Sender: "Emacs-orgmode" X-Migadu-Flow: FLOW_IN X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1645939160; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=bsGORzbg1vtOKxHA6uI2p29sMRLMB/mCnjh2I65PoPE=; b=mdeoOlDUrBpOWAkVW0ipZUEGDn/LzfM2T8J70OvsHKPtMvdKz5mwkjzQAom+Ip+GZpiP26 g/ycCt9y8/YgLSoME9F1TsMoDk43fyDIn3RvyfjQ+O/tZwrz7QIatdwHlPtV6vZJqpB6fd DzofIgJJbcEjylmOuFet0BYv4WeYUgiWop78oEftcfUB4LfqOQyIV63KF8w+nJmYs0+cP7 fMaMXYn8Tkci+pP1PhrAehBsTJ1r9DmC8DCIfN6ns11RcT8RALOOkFFrPIrhb2dYT3Ut6H TEsgIw54CePImnHdhQ7jC7d1njPvgW0K9CtfB/cOLi/txhMADR1Mxn/ZZSrC9Q== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1645939160; a=rsa-sha256; cv=none; b=MKC+Cnqcti8kiNnrGgKXqEC7cgo/OD9apDfR5qJd9hoZT1DCjVU5UwG0KbxSRyY7oVbOsw XPFM+0tODpDAKZ/QXQKJZHAc7k+Myt1y3Hx4XwVpMHDp2/JK71PfNmQD0G8p9qalCq8II4 +JXMWfhkDIrMPKri6GxsOVumJjxCqIogvMnBdJICXzVEoSjDkoceOUK+mvgVbEpmTe6ly9 kG65aGZezefy0frBkvE2TrxTLOQvPUN5XpAOVzSiD0hB2pTfIo9LPxOPYfOw/iPXjyBdrv LaFyAWp0y6IJu9JQkoQ0teZ7UxHXLm3aa0eWpkGgZ774mckSt+pSX4hoHS96qQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "emacs-orgmode-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="emacs-orgmode-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -3.61 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "emacs-orgmode-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="emacs-orgmode-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: 25F1C38703 X-Spam-Score: -3.61 X-Migadu-Scanner: scn0.migadu.com X-TUID: FillQ/RsY+93 I'm a happy org-mode user who usually just lurks on the list, but I have some expertise of note to share on the issue of taking donations and proprietary Javascript. I've spent much time over the last 25 years working for and/or helping to run various non-profit organizations related to FOSS. I've worked on the problem of “how do you take donations while limiting the amount of proprietary software both the donors and NPO staff have to use?” extensively. To my knowledge, the current answers to these questions are: (0) You cannot take online donations by credit/debit card or ACH without either: (a) handling PCI-compliance rules yourself, which is a high burden and out of reach for most small organizations. (I have researched this extensively, and am pretty sure that the level of self-PCI compliance that would be required for this would mean the organization would need to employ at least one person who will spend almost full-time working on PCI compliance.) (b) having the donor run some proprietary Javascript [0]. (1) It is impossible for an organization to take credit card donations without its staff sometimes using non-FOSS (usually in the form of proprietary Javascript). It's very difficult to take ACH donations of any kind without the staff occasionally using proprietary software. I'd be glad to discuss how I've come to these assessments in more detail if that's useful to the discussion. (However, I won't have time to check back into this thread until Tuesday due to a deadline.) I generally recommend PayPal to projects that want to minimize proprietary Javascript because you cn often make it all the way through a PayPal transaction (if you already have a PayPal account with a credit card attached and you're in the USA) with Javascript fully turned off. That's not saying much, but it's better than other processors. I retest that every 3-6 months; the last time I tested it was November. Comparatively, Stripe is particularly bad because they mandate that you load their proprietary Javascript on your own page (see below in footnote for more) if you want them to handle the PCI compliance. [0] Someone mentioned liberapay — but it simply uses Stripe and/or PayPal underneath for the donations. I just double checked this and noticed that the payment page has: which is what Stripe requires if you want them to handle the PCI compliance. -- bkuhn