Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

191–200 of 200 posts

Re: Open Source Isn't Dead

#191

Post by wilj »

bobkb wrote: post #166
wilj wrote: post #80

Earlier quoted context omitted.

I literally have a Claude Code skill called "/delib" that takes takes in any nodejs project/library and converts it to a dependency-less project only using the standard library. It started as a what-if joke, but it's turned out to be amazing. So yeah, npmjs.com is just reference site for me now, and node_modules stays tiny. And the output is honestly superior. I end up with smaller projects, clean code, and a huge su…

Interesting - I am interested to know how’s it impacting the codebase size interms of lines of code.

It varies from project to project, but applications benefit a lot more than libraries. When I de-lib a normal express app it might add a few hundred lines of code and a few thousand new tests, but if I de-lib an library then depends on how ancient it is. The older the library is, the higher the chances that most of what it needs is built-in to the standard library.

Re: Open Source Isn't Dead

#192

Post by theshrike79 »

440bx wrote: post #117
lelanthran wrote: post #108

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

As someone who works on closed source software and has done for a couple of decades, most companies won't even know about that and of those who do only a fraction give enough of a shit about it to do anything until they are caught with their pants down.

If a company specifically doesn't have a dedicated security team (or even a person), this will never get done.

Most software companies sadly don't hire a dedicated (software) security expert.

Re: Open Source Isn't Dead

#193

Post by theshrike79 »

rd wrote: post #60
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

I don't follow. It seems obvious that there's more to gain for attackers using AI agents to exploit open source repositories, than there is for good samaritan defenders. In this new closed-source world (for Cal.com), there's nothing stopping them from running their own internal security agent audits, all whilst at least blocking the easiest method of finding zero-days - that is, being open source. This really just se…

It's a token game.

Let's say finding a security issue takes 10M tokens. If one company has to pay for it, they most likely won't bother. It's purely a cost/benefit thing for them.

But if you have an open source project, you might get a 1000 people looking at it, each only has to spend 10k tokens to find the same flaws.

Re: Open Source Isn't Dead

#194

Post by rule_of_cool »

jongjong wrote: post #41

I decided to not open source my latest project but it has nothing to do with security concerns. My code is perfectly secure and bug-free. My concern is mostly financial. Most people would be in a better position to monetize my software than I am... Using AI to obfuscate the origin while appropriating all the key innovations. I wouldn't get any credit. Also, I'm not really interested in humans anymore. I have human fa…

I mean that's fair enough but I don't think one person keeping their code closed source really changes all that much. And it depends on what your software does, no-ones out there really replacing (while actually saving any money at least) anything complicated with vibecoding, and GPL violations already happened before.

Re: Open Source Isn't Dead

#195

Post by rule_of_cool »

righthand wrote: post #27

Open source is dead, AI-pundits are applying the wrong lessons. No one has to accept AI or play the game all these AI companies don’t work if everyone stops publishing. Let the AI generated content industry have the publish space, they're very adamant about taking it over and watering it down with slop. I wrote some very nice expressive text for our deployment guide. My project manager took the guide and had Gemini b…

there seems to be a certain type of person that thinks if an LLM can generate content faster than means it's better, said belief appears to also be linked with thinking that if text is long it should be broken down so it's easier to understand, it would seem a bit contradictory considering LLM generated code is usually more difficult to correctly review than code a human wrote, but at the core of it might be a poor understanding of systems, those bullet-points are going to get skimmed over or read but not understood, not everything can be easy.

Re: Open Source Isn't Dead

#196

Post by rule_of_cool »

righthand wrote: post #94
henry2023 wrote: post #52

Earlier quoted context omitted.

Don’t get me wrong but if virtually all modern software infrastructure lives on top of open source and they’re mostly fine then I’d imagine that you can make a scheduling webapp secure independent to if it’s OSS or not. It’s OK if there’s another reason for this transition, just be transparent about it and don’t treat your users as children.

They don’t owe you a complete list of reasons why they’re close sourcing their software. They are not a publicly traded company and no one (customers) actually cares if the product is open source or not.

No-one cares if a product is closed-source, a lot of people do care if a product is open source, and really unless a product is truly unique (almost no product is) that is often the main selling point.

Re: Open Source Isn't Dead

#197

Post by rule_of_cool »

yc-kraln wrote: post #149

every line of code is a liability. open, closed, doesn't matter. companies will have to treating it that way--which means actual engineering--or they will get burnt, and hard.

which is why am I happy to launch the first AI-first meeting scheduling app, yes it costs 5000 USD/month but we have almost completely eliminated any use of code in our application, offering enterprise quality security by having Claude (TM) Opus (TM) 4.8 (TM) directly reply to all HTTPS requests - end to end AI driven agentic software is finally here.

Re: Open Source Isn't Dead

#198

Post by righthand »

rule_of_cool wrote: post #196
righthand wrote: post #94

Earlier quoted context omitted.

They don’t owe you a complete list of reasons why they’re close sourcing their software. They are not a publicly traded company and no one (customers) actually cares if the product is open source or not.

No-one cares if a product is closed-source, a lot of people do care if a product is open source, and really unless a product is truly unique (almost no product is) that is often the main selling point.

Open source software is just a method for corporations to get free evangelization of their product. Companies are now saying “with the assault of AI it is no longer valuable to keep the code open.” They don’t need the handful of Twitter addicted software devs that will evangelize for them anymore because they lose too much by publishing the code. For small companies, the product is most likely the extent of their brand and offerings. Not worth the risk of going out of business, especially when competitors probably aren’t open source.

Re: Open Source Isn't Dead

#199

Post by righthand »

hootz wrote: post #75
righthand wrote: post #27

Open source is dead, AI-pundits are applying the wrong lessons. No one has to accept AI or play the game all these AI companies don’t work if everyone stops publishing. Let the AI generated content industry have the publish space, they're very adamant about taking it over and watering it down with slop. I wrote some very nice expressive text for our deployment guide. My project manager took the guide and had Gemini b…

And your paragraph had a much bigger impact on the reader. Your paragraph reads like an experienced senior developer teaching you to not screw things up, while the AI generated bullet points sound like generic ToS that everyone ignores.

Thank you, my intent was to write something memorable but also calm any exterior worries about deploying code and the feeling of “being in trouble because prod is broked”.

Re: Open Source Isn't Dead

#200

Post by bobkb »

wilj wrote: post #191
bobkb wrote: post #166

Earlier quoted context omitted.

Interesting - I am interested to know how’s it impacting the codebase size interms of lines of code.

It varies from project to project, but applications benefit a lot more than libraries. When I de-lib a normal express app it might add a few hundred lines of code and a few thousand new tests, but if I de-lib an library then depends on how ancient it is. The older the library is, the higher the chances that most of what it needs is built-in to the standard library.

Thank you. I have been thinking about the same approach. However my worry is the open source libraries often gets more eyeballs and CPU cycles and ends up much more refined over a period of time.
Post reply on HN