Create New Stripe Invoice with Invoice.new | Hacker News Reader

Create New Stripe Invoice with Invoice.new

invoice.new

46 pointszuhayeer24 comments

This feels so wrong (and the fact that Google has been doing it for some time makes it feel even more wrong): this kind of address doesn't show explicitly which service is targeted, so it's a great target for phishing and completely fails all the prevention we have been doing. Also, the domain could change hands and provide a different service. Finally, it makes it look like it's a "service" (people will ask, is it provided by the browser?) but it's actually just a marketing trick, because someone paid some money to have it.

Instead of making the internet a better place, this makes it an even more awkward place for us tech and an even more dangerous place for every normal user.

This TLD is run by Google, and is explicitly marketed as "shortcuts to your favorite actions on the websites you love"

Here's a list of all the current shortcuts: https://whats.new/shortcuts/

> "shortcuts to your favorite actions on the websites you love"

You can't make this stuff up

It just seems stupid to me, or maybe I just don't get it. If I need to create a github repo should I then remember this extremely special "shortcut" rather than just clicking "new repo" in the github UI?

I just have a bookmarks menu on the bookmarks bar for frequent actions. That, incidentally also means I get straight to e.g. the correct Google account (I have a work one, one for my personal company, and a private one, and I have menus for each of them)

Disclosure: I work at google and was vaguely involved in one tiny sliver of this.

Some of the .new urls are more useful than others, imo. I think the GitHub example feels thin to me, as creating a repo is a relatively infrequent action.

But I use docs.new and sheets.new daily, to throw together notes for a meeting, or because I want to model something - usually for scratchpad use cases. It’s the fastest way to get right into an editor, and then I decide later if I want to save it to someplace to organize it.

The problem with some of the journey-oriented flows like reservation.new is that it doesn’t give me a chance to enter any parameters, and so it saves me a touch of effort but I still have to go tweak the time and party size, etc.

I don't love Stripe and creating invoices is not my favourite action. This is false advertising.

DNS shouldn't be responsible for this.

Also, why can't we just have new.docs.google instead?

There should be a web API that lets you register typing-based shortcuts.

It just cements the idea among consumers that there is only one service, where they can't even name one alternative.

That's likely the point.

Years of education about phishing are canceled with these fancy *.new domains.

this is an interesting experiment in "web ui". If you can do common business operations by invoking CLI-esque or programming-esque commands into your address bar, I'd say Stripe's mission of "raising the GDP of the internet" is pretty damn near. Imagine:

- business.new (create a US-based C or S corp)

- equity.plan.new (create an equity plan for above corp)

- employment.contract.new (get your first hires on above corp)

or, if you want to dive more into the product-y world:

- api.new (create a new API backed by the serverless provider of your choice)

- saas.new (create a new saas with a landing page and default layout, maybe backed by a low-code platform like Bubble)

Essentially, turn the URL bar into a general "command bar for productivity on the web".

docs.new creates a new google document

I think it's a terrible idea, which works against small startups who can't afford these high value domain names.

It's been around for years, most famously Google's docs.new, sheets.new etc.

Even it it's been around for years it will never get some actual use and will remain a marketing gimmick.

You can achieve the same thing with a hosts file. If your users use remote VPN and your local DNS anyway, just redirect it internally and block off the true destinations of the TLDs.

Not sure it amounts to much though. But looks great in a meeting with suits.

Those small startups are Google's competition.

Along with repo.new to create a new GitHub repository.

Or just stripe.new/action and not having to pollute the domain space with a huge range of names.

Requires a login to read. What exactly is newsworthy about this ?

There is nothing to read, it's a shortcut to creating a new invoice with stripe invoice. (To create a stripe invoice, you have to login into stripe.)

Kinda funny that this was submitted with an http: URL, given that .new is one of the very few HTTPS-only TLDs. (That is, the whole TLD it’s on the HSTS preload list.)

.new is altogether a weird TLD experiment. Over $400 per year, and you can basically only use it as a short URL to somewhere on your own site that creates something. (See the rules at https://www.registry.google/policies/registration/new/.) If you don’t think https://dashboard.stripe.com/invoices/create is nice enough (that being what https://invoice.new redirects to), why not instead do something like https://stripe.com/new/invoice? It’s cheaper, probably requires less maintenance, and is a URL that I can be confident about, because it’s on stripe.com rather than “invoice.new” which could be considered an untrustworthy domain.

When I say untrustworthy: how can you tell whether invoice.new is controlled by Stripe? The only two possibilities I can think of are whois records and name servers. Whois is unsurprisingly completely useless here (it’s all “REDACTED FOR PRIVACY”). Name servers are of the form ns-*.awsdns-*.* which I presume is AWS. I’m not familiar with what AWS DNS servers are, but it’s the same set of four as stripe.com, which is a good sign. So I’m going to assume that yes, this is run by Stripe. But a phishing attack is quite plausible: someone registers invoice.new, making it redirect to Stripe, socially engineers a lowly employee they have connections with into making mention of it in docs or product or something, increasing in scale over time until it’s common knowledge and thought to be official by employees and public alike (still trying to sneak under the radar a bit to avoid notice by someone who actually controls Stripe’s domains); and then finally, stop redirecting and start serving a counterfeit login page.

(On the HTTP point, there are typically 0–2 http: links on the HN front page out of 30, with old things overrepresented. Plus the Legal and Apply to YC links in the footer are http: but should be https:. On the topic of unwisely-http: links, it’s very common in marketing/transactional emails, which is sometimes concerning when you have sensitive information and potentially auth tokens in the URLs. I notice these things because I have Firefox’s HTTPS-only mode enabled and a user stylesheet via Stylus, `:link[href^="http:"]::after { content: " [http]"; color: red; text-decoration: none; }`, because I’m curious.)

I didn't think it's controlled by Stripe, I thought it's some micro-SaaS. Not a bad thing. Now I know that it's Stripe after trying to open it.

Request for a product: Place where to see who owned the dot new domain.

Reply on news.ycombinator.com