Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

111–120 of 337 posts

Re: Cal.com is going closed source

#111

Post by johnfn »

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

After a release, attackers have effectively infinite time to throw an LLM against every line of your code - an LLM that only gets smarter and cheaper to run as time passes. In order to feel secure you’d need to do all the work you’d imagine an attacker would ever do, for every single release you ship.

Re: Cal.com is going closed source

#112

Post by wqtz »

In my advisory job founders always raise the question about open sourcing within the first hour of meeting me. They think that open sourcing product means transparency and developer trust which helps with early adoption. Every single founder I talked to brings up open source as a market penetration method to drive the initial adoption.

I always say to just stop with the virtue signaling led sales technique.

I despise the "we are like the market leader of our niche but open source" angle. Developer as a buyer and as a community these days in my opinion do not care about open source anymore. There is no long term value to that. The moment a product gets traction the open source elements is a constant mild headache as open source product means that they have no intellectual copyright on the core aspect of the product and it is hard to raise money or sell the company. And whenever a product gets traction they will take any excuse to make it close source again. With an open source product they are just coasting on brand. Regardless of what your personal opinion is, this has been largely true for most for-profit business.

Open source is largely is nothing more then a branding concept for a company who is backed by investors.

Re: Cal.com is going closed source

#114

Post by dang »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

Thanks - I've re-upped* that one here: Cybersecurity looks like proof of work now - https://news.ycombinator.com/item?id=47769089 (no comments yet)

* a la https://news.ycombinator.com/item?id=26998308

Re: Cal.com is going closed source

#115

Post by t0mas88 »

fontain wrote: post #88

Monumentally dumb given their codebase is already public and the type of security issues that exist in software are usually found in the oldest code. But also, and more importantly, cal.com launched coss.com last year, open source is (ostensibly) their DNA. How could they do a complete 180 on something so fundamental and think that wouldn’t worry customers, much more so than their codebase being public? I cannot even…

Coss.com reads like a half assed pivot if you look at it with today's news. It's clear cal.com isn't making enough money and going closed source is yet another attempt to fix that.

Re: Cal.com is going closed source

#116

Post by notnullorvoid »

OsrsNeedsf2P wrote: post #96
DrammBA wrote: post #56

Earlier quoted context omitted.

I have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.

An app like Cal.com can be vibe coded in a few evenings with a Chrome MCP server pointed to their website to figure out all the nooks and crannys. The moat of Cal.com is not the code, it's the users who don't want to migrate. The real answer is they are likely having a hard time converting people to paid plans

> The moat of Cal.com is not the code, it's the users who don't want to migrate.

That's a very weak moat unless you have something else like the friction of network dependence similar to a social network.

Re: Cal.com is going closed source

#118

Post by JoshTriplett »

jstummbillig wrote: post #102
simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. That can't be right, can it? Given stable software, the relative attack surface keeps shrinking. Mythos does not produce exploits. Should be defenders advantage, token wise, no?

> Mythos does not produce exploits.

AI in general will, don't worry. "Move fast and break things" makes more exploits than "move steadily and fix things" does.

Re: Cal.com is going closed source

#119

Post by liamgm »

ezekg wrote: post #81
popalchemist wrote: post #39

Seems like it's just being used as a convenient pretense to back out of open-source.

I mean, they were a COSS startup using the AGPLv3, so checks out. :)

Changed the license of the foss version cal.diy to MIT . Grace in disguise , now enterprise user can host cal.diy without worries of viral licensing .

Re: Cal.com is going closed source

#120

Post by notnullorvoid »

Security through obscurity can be a good security layer, but you need to maintain obscurity. That's a lot harder than Cal.com seems to realize.

For example using something like Next.js means a very large chunk of important obscurity is thrown out the window. The same for any publicly available server/client isomorphic framework.

Post reply on HN