Cal.com is going closed source • Hacker News Board

Re: Cal.com is going closed source

#301

Post by cassianoleal » Thu, Apr 16, 2026, 4:23 PM UTC

mgdev wrote: post #87

cassianoleal wrote: post #83

Earlier quoted context omitted.

> I suspect we'll see more 'open spec' software, with actual source generated on-demand (or near to it) by models. Then all the security and governance will happen at the model layer. So each time you roll the dice you gamble on getting a fresh set of 0-days? I don't get why anyone would want this.

You already do this with human-authored code, just slowly. Project model capabilities out a few years. Even if you only assume linear improvement at some point your risk-adjusted outcome lines cross each other and this becomes the preferred way of authoring code - code nobody but you ever sees. Most enterprises already HATE adopting open source. They only do it because the economic benefit of free reuse has tradition…

> You already do this with human-authored code, just slowly.

No I don't. I build predictable and deterministic pipelines. If I rebuild from a specific git sha, I expect the same output. If I get something different, I need to fix what's causing that.

Re: Cal.com is going closed source

#302

Post by johnfn » Thu, Apr 16, 2026, 5:08 PM UTC

utopiah wrote: post #215

johnfn wrote: post #111

Earlier quoted context omitted.

After a release, attackers have effectively infinite time to throw an LLM against every line of your code - an LLM that only gets smarter and cheaper to run as time passes. In order to feel secure you’d need to do all the work you’d imagine an attacker would ever do, for every single release you ship.

> attackers have effectively infinite time No, attackers are also rational economical actors. They don't randomly attack any software just for the aesthetics beauty of the process. They attack for bounty, for fame, for national interest, etc. No matter the reason it's not random and thus they DO have a budget, both in time and money. They attack THIS project versus another project because it's interesting to them. If…

The amount of time they will invest is proportional to how much usage / how high value the target is. If your release is used by no one then no one is going to attack it, but it didn't matter anyways.

Re: Cal.com is going closed source

#303

Post by johnfn » Thu, Apr 16, 2026, 5:09 PM UTC

mixdup wrote: post #124

johnfn wrote: post #111

Earlier quoted context omitted.

After a release, attackers have effectively infinite time to throw an LLM against every line of your code - an LLM that only gets smarter and cheaper to run as time passes. In order to feel secure you’d need to do all the work you’d imagine an attacker would ever do, for every single release you ship.

The first few times it's going to be expensive, but once everyone level sets with intense scans of their codebases, "every single release" is actually not that big a deal, since you are not likely to be completely rebuilding your codebase every release

I'm not sure. An innocuous one line change like "bump version" possibly adds a million new lines of code.

Re: Cal.com is going closed source

#304

Post by johnfn » Thu, Apr 16, 2026, 5:10 PM UTC

rhubarbtree wrote: post #231

johnfn wrote: post #111

Earlier quoted context omitted.

After a release, attackers have effectively infinite time to throw an LLM against every line of your code - an LLM that only gets smarter and cheaper to run as time passes. In order to feel secure you’d need to do all the work you’d imagine an attacker would ever do, for every single release you ship.

But so do you and all your users what’s your point?

No? I can't go out and retroactively fix a bug in a version my users are using? I need to release a new version?

Re: Cal.com is going closed source

#305

Post by rbbydotdev » Thu, Apr 16, 2026, 5:18 PM UTC

I honestly was surprised with the response I got, for what was basically a Sunday hack project: https://github.com/rbbydotdev/someday

I think people really like how it's free (runs on google app scripts) and open source.

I've personally moved onto google's free gmail calendar scheduling tool, which strangely took pretty long to come to market. Calendly stretches back to ... 2013?

Scheduling, oddly feels a little niche (maybe less so today?), when it shouldn't be. Maybe there some more opportunity there.

Re: Cal.com is going closed source

#306

Post by NetMageSCW » Thu, Apr 16, 2026, 7:14 PM UTC

wild_egg wrote: post #18

Peer_Rich wrote: post #5

Earlier quoted context omitted.

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

It only takes 20 minutes and $200 to hack a closed source one too though. LLMs are ludicrously good at using reverse engineering tools and having source available to inspect just makes it slightly more convenient.

A little harder when you don’t have the source or the binaries.

Re: Cal.com is going closed source

#307

Post by NetMageSCW » Thu, Apr 16, 2026, 7:15 PM UTC

senko wrote: post #35

Peer_Rich wrote: post #5

Earlier quoted context omitted.

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

What makes you think it'll take him more than 16 mins and $110 claude code credits to hack your closed source project?

SaaS makes that harder.

Re: Cal.com is going closed source

#308

Post by NetMageSCW » Thu, Apr 16, 2026, 7:19 PM UTC

theahura wrote: post #173

I'm sorta suspicious. I don’t really think this is why they are moving to closed source. It’s true that there is more security risk, but that actually justifies being open source, because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory). My strong hunch is they are moving to closed source because it is now trivial to copy a prod…

> because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory)

Whose theory? That makes no sense at all. The creator can spend the same amount on tokens whether it is closed or open source.

Re: Cal.com is going closed source

#309

Post by NetMageSCW » Thu, Apr 16, 2026, 7:20 PM UTC

amazingamazing wrote: post #156

this is a big nothing. they relicensed the previous cal.com as cal.diy (MIT by the way, instead AGPL or something else) and effectively forked their own product into the "new" cal.com. anyone who cares would just use cal.diy as they were prior to this announcement with cal.com

That’s incorrect - they explained that cal.diy is missing a lot of recent changes.

Re: Cal.com is going closed source

#310

Post by NetMageSCW » Thu, Apr 16, 2026, 7:21 PM UTC

evanjrowley wrote: post #65

Juxtapose this with the fact that many HNers will decry strong copyleft FOSS licenses as not being truly "open source" - the reality is that closed source software is still full of open-source non-copyleft dependencies. Unless you're rolling your own encryption and TCP stack, being closed source will not be the easy solution that many imagine it to be.

Where is the Windows TCP stack source?