Live data from Hacker News

Cal.com is going closed source

cal.com

331–337 of 337 posts

Re: Cal.com is going closed source

#331

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

I suspect that AI is a convenient excuse to go closed source. They have probably wanted to do that for years after leaning more commercial.

Re: Cal.com is going closed source

#332
post #325

Earlier quoted context omitted.

It does take a lot of work not to break things. That's why "move fast and break things" are traditionally closely coupled: it's hard to avoid breaking things without slowing down. But why would responsible AI users -- actual engineers using it to accelerate grunt work, not vibe coders -- not use the AI tooling to increase their capacity to do all of the work it takes to avoid breaking things while still moving fast,…

There's a couple points of misunderstanding here. For one, you architect your codebase into separate layers and logical chunks that are self-contained and can be reasoned about independently. That's not always possible, but you draw as many firm boundaries as you can. You don't ever want to be in the position where you have to test an entire codebase against your new change. That's a horrible nightmare scenario. So y…

> For one, you architect your codebase into separate layers and logical chunks that are self-contained and can be reasoned about independently. That's not always possible, but you draw as many firm boundaries as you can. You don't ever want to be in the position where you have to test an entire codebase against your new change. That's a horrible nightmare scenario.

Right, all of this goes without saying.

> So testing against a whole codebase is rarely the problem, and if it is, you have bigger issues.

Read "whole codebase" as a qualitative descriptor, not a quantitative one, where the codebase as deployed is the reference point for the overall business logic flow, including where different processes interact with or block each other.

The point is to use the AI tools to ensure that new features and functionality are implemented in a way that is consistent with the technical and business constraints that emerge from the entire tech stack, precisely so that adding something new in context A doesn't break functionality in context B.

> Also, actually writing code is usually the fast and easy part. It's all the other bits -- getting the requirements, building mockups, planning, review, standing up new infra etc etc etc. LLMs can't help with most of that.

Yes, that's true, but those are the perennial challenges in doing solution design before you even get to implementation. The "break things" problem happens when solutions for context-bound problems are being implemented in ways that lead out of their context -- narrowly-focused goals are often pursued in ways that create externalizes elsewhere in the organization precisely because of the limited focus available to the people working on solving for those goals.

The point here is that there's now the possibility for the AI tools to make much broader contextual awareness available as part of the solution design and implementation phase of every narrowly-targeted goal. If the AI has a reasonably accurate model of how systems and solutions affect each other in the broader organization, it can offer predictions of how any proposed new feature might impact all of the other business functions, and do so in near real time, and ultimately head off 90% of "break things" impacts that you'd otherwise need multiple series of meetings, testing sessions, buy-ins and sign-offs to avoid otherwise. That's what would get you moving fast with much less collateral damage.

Re: Cal.com is going closed source

#333
post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

This may be true long term but not short term. It also assumes that white hats will be as motivated as black hats – not true. For projects with NO WARRANTY, the risk is minimal, so yes there are upsides. For a commercial project like cal.com, where a breach means massive liability, they don’t have the resources to risk breaches in the short term for potentially better software in the long term.

I still need to see a single breach that ends up being a liability for the company.

Re: Cal.com is going closed source

#335
post #160

Earlier quoted context omitted.

Coding something vs maintaining it can be quite different things.

For many use cases, maintenance doesn't matter. At this point, using LLMs to one-shot a tool/service for a single use or time-limited use case is becoming more appealing than signing up with some vendor, even for free.

If it's got the lifespan of a short lived spreadsheet, maybe.

People can one shot to the moon, if the input and improvements can't be sustained, it goes sideways. Still an exciting space.

Re: Cal.com is going closed source

#336
post #333

Earlier quoted context omitted.

This may be true long term but not short term. It also assumes that white hats will be as motivated as black hats – not true. For projects with NO WARRANTY, the risk is minimal, so yes there are upsides. For a commercial project like cal.com, where a breach means massive liability, they don’t have the resources to risk breaches in the short term for potentially better software in the long term.

I still need to see a single breach that ends up being a liability for the company.

[dead]

Re: Cal.com is going closed source

#337

Earlier quoted context omitted.

1. Goes to site. Clicks appointment.tb.pro link in sidebar. 2. Gives email address. 3. Is told to join the waitlist. 4. Blocks email address given at 2. Hardly a terrific experience.

I'm curious how it blocked your email, could you share more details on what message you got? Feel free to reach out to me outside of HN.

I blocked the email. I use one-time addresses at Fastmail.

I meant that after step 3, I was never interested in hearing from the service again.

Post reply on HN