greysteil

You should just do it - if it's a mistake, it will be really easy to fix.

Can't speak for Sweden, but in London I'm not aware of any stigma around living on boats. A friend of mine at McKinsey, a big management consultancy firm that's as corporate as they come, lived on one and regularly invited colleagues over.

Thanks Paul, big fan of CircleCI.

Great link, and I totally agree with that lesson. Side project feels like a good way to have learnt it!

Thanks!

Adding new languages is as easy as the package manager makes it... which is normally still quite hard! The core logic for Dependabot is open-source here, including all the language-specific logic for Ruby, JS and PHP, and a starter (lots of work still required) for Python: https://github.com/gocardless/bump-core.

For the app itself, we used Ruby (because we'd built the original core gem, which was https://github.com/gocardless/bump, in Ruby at a work hackathon years ago).

Costs under £50 a month to keep running at the moment, creating about 2,000 PRs a month. We could really do with getting it into the GitHub marketplace so we can start charging people and cover those costs!

Thanks for the advice! Security is definitely a big angle here - not only do dependency updates often include patches for known vulnerabilities, they're also the least likely to be affected by future vulnerabilities.

We wrote a blog post about it here: https://dependabot.com/blog/the-latest-dependency-version-is...

I built Dependabot (https://dependabot.com), a service that checks your dependencies are up-to-date every morning and creates pull requests for you if they're not. Intention was to make dependency management suck less, whilst also adding a bit of runway to a bigger startup I wanted to do.

* Spent 2 months building it - much longer than I'd thought. The work required to get from a prototype (2 days) to a SaaS product (2 months) was way bigger that I'd thought. So much polish, and so many edge cases to consider when the client goes from "you" to "anyone else". Lesson: building something for other people takes a lot longer than building something for yourself.

* Tried to launch on Hacker News but failed to get any attention. Our blog post on "10 years of Rubysec data analysed" never made it off the "newest" page, despite being pretty solid content (spent two days building a Jupyter Notebook so anyone could replicate our results, etc.). Was a big psychological hit at the time. Lesson: there's lots of randomness in launches - don't rely on them to much.

* Thought GitHub Marketplace would list us and help with distribution, but it's been extremely hard to persuade them to. The jury is still out on this one, but they (understandably) want us to have lots of users before they invest in even assessing the app. Lesson: don't rely on the goodwill of third parties - unless you've got something they want/need, you'll be stumped if they decide they're not interested.

I haven't given up yet, and I still really believe in the product, but it's been a much harder journey than expected! Marketing has been by far the toughest part, and I don't have a solution to it yet.

Awesome, looking forward to it, and nice work on PyUp!

Agreed. Would be interested to hear what happens when you filter for projects that have had any activity in the last month (say).

Jay (at PyUp) - any idea?

Hey, Grey from Dependabot here. Happy to answer any questions people have about the data or the analysis we've done.

You can use Lob in the UK. We (GoCardless) do, and have had a good experience.

Great idea - I wish this existed for Ruby gems. Currently we use Gemnasium to keep track of our dependencies and have a manual process to:

- check Gemnasium

- bump the gem locally and push to branch to GitHub

- find the changelog for the change (or a diff link) and paste create a PR with that as the description

- merge and deploy if our test pass and the changelog looks OK

Everything except the final step should definitely be automated. I can totally see how doing the same across many repos and sharing aggregated information could make the final step a lot easier, too.

Psyched to see you guys expand.

I always recommend https://www.siliconmilkroundabout.com for a pretty good list of London startups.

Nice. You're missing a couple of our (GoCardless's) open opportunities though - I'll ping you an email.