Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

21–30 of 337 posts

Re: Cal.com is going closed source

#21

Post by hypeatei »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

> neighbors son 15 mins and $100 claude code credits

Is that true? Didn't the Mythos release say they spent $20k? I'm also skeptical of Anthropic here doing essentially what amounts to "vague posting" in an attempt scare everyone and drive up their value before IPO.

Re: Cal.com is going closed source

#22

Post by fwip »

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did.

It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

Re: Cal.com is going closed source

#23

Post by wild_egg »

rvz wrote: post #8

You know what? Great move. Open-source supporters don't have a sustainable answer to the fact that AI models can easily find N-day vulnerabilities extremely quickly and swamp maintainers with issues and bug-reports left hanging for days. Unfortunately, this is where it is going and the open-source software supporters did not for-see the downsides of open source maintenance in the age of AI especially for businesses w…

Haven't the SQLite tests always been closed? Getting access to them is a major reason for financially supporting them

Re: Cal.com is going closed source

#24

Post by pdntspa »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

whooptie fuggin doo, then spend $200 on finding and fixing the issues before you push your commits to the cloud

Re: Cal.com is going closed source

#25

Post by bakugo »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

*This comment sponsored by Anthropic

Re: Cal.com is going closed source

#26

Post by toast0 »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

I don't think this really helps that much. Your neighbor could ask an LLM to decompile your binaries, and then run security analysis on the results.

If the tool correctly says you've got security issues, trying to hide them won't work. You still have the security issues and someone is going to find them.

Re: Cal.com is going closed source

#27

Post by creatonez »

This is some truly exceptionally clownish attention seeking nonsense. The rationale here is complete nonsense, they just wanted to put "because AI" after announcing their completely self-serving decision. If AI cyber offense is such a concern, recognize your role as a company handling truckloads of highly sensitive information and actually fix your security culture instead of just obscuring it.

Re: Cal.com is going closed source

#29

Post by badgersnake »

gouthamve wrote: post #3

This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.

AI is certainly getting a lot of milage as an excuse for doing bad things.

Wanna sack a load of staff? - AI

Wanna cut your consumer products division? - AI

Wanna take away the source? - AI

Re: Cal.com is going closed source

#30

Post by bayindirh »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

Why not can’t you (as in Cal.com) spend that amount of money and find vulnerabilities yourself?

You can keep the untested branch closed if you want to go with “cathedral” model, even.

Post reply on HN