←back to thread

1134 points mtlynch | 2 comments | | HN request time: 0.53s | source
Show context
voz_ ◴[] No.22937388[source]
"Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn?

Also:

`The Stripe library generates a new request like this every time a user views a new page in my app.`

In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

replies(6): >>22937492 #>>22937591 #>>22937739 #>>22937776 #>>22939820 #>>22940340 #
mtlynch ◴[] No.22937492[source]
Thanks for reading!

> "Stripe is Silently" - can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn?

I struggled a lot with the title, as I didn't want to project intention onto Stripe.

That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic.

> In "your" app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?

replies(2): >>22937558 #>>22937916 #
voz_[dead post] ◴[] No.22937558[source]
> I can't possibly know the side effects of every piece of code in my app.

This is what i wrong with development today. Everyone just shoves a bunch of npm packages and libs into their bloated site and is then surprised when it behaves in ways you didnt expect? Imagine if everything was built with this level of carelessness!

1. gruez ◴[] No.22937573[source]
Why derail this discussion into a rant about supply chain attacks in the javascript ecosystem?
replies(1): >>22937725 #
2. saagarjha ◴[] No.22937725[source]
Because it's an easy position to retreat back to, even if it's not relevant.