Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

251–260 of 337 posts

Re: Cal.com is going closed source

#251

Post by eloisant »

vlapec wrote: post #52
ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

LLMs really are stunningly good at finding vulnerabilities in code, which is why, with closed-source code, you can and probably will use them to make your code as secure as possible. But you won't keep the doors open for others to use them against it. So it is, unfortunately, understandable in a way...

LLM like humans can find vulnerabilities in black boxes. We already established 30 years ago that open source is usually more secure than closed source and that security by obscurity doesn't work.

Re: Cal.com is going closed source

#252

Post by TeMPOraL »

j45 wrote: post #160
OsrsNeedsf2P wrote: post #96

Earlier quoted context omitted.

An app like Cal.com can be vibe coded in a few evenings with a Chrome MCP server pointed to their website to figure out all the nooks and crannys. The moat of Cal.com is not the code, it's the users who don't want to migrate. The real answer is they are likely having a hard time converting people to paid plans

Coding something vs maintaining it can be quite different things.

For many use cases, maintenance doesn't matter. At this point, using LLMs to one-shot a tool/service for a single use or time-limited use case is becoming more appealing than signing up with some vendor, even for free.

Re: Cal.com is going closed source

#253

Post by TeMPOraL »

teleforce wrote: post #164
bit1993 wrote: post #101

Earlier quoted context omitted.

Called this 9 months ago https://news.ycombinator.com/item?id=44559840 "AI slop is rapidly destroying the WWW, most of the content is becoming more and more low-quality and difficult to tell if its true or hallucinated. Pre-AI web content is now more like the golden-standard in terms of correctness, browsing the Internet Archive is much better. This will only cause content to go behind pay-walls, allot of open-source…

Typical FUD. Replace AI with "open source and Linux", and "open source" with "Windows" in the statements. That's what Microsoft's PR team would have said about open source and Linux about 20 years back in the 2000s. After the unsuccessful FUD era, now Microsoft is running away with Linux by running its Windows alongside via WSL to combat MacOS Unix-like popularity, and due to Linux and open source dominance in the cl…

Even worse, in that Microsoft's FUD was mostly right. The joke about Open Source being communism played out straight - FOSS pretty much destroyed the ability to make money on software products, accelerating transition to SaaS models where you can carefully seek rent from the shelter of your secure company servers (later, cloud), and that is in large part responsible for modern surveillance economy - as it turns out, some SaaS segments decayed to "free with ads", where - much like with OSS and locally-run software - you cannot compete on price with free.

Re: Cal.com is going closed source

#255

Post by ButlerianJihad »

Nukahaha wrote: post #254

Isn't the joke that everything is open source if you can read assembly? Pretty sure someone is working on an AI that reads assembly... Not sure hiding the codebase away is a viable solution!

That may be true for software that you download and install as an app, but for SaaS, there is no need to expose the code to anyone at all. Only your API endpoints are available. You can try and "black box reverse engineer" through the client code and its API calls, but that's not the same as having the server code in hand to pick apart.

Re: Cal.com is going closed source

#256

Post by duskdozer »

theahura wrote: post #171
DrammBA wrote: post #56

Earlier quoted context omitted.

I have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.

At risk of self promotion, I think more people should adopt something like the Ship of Theseus license ( https://github.com/tilework-tech/nori-skillsets/pull/465/cha... ). It's not obvious if this will patch the clean room hole in licensing, but I'd rather see it play out in court than assume opensource is just fully dead

I like the spirit but I do find it a bit ironic to include it in a project where almost every commit is made by an LLM

Re: Cal.com is going closed source

#257

Post by haritha-j »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

I like that LLMs have basically switched to the weapons business model. Buy our LLM so that the bad guy we'll sell our LLM to doesnt destroy your code. As a bonus, we'll give you a little head start. And if you're a small company that can't afford our LLM, too bad.

Re: Cal.com is going closed source

#258

Post by il-b »

OsrsNeedsf2P wrote: post #96
DrammBA wrote: post #56

Earlier quoted context omitted.

I have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.

An app like Cal.com can be vibe coded in a few evenings with a Chrome MCP server pointed to their website to figure out all the nooks and crannys. The moat of Cal.com is not the code, it's the users who don't want to migrate. The real answer is they are likely having a hard time converting people to paid plans

> An app like Cal.com can be vibe coded in a few evenings

Do it then

Re: Cal.com is going closed source

#259

Post by jodrellblank »

mgdev wrote: post #87
cassianoleal wrote: post #83

Earlier quoted context omitted.

> I suspect we'll see more 'open spec' software, with actual source generated on-demand (or near to it) by models. Then all the security and governance will happen at the model layer. So each time you roll the dice you gamble on getting a fresh set of 0-days? I don't get why anyone would want this.

You already do this with human-authored code, just slowly. Project model capabilities out a few years. Even if you only assume linear improvement at some point your risk-adjusted outcome lines cross each other and this becomes the preferred way of authoring code - code nobody but you ever sees. Most enterprises already HATE adopting open source. They only do it because the economic benefit of free reuse has tradition…

Next, you double click the Excel icon on the desktop, and instead of having Excel installed or a spec of Excel, you have a cloud service with thirty years of Usenet, Quora, StackOverflow, Reddit, PHPBB comments and blog tutorials about how people use Excel, and you wait a few moments while approximately-Excel is rederived from these experiences.

You’ll accept the delay because by then it happens faster than Microsoft can make a splashscreen and window open from a local nvme drive. And because you can customise Excel’s feature set by simply posting a Reddit comment where you hallucinate using a feature that Excel doesn’t have and waiting a couple of days.

[although it can be difficult to find the real Reddit to post on as your web browser will tend to synthesise the experience of visiting any website using a cloud AI model of every website without connecting to the real one at all. This was widely loved as a security measure and since most websites are AI written content on AI written codebases, makes less difference than you’d first think]

Re: Cal.com is going closed source

#260

Post by egorfine »

wartywhoa23 wrote: post #225
egorfine wrote: post #142

What's preventing cal.com to run the AI researcher over their own codebase and find their vulnerabilities before anyone else and patch them all by tomorrow morning? That's right. Nothing.

Unwilling to pay AI tax, maybe?

No worries, someone else will do that for them. Just like they explained.

And given that they will not rewrite the whole codebase in the next few days it means that security vulnerabilities are still there to be discovered by someone willing to pay the AI tax.

Post reply on HN