Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

271–280 of 337 posts

Re: Cal.com is going closed source

#271

Post by chii »

OccamsMirror wrote: post #249
eloisant wrote: post #244

Earlier quoted context omitted.

Exactly, that's why most Saas companies are in a very tough position. You have to bring value that goes beyond the source code and hosting, otherwise your clients are going to vibe code a custom solution instead of paying you.

> otherwise your clients are going to vibe code a custom solution instead of paying you. How many things do you want to be responsible for? How many vibe coded projects do you want to maintain? I think this line of reasoning is overblown. Just because you can doesn't mean a significant number of people will . I think the 3D printer comparison is apt.

> How many vibe coded projects do you want to maintain?

here comes the next SaaS idea - vibe coded services as a service. You tell what service you want, may be point out a couple examples, and you get that service vibe coded and hosted for you for a small monthly fee!

Re: Cal.com is going closed source

#272

Post by ltbarcly3 »

rvz wrote: post #8

You know what? Great move. Open-source supporters don't have a sustainable answer to the fact that AI models can easily find N-day vulnerabilities extremely quickly and swamp maintainers with issues and bug-reports left hanging for days. Unfortunately, this is where it is going and the open-source software supporters did not for-see the downsides of open source maintenance in the age of AI especially for businesses w…

Take it back to linkedin!

Re: Cal.com is going closed source

#273

Post by swordsith »

Something about a scheduling/productivity app (one of the most common vibe-coded projects people make) being the subject of this is funny to me. I wonder how many tokens have been wasted making apps like this, let alone time.

Re: Cal.com is going closed source

#274

Post by jstummbillig »

rhplus wrote: post #107
jstummbillig wrote: post #102

Earlier quoted context omitted.

> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. That can't be right, can it? Given stable software, the relative attack surface keeps shrinking. Mythos does not produce exploits. Should be defenders advantage, token wise, no?

It’s the classic asymmetric warfare problem: Defenders have to find all the holes in all their systems, while attackers just need to find one hole in one system.

The point is that, as the defender, you only have to find each hole once, while the attacker can spend an infinite amount of tokens trying to find more holes, that are increasingly harder to find and might, eventually, not exist at all. The defender can do that too, of course, but being in the defense, there is value in not being able to uncover new holes (your system keeps working, ostensibly) while as the attacker that's simply how you fail.

Re: Cal.com is going closed source

#276

Post by kewisch »

jen729w wrote: post #235
ryanleesipes wrote: post #143

Head of Thunderbird project here. Our scheduling tool, Thunderbird Appointment, will always be open source. Repo here: https:// github.com/thunderbird/appointment Come talk to us and build with us. We'll help you replace Cal.com

1. Goes to site. Clicks appointment.tb.pro link in sidebar. 2. Gives email address. 3. Is told to join the waitlist. 4. Blocks email address given at 2. Hardly a terrific experience.

I'm curious how it blocked your email, could you share more details on what message you got? Feel free to reach out to me outside of HN.

Re: Cal.com is going closed source

#277

Post by alienbaby »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

This feels like it misses the point. Tokens = money. The real differentiator is time and effort.

Llm's will find your issues faster, but not necessarily more accurately than a domain expert. But experts cost money and effort takes longer to apply.

Are llm's going to reduce everyone's wages because they are cheap labour?

Re: Cal.com is going closed source

#278

Post by alienbaby »

Tepix wrote: post #268

The AI companies profit hugely from open source. In fact, without open source, their most significant financial success (coding assistants) wouldn't exist. They should provide free continued git commit security analysis for open source projects. That would increase the quality of open source projects and would inspire more projects to go open source, which is also a win for the AI companies.

This was my thought too. Your tool is great at finding vulnerabilities, and we want software to be secure for everyone, secure code should not be out of reach to those who can't afford it.

Scan everyone's code, for free. Make all code as secure as an llm can make it as a baseline.

Re: Cal.com is going closed source

#279

Post by Terretta »

pcblues wrote: post #184
sandeepkd wrote: post #126

Earlier quoted context omitted.

What is being phrased as obscurity is one of the approaches to security as long as you are able to keep the code safe. Your passwords, security keys are just random combination of strings, the fact that they are obscure from everyone is what provides you the security

Decompilation and you are back to the level of security you started with. OpenSSH is open for a good reason. Please acknowledge your error. Are you AI?

How do you decompile a SaaS? They're a SaaS.

OTOH, their position seems to be "many LLMs make shallow bugs" is unhelpful; same as many eyes make shallow bugs considered unhelpful.

What seems genuinely needed by the open source economy to both surface these latent vulns and tamp down finding-slop is a new https://bughook.github.com/your/repo/ that these big LLMs (Mythos, etc.) support. Mythos understands if it's been used to find an vuln, and back end auto-reports verified findings the git service can feed to a Dependabot type tool.

Even better, price up Mythos to cover running a background verifier that gets the project, revalidates the issue, before that bughook.

Meanwhile, train it on these findings, so its future self doesn't create them.

Re: Cal.com is going closed source

#280

Post by imtringued »

theahura wrote: post #171
DrammBA wrote: post #56

Earlier quoted context omitted.

I have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.

At risk of self promotion, I think more people should adopt something like the Ship of Theseus license ( https://github.com/tilework-tech/nori-skillsets/pull/465/cha... ). It's not obvious if this will patch the clean room hole in licensing, but I'd rather see it play out in court than assume opensource is just fully dead

I don't think you understand how copyright works.

Copyright can only deny the right to make copies.

If someone spends years using your software and they have learned a mental model of how your software works, they can build an exact replica and there is nothing you can do about that since there is no copy you can sue over. Said user is also allowed to use AI tools to aid in the process.

What you want is an EULA, which is a contract users explicitly have to agree with. A license file only grants access or the right to copy, it doesn't affect usage of your software.

Post reply on HN