Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependabot is joining GitHub

dependabot.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Dependabot is joining GitHub

#21

Post by xd1936 »

Kalium wrote: post #11
the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

Sure. I think what he's saying is, even if the built-in version of Dependabot is good, it's really hard for another startup to come along and make the the next Dependabot 2, that does things even better. Without that threat of competition, Github's implementation may stagnate. I haven't seen any indication of stagnation from the Github team yet though.

Re: Dependabot is joining GitHub

#23

Post by Kalium »

xd1936 wrote: post #21
Kalium wrote: post #11

Earlier quoted context omitted.

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

Sure. I think what he's saying is, even if the built-in version of Dependabot is good, it's really hard for another startup to come along and make the the next Dependabot 2, that does things even better. Without that threat of competition, Github's implementation may stagnate. I haven't seen any indication of stagnation from the Github team yet though.

I understand and agree that that is what parent is saying.

I think it might be worth considering that Dependabot outdid a Github feature to do the exact same thing. Dependabot beat out the in-house Github implementation by being better and having better features. Indeed, Dependabot integrated with Github better!

I understand the concern. There's a very real fear that having Dependabot in-house at Github might mean that something even better never develops. It's very possible that this might come true this time! But I am skeptical, given that it clearly failed to occur previously. I'm not seeing why this time around will be different, but I'm sure that's just a lack of vision on my part.

Plus, well, if Dependabot keeps away all would-be competitors by being so good at what it does that nobody can compete... I consider that a win. My main concern and primary goal is more secure software, not more startups rooted in an ecosystem around Github.

Re: Dependabot is joining GitHub

#25

Post by stephenson »

That makes so much sense! A more secure open source world, a better product for our close projects and two amazing tools merging. Love it!

Dependabot, you did well, build a fantastic tool, now join the rocketship and kick ass!

Re: Dependabot is joining GitHub

#26

Post by jen20 »

xd1936 wrote: post #21
Kalium wrote: post #11

Earlier quoted context omitted.

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

Sure. I think what he's saying is, even if the built-in version of Dependabot is good, it's really hard for another startup to come along and make the the next Dependabot 2, that does things even better. Without that threat of competition, Github's implementation may stagnate. I haven't seen any indication of stagnation from the Github team yet though.

I would argue that GitHub has appeared substantially less stagnant _since_ the acquisition than the year or so beforehand.

(Edited to correct a typo)

Re: Dependabot is joining GitHub

#28

Post by SifJar »

Kalium wrote: post #14
lasagnaphil wrote: post #13

Earlier quoted context omitted.

If you view Github as just a Git (and occasionally static site) hosting service, then there's not lock-in whatsover; you can always move to somewhere like Gitlab or host your own. But the point is: Github isn't just a Git website anymore; it creates a community around it. Right now the reason why people aren't easily moving out of Github is because by moving to somewhere else, they have to risk getting less views, le…

If you were a Sponsor in Liberapay and earning $30000 a month and then had disagreements with Liberapay's policies and want to get out, you now have to risk shaving off all your sponsors to switch to a different service like GitHub. Maybe some of your passionate existing patrons will go towards the extra effort to switch alongside you, but the reality is: most won't. This isn't an argument against GitHub or LiberaPay…

Possibly a slight difference though in that GitHub isn't _just_ a financial intermediary; with all the other functionality on offer, it may be a lot easier to find something to disagree with/dislike

Re: Dependabot is joining GitHub

#29

Post by agnokapathetic »

jen20 wrote: post #26
xd1936 wrote: post #21

Earlier quoted context omitted.

Sure. I think what he's saying is, even if the built-in version of Dependabot is good, it's really hard for another startup to come along and make the the next Dependabot 2, that does things even better. Without that threat of competition, Github's implementation may stagnate. I haven't seen any indication of stagnation from the Github team yet though.

I would argue that GitHub has appeared substantially less stagnant _since_ the acquisition than the year or so beforehand. (Edited to correct a typo)

Yes. They were about to have their enterprise lunch eaten by GitLab
Post reply on HN