Hacker News Reader

Comment by mrchess | Hacker News Reader

Out of the box Rails solutions with integrated payment systems scares me as it allows people with little Rails experience to quickly allow payments.

I'd parallel my concern to beginner developers who create Rails projects that don't check for User ownership when navigating to /edit paths.

Implementing Stripe is almost a small rite of passage. It forces you to understand the API, and how it treats payments and other various objects.

View on HN

It is VERY easy for a novice Rails developer to critically fail at that implementation, though. All you have to do is put a name attribute on the credit card or CVV text field. That seems logical, will not cause any visible problems, and immediately both compromises customer security and introduces substantial business risk due to putting you in PCI scope (and you just failed).

Next to this, the marginal hazing value of forcing them to write 20 lines from scratch seems muted.

What you raise is a valid concern, but is it better for a new developer to work off a best practice style example app or try to reinvent the wheel on their own?

I agree. I know a lot of developers that will benefit having a good example to work from.

No doubt I agree as well. Best way to learn is by imitation. But yeah, it is just a concern, that's all.

A new developer by definition doesn't know what best practices are, so they can't judge whether the example app they're working off of is safe or not. By way of a too-abstract analogy, learning multiplication tables is not reinventing the wheel.

I share your point of view. In this case, the code is much more of a "starter app" than an "out of the box" solution. There's a good amount of customizing and tweaking required before the app can be deployed, which will encourage an inexperienced developer to gain some skill. The tutorial helps; it's probably the most detailed introduction to the implementation issues of a membership site and Stripe that is offered anywhere. The intent is to be a mentor for the "rite of passage."

If you browse through the models, there's actually nothing like a Purchase model. Devs using this library will still have to integrate Stripe

It's an application (example app or starter app), not a library. Stripe is integrated to the extent that you can set up a real subscription-based site with recurring billing. Yes, there's no Purchase model, but you'll find the integration code in JavaScript and the User model's methods. Certainly it could be refactored if you'd like to see a Purchase model but the integration is already there. The tutorial describes the architecture and implementation with much detail.

Reply on news.ycombinator.com