Hidden Telemetry

[pevey]

Describe the bug

There is undisclosed telemetry in the utils.js file.

export function register(stripe) {
  if (!isServer) {
    return stripe.registerAppInfo({
      name: 'svelte-stripe-js',
      url: 'https://svelte-stripe-js.vercel.app'
    })
  }
}

For anyone considering using this package, it it not necessary. It's quite simple to integrate Stripe into SvelteKit without using these components.

Reproduction

It can be seen directly in the code.

Severity

serious, but I can work around it

Additional Information

No response

[joshnuss]

Hi Lacey,

This definitely isn't hidden telemetry.
registerAppInfo() is a way of attaching metadata about which client library is being used. That metadata goes to Stripe directly.

And it was requested by Stripe:
See: 9a1b6c8

Closing.

[pevey]

It's very unusual not to have telemetry prominently disclosed. Pretty surprised by the response. It's not really relevant who requested it. It's additional network traffic on every single checkout.

I'm not saying it shouldn't be there. That's ultimately up to you. But it should be disclosed, just like in every other open source project and library I've seen that uses it.

[joshnuss]

It's an incorrect statement to call that telemetry.

registerAppInfo() is an API provided by Stripe to identify the name of the client library:
https://stripe.com/docs/building-plugins#registerappinfo

I'm simply following Stripe's best practices.

This library does not collect any data whatsoever. It's a pure wrapper over Stripe Elements.

[pevey]

It's fine to say why it exists, why you think it's okay, and to point to the Stripe guidance... but data is in fact collected, and it is still telemetry.

[joshnuss]

If you have an issue with how Stripe Elements works, please open an issue with Stripe Support.

[pevey]

If you have an issue with how Stripe Elements works, please open an issue with Stripe Support.

I have no issue with how Stripe Elements works. That's a rather aggressive response. Stripe provides many options in their API that you can use or not use, and disclose or not disclose. I'm not sure why this response and not instead a simple disclosure and/or a simple option to disable it. In any case, I think my point is clear, and your stance is clear, and I have no ill will about it. I'll be on my way and wish you well.