Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

131–140 of 337 posts

Re: Cal.com is going closed source

#131

Post by flying_sheep »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them

This is true until certain point, unless the requirement / contract itself has loophole which the attacker can exploit it without limit. But I don't think this is the case.

Let's say, if someone found an loophole in sort() which can cause denial-of-service. The cause would be the implementation itself, not the contract of sorting. People + AI will figure it out and fix it eventually.

Re: Cal.com is going closed source

#132

Post by traderj0e »

axeldunkel wrote: post #128

Sounds like "security by obscurity" to me - if you think AI is so good at finding security issues - it will find them in compiled code as well. Why not using it in your favor and let it search for bugs you'd otherwise not find?

You can lock down the source and also use AI to look for bugs in it. It does take significantly more time and money for AI to find bugs in compiled code.

That said, I agree with another commenter that this seems like more of a business decision than a security one.

Re: Cal.com is going closed source

#133

Post by traderj0e »

keeda wrote: post #84
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

Security through obscurity is only problematic if that is the only, or a primary, layer of defense. As an incremental layer of deterrence or delay, it is an absolutely valid tactic. (Note, not commenting on whether that is the rationale here.)

That, and plenty of closed-source software at least has a decent security track record by now. I haven't seen an obvious cause-and-effect of open-source making something more secure. Only the other direction, where insecure closed-source software is kept closed because they know it's Swiss cheese.

Re: Cal.com is going closed source

#134

Post by gp14 »

esafak wrote: post #40
gouthamve wrote: post #3

This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.

Their product is getting commoditized: https://workspace.google.com/resources/appointment-schedulin...

Calendar apps have been commoditized for about 15 years now but they keep growing!

Re: Cal.com is going closed source

#135

Post by mellosouls »

The founder proclaimed "Open Source is Dead" in the original tweet.

I thought this was grandiose and projecting their own weakness onto others, an extremely unappealing marketing position that may get clicks in the short term but will undermine trust beyond that.

Re: Cal.com is going closed source

#136

Post by lrvick »

There are endless closed calendar options. Cal.com being FOSS and not making us feel locked in forever was the only reason we chose it over wasting limited cycles self hosting this at Distrust and Caution.

AI can clone something like cal.com with or without source code access, so in trying to pointlessly defend against AI they are just ruining the trust they built with their customers, which is the one thing AI can never create out of thin air.

We exclusively run our companies with FOSS software we can audit or change at any time because we work in security research so every tool we choose is -our- responsibility.

They ruined their one and only market differentiator.

We will now be swapping to self hosting ASAP and canceling our subscriptions.

Really disappointing.

Meanwhile at Distrust and Caution we will continue to open source every line of code we write, because our goal is building trust with our customers and users.

Re: Cal.com is going closed source

#137

Post by [deleted] »

sandeepkd wrote: post #125
ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

Every change would introduce the possibility of a vulnerability being added to the system and one would need to run the LLM scan across the entire code base. It gets very costly in a environment where you are doing regular commits. Companies like Github already provide scanning tools for static analysis and the cost is already high for them.

[deleted]

Re: Cal.com is going closed source

#138

Post by tonymet »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

This may be true long term but not short term. It also assumes that white hats will be as motivated as black hats – not true.

For projects with NO WARRANTY, the risk is minimal, so yes there are upsides.

For a commercial project like cal.com, where a breach means massive liability, they don’t have the resources to risk breaches in the short term for potentially better software in the long term.

Re: Cal.com is going closed source

#139

Post by tecoholic »

gouthamve wrote: post #3

This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.

I think people are finding ways to either enable “pro” features and at least find the right extension points to implement them easily with LLMs. Security is window dressing.

Re: Cal.com is going closed source

#140

Post by raincole »

dspillett wrote: post #68
Mordisquitos wrote: post #63

Earlier quoted context omitted.

Their commercial users have auditing budgets.

Does your ideal world have an easy path to citizenship? I might like to live there.

> SAN FRANCISCO – March 17, 2026 – The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced $12.5 million in total grants from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen the security of the open source software ecosystem.

https://openssf.org/tag/google

"But that's Linux, how small libraries get audit budget..." fortunately LLM has eliminated the need to have small libraires in your dependency chain.

Post reply on HN