Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cal.com is going closed source

cal.com

Post reply on HN
Print view View original

41–50 of 337 posts

Re: Cal.com is going closed source

#41

Post by samename »

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

That’s a non-trivial cost for commonly severely underfunded open source projects

Re: Cal.com is going closed source

#43

Post by earthnail »

fwip wrote: post #22
ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did. It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

> It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

This! I love OSS but this argument seems to get overlooked in most of the comments here.

Re: Cal.com is going closed source

#44

Post by iancarroll »

I know plenty of security researchers who exclusively use Claude Code and other tools for blackbox testing against sites they don’t have the source code for. It seems like shutting down the entire product is the only safe decision here!

Re: Cal.com is going closed source

#45

Post by pietz »

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

This conclusion makes more sense to me, but maybe I'm too naive.

The media momentum of this threat really came with Mythos, which was like 2 or 3 weeks ago? That seems like a fairly short time to pivot your core principles like that. It sounds to me like they wanted to do this for other business related reasons, but now found an excuse they can sell to the public.

(I might be very wrong here)

Re: Cal.com is going closed source

#46

Post by fcarraldo »

_pdp_ wrote: post #38

The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but the existence of AI is deterrent for most. Lets be honest, in recent times the only reason startups went open source first was to build a community and build organic growth engine powered by early adaptors. Now this is no longer viable and in fact it is simply…

> The real threat is not security but bad actors copying your code and calling it theirs.

How has this changed?

Re: Cal.com is going closed source

#49

Post by hmokiguess »

Risk tolerance and emotional capacity differs from one individual to another, while I may disagree with the decision I am able to respect the decision.

That said, I think it’s important to try and recognize where things are from multiple angles rather than bucket things from your filter bubble alone, fear sells and we need to stop buying into it.

Re: Cal.com is going closed source

#50

Post by ErroneousBosh »

Peer_Rich wrote: post #5
doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

> since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project

To what end? You can just look at the code. It's right there. You don't need to "hack" anything.

If you want to "hack on it", you're welcome to do so.

Would you like to take a look at some of my open-source projects your neighbour's kid might like to hack on?

Post reply on HN