←back to thread

1134 points mtlynch | 3 comments | | HN request time: 0.706s | source
Show context
voz_ ◴[] No.22937388[source]
"Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn?

Also:

`The Stripe library generates a new request like this every time a user views a new page in my app.`

In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

replies(6): >>22937492 #>>22937591 #>>22937739 #>>22937776 #>>22939820 #>>22940340 #
mtlynch ◴[] No.22937492[source]
Thanks for reading!

> "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn?

I struggled a lot with the title, as I didn't want to project intention onto Stripe.

That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic.

> In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?

replies(2): >>22937558 #>>22937916 #
1. gruez ◴[] No.22937573[source]
Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
replies(1): >>22937725 #
2. gbear605 ◴[] No.22937687[source]
Do you really know every side effect of every piece of your software stack?
3. saagarjha ◴[] No.22937725[source]
Because it's an easy position to retreat back to, even if it's not relevant.