Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.diy: open-source community edition of cal.com

github.com

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Cal.diy: open-source community edition of cal.com

#11

Post by rectang »

geoffschmidt wrote: post #3
bluehatbrit wrote: post #2

Cal.com has always had an open source community edition, I've been using it for some time. Is this just a rebrand of that line?

https://cal.com/blog/cal-com-goes-closed-source-why

I'm unpersuaded by the assertion that closing the source is an effective security bulwark.

From that page:

> Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities.

Yeah, and AI can also be pointed at closed source as soon as that source leaks. The threat has increased for both open and closed source in roughly the same amount.

In fact, open source benefits from white hat scanning for vulnerabilities, while closed source does not. So when there's a vuln in open source, there will likely be a shorter window between when it is known by attackers and when authors are alerted.

Re: Cal.diy: open-source community edition of cal.com

#13

Post by sreekanth850 »

FlamingMoe wrote: post #5

From the docs, "It is strictly recommended for personal, non-production use." Wow what a 180 from just a year ago when their blog said, "For companies that handle sensitive information, deploying open-source scheduling software on-premises can offer an extra layer of security. Unlike cloud services controlled by external vendors, on-prem installations let teams maintain full ownership of their infrastructure. " ¹ I j…

I still remember when they launched here. "Opensource Alternate to Calendly" was their post title.

Re: Cal.diy: open-source community edition of cal.com

#14

Post by fnoef »

sreekanth850 wrote: post #13
FlamingMoe wrote: post #5

From the docs, "It is strictly recommended for personal, non-production use." Wow what a 180 from just a year ago when their blog said, "For companies that handle sensitive information, deploying open-source scheduling software on-premises can offer an extra layer of security. Unlike cloud services controlled by external vendors, on-prem installations let teams maintain full ownership of their infrastructure. " ¹ I j…

I still remember when they launched here. "Opensource Alternate to Calendly" was their post title.

What do you want, it’s hard to resist VC money and “the enterprise offering”

Re: Cal.diy: open-source community edition of cal.com

#15

Post by hungryhobbit »

rectang wrote: post #11
geoffschmidt wrote: post #3

Earlier quoted context omitted.

https://cal.com/blog/cal-com-goes-closed-source-why

I'm unpersuaded by the assertion that closing the source is an effective security bulwark. From that page: > Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. Yeah, and AI can also be pointed at closed source as soon as that source leaks. The threat has increased for both open and closed source in roughly the same amount. In fact, open source benefits from white hat s…

If you believe they really did it for security, I have a very nice bridge to sell you for an extremely low price ...

Look, tech companies lie all the time to make their bad decisions sound less bad. Simple example: almost every "AI made us more efficient" announcement is really just a company making (unpopular) layoffs, but trying to brand them as being part of an "efficiency effort".

I'd bet $100 this company just wants to go closed source for business reasons, and (just like with the layoffs masquerading as "AI efficiency") AI is being used as the scapegoat.

Re: Cal.diy: open-source community edition of cal.com

#17

Post by rectang »

hungryhobbit wrote: post #15
rectang wrote: post #11

Earlier quoted context omitted.

I'm unpersuaded by the assertion that closing the source is an effective security bulwark. From that page: > Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. Yeah, and AI can also be pointed at closed source as soon as that source leaks. The threat has increased for both open and closed source in roughly the same amount. In fact, open source benefits from white hat s…

If you believe they really did it for security, I have a very nice bridge to sell you for an extremely low price ... Look, tech companies lie all the time to make their bad decisions sound less bad. Simple example: almost every "AI made us more efficient" announcement is really just a company making (unpopular) layoffs, but trying to brand them as being part of an "efficiency effort". I'd bet $100 this company just w…

Who says I believe it? ;)

I'm just choosing to focus on the substance of the argument itself, which I think is risible regardless of who makes it and why.

Re: Cal.diy: open-source community edition of cal.com

#18

Post by _ache_ »

I just installed calrs, a recent alternative to cal.diy. It absolutely rocks! The only downside is that it requires me to activate STARTTLS as force-TLS-SMTP isn't supported (I had to check the source code). It’s young, very promising, and honestly, I don't know what I could ask for more.

I also replaced Radical with rustical, and I gained free push updates.

https://cal.rs/ and https://github.com/lennart-k/rustical

And if you wanna try it out. https://cal.ache.one/u/ache

Re: Cal.diy: open-source community edition of cal.com

#19

Post by spiderfarmer »

fnoef wrote: post #14
sreekanth850 wrote: post #13

Earlier quoted context omitted.

I still remember when they launched here. "Opensource Alternate to Calendly" was their post title.

What do you want, it’s hard to resist VC money and “the enterprise offering”

That's why I'm worried about Laravel taking on a huge sum.

Re: Cal.diy: open-source community edition of cal.com

#20

Post by fencepost »

Can someone who's looked at the security of these systems give a bit more context on that?

The thing that's always concerned me with them is questions of "what level of access is required to the system(s) actually hosting my calendar data?" and "if this vendor is compromised, what level of access might an attacker in control of the vendor systems have?" Obviously this will vary by what kind of access controls backends have (e.g. M365, Google Workspace, assorted CRM systems, smaller cloud providers, self-hosted providers, etc.).

Edit: basically, with a lot of these systems, what's expected to be the authoritative data provider/storage?

Post reply on HN