4 ms·

"Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What

by voz_ 7y ago

"Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? Also: `The Stripe library generates a new request like this every time a user views a new page in my app.` In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

mtlynch 7y ago
Thanks for reading! > "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? I struggled a lot with the title, as I didn't want to project intention onto Stripe. That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic. > In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael? I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?
- voz_ 7y ago
  > I can't possibly know the side effects of every piece of code in my app. This is what i wrong with development today. Everyone just shoves a bunch of npm packages and libs into their bloated site and is then surprised when it behaves in ways you didnt expect? Imagine if everything was built with this level of carelessness!
  - gruez 7y ago
    Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
    - saagarjha 7y ago
      Because it's an easy position to retreat back to, even if it's not relevant.
  - gbear605 7y ago
    Do you really know every side effect of every piece of your software stack?
- 3pt14159 7y ago
  I love Stripe, but this type of feature should be made front and clear when installing it. Some people use Stripe for a very small part of a very large app. If it's an online store, then it's totally fine. If it's an app where 95% of the routes are supposed to be private then it's not ok. So I appreciate this post mtlynch.
gruez 7y ago
> "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? I fail to see how it's clickbait. "Silently" conveys to the readers that the recordings were done without the user's consent or knowledge. >In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael? Way to victim blame.
dang 7y ago
Ok, we've abandoned silence in the title above. I think that's redundant anyhow. I also took out "your". That's a standard moderation trick since second-person pronouns in titles tend also to be clickbait: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20headline%20you%20wired&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- mtlynch 7y ago
  Thanks! I'll be mindful of this in future submissions.
  - deleted 7y ago
    [deleted]
- GeorgeDoe 7y ago
  It's not redundant at all. Admit it you have updated the title because Stripe is HN's company. I don't remember anyone ever editing posts concerning Google's tracking / privacy issues, for example.
  - dang 7y ago
    We edit titles all the time, including sensational titles about Google or anything else. This is routine. You probably wouldn't remember such edits because you probably wouldn't notice them in the first place. We particularly edit titles that users have started complaining about: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20ok%20title%20above&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Experience has shown that to be the way to minimize off-topic title complaints (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20title%20fever&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). The meaning of the title in this case hasn't changed. Websites don't make noises when they record things. Edit: out of curiosity, I looked for some other cases where we took out the word 'silently'. Here are some: https://news.ycombinator.com/item?id=22678471 https://news.ycombinator.com/item?id=22678471 (changed from "~30% of Android apps silently inspect other apps installed on your smartphone") https://news.ycombinator.com/item?id=20453115 https://news.ycombinator.com/item?id=20453115 (changed from "Apple is silently updating Macs * again* to remove Zoom's insecure software") https://news.ycombinator.com/item?id=16715835 https://news.ycombinator.com/item?id=16715835 (changed from "Giraffes Silently Slip onto the Endangered Species List") People have made HN title trackers over the years. My favorite is https://hackernewstitles.netlify.app/ https://hackernewstitles.netlify.app/ (via https://news.ycombinator.com/item?id=21617016 https://news.ycombinator.com/item?id=21617016). It's not perfect because it can't distinguish what submitters did from what moderators did, doesn't know what the software changed, etc. But it gives the basic picture.
deleted 7y ago
[deleted]
domador 7y ago
The accuracy of the adverb "silently" is debatable, as are other questions that arise the practices described in the article. Here are some debate questions and the way I'd answer them: 1) Is it fair to include the word "silently" in this post's title? [I think so, especially since it's part of the original article and reflects the author's emphasis.] 2) Does the word "silently" make Stripe look sneaky and bad? [Yes.] 3) Is Stripe's level of tracking invasive? [Yes.] 4) Should Stripe have been more forthcoming about the level of tracking they practice? [Most definitely! In this age of data breaches, users-as-the-product, and sneaky, untrustworthy online companies, Stripe should DEFINITELY have been more open about this, and should let its payment-service customers know what they're signing up for, in clear terms. Fraud prevention is a desirable feature, but potential customers should also be able to weigh that against the cost of invasive tracking. Furthermore, as a payment-processing company which can make loads of money in a very straightforward way (through commissions), Stripe should be content to be just that, and should get rid of any ideas, visions, or TOS language involving payment-service-tracking-derived advertising. If Stripe wants to take the high road, they could consider adding a "no data sold to advertisers" canary in its TOS that can assure the privacy-conscious of Stripe's pure intentions--or warn them when an undesirable corporate change happens that may prompt them to look for a service more aligned with their own priorities. Personally, I'm tired of companies that want to take over the world and seek profit in every area at any cost. Sheesh!]
ric2b 7y ago
> How do you not know all the side effects you dependencies may have when before adding them? Do you? You've audited 100% of the code you use? At best you're careful when choosing your dependencies and you have a reasonable degree of trust.

by voz_ 7y ago

mtlynch 7y ago

Thanks for reading! > "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? I struggled a lot with the title, as I didn't want to project intention onto Stripe. That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic. > In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael? I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?

voz_ 7y ago
> I can't possibly know the side effects of every piece of code in my app. This is what i wrong with development today. Everyone just shoves a bunch of npm packages and libs into their bloated site and is then surprised when it behaves in ways you didnt expect? Imagine if everything was built with this level of carelessness!
- gruez 7y ago
  Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
  - saagarjha 7y ago
    Because it's an easy position to retreat back to, even if it's not relevant.
- gbear605 7y ago
  Do you really know every side effect of every piece of your software stack?
3pt14159 7y ago
I love Stripe, but this type of feature should be made front and clear when installing it. Some people use Stripe for a very small part of a very large app. If it's an online store, then it's totally fine. If it's an app where 95% of the routes are supposed to be private then it's not ok. So I appreciate this post mtlynch.

gruez 7y ago

> "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? I fail to see how it's clickbait. "Silently" conveys to the readers that the recordings were done without the user's consent or knowledge. >In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael? Way to victim blame.

dang 7y ago

Ok, we've abandoned silence in the title above. I think that's redundant anyhow. I also took out "your". That's a standard moderation trick since second-person pronouns in titles tend also to be clickbait: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20headline%20you%20wired&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

mtlynch 7y ago
Thanks! I'll be mindful of this in future submissions.
- deleted 7y ago
  [deleted]
GeorgeDoe 7y ago
It's not redundant at all. Admit it you have updated the title because Stripe is HN's company. I don't remember anyone ever editing posts concerning Google's tracking / privacy issues, for example.
- dang 7y ago
  We edit titles all the time, including sensational titles about Google or anything else. This is routine. You probably wouldn't remember such edits because you probably wouldn't notice them in the first place. We particularly edit titles that users have started complaining about: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20ok%20title%20above&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Experience has shown that to be the way to minimize off-topic title complaints (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20title%20fever&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). The meaning of the title in this case hasn't changed. Websites don't make noises when they record things. Edit: out of curiosity, I looked for some other cases where we took out the word 'silently'. Here are some: https://news.ycombinator.com/item?id=22678471 https://news.ycombinator.com/item?id=22678471 (changed from "~30% of Android apps silently inspect other apps installed on your smartphone") https://news.ycombinator.com/item?id=20453115 https://news.ycombinator.com/item?id=20453115 (changed from "Apple is silently updating Macs * again* to remove Zoom's insecure software") https://news.ycombinator.com/item?id=16715835 https://news.ycombinator.com/item?id=16715835 (changed from "Giraffes Silently Slip onto the Endangered Species List") People have made HN title trackers over the years. My favorite is https://hackernewstitles.netlify.app/ https://hackernewstitles.netlify.app/ (via https://news.ycombinator.com/item?id=21617016 https://news.ycombinator.com/item?id=21617016). It's not perfect because it can't distinguish what submitters did from what moderators did, doesn't know what the software changed, etc. But it gives the basic picture.

deleted 7y ago

[deleted]

domador 7y ago

The accuracy of the adverb "silently" is debatable, as are other questions that arise the practices described in the article. Here are some debate questions and the way I'd answer them: 1) Is it fair to include the word "silently" in this post's title? [I think so, especially since it's part of the original article and reflects the author's emphasis.] 2) Does the word "silently" make Stripe look sneaky and bad? [Yes.] 3) Is Stripe's level of tracking invasive? [Yes.] 4) Should Stripe have been more forthcoming about the level of tracking they practice? [Most definitely! In this age of data breaches, users-as-the-product, and sneaky, untrustworthy online companies, Stripe should DEFINITELY have been more open about this, and should let its payment-service customers know what they're signing up for, in clear terms. Fraud prevention is a desirable feature, but potential customers should also be able to weigh that against the cost of invasive tracking. Furthermore, as a payment-processing company which can make loads of money in a very straightforward way (through commissions), Stripe should be content to be just that, and should get rid of any ideas, visions, or TOS language involving payment-service-tracking-derived advertising. If Stripe wants to take the high road, they could consider adding a "no data sold to advertisers" canary in its TOS that can assure the privacy-conscious of Stripe's pure intentions--or warn them when an undesirable corporate change happens that may prompt them to look for a service more aligned with their own priorities. Personally, I'm tired of companies that want to take over the world and seek profit in every area at any cost. Sheesh!]

ric2b 7y ago

> How do you not know all the side effects you dependencies may have when before adding them? Do you? You've audited 100% of the code you use? At best you're careful when choosing your dependencies and you have a reasonable degree of trust.