211–220 of 337 posts
This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.
This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…
As LLMs improve and adoption grows, maintaining a FOSS project is becoming more complex and more expensive in terms of time and manpower. That part is easy to understand. It is also become a trend that LLM-assisted users are generating more low-quality issues, dubious security reports, and noisy PRs, to the point where keeping the whole stack open source no longer feels worth it. Even if the real reason is monetizati…
What's worse is your choosing to keep it buggy behind closed doors so no one can see the bugs. That's 100% the wrong approach.
Lame. "We don't want AI pointed at our code so we're going closed source". That's hilarious and a cover up.
So not really.
I think they went closed source as there are too many decent clones based off their code and they realized it's eating up their niche.
This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…
After a release, attackers have effectively infinite time to throw an LLM against every line of your code - an LLM that only gets smarter and cheaper to run as time passes. In order to feel secure you’d need to do all the work you’d imagine an attacker would ever do, for every single release you ship.
No, attackers are also rational economical actors. They don't randomly attack any software just for the aesthetics beauty of the process. They attack for bounty, for fame, for national interest, etc. No matter the reason it's not random and thus they DO have a budget, both in time and money. They attack THIS project versus another project because it's interesting to them. If it's not, they might move to another project but they certainly won't spend infinite time precisely because they don't have infinite resources. IMHO it's much more interesting to consider the realistic arm race then theoretical scenarii that never take place.
Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…
This is an economically sound conclusion. It also means that you need to extract enough value to cover the cost of said tokens, or reduce the economic benefit of finding exploits. Reducing economic benefit largely comes down to reducing distribution (breadth) and reducing system privilege (depth). One way to reduce distribution is to, raise the price. Another is to make a worse product. Naturally, less valuable softw…
Earlier quoted context omitted.
At risk of self promotion, I think more people should adopt something like the Ship of Theseus license ( https://github.com/tilework-tech/nori-skillsets/pull/465/cha... ). It's not obvious if this will patch the clean room hole in licensing, but I'd rather see it play out in court than assume opensource is just fully dead
I cannot imagine that license addendum is legally enforceable (let alone provable) in most jurisdictions on earth but it is interesting.
But that is very unlikely even if everyone adopted it, which they won't.
Head of Thunderbird project here. Our scheduling tool, Thunderbird Appointment, will always be open source. Repo here: https:// github.com/thunderbird/appointment Come talk to us and build with us. We'll help you replace Cal.com
Head of Thunderbird project here. Our scheduling tool, Thunderbird Appointment, will always be open source. Repo here: https:// github.com/thunderbird/appointment Come talk to us and build with us. We'll help you replace Cal.com
You should add some screenshots to the readme or somewhere before a sign in screen. Sounds like a great tool though. How much is the hosted version?