Dependabot is joining GitHub • Hacker News Board

Re: Dependabot is joining GitHub

#41

Post by skybrian » Thu, May 23, 2019, 5:49 PM UTC

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

This is a special case of the general trend that increasing quality is a barrier to entry. Even with a bit of competition, it's just harder to compete as complexity goes up and users have higher expectations. For example see the top-selling movies or games.

Open source code somewhat mitigates this: Apple forked KHTML, then Google forked WebKit, and now Microsoft is building on and may someday fork Chromium. But it remains the case that some projects are very hard to do from scratch with professional quality, and even maintaining a fork requires a lot of expertise.

Also, sometimes you can reverse the aesthetic so that some people prefer stuff that's not professional quality, so you get an "indy" market.

Re: Dependabot is joining GitHub

#42

Post by craftyguy » Thu, May 23, 2019, 5:50 PM UTC

stephenson wrote: post #25

That makes so much sense! A more secure open source world, a better product for our close projects and two amazing tools merging. Love it! Dependabot, you did well, build a fantastic tool, now join the rocketship and kick ass!

> A more secure open source world

A world built on proprietary services is not an open source world.

Re: Dependabot is joining GitHub

#43

Post by Guillaume86 » Thu, May 23, 2019, 8:09 PM UTC

polskibus wrote: post #37

hanniabu wrote: post #8

Earlier quoted context omitted.

> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization. There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.

It disincentivizes GitHub from maintaining feature parity of the API for integrators with what is available through UI.

Yes, if they announce the new "integrated" dependabot version will continue to only use public APIs, that would be a major positive statement about the "openness" of Microsoft GitHub. Otherwise buying major tools and integrate them looks scary.

Re: Dependabot is joining GitHub

#44

Post by anoncake » Thu, May 23, 2019, 8:28 PM UTC

ljm wrote: post #36

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

They might see GitLab as a threat (GitLab itself aims to be an all-in-one platform) and are taking steps to up their game.

So instead of having the choice between a neutral platform and an all-in-one solution, we get two all-in-one solutions cloning each other.

There's a name for this kind of market failure, but I can't remember it.

Re: Dependabot is joining GitHub

#45

Post by anoncake » Thu, May 23, 2019, 9:06 PM UTC

ralphstodomingo wrote: post #20

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

For some reason centralization is such a loaded term these days, and I wonder why. There are things that centralization deals with that decentralized, open solutions seem to neglect. For example, pushing GitHub to become an all-in-one platform reduces fatigue of having to learn multiple, independent third-party apps/platforms. Not everyone wants nor knows how to write glue/infra code, time is essential and there are…

Centralizing to Github means giving them a monopoly. Privately owned monopolies are a horrible idea.

Re: Dependabot is joining GitHub

#46

Post by drusepth » Sun, May 26, 2019, 10:05 PM UTC

xd1936 wrote: post #21

Kalium wrote: post #11

Earlier quoted context omitted.

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

Sure. I think what he's saying is, even if the built-in version of Dependabot is good, it's really hard for another startup to come along and make the the next Dependabot 2, that does things even better. Without that threat of competition, Github's implementation may stagnate. I haven't seen any indication of stagnation from the Github team yet though.

Wouldn't that stagnation be exactly what prompts another startup to come along and make the next Dependabot 2?

Re: Dependabot is joining GitHub

#47

Post by jrochkind1 » Mon, May 27, 2019, 12:41 AM UTC

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

> Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" dev tool and platform.

I think some of those trying to compete with Github were already trying to compete by providing better 'native' integrations. Say, Gitlab and CI. You can use other CI with Gitlab and Gitlab CI with things other than Gitlab, but it's meant to be a "don't have to decide just works" integration. Gitlab in general seems to be trying to compete by being much more "all in one".

So it's not shocking to see Github trying to stay on top of things by doing similar.

In both cases, there may be something 'natural' about this means of trying to get customers, some reason that many companies begin with "APIs to get third-parties to give our users good tools" and move towards "all in one" -- as the market matures, I think both for the current market leader and challengers. I agree it has some downsides (as well as upsides) for customers, but it seems to be not unique to github.