sorbet VS stripe-js

Not part of the official language spec, but Ruby has Sorbet, from a company who employs Ruby core contributors and helped with the recently released JIT additions to the language, amount countless other contributions over the last couple decades.

https://sorbet.org/

First let's introduce the tool: Sorbet is a gem developed by Stripe that aims to bring type notation syntax and type checking support for the Ruby ecosystem by utilizing the "Gradual typing" philosophy, it also provide type generation from YARD comments via the tapioca gem, allowing to grow alongside the already built Ruby codebase.

We have hundreds of thousands of lines of ruby code spanning many services / monoliths. Even now I find it somewhat annoying to open a controller / component that is basically an empty class def but somehow executes a bunch of complex stuff via mixins, monkey patches etc, and you have to figure out how.

We are turning to https://sorbet.org/ to reign in the madness. I'm keen to know if others are doing the same, and how they are finding it (pros and cons)

According to https://sorbet.org/ , the vast majority of code at Stripe is written in ruby.

Caso de Stripe, que tuvo que inventar Sorbet para tener type checking en ruby.

> I guess what I'm asking is: do you see a future where there is more explicit control afforded to people who want to pick their own tradeoffs without resorting to writing everything performance-sensitive in extensions written in C/Rust/whatever?

An approach exists already in the present, and it's Stripe's Sorbet AOT compiler (https://github.com/sorbet/sorbet/tree/master/compiler).

That's incorrect. You may be thinking of Stripe, and AFAICT it's not very actively developed anymore: https://github.com/sorbet/sorbet/commits/master/compiler

At ReadMe, we’re constantly keeping an eye on the best DX out there, and we’ve come to notice a trend. Many of the top API-first companies out there offer their own custom SDKs, such as Stripe, Twilio, and Plaid (and I’m only linking to their JavaScript SDKs!).

Due to PCI compliance requirements, the Stripe.js library has to be loaded from Stripe's servers. This creates a challenge when working with server-side rendered apps, as the window object is not available on the server. To help us manage that complexity, Stripe provides a loading wrapper that allows importing Stripe.js like an ES module:

This approach was no different when I started thinking about the SprintDock website (a working title) and backend infrastructure needed for the first time back in April 2021, when I was still working full-time. This was until I started playing around with Stripe JS.

Stripe.js should not require React to run - I wouldn't recommend using React unless you want it for some other reason. Maybe check out the docs here for how to get started? https://stripe.com/docs/js

Implement Stripe JS to collect card details and convert to token on the frontend

That’s all for this tutorial. Hopefully it has given you an understanding of how to process Stripe payments in a Node.js application. There are many more configurable options available not used in this tutorial. To discover all these options the offical Stripe.js documentation is an excellent resource.

Thank you to our top open-source contributors this month: marcoscannabrava, viablecell (stripe-js), williammartin (stripe-node), jmarkowski, kronthto, hibariya (stripe-samples), alihussain5, Morriar, tophattom, richardxia, RyanBrushett, karmakaze, alexdunae, Bo98, kddeisz (sorbet).

For a payment gateway, you should check out Stripe. You can use their JavaScript SDK which allows you to take payment (https://stripe.com/docs/js). A competent developer with experience in these SDKs could wire up a payment gateway anywhere between a day and a couple of days.

https://github.com/stripe/stripe-js strikes perhaps the most realistic balance possible, recognizing that NPM is an insecure place for their core JS logic that creates a PCI compliant iFrame, and so their NPM package is just a loader for a script tag hosted securely. And yet they encourage people to use NPM for the wrapper itself. Which is just as vulnerable to supply chain attacks as anything else on NPM. If this isn't tacit acknowledgement of a "new standard" I don't know what is. I absolutely agree that it's problematic.