thepsi
The fee for wildcard certs (~60USD) is a one-off to verify your identity - usually via a quick phone call to confirm details from your official documents.
Once that's complete, you can generate as many certs as you need (incl. wildcards and Subject Alternative Name) from their control panel, subject to jumping through the usual hoops to prove that you have control of each domain.
I like how the controls/movement are precise yet just forgiving enough.
Only thing, I'm not hearing any music (Chrome 11 beta, OS X).
Trivial nit: backslashes are doubled when rules are restored from the session.
If that's the case then, holes aside, it makes sense for a merchant to integrate 3DS to reduce chargebacks (not to mention some acquirers charge lower rates for VBV payments, which can help offset PSP fees). But your earlier comment suggested that you were still being stung for chargebacks - I'd be interested to know why.
(and yes, it's a lot of spec for what's essentially 3 XML request/response pairs, but that's the payments industry for you - you'll know what I mean if you've had the joy of ploughing through APACS-70 or its predecessors...)
Ignoring the flaws in most current implementations, isn't this the kind of thing 3D-Secure (VBV, SecureCode, etc.) is supposed to reduce?
Having said that, merchants at the level 2-3 size often won't have renegotiated rates agreed with their acquirer back when the merchant was smaller - doing so can soften the impact of outsourcing capture/storage considerably (perhaps even pay for it completely).
Agree that merchants should read PCI-DSS, but smaller shops may not have the expertise/time to realise/handle the implications (do you record telephone calls from customers, for instance?). For any size of merchant, to be able to say "we're unlikely to be breached as we don't store card numbers" is a good thing indeed.
Some of the sites you linked to suck for far worse reasons, anyway - why would I want to see AMPC's pricing when the homepage gives no indication of what they actually do? (something to do with postage and "exclusive industry benefits" apparently)
Given the focus on APIs I guess you're aiming it at those wanting to programmatically generate PDFs using a familiar markup, rather than conversion of existing (static) content into PDF? If so, maybe investigate the ability to overlay rendering onto an existing PDF template at some point - in my experience it's been a common requirement (think form letters, account statements, etc).
Interesting that it appears to execute Javascript; guess it's a sign of the times that you need to in order to render many sites correctly nowadays. I haven't poked it too hard, but suspect there might be one or two security challenges there...
Having taken a look now, sounds handy!
* support for alternate names (e.g. The Hague vs. Den Haag)
* some way of knowing when a city wasn't found - right now if I type the name of an unrecognised place then it isn't clear that the time displayed is no longer valid
* optional vertical layout for phones, and (to go with that) offline support? Perhaps not quite so minor, I'll admit ;)
Oh, and re. the "programmer-friendly" comment in your article - I'm one and I don't find those sites at all friendly...