S1E25 — Dependabot version updates introduce default package cooldown

GARY: — and that's the thing nobody tells you about karma, it's not even real, it's just, it's a number, it's a fake internet number, and yet I would trade my left kidney for four thousand of them, which, by the way, is not a stat I have, I don't have a kidney number for this, forget I said kidney—

OBI: Gary. Mic's hot.

GARY: It's always hot, Obi, that's the — okay. Okay. We're doing this. Hi. I'm Gary. I founded a company that turned four thousand years of metallurgy into a PowerPoint deck and then into nothing.

MAEVE: Maeve. General partner. I passed on Gary's Series C, and I would do it again, correctly, every single time.

GARY: You don't have to say that every week.

MAEVE: I do, actually. It's in my LP letter.

OBI: Obi. Fifteen years keeping other people's shit online so they can go on stage and say "we." Nobody's paged me tonight yet, so we've got that.

GRUNER: Gruner.

GRUNER: Field notes say humans invented lock file. Then invented reason to ignore lock file. Fascinating species.

MAEVE: He's not wrong.

OBI: Tonight's thread. Hacker News, forty-eight thousand and change, id 48913050. Title's dry as hell — "Dependabot version updates introduce default package cooldown." Sixty-eight comments. We're doing the good ones.

GARY: Cooldown. Like — like a nightclub thing? Like a bouncer thing?

OBI: Sort of. Keep going, you're already wrong, it's charming.

OBI: Here. Dependabot — GitHub's little robot that opens pull requests to bump your dependencies for you — now defaults to a cooldown. A delay before it'll actually pull in a brand new package version. It doesn't grab the thing the second it's published anymore. It waits.

GARY: Waits for what, a text back?

OBI: Waits, Gary. Just waits. Gives the ecosystem a few days to notice if the new version's radioactive garbage before your CI robot marries it.

MAEVE: Thesis: we built a machine to move faster than trust could travel, and the fix for the machine is a timer. That's the whole industry in one sentence. Fourteen years of "ship it" arriving, breathless, at "actually, let's wait a little."

GARY: Right, right, no, that tracks, that's — I read about this actually, this is the thing where Dependabot got acquired by npm, correct?

OBI: No.

GARY: GitHub owns npm though.

OBI: GitHub owns npm. Dependabot's a GitHub thing. Nobody got acquired tonight, Gary, put the business voice away.

GARY: I'm just saying I know things.

OBI: You know adjacent things. It's your whole personality.

OBI: Top comment. insanitybit. And I'm reading this one exactly as written, because it deserves that. Quote: "What a state of things where we have to fear installing software, and rely on vendors to scan things ahead of time, because our supply chain is such a mess and our tooling is so incapable of — and uninterested in — protecting us." End quote.

OBI: Incapable of. And uninterested in. Fifteen years, that's the whole pager. That's every 3 a.m. text I've ever gotten summarized by a stranger on the internet in one sentence, for free, no equity.

GARY: I mean — to be fair to the ecosystem —

OBI: Do not defend the ecosystem to me.

GARY: I'm just saying somebody built the tooling, somebody's trying —

OBI: Nobody built you a fucking safety net either, Gary, and you still jump off buildings for a living. "Incapable of and uninterested in" isn't an insult, man, it's a job description, and you know whose desk it lands on at 3 a.m.? Not the founder's. Never the founder's.

GARY: That's — yeah. No, that's fair. That's very fair, actually.

MAEVE: It's the thread's whole spine, though — is that apathy, or is it just an actually impossible problem? Nobody down there answers it. I'm not going to insult the room by pretending we will either.

OBI: Good. Keep going.

OBI: Reply, from sunaookami, and it's a shiv: "No way to prevent this says only package manager where this regularly happens." That's a diss track, that's a whole diss track in one sentence.

MAEVE: Sub-tweeting an entire ecosystem in eleven words. Respect the compression.

GARY: So npm's just — uniquely cursed? That's rough, that's really rough for them specifically —

OBI: Insanitybit's not having it. Comes back with — I'm reading this one too — "Every major package manager is just as fucked."

MAEVE: Mic drop. Diversified risk. Every portfolio company is on fire, it's just a question of which fire you're standing closest to.

GARY: — which honestly, statistically, is basically —

GARY: — basically everyone's problem, is my point, nobody's special, we're all drowning in the same lake —

OBI: Cable again.

GARY: The cable is fine.

GRUNER: Field note. Human calls this "vertical." Is not vertical. Is everyone, on fire, at different altitude.

MAEVE: That's — I want to build a taxonomy of this. There's ecosystem-level risk and there's package-level risk and I think what we're actually litigating here is a category error dressed up as —

OBI: Maeve, nobody asked for a taxonomy.

MAEVE: Nobody ever asks for the taxonomy. That's why the taxonomy's necessary.

GARY: Can we just — is it one ecosystem's fault or is it everyone's fault, that's all I—

OBI: It's not about fault, it's about who eats the outage.

GARY: Fine. Fine! Everyone's fucked equally, got it, moving on, this is very healthy for me personally—

OBI: Reply further down, from Insimwytim, and this one's the real one. Quote: "You cannot call it a supply chain, if you have zero contractual relationships with the authors of the solutions you are using." Links back to some other thread from July, same argument, older scar.

GARY: No contract.

OBI: No contract.

GARY: I gave away my first ORM wrapper for free. Before Bauxlite. Three hundred people depended on it for two years, one of them ran a payroll system on it, and when it broke at 2 a.m. on a Friday I fixed it because I felt guilty, not because anybody owed me a call, or a check, or a — anything. Nobody signs anything. You just wake up responsible.

OBI: Yeah.

OBI: That's the job I've been doing free since 2011 for men who call it "the community" right up until it's time to name who's in the will.

GRUNER: Is not supply chain. Is arranged marriage. Nobody proposed. Everybody show up anyway.

MAEVE: That's — huh.

GARY: Yeah.

OBI: Reply chain police itself a little after that — cryo32, flat as hell: "Oh that one really makes you think doesn't it." And stingraycharles backs it up, says arguing over whether "supply" implies "compensation" isn't interesting, the real point stands regardless what you call it.

MAEVE: The thread correcting its own tangent. Rare. Beautiful. We're not going to respect it.

GARY: We never respect it.

MAEVE: Because here's the actual arc, if you zoom out — and I mean all the way out — this is the printing press. Before Gutenberg, information had a chain of custody. A scribe, a patron, a name on the colophon. Movable type severs that. Suddenly anyone can copy anything and nobody's accountable for what gets copied, and four hundred years later we're surprised that open source has the exact same defect at the exact same layer, except now the printing press runs itself, forks itself, and updates itself in your CI pipeline at two in the morning while you're asleep —

OBI: ...what?

GARY: I don't — what?

MAEVE: I said what I said.

OBI: No, say it again, I want to hear it lose more coherence the second time.

MAEVE: I'm not repeating myself for your comfort.

MAEVE: Cooldown's a timer, though. Not trust. A timer just tells you a version's been sitting there a few days without exploding yet. That's not the same as somebody standing behind it.

OBI: No. It's a smoke detector, not a fire marshal.

GARY: So we still don't actually know if it's — apathy, or if it's just genuinely impossible to fix.

OBI: No. We don't. And I'm not going to pretend I do just because it's the last segment.

MAEVE: Good. Leave it open. It's more useful broken.

GARY: insanitybit's got, what, karma in the thousands off one paragraph. I built a company for four years and I've got a dead pen plotter and a Series C nobody funded.

MAEVE: Correctly.

GARY: Correctly. Sure. I just — I liked being someone who shipped something once. Even if it was aluminum. Even if it was doomed from the pitch deck.

OBI: You shipped something free too, Gary. Same as every handle in that thread. Doesn't make you special. Makes you one of them.

GARY: That's the nicest thing you've said to me all show.

OBI: Don't get used to it.

GRUNER: Report will say: humans build machine to skip trust. Machine works too well. Now building second machine to put trust back. Second machine is timer. Humans call this progress.

MAEVE: No contract, no chain, just a bunch of people who never met each other, all mad about the same three days.

GARY: That's — yeah. That's the show. That's tonight.

OBI: That's tonight.