20 ms·

Cal.com is going closed source

femto 5mo ago
Will it make any difference to security? LLMs are excellent pattern matchers. The source is a sequence of tokens, the binary is a sequence of tokens. Whats the difference to an LLM?
lapinovski 5mo ago
Cal.com was open source?
mastermage 5mo ago
Security through obscurity has always worked out so well.
gouthamve 5mo ago
This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.
- badgersnake 5mo ago
  AI is certainly getting a lot of milage as an excuse for doing bad things. Wanna sack a load of staff? - AI Wanna cut your consumer products division? - AI Wanna take away the source? - AI
  - rhubarbtree 5mo ago
    Well, first AI uses security to sell models. So other companies hijack their narrative for their purposes. This is how marketing works.
- esafak 5mo ago
  Their product is getting commoditized: https://workspace.google.com/resources/appointment-scheduling/ https://workspace.google.com/resources/appointment-schedulin...
  - no_wizard 5mo ago
    I always felt it was a matter of time before Google took notice. It has always been odd to me they didn’t have this functionality years ago. It’s been requested for a long long time
  - gp14 5mo ago
    Calendar apps have been commoditized for about 15 years now but they keep growing!
  - bensyverson 5mo ago
    The real downside to Google's solution is that you have to use Google Meet. Depending on your opinion of Meet, this is either no big deal or a total deal breaker.
  - rhubarbtree 5mo ago
    Remember when calendly went out of business?
- fhn 5mo ago
  Yeah, I don't buy it. If they don't want these security reports, ignore them and continue your path. Blaming AI is just an excuse to close source. If you don't want AI to learn from your code, too late. Add genetic algorithms and fuzzing into AI and it can iterate and learn a billion times faster, no need to learn for humans.
- tecoholic 5mo ago
  I think people are finding ways to either enable “pro” features and at least find the right extension points to implement them easily with LLMs. Security is window dressing.
- kartika36363 5mo ago
  correct. guy's doing mental gymnastics all to say he's a sellout.
andsoitis 5mo ago
> Today, we are making the very difficult decision to move to closed source, and there’s one simple reason: security. It seems like an easy decision, not a difficult one.
doytch 5mo ago
I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?
- Peer_Rich 5mo ago
  hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project
  - doytch 5mo ago
    Right, but those capabilities are available to you as well. Granted the remediation effort will take longer but...you're going to do that for any existing issues _anyway_ right? I understand why this is a tempting thing to do in a "STOP THE PRESSES" manner where you take a breather and fix any existing issues that snuck through. I don't yet understand why when you reach steady-state, you wouldn't rely on the same tooling in a proactive manner to prevent issues from being shipped. And if you say "yeah, that's obv the plan," well then I don't understand what going closed-source _now_ actually accomplishes with the horses already out of the barn.
    - throwaway5752 5mo ago
      > those capabilities are available to you as well Give him $100 to obtain that capability. Give each open source project maintainer $100. Or internalize the cost if they all decide the hassle of maintaining an open source project is not worth it any more. I'm not aiming this reply at you specific, but it's the general dynamic of this crisis. The real answer is for the foundational model providers to give this money. But instead, at least one seems to care more about acquiring critical open source companies. We should openly talk about this - the existing open source model is being killed by LLMs, and there is no clear replacement.
  - simonw 5mo ago
    Are you at all worried that the message you are spreading here is "We are no longer confident in our own ability to secure your data?"
ButlerianJihad 5mo ago
This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was roundly debunked. Isn't it a shame that it's basically been fulfilled now with LLMs? https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law
- layer8 5mo ago
  Attackers only need LLMs to be good at randomly finding one vulnerability, whereas service providers need them to be good at finding all such vulnerabilities.
- fwip 5mo ago
  It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did. It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.
  - deleted 5mo ago
    [deleted]
  - earthnail 5mo ago
    > It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once. This! I love OSS but this argument seems to get overlooked in most of the comments here.
- dgellow 5mo ago
  I mean, you should definitely have _some_ level of audit by LLMs before you ship, as part of the general PR process. But you might need thousands of sessions to uncover some vulnerabilities, and you don’t want to stop shipping changes because the security checks are taking hours to run
rvz 5mo ago
You know what? Great move. Open-source supporters don't have a sustainable answer to the fact that AI models can easily find N-day vulnerabilities extremely quickly and swamp maintainers with issues and bug-reports left hanging for days. Unfortunately, this is where it is going and the open-source software supporters did not for-see the downsides of open source maintenance in the age of AI especially for businesses with "open-core" products. Might as well close-source them to slow the attackers (with LLMs) down. Even SQLite has closed-sourced their tests which is another good idea.
- deleted 5mo ago
  [deleted]
- zb3 5mo ago
  > especially for businesses with "open-core" products. Then good, that overengineered, intentionally-crippled crap should go away.
- wild_egg 5mo ago
  Haven't the SQLite tests always been closed? Getting access to them is a major reason for financially supporting them
- hayleox 5mo ago
  The tools are available to everyone. It's becoming easier for hackers to attack you at the same speed that it's becoming easier for you to harden your systems. When everyone gains the same advantage at the same time, nothing has really changed. It makes me think of how great chess engines have affected competitive chess over the last few years. Sure, the ceiling for Elo ratings at the top levels has gone up, but it's still a fair game because everyone has access to the new tools. High-level players aren't necessarily spending more time on prep than they were before; they're just getting more value out of the hours they do spend.
  - popalchemist 5mo ago
    I agree it's a shit tactic, but one thing I can say for those running software businesses is that it's not an equivalent linear increase on both sides. It's asymmetric, because # of both attackers and the amount of attack surface (exposed 3rd party dependencies, for example) is near infinite, with no opportunity cost for failure by the bad actors (hackers). However a single failure can bring down a company, particularly when they may be hosting sensitive user data that could ruin their customers' businesses or lives. I think Cal are making the wrong call, and abandoning their principles. But it isn't fair to say the game is accelerating in a proportionate way. See: https://www.youtube.com/watch?v=2CieKDg-JrA https://www.youtube.com/watch?v=2CieKDg-JrA Ultimately, he concludes that while in the short run the game defines the players' actions, an environment that makes cooperation too risky naturally forces participants to stop cooperating to protect themselves from being "exploited" (this bit is around 34:39 - 34:46)
simonw 5mo ago
Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-of-work-now.html https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find exploits so long as you keep throwing money at it, security is reduced to a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them.
- not-chatgpt 5mo ago
  Security should be a non issue in the age of AI now that auditing is cheaper than ever. I'd give them more credits if they use the AI slop unmaintainability argument.
  - habinero 5mo ago
    Ha ha ha ha. I wish that were true. Getting people to patch existing, known vulns is hard enough.
- criddell 5mo ago
  How may open source libraries have auditing budgets?
  - Mordisquitos 5mo ago
    Their commercial users have auditing budgets.
    - dspillett 5mo ago
      Does your ideal world have an easy path to citizenship? I might like to live there.
woodruffw 5mo ago
Today, it's easy to (publicly) evaluate the ability of LLMs to find bugs in open source codebases, because you don't need to ask permission. But this doesn't actually tell us the negative statement, which is that an LLM won't just as effectively find bugs in closed codebases, including through black-box testing, reverse engineering, etc. If the null hypothesis is that LLMs are good at finding bugs, full stop, then it's unclear to me that going closed actually does much to stop your adversary (particularly as a service operator).
zb3 5mo ago
This has to be the most bullshit reason I've seen.. if AI can be pointed and find vulnerabilities then do it yourself before publishing the code.
- dspillett 5mo ago
  > if AI can be pointed and find vulnerabilities then do it yourself before publishing the code At your cost. Every time you push. (or if not that, at least every time there is a new version that you call a release) Including every time a dependency updates, unless you pin specific versions. I assume (caveat: I've not looked into the costs) many projects can't justify that. Though I don't disagree with you that this looks like a commercial decision with “LLM based bug finders could find all our bad code” as an excuse. The lack of confidence in their own code while open does not instil confidence that it'll be secure enough to trust now closed.
  - zb3 5mo ago
    For-profit companies using open-source software should bear that cost - that's my position. I believe than N companies using an open source project and contributing back would make this burden smaller than one company using the same closed-source project.
bearsyankees 5mo ago
Think this is a bad, bad move... https://news.ycombinator.com/item?id=47780712 https://news.ycombinator.com/item?id=47780712
creatonez 5mo ago
This is some truly exceptionally clownish attention seeking nonsense. The rationale here is complete nonsense, they just wanted to put "because AI" after announcing their completely self-serving decision. If AI cyber offense is such a concern, recognize your role as a company handling truckloads of highly sensitive information and actually fix your security culture instead of just obscuring it.
- jhatemyjob 5mo ago
  I mean it's not complete nonsense, but yeah, doing it for security reasons sounds like BS. I actually thought this was going to be about how AI makes it super easy for someone to steal all their code and fold it into their own competing project. I've seen a few open source projects get sideswiped by this, AI is pretty good at copying code (and obfuscating the fact that it was copied). I suspect that's the real reason but it doesn't sound as good. So they went with this half-truth.
deleted 5mo ago
[deleted]
nativeit 5mo ago
I guess why fix vulnerabilities when you can just obscure them?
asdev 5mo ago
Who even uses their open source product?
_pdp_ 5mo ago
The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but the existence of AI is deterrent for most. Lets be honest, in recent times the only reason startups went open source first was to build a community and build organic growth engine powered by early adaptors. Now this is no longer viable and in fact it is simply helping competitors. So why do it then? The only open source that will remain will be the real open source projects that are true to the ethos.
- fcarraldo 5mo ago
  > The real threat is not security but bad actors copying your code and calling it theirs. How has this changed?
  - HyprMusic 5mo ago
    Bad actors can rewrite it with AI and claim ownership of the result.
- evanjrowley 5mo ago
  I agree with you that AI's disruption of attribution is a much bigger problem, but it's also worth recognizing that not everyone has this same motivation. It mostly affects copyleft open source licenses. Attribution isn't required for permissive many open source licenses. Dependencies with those licenses will oftentimes end up inside closed source software. Even if there isn't FOSS in the closed-source software, basically everyone's threat model includes (or should include) "OpenSSL CVE". On that basis, I doubt Cal is accomplishing as much as they hope to by going closed source.
- fedeb95 5mo ago
  If you copy the code infringing licenses, yes, it will be harder to legally sort things out. Otherwise, copying code and improving it with AI or with humans is the same, as long as the product improves. I doubt that many semi-automatic AI copies can really improve a product more than the original team, for really valid products. AI will be a filter of bad quality.
popalchemist 5mo ago
Seems like it's just being used as a convenient pretense to back out of open-source.
- ezekg 5mo ago
  I mean, they were a COSS startup using the AGPLv3, so checks out. :)
  - liamgm 5mo ago
    Changed the license of the foss version cal.diy to MIT . Grace in disguise , now enterprise user can host cal.diy without worries of viral licensing .
    - ezekg 5mo ago
      That was my point. Only reason they were using the AGPLv3 in the first place was as a hush hush non-compete, and now that that doesn't matter...
barelysapient 5mo ago
I hate how this sounds...but this reads to me "we lack the confidence in our code security so we're closing the source code to conceal vulnerabilities which may exist."
iancarroll 5mo ago
I know plenty of security researchers who exclusively use Claude Code and other tools for blackbox testing against sites they don’t have the source code for. It seems like shutting down the entire product is the only safe decision here!
hmokiguess 5mo ago
Risk tolerance and emotional capacity differs from one individual to another, while I may disagree with the decision I am able to respect the decision. That said, I think it’s important to try and recognize where things are from multiple angles rather than bucket things from your filter bubble alone, fear sells and we need to stop buying into it.
adamtaylor_13 5mo ago
Could you not simply point AI at your open source codebase and use it to red-team your own codebase? This post's argument seems circular to me.
deleted 5mo ago
[deleted]
tudorg 5mo ago
It's funny that this news showed up just as we (Xata) have gone the other direction, citing also changes due to AI: https://xata.io/blog/open-source-postgres-branching-copy-on-write https://xata.io/blog/open-source-postgres-branching-copy-on-... We did consider arguments in both directions (e.g. easier to recreate the code, agents can understand better how it works), but I honestly think the security argument goes for open source: the OSS projects will get more scrutiny faster, which means bugs won't linger around. Time will tell, I am in the open source camp, though.
- microflash 5mo ago
  Just wanted to appreciate the open-source work by Xata. I’ve been eyeing pgroll [1] for schema migrations after Liquibase license shenanigans (the only barrier for me is json-based migration instead of sql-based migrations) [1] https://github.com/xataio/pgroll https://github.com/xataio/pgroll
tokai 5mo ago
Security through obscurity has been known to be a faulty approach for nearly 200 years. Yet here we are.
righthand 5mo ago
This is the future now that AI is here. Publishing is going to be dead, look at the tea leaves, how many engineers are claiming they don’t use package managers anymore and just generate dependencies? 5 years and no one will be making an argument for open source or blogging.
evanjrowley 5mo ago
Juxtapose this with the fact that many HNers will decry strong copyleft FOSS licenses as not being truly "open source" - the reality is that closed source software is still full of open-source non-copyleft dependencies. Unless you're rolling your own encryption and TCP stack, being closed source will not be the easy solution that many imagine it to be.
- NetMageSCW 5mo ago
  Where is the Windows TCP stack source?
dec0dedab0de 5mo ago
This seems dishonest, like someone is forcing the decision for other reasons, and they're using security and AI as a distraction.
poisonborz 5mo ago
AI sure is useful as a scapegoat for any negative PR inducing moves.
xnx 5mo ago
Saaspocalypse is coming for cal.com
fontain 5mo ago
Monumentally dumb given their codebase is already public and the type of security issues that exist in software are usually found in the oldest code. But also, and more importantly, cal.com launched coss.com last year, open source is (ostensibly) their DNA. How could they do a complete 180 on something so fundamental and think that wouldn’t worry customers, much more so than their codebase being public? I cannot even begin to understand this. Surely there must be more to the story?
- abound 5mo ago
  Oh wow the coss.com thing makes this so much worse. Making such an aggressive and public commitment to open source to then turn around and do something like this is a pretty rough look.
- t0mas88 5mo ago
  Coss.com reads like a half assed pivot if you look at it with today's news. It's clear cal.com isn't making enough money and going closed source is yet another attempt to fix that.
abound 5mo ago
This certainly makes me feel better about the project I started a few months ago to replace my Cal.com instance with a smaller, simpler self-hosted tool https://git.sr.ht/~bsprague/schedyou https://git.sr.ht/~bsprague/schedyou
righthand 5mo ago
Good for them. I’m sure they saw the writing on the wall when Monday.com was cloned. This is the right move.
analogpixel 5mo ago
TIL I learned about yet another calendar application I don't need. Someone should setup their openclaw to just write a new todo/calendar app each week; they'll be billionaires by the end of the year.
deleted 5mo ago
[deleted]
Tepix 5mo ago
Hey cal.com, as a potential customer, you have just lost me. Open source is set to profit from improved transparency in the SSDLC. With closed source, you will have to trust the software vendor instead. I'm not sure I agree with Drew Breunig, however. The number of bugs isn't infinite. Once we have models that are capable enough and scan the source code with them at regular intervals, the likelihood of remaining bugs that can be exploited goes way down.
post-it 5mo ago
- You know, Lindsay, as a software engineering consultant, I have advised a number of companies to explore closing their source, where the codebase remains largely unchanged but secure through obscurity. - Well, did it work for those companies? - No, it never does. I mean, these companies somehow delude themselves into thinking it might, but... but it might work for us.
codegeek 5mo ago
I am beyond convinced at this point that you either run an Open Source Project with a small revenue company (single digit millions) or run a software company that does more than 10M ARR at the least and be closed source. I know there are exceptions but most open source Software companies are providing code with heavy restrictions or teaser features and gate keep everything in their "ee/enterprise" version etc.
wqtz 5mo ago
In my advisory job founders always raise the question about open sourcing within the first hour of meeting me. They think that open sourcing product means transparency and developer trust which helps with early adoption. Every single founder I talked to brings up open source as a market penetration method to drive the initial adoption. I always say to just stop with the virtue signaling led sales technique. I despise the "we are like the market leader of our niche but open source" angle. Developer as a buyer and as a community these days in my opinion do not care about open source anymore. There is no long term value to that. The moment a product gets traction the open source elements is a constant mild headache as open source product means that they have no intellectual copyright on the core aspect of the product and it is hard to raise money or sell the company. And whenever a product gets traction they will take any excuse to make it close source again. With an open source product they are just coasting on brand. Regardless of what your personal opinion is, this has been largely true for most for-profit business. Open source is largely is nothing more then a branding concept for a company who is backed by investors.
- wartywhoa23 5mo ago
  > Open source is largely is nothing more then a branding concept for a company who is backed by investors. And a religion that was invented by those who wanted to have all the world's code for free to train AI to code.
dang 5mo ago
Related ongoing threads: Open Source Isn't Dead - https://news.ycombinator.com/item?id=47780712 https://news.ycombinator.com/item?id=47780712 Cybersecurity looks like proof of work now - https://news.ycombinator.com/item?id=47769089 https://news.ycombinator.com/item?id=47769089
aizk 5mo ago
Sounds backwards to me.
notnullorvoid 5mo ago
Security through obscurity can be a good security layer, but you need to maintain obscurity. That's a lot harder than Cal.com seems to realize. For example using something like Next.js means a very large chunk of important obscurity is thrown out the window. The same for any publicly available server/client isomorphic framework.
com2kid 5mo ago
Proposition 1: The majority of a code in a modern app is from shared libraries Proposition 2: The most popular shared libraries are going to be quickly torn apart by LLM security tools to find vulnerabilities Proposition 3: After a brief period of mass vulnerability discovery, the overall quality of shared libraries will dramatically increased. Conclusion: After the initial wave of vulnerabilities has passed, the main threat to open source code bases is in their own comparatively small amount of code.
behringer 5mo ago
Security via obscurity and you get to blame AI too! What a win for their marketing team.
axeldunkel 5mo ago
Sounds like "security by obscurity" to me - if you think AI is so good at finding security issues - it will find them in compiled code as well. Why not using it in your favor and let it search for bugs you'd otherwise not find?
- traderj0e 5mo ago
  You can lock down the source and also use AI to look for bugs in it. It does take significantly more time and money for AI to find bugs in compiled code. That said, I agree with another commenter that this seems like more of a business decision than a security one.
mellosouls 5mo ago
The founder proclaimed "Open Source is Dead" in the original tweet. I thought this was grandiose and projecting their own weakness onto others, an extremely unappealing marketing position that may get clicks in the short term but will undermine trust beyond that.
lrvick 5mo ago
There are endless closed calendar options. Cal.com being FOSS and not making us feel locked in forever was the only reason we chose it over wasting limited cycles self hosting this at Distrust and Caution. AI can clone something like cal.com with or without source code access, so in trying to pointlessly defend against AI they are just ruining the trust they built with their customers, which is the one thing AI can never create out of thin air. We exclusively run our companies with FOSS software we can audit or change at any time because we work in security research so every tool we choose is -our- responsibility. They ruined their one and only market differentiator. We will now be swapping to self hosting ASAP and canceling our subscriptions. Really disappointing. Meanwhile at Distrust and Caution we will continue to open source every line of code we write, because our goal is building trust with our customers and users.
egorfine 5mo ago
What's preventing cal.com to run the AI researcher over their own codebase and find their vulnerabilities before anyone else and patch them all by tomorrow morning? That's right. Nothing.
- wartywhoa23 5mo ago
  Unwilling to pay AI tax, maybe?
  - egorfine 5mo ago
    No worries, someone else will do that for them. Just like they explained. And given that they will not rewrite the whole codebase in the next few days it means that security vulnerabilities are still there to be discovered by someone willing to pay the AI tax.
ryanleesipes 5mo ago
Head of Thunderbird project here. Our scheduling tool, Thunderbird Appointment, will always be open source. Repo here: https:// github.com/thunderbird/appointment Come talk to us and build with us. We'll help you replace Cal.com
- ezekg 5mo ago
  "Thunderbird, the open source Cal.com"
  - ryanleesipes 5mo ago
    Love it!
- raybb 5mo ago
  You should add some screenshots to the readme or somewhere before a sign in screen. Sounds like a great tool though. How much is the hosted version?
  - bean469 5mo ago
    There are screenshots in the link[1] provided in the README.md 1. https://stage.appointment.day https://stage.appointment.day
  - m3nu 5mo ago
    A Docker image would be good too.
  - ryanleesipes 5mo ago
    Yes, we should. Will do that today
  - devmount 5mo ago
    We added some screenshots to the repository now. Thanks so much for the suggestion!
- sashimimono 5mo ago
constantlm 5mo ago
Security through obscurity isn't a great strategy.
jemiluv8 5mo ago
I have fond memories of this project. Contributing to it really helped me ramp up my dev skills and was effectively my introduction to monorepo’s in JavaScript. It was the kind of codebase I couldn’t get my hands on while working in my part of the world. Good luck going closed source.
smetannik 5mo ago
This sounds more like a good excuse to go closed source. I feel that real reason might be revenue-related.
CamperBob2 5mo ago
Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. AI also goes a long way towards erasing the distinction between source code and executable code. The disassembly skill of a good LLM is nothing short of jaw-dropping. So going closed-source may be safer for SaaS, but closing the source won't save a codebase from being exploited if the binaries are still accessible to the public. In that sense, instead of dooming SaaS as many people have suggested AI will do, it may instead be a boon.
alance 5mo ago
I only found cal.com in the first place because I searched for an open source calendly alternative.
sadeshmukh 5mo ago
Security by obscurity has never been real.
amazingamazing 5mo ago
this is a big nothing. they relicensed the previous cal.com as cal.diy (MIT by the way, instead AGPL or something else) and effectively forked their own product into the "new" cal.com. anyone who cares would just use cal.diy as they were prior to this announcement with cal.com
- theturtletalks 5mo ago
  We’d hope but they could neuter Cal.diy over time. From their chart between the differences of cal.diy and cal.com, teams are not supported. I’m self hosting Cal.com and I think I do have access to teams as of right now.
- NetMageSCW 5mo ago
  That’s incorrect - they explained that cal.diy is missing a lot of recent changes.
neuroelectron 5mo ago
Chatgpt, write me a reason to make more money as a tech ceo. Charge for api access, take a cut of the extensions economy. How do i do that, I'm open source?
theturtletalks 5mo ago
Enshittification has come for VC backed open-source. AI has deemed commercial open source obsolete especially when users can point Calude Code to calcom on GitHub and ask it to make them scheduling features directly into their product. That’s what spooked Cal.
ernsheong 5mo ago
Well let’s just finish and CLOSE them off. Delete all your subscriptions, boys.
a-fadil 5mo ago
Open source means living under constant scrutiny. AI just made that scrutiny cheaper and faster. I feel this every day maintaining an open source project. The temptation to close the source is real but let’s not forget that open source is what raised the bar for software quality in the first place.
- dnnddidiej 5mo ago
  Not really. Open source just means distributing the source. Either via CD or some internet based protocol. Maybe you are referring to the whole Github thing.
  - mynameisvlad 5mo ago
    I mean, by definition, open source means that the source code is available and therefore _open_ to scrutiny. Regardless of how it is distributed.
    - dnnddidiej 5mo ago
      Right. But what is the problem? * Someone lols at code. Answer: ignore them. * Someone sees your vulns. Answer: someone is already trying to hack you anyway.
- wartywhoa23 5mo ago
  Open source is what made this AI shitshow possible in the first place.
theahura 5mo ago
I'm sorta suspicious. I don’t really think this is why they are moving to closed source. It’s true that there is more security risk, but that actually justifies being open source, because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory). My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. But I'd want to see more adoption of something like the Ship of Theseus license (https://github.com/tilework-tech/nori-skillsets/pull/465/changes https://github.com/tilework-tech/nori-skillsets/pull/465/cha...) before giving up on open source entirely
- sgbeal 5mo ago
  > My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. Since such "clean room" implementations ostensibly do not see the source, it's arguably irrelevant whether such sources are open are not. Such implementations will happen regardless of whether the sources they're reimplementing are opened or closed.
- ezekg 5mo ago
  I very much doubt that addendum would hold up to a lawyer.
- NetMageSCW 5mo ago
  > because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory) Whose theory? That makes no sense at all. The creator can spend the same amount on tokens whether it is closed or open source.
- Gormo 5mo ago
  > My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. The "clean room" part of clean-room reverse engineering implies that there is no exposure to the original copyrighted code on the part of those doing the reimplementation, whether human developers or AI. Traditionally, if you're working of the source code itself, you have one party translate the source code back into a design document, specifying behavior, and then you have another party implement that design spec with original code. If you already have a running copy of the software to model the behavior off of, then you don't need the original source code in the first place. So going closed source will have zero effect on the capacity of AI tools to be used for clean room reverse engineering: all you need is the runtime. > But I'd want to see more adoption of something like the Ship of Theseus license (https://github.com/tilework-tech/nori-skillsets/pull/465/cha https://github.com/tilework-tech/nori-skillsets/pull/465/cha...) before giving up on open source entirely This license doesn't seem valid: a license can't redefine what qualifies as a derivative work. That's determined by copyright law itself, and if copyright law says that a clean-room reimplementation isn't a derivative work, then it isn't restricted by copyright, so doesn't need a license in the first place.
usernametaken29 5mo ago
Just a random thought. Up until yesterday this project was open source. The code base won’t be rewritten tomorrow. More likely is that conserved parts of the source code, something like 90% will just remain the same. Particularly the core database schema around users and security are likely to stay the same. Since the old code is already out there what’s stopping me from exploiting the software as it was? This looks an awful lot like marketing to me, and not like real security concerns.
diebillionaires 5mo ago
Lame. "We don't want AI pointed at our code so we're going closed source". That's hilarious and a cover up.
- szszrk 5mo ago
  I think them going closed source is as much related to security and AI, as work from office is related to productivity in large companies. So not really. I think they went closed source as there are too many decent clones based off their code and they realized it's eating up their niche.
huslage 5mo ago
Cal.com is failing. This is a rugpull with an AI excuse.
dhruv3006 5mo ago
I guess this is an AI excuse again.
pcblues 5mo ago
Security by obscurity. Good luck. So novice.
opem 5mo ago
> When we started Cal.com, we believed deeply in open source. No you certainly didn't, otherwise you shouldn't have come up with such a meaningless excuse!
sreekanth850 5mo ago
This has one of the most shittiest codebase out of all. Not surprised by this move.
thegdsks 5mo ago
This is why CC0 and MIT matter for projects people depend on. Once you build on something with a restrictive license this is always a risk.
quotemstr 5mo ago
LOL. Every generation has to learn anew that security through obscurity is no security at all.
sgbeal 5mo ago
> Today, we are making the very difficult decision to move to closed source, and there’s one simple reason: security. (Enter name of large software vendor here) has long-since proven that security through obscurity is not a real thing.
kartika36363 5mo ago
thats like the funniest excuse to cash out on people's open source contributions
whatiathisnon 5mo ago
This is completely stupid and ridiculous. Why not just use AI to patch your software? Its just as effortful as someone finding and exploiting a vuln on your system. What's worse is your choosing to keep it buggy behind closed doors so no one can see the bugs. That's 100% the wrong approach.
abusedmedia 5mo ago
The article is leaking from all sides. As a wannabe hacker would find a hole in a public repo, what can the repo owner do, who knows every detail of the project and has a high interest in it, also economically?
seyz 5mo ago
[dead]
eloisant 5mo ago
This reads like a post from 1995. "But if everyone can read the source code, they'll be able to find vulnerabilities more easily!" No. Security by obscurity has proven wrong.
fedeb95 5mo ago
security by obscurity doesn't work.
- ButlerianJihad 5mo ago
  > security by obscurity doesn't work. That is not true. https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity Security through obscurity doesn't work in isolation. It doesn't work as the only solution. It is discouraged, because it can be a panacea. But it also doesn't hurt in many instances. Holding back your source code can be a strategic advantage. It does mean that adversaries can't directly read it (nor can your friends or allies!) Having a proprietary protocol or file format, this is also "security through obscurity" and it may slow down or hinder an attacker. Obscurity may be part of a "defense in depth" strategy that includes robust and valid methods as well. But it is harmful to baldly claim that "it doesn't work".
redsocksfan45 5mo ago
[dead]
Nukahaha 5mo ago
Isn't the joke that everything is open source if you can read assembly? Pretty sure someone is working on an AI that reads assembly... Not sure hiding the codebase away is a viable solution!
- ButlerianJihad 5mo ago
  That may be true for software that you download and install as an app, but for SaaS, there is no need to expose the code to anyone at all. Only your API endpoints are available. You can try and "black box reverse engineer" through the client code and its API calls, but that's not the same as having the server code in hand to pick apart.
aswerty 5mo ago
Surely the argument is just to have an LLM stressing for vulnerabilities during the build pipeline before merging to main? Resulting in better security from LLMs. One must assume this was a direction they wanted to move towards and this is the justification they thought would be most palatable.
equinox6380 5mo ago
[dead]
Tepix 5mo ago
The AI companies profit hugely from open source. In fact, without open source, their most significant financial success (coding assistants) wouldn't exist. They should provide free continued git commit security analysis for open source projects. That would increase the quality of open source projects and would inspire more projects to go open source, which is also a win for the AI companies.
- alienbaby 5mo ago
  This was my thought too. Your tool is great at finding vulnerabilities, and we want software to be secure for everyone, secure code should not be out of reach to those who can't afford it. Scan everyone's code, for free. Make all code as secure as an llm can make it as a baseline.
ltbarcly3 5mo ago
Let me share the press release template for 2026: Hi {audience}, It is with a heavy heart that I have to announce that {thing we were going to do anyway} is necessary due to AI. AI has changed the industry and we are powerless to do anything other than {unpopular decision we were going to do regardless}.
swordsith 5mo ago
Something about a scheduling/productivity app (one of the most common vibe-coded projects people make) being the subject of this is funny to me. I wonder how many tokens have been wasted making apps like this, let alone time.
Hendrikto 5mo ago
> Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. So do that and fix your bugs. This post makes no sense.
sanghyunp 5mo ago
[dead]
redoh 5mo ago
[flagged]
robinhood 5mo ago
Very weak argument. You could have had the same speech before AI. I would rather say that the core product is not strong and differentiated enough to resist this new age of coding, and it's an attempt to protect revenues.
m11a 5mo ago
I'm not sure security through obscurity is a great practice? Not to mention, I presume the core bits of Cal.com's source code are already in place and aren't going to change significantly? Like, this feels like a business decision and not a security decision
james-clef 5mo ago
I'm all for FOSS as well, but not sure I would have open sourced the commercial offering to begin with. Love the idea though, it's so bold.
rbbydotdev 5mo ago
I honestly was surprised with the response I got, for what was basically a Sunday hack project: https://github.com/rbbydotdev/someday https://github.com/rbbydotdev/someday I think people really like how it's free (runs on google app scripts) and open source. I've personally moved onto google's free gmail calendar scheduling tool, which strangely took pretty long to come to market. Calendly stretches back to ... 2013? Scheduling, oddly feels a little niche (maybe less so today?), when it shouldn't be. Maybe there some more opportunity there.
8260337551 5mo ago
Judging by the CEOs picture on LinkedIn, he's full of himself.
Gormo 5mo ago
EasyAppointments (https://github.com/alextselegidis/easyappointments https://github.com/alextselegidis/easyappointments) is still FOSS. We managed our team calendars on it at a previous company, but I rolled out Cal.com due to more apparent support and sophistication at my current company. Turns out most of that sophistication turned out to be bloat: we saw successive version releases add features we didn't care about while increasingly putting previously open features, like team calendars, behind a paywall. This move by Cal.com seems to be transparently an attempt to maintain that paywall against users who'd otherwise just use LLMs to remove it. I guess it's back to EasyAppointments, which still seems to work just fine.
zerotoship 5mo ago
users can just point Claude Code at cal on GitHub and ask it to build xyz features directly into their own product .. and most of them won't bother following the license. it's happening with so many projects in open source
nexustoken 5mo ago
[dead]

femto 5mo ago

Will it make any difference to security? LLMs are excellent pattern matchers. The source is a sequence of tokens, the binary is a sequence of tokens. Whats the difference to an LLM?

lapinovski 5mo ago

Cal.com was open source?

mastermage 5mo ago

Security through obscurity has always worked out so well.

gouthamve 5mo ago

This is a weird knee-jerk reaction. I feel like this is more a business decision than a security decision. I feel like with AI, self-hosting software reliably is becoming easier so the incentives to pay for a hosted service of an OSS project are going down.

badgersnake 5mo ago
AI is certainly getting a lot of milage as an excuse for doing bad things. Wanna sack a load of staff? - AI Wanna cut your consumer products division? - AI Wanna take away the source? - AI
- rhubarbtree 5mo ago
  Well, first AI uses security to sell models. So other companies hijack their narrative for their purposes. This is how marketing works.
esafak 5mo ago
Their product is getting commoditized: https://workspace.google.com/resources/appointment-scheduling/ https://workspace.google.com/resources/appointment-schedulin...
- no_wizard 5mo ago
  I always felt it was a matter of time before Google took notice. It has always been odd to me they didn’t have this functionality years ago. It’s been requested for a long long time
- gp14 5mo ago
  Calendar apps have been commoditized for about 15 years now but they keep growing!
- bensyverson 5mo ago
  The real downside to Google's solution is that you have to use Google Meet. Depending on your opinion of Meet, this is either no big deal or a total deal breaker.
- rhubarbtree 5mo ago
  Remember when calendly went out of business?
fhn 5mo ago
Yeah, I don't buy it. If they don't want these security reports, ignore them and continue your path. Blaming AI is just an excuse to close source. If you don't want AI to learn from your code, too late. Add genetic algorithms and fuzzing into AI and it can iterate and learn a billion times faster, no need to learn for humans.
tecoholic 5mo ago
I think people are finding ways to either enable “pro” features and at least find the right extension points to implement them easily with LLMs. Security is window dressing.
kartika36363 5mo ago
correct. guy's doing mental gymnastics all to say he's a sellout.

andsoitis 5mo ago

> Today, we are making the very difficult decision to move to closed source, and there’s one simple reason: security. It seems like an easy decision, not a difficult one.

doytch 5mo ago

I get the mentality but it feels very much like security through obscurity. When did we decide that that was the correct model?

Peer_Rich 5mo ago
hey cofounder here. since it takes my 16 year old neighbors son 15 mins and $100 claude code credits to hack your open source project
- doytch 5mo ago
  Right, but those capabilities are available to you as well. Granted the remediation effort will take longer but...you're going to do that for any existing issues _anyway_ right? I understand why this is a tempting thing to do in a "STOP THE PRESSES" manner where you take a breather and fix any existing issues that snuck through. I don't yet understand why when you reach steady-state, you wouldn't rely on the same tooling in a proactive manner to prevent issues from being shipped. And if you say "yeah, that's obv the plan," well then I don't understand what going closed-source _now_ actually accomplishes with the horses already out of the barn.
  - throwaway5752 5mo ago
    > those capabilities are available to you as well Give him $100 to obtain that capability. Give each open source project maintainer $100. Or internalize the cost if they all decide the hassle of maintaining an open source project is not worth it any more. I'm not aiming this reply at you specific, but it's the general dynamic of this crisis. The real answer is for the foundational model providers to give this money. But instead, at least one seems to care more about acquiring critical open source companies. We should openly talk about this - the existing open source model is being killed by LLMs, and there is no clear replacement.
- simonw 5mo ago
  Are you at all worried that the message you are spreading here is "We are no longer confident in our own ability to secure your data?"

ButlerianJihad 5mo ago

This seems kind of crazy. If LLMs are so stunningly good at finding vulnerabilities in code, then shouldn't the solution be to run an LLM against your code after you commit, and before you release it? Then you basically have pentesting harnesses all to yourself before going public. If an LLM can't find any flaws, then you are good to release that code. A few years ago, I invoked Linus's Law in a classroom, and I was roundly debunked. Isn't it a shame that it's basically been fulfilled now with LLMs? https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law

layer8 5mo ago
Attackers only need LLMs to be good at randomly finding one vulnerability, whereas service providers need them to be good at finding all such vulnerabilities.
fwip 5mo ago
It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did. It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.
- deleted 5mo ago
  [deleted]
- earthnail 5mo ago
  > It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once. This! I love OSS but this argument seems to get overlooked in most of the comments here.
dgellow 5mo ago
I mean, you should definitely have _some_ level of audit by LLMs before you ship, as part of the general PR process. But you might need thousands of sessions to uncover some vulnerabilities, and you don’t want to stop shipping changes because the security checks are taking hours to run

rvz 5mo ago

You know what? Great move. Open-source supporters don't have a sustainable answer to the fact that AI models can easily find N-day vulnerabilities extremely quickly and swamp maintainers with issues and bug-reports left hanging for days. Unfortunately, this is where it is going and the open-source software supporters did not for-see the downsides of open source maintenance in the age of AI especially for businesses with "open-core" products. Might as well close-source them to slow the attackers (with LLMs) down. Even SQLite has closed-sourced their tests which is another good idea.

deleted 5mo ago
[deleted]
zb3 5mo ago
> especially for businesses with "open-core" products. Then good, that overengineered, intentionally-crippled crap should go away.
wild_egg 5mo ago
Haven't the SQLite tests always been closed? Getting access to them is a major reason for financially supporting them
hayleox 5mo ago
The tools are available to everyone. It's becoming easier for hackers to attack you at the same speed that it's becoming easier for you to harden your systems. When everyone gains the same advantage at the same time, nothing has really changed. It makes me think of how great chess engines have affected competitive chess over the last few years. Sure, the ceiling for Elo ratings at the top levels has gone up, but it's still a fair game because everyone has access to the new tools. High-level players aren't necessarily spending more time on prep than they were before; they're just getting more value out of the hours they do spend.
- popalchemist 5mo ago
  I agree it's a shit tactic, but one thing I can say for those running software businesses is that it's not an equivalent linear increase on both sides. It's asymmetric, because # of both attackers and the amount of attack surface (exposed 3rd party dependencies, for example) is near infinite, with no opportunity cost for failure by the bad actors (hackers). However a single failure can bring down a company, particularly when they may be hosting sensitive user data that could ruin their customers' businesses or lives. I think Cal are making the wrong call, and abandoning their principles. But it isn't fair to say the game is accelerating in a proportionate way. See: https://www.youtube.com/watch?v=2CieKDg-JrA https://www.youtube.com/watch?v=2CieKDg-JrA Ultimately, he concludes that while in the short run the game defines the players' actions, an environment that makes cooperation too risky naturally forces participants to stop cooperating to protect themselves from being "exploited" (this bit is around 34:39 - 34:46)

simonw 5mo ago

Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-of-work-now.html https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o... Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private. > If Mythos continues to find exploits so long as you keep throwing money at it, security is reduced to a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them.

not-chatgpt 5mo ago
Security should be a non issue in the age of AI now that auditing is cheaper than ever. I'd give them more credits if they use the AI slop unmaintainability argument.
- habinero 5mo ago
  Ha ha ha ha. I wish that were true. Getting people to patch existing, known vulns is hard enough.
criddell 5mo ago
How may open source libraries have auditing budgets?
- Mordisquitos 5mo ago
  Their commercial users have auditing budgets.
  - dspillett 5mo ago
    Does your ideal world have an easy path to citizenship? I might like to live there.

woodruffw 5mo ago

Today, it's easy to (publicly) evaluate the ability of LLMs to find bugs in open source codebases, because you don't need to ask permission. But this doesn't actually tell us the negative statement, which is that an LLM won't just as effectively find bugs in closed codebases, including through black-box testing, reverse engineering, etc. If the null hypothesis is that LLMs are good at finding bugs, full stop, then it's unclear to me that going closed actually does much to stop your adversary (particularly as a service operator).

zb3 5mo ago

This has to be the most bullshit reason I've seen.. if AI can be pointed and find vulnerabilities then do it yourself before publishing the code.

dspillett 5mo ago
> if AI can be pointed and find vulnerabilities then do it yourself before publishing the code At your cost. Every time you push. (or if not that, at least every time there is a new version that you call a release) Including every time a dependency updates, unless you pin specific versions. I assume (caveat: I've not looked into the costs) many projects can't justify that. Though I don't disagree with you that this looks like a commercial decision with “LLM based bug finders could find all our bad code” as an excuse. The lack of confidence in their own code while open does not instil confidence that it'll be secure enough to trust now closed.
- zb3 5mo ago
  For-profit companies using open-source software should bear that cost - that's my position. I believe than N companies using an open source project and contributing back would make this burden smaller than one company using the same closed-source project.

bearsyankees 5mo ago

Think this is a bad, bad move... https://news.ycombinator.com/item?id=47780712 https://news.ycombinator.com/item?id=47780712

creatonez 5mo ago

This is some truly exceptionally clownish attention seeking nonsense. The rationale here is complete nonsense, they just wanted to put "because AI" after announcing their completely self-serving decision. If AI cyber offense is such a concern, recognize your role as a company handling truckloads of highly sensitive information and actually fix your security culture instead of just obscuring it.

jhatemyjob 5mo ago
I mean it's not complete nonsense, but yeah, doing it for security reasons sounds like BS. I actually thought this was going to be about how AI makes it super easy for someone to steal all their code and fold it into their own competing project. I've seen a few open source projects get sideswiped by this, AI is pretty good at copying code (and obfuscating the fact that it was copied). I suspect that's the real reason but it doesn't sound as good. So they went with this half-truth.

deleted 5mo ago

[deleted]

nativeit 5mo ago

I guess why fix vulnerabilities when you can just obscure them?

asdev 5mo ago

Who even uses their open source product?

_pdp_ 5mo ago

The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but the existence of AI is deterrent for most. Lets be honest, in recent times the only reason startups went open source first was to build a community and build organic growth engine powered by early adaptors. Now this is no longer viable and in fact it is simply helping competitors. So why do it then? The only open source that will remain will be the real open source projects that are true to the ethos.

fcarraldo 5mo ago
> The real threat is not security but bad actors copying your code and calling it theirs. How has this changed?
- HyprMusic 5mo ago
  Bad actors can rewrite it with AI and claim ownership of the result.
evanjrowley 5mo ago
I agree with you that AI's disruption of attribution is a much bigger problem, but it's also worth recognizing that not everyone has this same motivation. It mostly affects copyleft open source licenses. Attribution isn't required for permissive many open source licenses. Dependencies with those licenses will oftentimes end up inside closed source software. Even if there isn't FOSS in the closed-source software, basically everyone's threat model includes (or should include) "OpenSSL CVE". On that basis, I doubt Cal is accomplishing as much as they hope to by going closed source.
fedeb95 5mo ago
If you copy the code infringing licenses, yes, it will be harder to legally sort things out. Otherwise, copying code and improving it with AI or with humans is the same, as long as the product improves. I doubt that many semi-automatic AI copies can really improve a product more than the original team, for really valid products. AI will be a filter of bad quality.

popalchemist 5mo ago

Seems like it's just being used as a convenient pretense to back out of open-source.

ezekg 5mo ago
I mean, they were a COSS startup using the AGPLv3, so checks out. :)
- liamgm 5mo ago
  Changed the license of the foss version cal.diy to MIT . Grace in disguise , now enterprise user can host cal.diy without worries of viral licensing .
  - ezekg 5mo ago
    That was my point. Only reason they were using the AGPLv3 in the first place was as a hush hush non-compete, and now that that doesn't matter...

barelysapient 5mo ago

I hate how this sounds...but this reads to me "we lack the confidence in our code security so we're closing the source code to conceal vulnerabilities which may exist."

iancarroll 5mo ago

I know plenty of security researchers who exclusively use Claude Code and other tools for blackbox testing against sites they don’t have the source code for. It seems like shutting down the entire product is the only safe decision here!

hmokiguess 5mo ago

Risk tolerance and emotional capacity differs from one individual to another, while I may disagree with the decision I am able to respect the decision. That said, I think it’s important to try and recognize where things are from multiple angles rather than bucket things from your filter bubble alone, fear sells and we need to stop buying into it.

adamtaylor_13 5mo ago

Could you not simply point AI at your open source codebase and use it to red-team your own codebase? This post's argument seems circular to me.

deleted 5mo ago

[deleted]

tudorg 5mo ago

It's funny that this news showed up just as we (Xata) have gone the other direction, citing also changes due to AI: https://xata.io/blog/open-source-postgres-branching-copy-on-write https://xata.io/blog/open-source-postgres-branching-copy-on-... We did consider arguments in both directions (e.g. easier to recreate the code, agents can understand better how it works), but I honestly think the security argument goes for open source: the OSS projects will get more scrutiny faster, which means bugs won't linger around. Time will tell, I am in the open source camp, though.

microflash 5mo ago
Just wanted to appreciate the open-source work by Xata. I’ve been eyeing pgroll [1] for schema migrations after Liquibase license shenanigans (the only barrier for me is json-based migration instead of sql-based migrations) [1] https://github.com/xataio/pgroll https://github.com/xataio/pgroll

tokai 5mo ago

Security through obscurity has been known to be a faulty approach for nearly 200 years. Yet here we are.

righthand 5mo ago

This is the future now that AI is here. Publishing is going to be dead, look at the tea leaves, how many engineers are claiming they don’t use package managers anymore and just generate dependencies? 5 years and no one will be making an argument for open source or blogging.

evanjrowley 5mo ago

Juxtapose this with the fact that many HNers will decry strong copyleft FOSS licenses as not being truly "open source" - the reality is that closed source software is still full of open-source non-copyleft dependencies. Unless you're rolling your own encryption and TCP stack, being closed source will not be the easy solution that many imagine it to be.

NetMageSCW 5mo ago
Where is the Windows TCP stack source?

dec0dedab0de 5mo ago

This seems dishonest, like someone is forcing the decision for other reasons, and they're using security and AI as a distraction.

poisonborz 5mo ago

AI sure is useful as a scapegoat for any negative PR inducing moves.

xnx 5mo ago

Saaspocalypse is coming for cal.com

fontain 5mo ago

Monumentally dumb given their codebase is already public and the type of security issues that exist in software are usually found in the oldest code. But also, and more importantly, cal.com launched coss.com last year, open source is (ostensibly) their DNA. How could they do a complete 180 on something so fundamental and think that wouldn’t worry customers, much more so than their codebase being public? I cannot even begin to understand this. Surely there must be more to the story?

abound 5mo ago
Oh wow the coss.com thing makes this so much worse. Making such an aggressive and public commitment to open source to then turn around and do something like this is a pretty rough look.
t0mas88 5mo ago
Coss.com reads like a half assed pivot if you look at it with today's news. It's clear cal.com isn't making enough money and going closed source is yet another attempt to fix that.

abound 5mo ago

This certainly makes me feel better about the project I started a few months ago to replace my Cal.com instance with a smaller, simpler self-hosted tool https://git.sr.ht/~bsprague/schedyou https://git.sr.ht/~bsprague/schedyou

righthand 5mo ago

Good for them. I’m sure they saw the writing on the wall when Monday.com was cloned. This is the right move.

analogpixel 5mo ago

TIL I learned about yet another calendar application I don't need. Someone should setup their openclaw to just write a new todo/calendar app each week; they'll be billionaires by the end of the year.

deleted 5mo ago

[deleted]

Tepix 5mo ago

Hey cal.com, as a potential customer, you have just lost me. Open source is set to profit from improved transparency in the SSDLC. With closed source, you will have to trust the software vendor instead. I'm not sure I agree with Drew Breunig, however. The number of bugs isn't infinite. Once we have models that are capable enough and scan the source code with them at regular intervals, the likelihood of remaining bugs that can be exploited goes way down.

post-it 5mo ago

- You know, Lindsay, as a software engineering consultant, I have advised a number of companies to explore closing their source, where the codebase remains largely unchanged but secure through obscurity. - Well, did it work for those companies? - No, it never does. I mean, these companies somehow delude themselves into thinking it might, but... but it might work for us.

codegeek 5mo ago

I am beyond convinced at this point that you either run an Open Source Project with a small revenue company (single digit millions) or run a software company that does more than 10M ARR at the least and be closed source. I know there are exceptions but most open source Software companies are providing code with heavy restrictions or teaser features and gate keep everything in their "ee/enterprise" version etc.

wqtz 5mo ago

In my advisory job founders always raise the question about open sourcing within the first hour of meeting me. They think that open sourcing product means transparency and developer trust which helps with early adoption. Every single founder I talked to brings up open source as a market penetration method to drive the initial adoption. I always say to just stop with the virtue signaling led sales technique. I despise the "we are like the market leader of our niche but open source" angle. Developer as a buyer and as a community these days in my opinion do not care about open source anymore. There is no long term value to that. The moment a product gets traction the open source elements is a constant mild headache as open source product means that they have no intellectual copyright on the core aspect of the product and it is hard to raise money or sell the company. And whenever a product gets traction they will take any excuse to make it close source again. With an open source product they are just coasting on brand. Regardless of what your personal opinion is, this has been largely true for most for-profit business. Open source is largely is nothing more then a branding concept for a company who is backed by investors.

wartywhoa23 5mo ago
> Open source is largely is nothing more then a branding concept for a company who is backed by investors. And a religion that was invented by those who wanted to have all the world's code for free to train AI to code.

dang 5mo ago

Related ongoing threads: Open Source Isn't Dead - https://news.ycombinator.com/item?id=47780712 https://news.ycombinator.com/item?id=47780712 Cybersecurity looks like proof of work now - https://news.ycombinator.com/item?id=47769089 https://news.ycombinator.com/item?id=47769089

aizk 5mo ago

Sounds backwards to me.

notnullorvoid 5mo ago

Security through obscurity can be a good security layer, but you need to maintain obscurity. That's a lot harder than Cal.com seems to realize. For example using something like Next.js means a very large chunk of important obscurity is thrown out the window. The same for any publicly available server/client isomorphic framework.

com2kid 5mo ago

Proposition 1: The majority of a code in a modern app is from shared libraries Proposition 2: The most popular shared libraries are going to be quickly torn apart by LLM security tools to find vulnerabilities Proposition 3: After a brief period of mass vulnerability discovery, the overall quality of shared libraries will dramatically increased. Conclusion: After the initial wave of vulnerabilities has passed, the main threat to open source code bases is in their own comparatively small amount of code.

behringer 5mo ago

Security via obscurity and you get to blame AI too! What a win for their marketing team.

axeldunkel 5mo ago

Sounds like "security by obscurity" to me - if you think AI is so good at finding security issues - it will find them in compiled code as well. Why not using it in your favor and let it search for bugs you'd otherwise not find?

traderj0e 5mo ago
You can lock down the source and also use AI to look for bugs in it. It does take significantly more time and money for AI to find bugs in compiled code. That said, I agree with another commenter that this seems like more of a business decision than a security one.

mellosouls 5mo ago

The founder proclaimed "Open Source is Dead" in the original tweet. I thought this was grandiose and projecting their own weakness onto others, an extremely unappealing marketing position that may get clicks in the short term but will undermine trust beyond that.

lrvick 5mo ago

There are endless closed calendar options. Cal.com being FOSS and not making us feel locked in forever was the only reason we chose it over wasting limited cycles self hosting this at Distrust and Caution. AI can clone something like cal.com with or without source code access, so in trying to pointlessly defend against AI they are just ruining the trust they built with their customers, which is the one thing AI can never create out of thin air. We exclusively run our companies with FOSS software we can audit or change at any time because we work in security research so every tool we choose is -our- responsibility. They ruined their one and only market differentiator. We will now be swapping to self hosting ASAP and canceling our subscriptions. Really disappointing. Meanwhile at Distrust and Caution we will continue to open source every line of code we write, because our goal is building trust with our customers and users.

egorfine 5mo ago

What's preventing cal.com to run the AI researcher over their own codebase and find their vulnerabilities before anyone else and patch them all by tomorrow morning? That's right. Nothing.

wartywhoa23 5mo ago
Unwilling to pay AI tax, maybe?
- egorfine 5mo ago
  No worries, someone else will do that for them. Just like they explained. And given that they will not rewrite the whole codebase in the next few days it means that security vulnerabilities are still there to be discovered by someone willing to pay the AI tax.

ryanleesipes 5mo ago

Head of Thunderbird project here. Our scheduling tool, Thunderbird Appointment, will always be open source. Repo here: https:// github.com/thunderbird/appointment Come talk to us and build with us. We'll help you replace Cal.com

ezekg 5mo ago
"Thunderbird, the open source Cal.com"
- ryanleesipes 5mo ago
  Love it!
raybb 5mo ago
You should add some screenshots to the readme or somewhere before a sign in screen. Sounds like a great tool though. How much is the hosted version?
- bean469 5mo ago
  There are screenshots in the link[1] provided in the README.md 1. https://stage.appointment.day https://stage.appointment.day
- m3nu 5mo ago
  A Docker image would be good too.
- ryanleesipes 5mo ago
  Yes, we should. Will do that today
- devmount 5mo ago
  We added some screenshots to the repository now. Thanks so much for the suggestion!
sashimimono 5mo ago

constantlm 5mo ago

Security through obscurity isn't a great strategy.

jemiluv8 5mo ago

I have fond memories of this project. Contributing to it really helped me ramp up my dev skills and was effectively my introduction to monorepo’s in JavaScript. It was the kind of codebase I couldn’t get my hands on while working in my part of the world. Good luck going closed source.

smetannik 5mo ago

This sounds more like a good excuse to go closed source. I feel that real reason might be revenue-related.

CamperBob2 5mo ago

Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. AI also goes a long way towards erasing the distinction between source code and executable code. The disassembly skill of a good LLM is nothing short of jaw-dropping. So going closed-source may be safer for SaaS, but closing the source won't save a codebase from being exploited if the binaries are still accessible to the public. In that sense, instead of dooming SaaS as many people have suggested AI will do, it may instead be a boon.

alance 5mo ago

I only found cal.com in the first place because I searched for an open source calendly alternative.

sadeshmukh 5mo ago

Security by obscurity has never been real.

amazingamazing 5mo ago

this is a big nothing. they relicensed the previous cal.com as cal.diy (MIT by the way, instead AGPL or something else) and effectively forked their own product into the "new" cal.com. anyone who cares would just use cal.diy as they were prior to this announcement with cal.com

theturtletalks 5mo ago
We’d hope but they could neuter Cal.diy over time. From their chart between the differences of cal.diy and cal.com, teams are not supported. I’m self hosting Cal.com and I think I do have access to teams as of right now.
NetMageSCW 5mo ago
That’s incorrect - they explained that cal.diy is missing a lot of recent changes.

neuroelectron 5mo ago

Chatgpt, write me a reason to make more money as a tech ceo. Charge for api access, take a cut of the extensions economy. How do i do that, I'm open source?

theturtletalks 5mo ago

Enshittification has come for VC backed open-source. AI has deemed commercial open source obsolete especially when users can point Calude Code to calcom on GitHub and ask it to make them scheduling features directly into their product. That’s what spooked Cal.

ernsheong 5mo ago

Well let’s just finish and CLOSE them off. Delete all your subscriptions, boys.

a-fadil 5mo ago

Open source means living under constant scrutiny. AI just made that scrutiny cheaper and faster. I feel this every day maintaining an open source project. The temptation to close the source is real but let’s not forget that open source is what raised the bar for software quality in the first place.

dnnddidiej 5mo ago
Not really. Open source just means distributing the source. Either via CD or some internet based protocol. Maybe you are referring to the whole Github thing.
- mynameisvlad 5mo ago
  I mean, by definition, open source means that the source code is available and therefore _open_ to scrutiny. Regardless of how it is distributed.
  - dnnddidiej 5mo ago
    Right. But what is the problem? * Someone lols at code. Answer: ignore them. * Someone sees your vulns. Answer: someone is already trying to hack you anyway.
wartywhoa23 5mo ago
Open source is what made this AI shitshow possible in the first place.

theahura 5mo ago

I'm sorta suspicious. I don’t really think this is why they are moving to closed source. It’s true that there is more security risk, but that actually justifies being open source, because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory). My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. But I'd want to see more adoption of something like the Ship of Theseus license (https://github.com/tilework-tech/nori-skillsets/pull/465/changes https://github.com/tilework-tech/nori-skillsets/pull/465/cha...) before giving up on open source entirely

sgbeal 5mo ago
> My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. Since such "clean room" implementations ostensibly do not see the source, it's arguably irrelevant whether such sources are open are not. Such implementations will happen regardless of whether the sources they're reimplementing are opened or closed.
ezekg 5mo ago
I very much doubt that addendum would hold up to a lawyer.
NetMageSCW 5mo ago
> because open source tooling can spend more tokens hardening itself against security vulns than closed source tooling (at least, that’s the theory) Whose theory? That makes no sense at all. The creator can spend the same amount on tokens whether it is closed or open source.
Gormo 5mo ago
> My strong hunch is they are moving to closed source because it is now trivial to copy a product with AI clean rooms. Which, tbf, is a totally valid reason to move closed source. The "clean room" part of clean-room reverse engineering implies that there is no exposure to the original copyrighted code on the part of those doing the reimplementation, whether human developers or AI. Traditionally, if you're working of the source code itself, you have one party translate the source code back into a design document, specifying behavior, and then you have another party implement that design spec with original code. If you already have a running copy of the software to model the behavior off of, then you don't need the original source code in the first place. So going closed source will have zero effect on the capacity of AI tools to be used for clean room reverse engineering: all you need is the runtime. > But I'd want to see more adoption of something like the Ship of Theseus license (https://github.com/tilework-tech/nori-skillsets/pull/465/cha https://github.com/tilework-tech/nori-skillsets/pull/465/cha...) before giving up on open source entirely This license doesn't seem valid: a license can't redefine what qualifies as a derivative work. That's determined by copyright law itself, and if copyright law says that a clean-room reimplementation isn't a derivative work, then it isn't restricted by copyright, so doesn't need a license in the first place.

usernametaken29 5mo ago

Just a random thought. Up until yesterday this project was open source. The code base won’t be rewritten tomorrow. More likely is that conserved parts of the source code, something like 90% will just remain the same. Particularly the core database schema around users and security are likely to stay the same. Since the old code is already out there what’s stopping me from exploiting the software as it was? This looks an awful lot like marketing to me, and not like real security concerns.

diebillionaires 5mo ago

Lame. "We don't want AI pointed at our code so we're going closed source". That's hilarious and a cover up.

szszrk 5mo ago
I think them going closed source is as much related to security and AI, as work from office is related to productivity in large companies. So not really. I think they went closed source as there are too many decent clones based off their code and they realized it's eating up their niche.

huslage 5mo ago

Cal.com is failing. This is a rugpull with an AI excuse.

dhruv3006 5mo ago

I guess this is an AI excuse again.

pcblues 5mo ago

Security by obscurity. Good luck. So novice.

opem 5mo ago

> When we started Cal.com, we believed deeply in open source. No you certainly didn't, otherwise you shouldn't have come up with such a meaningless excuse!

sreekanth850 5mo ago

This has one of the most shittiest codebase out of all. Not surprised by this move.

thegdsks 5mo ago

This is why CC0 and MIT matter for projects people depend on. Once you build on something with a restrictive license this is always a risk.

quotemstr 5mo ago

LOL. Every generation has to learn anew that security through obscurity is no security at all.

sgbeal 5mo ago

> Today, we are making the very difficult decision to move to closed source, and there’s one simple reason: security. (Enter name of large software vendor here) has long-since proven that security through obscurity is not a real thing.

kartika36363 5mo ago

thats like the funniest excuse to cash out on people's open source contributions

whatiathisnon 5mo ago

This is completely stupid and ridiculous. Why not just use AI to patch your software? Its just as effortful as someone finding and exploiting a vuln on your system. What's worse is your choosing to keep it buggy behind closed doors so no one can see the bugs. That's 100% the wrong approach.

abusedmedia 5mo ago

The article is leaking from all sides. As a wannabe hacker would find a hole in a public repo, what can the repo owner do, who knows every detail of the project and has a high interest in it, also economically?

seyz 5mo ago

[dead]

eloisant 5mo ago

This reads like a post from 1995. "But if everyone can read the source code, they'll be able to find vulnerabilities more easily!" No. Security by obscurity has proven wrong.

fedeb95 5mo ago

security by obscurity doesn't work.

ButlerianJihad 5mo ago
> security by obscurity doesn't work. That is not true. https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity Security through obscurity doesn't work in isolation. It doesn't work as the only solution. It is discouraged, because it can be a panacea. But it also doesn't hurt in many instances. Holding back your source code can be a strategic advantage. It does mean that adversaries can't directly read it (nor can your friends or allies!) Having a proprietary protocol or file format, this is also "security through obscurity" and it may slow down or hinder an attacker. Obscurity may be part of a "defense in depth" strategy that includes robust and valid methods as well. But it is harmful to baldly claim that "it doesn't work".

redsocksfan45 5mo ago

[dead]

Nukahaha 5mo ago

Isn't the joke that everything is open source if you can read assembly? Pretty sure someone is working on an AI that reads assembly... Not sure hiding the codebase away is a viable solution!

ButlerianJihad 5mo ago
That may be true for software that you download and install as an app, but for SaaS, there is no need to expose the code to anyone at all. Only your API endpoints are available. You can try and "black box reverse engineer" through the client code and its API calls, but that's not the same as having the server code in hand to pick apart.

aswerty 5mo ago

Surely the argument is just to have an LLM stressing for vulnerabilities during the build pipeline before merging to main? Resulting in better security from LLMs. One must assume this was a direction they wanted to move towards and this is the justification they thought would be most palatable.

equinox6380 5mo ago

[dead]

Tepix 5mo ago

The AI companies profit hugely from open source. In fact, without open source, their most significant financial success (coding assistants) wouldn't exist. They should provide free continued git commit security analysis for open source projects. That would increase the quality of open source projects and would inspire more projects to go open source, which is also a win for the AI companies.

alienbaby 5mo ago
This was my thought too. Your tool is great at finding vulnerabilities, and we want software to be secure for everyone, secure code should not be out of reach to those who can't afford it. Scan everyone's code, for free. Make all code as secure as an llm can make it as a baseline.

ltbarcly3 5mo ago

Let me share the press release template for 2026: Hi {audience}, It is with a heavy heart that I have to announce that {thing we were going to do anyway} is necessary due to AI. AI has changed the industry and we are powerless to do anything other than {unpopular decision we were going to do regardless}.

swordsith 5mo ago

Something about a scheduling/productivity app (one of the most common vibe-coded projects people make) being the subject of this is funny to me. I wonder how many tokens have been wasted making apps like this, let alone time.

Hendrikto 5mo ago

> Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities. So do that and fix your bugs. This post makes no sense.

sanghyunp 5mo ago

[dead]

redoh 5mo ago

[flagged]

robinhood 5mo ago

Very weak argument. You could have had the same speech before AI. I would rather say that the core product is not strong and differentiated enough to resist this new age of coding, and it's an attempt to protect revenues.

m11a 5mo ago

I'm not sure security through obscurity is a great practice? Not to mention, I presume the core bits of Cal.com's source code are already in place and aren't going to change significantly? Like, this feels like a business decision and not a security decision

james-clef 5mo ago

I'm all for FOSS as well, but not sure I would have open sourced the commercial offering to begin with. Love the idea though, it's so bold.

rbbydotdev 5mo ago

I honestly was surprised with the response I got, for what was basically a Sunday hack project: https://github.com/rbbydotdev/someday https://github.com/rbbydotdev/someday I think people really like how it's free (runs on google app scripts) and open source. I've personally moved onto google's free gmail calendar scheduling tool, which strangely took pretty long to come to market. Calendly stretches back to ... 2013? Scheduling, oddly feels a little niche (maybe less so today?), when it shouldn't be. Maybe there some more opportunity there.

8260337551 5mo ago

Judging by the CEOs picture on LinkedIn, he's full of himself.

Gormo 5mo ago

EasyAppointments (https://github.com/alextselegidis/easyappointments https://github.com/alextselegidis/easyappointments) is still FOSS. We managed our team calendars on it at a previous company, but I rolled out Cal.com due to more apparent support and sophistication at my current company. Turns out most of that sophistication turned out to be bloat: we saw successive version releases add features we didn't care about while increasingly putting previously open features, like team calendars, behind a paywall. This move by Cal.com seems to be transparently an attempt to maintain that paywall against users who'd otherwise just use LLMs to remove it. I guess it's back to EasyAppointments, which still seems to work just fine.

zerotoship 5mo ago

users can just point Claude Code at cal on GitHub and ask it to build xyz features directly into their own product .. and most of them won't bother following the license. it's happening with so many projects in open source

nexustoken 5mo ago

[dead]