Cal.com is going closed source • Hacker News Board

Re: Cal.com is going closed source

#51

Post by skybrian » Wed, Apr 15, 2026, 4:01 PM UTC

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

This seems similar to the lesson learned for cryptographic libraries where open source libraries vetted by experts become the most trusted.

Your average open source library isn’t going to get that scrutiny, though. It seems like it will result in consolidation around a few popular libraries in each category?

Re: Cal.com is going closed source

#52

Post by vlapec » Wed, Apr 15, 2026, 4:01 PM UTC

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

LLMs really are stunningly good at finding vulnerabilities in code, which is why, with closed-source code, you can and probably will use them to make your code as secure as possible.

But you won't keep the doors open for others to use them against it.

So it is, unfortunately, understandable in a way...

Re: Cal.com is going closed source

#53

Post by 1970-01-01 » Wed, Apr 15, 2026, 4:01 PM UTC

doytch wrote: post #4

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

This is not security via obscurity; it is reducing your attack surface as much as possible.

Re: Cal.com is going closed source

#54

Post by yawndex » Wed, Apr 15, 2026, 4:02 PM UTC

samename wrote: post #41

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

That’s a non-trivial cost for commonly severely underfunded open source projects

Cal.com is not a severely underfunded project, it raised around $32M of VC money.

Re: Cal.com is going closed source

#55

Post by tudorg » Wed, Apr 15, 2026, 4:02 PM UTC

It's funny that this news showed up just as we (Xata) have gone the other direction, citing also changes due to AI: https://xata.io/blog/open-source-postgres-branching-copy-on-...

We did consider arguments in both directions (e.g. easier to recreate the code, agents can understand better how it works), but I honestly think the security argument goes for open source: the OSS projects will get more scrutiny faster, which means bugs won't linger around.

Time will tell, I am in the open source camp, though.

Re: Cal.com is going closed source

#56

Post by DrammBA » Wed, Apr 15, 2026, 4:02 PM UTC

simonw wrote: post #11

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find e…

I have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.

Re: Cal.com is going closed source

#57

Post by HyprMusic » Wed, Apr 15, 2026, 4:03 PM UTC

fcarraldo wrote: post #46

_pdp_ wrote: post #38

The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but the existence of AI is deterrent for most. Lets be honest, in recent times the only reason startups went open source first was to build a community and build organic growth engine powered by early adaptors. Now this is no longer viable and in fact it is simply…

> The real threat is not security but bad actors copying your code and calling it theirs. How has this changed?

Bad actors can rewrite it with AI and claim ownership of the result.

Re: Cal.com is going closed source

#58

Post by [deleted] » Wed, Apr 15, 2026, 4:04 PM UTC

fwip wrote: post #22

ButlerianJihad wrote: post #6

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was…

It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did. It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

[deleted]

Re: Cal.com is going closed source

#59

Post by tokai » Wed, Apr 15, 2026, 4:04 PM UTC

Security through obscurity has been known to be a faulty approach for nearly 200 years. Yet here we are.

Re: Cal.com is going closed source

#60

Post by jhatemyjob » Wed, Apr 15, 2026, 4:05 PM UTC

creatonez wrote: post #27

This is some truly exceptionally clownish attention seeking nonsense. The rationale here is complete nonsense, they just wanted to put "because AI" after announcing their completely self-serving decision. If AI cyber offense is such a concern, recognize your role as a company handling truckloads of highly sensitive information and actually fix your security culture instead of just obscuring it.

I mean it's not complete nonsense, but yeah, doing it for security reasons sounds like BS. I actually thought this was going to be about how AI makes it super easy for someone to steal all their code and fold it into their own competing project. I've seen a few open source projects get sideswiped by this, AI is pretty good at copying code (and obfuscating the fact that it was copied). I suspect that's the real reason but it doesn't sound as good. So they went with this half-truth.