4 ms·

Thanks for reading! > "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to mak

Thanks for reading! > "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn? I struggled a lot with the title, as I didn't want to project intention onto Stripe. That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic. > In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael? I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?

voz_ 7y ago
> I can't possibly know the side effects of every piece of code in my app. This is what i wrong with development today. Everyone just shoves a bunch of npm packages and libs into their bloated site and is then surprised when it behaves in ways you didnt expect? Imagine if everything was built with this level of carelessness!
- gruez 7y ago
  Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
  - saagarjha 7y ago
    Because it's an easy position to retreat back to, even if it's not relevant.
- gbear605 7y ago
  Do you really know every side effect of every piece of your software stack?
3pt14159 7y ago
I love Stripe, but this type of feature should be made front and clear when installing it. Some people use Stripe for a very small part of a very large app. If it's an online store, then it's totally fine. If it's an app where 95% of the routes are supposed to be private then it's not ok. So I appreciate this post mtlynch.

voz_ 7y ago

> I can't possibly know the side effects of every piece of code in my app. This is what i wrong with development today. Everyone just shoves a bunch of npm packages and libs into their bloated site and is then surprised when it behaves in ways you didnt expect? Imagine if everything was built with this level of carelessness!

gruez 7y ago
Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
- saagarjha 7y ago
  Because it's an easy position to retreat back to, even if it's not relevant.
gbear605 7y ago
Do you really know every side effect of every piece of your software stack?

3pt14159 7y ago

I love Stripe, but this type of feature should be made front and clear when installing it. Some people use Stripe for a very small part of a very large app. If it's an online store, then it's totally fine. If it's an app where 95% of the routes are supposed to be private then it's not ok. So I appreciate this post mtlynch.