Cal.com is going closed source
A scheduling startup that built its brand on being open source is moving its main product to closed source, citing AI-enabled code scanning and security risks as the reason. Many commenters view this as security-through-obscurity and argue the company could instead use the same AI tools to harden its code, suggesting the real drivers are monetization, competition, and fear of AI-fueled cloning. The debate broadens into whether AI shifts the economics and viability of commercial open source, with some predicting more projects will close their code while others see AI as strengthening the case for transparent, jointly audited software.
Motivation for Going Closed Source
- Many commenters see the “security because of AI” rationale as a pretext for a business move (protecting revenue, preventing clones, VC pressure) rather than a genuine security pivot.
- Others accept that AI-assisted vulnerability discovery and noise (low-quality reports, LLM-found “vulns”) increase the burden on maintainers, especially for commercial open-core products.
Security Through Obscurity Debate
- Large portion of the thread argues that closing the source is “security by obscurity,” historically considered weak: vulnerabilities still exist and can be found via binaries, traffic analysis, or black-box testing.
- Counterpoint: even if not sufficient alone, obscurity can be one layer in “defense in depth” and can raise attacker cost (more tokens, more effort, less direct access to code).
- Skeptics say the move signals “we don’t trust our own security,” which may undermine user confidence more than open code does.
LLMs, Vulnerabilities, and Economics
- One camp: if LLMs are great at finding bugs, vendors should run them themselves pre-release; open source benefits most because multiple parties can “share the auditing budget.”
- Opposing view: defense is asymmetric; defenders must find all bugs, attackers only one. Continuous LLM scanning on every change and dependency update can be expensive.
- Some see cybersecurity becoming “proof-of-work”: you must spend more tokens hardening than attackers spend attacking.
- Others highlight that attackers and defenders have access to the same tools, so relative advantage may not change much.
Impact on Open Source and Users
- Several users state they chose Cal.com specifically because it was open source / self-hostable and plan to migrate away now.
- Some note that the previous open version has been relicensed as a separate MIT-licensed project, but worry it could be neutered over time.
- Broader sentiment: AI is accelerating a trend where VC-backed “open source” is used mainly as a growth and branding tactic, then revoked once traction is achieved.
- Others point to alternative open scheduling tools (e.g., Thunderbird Appointment) and personal projects, and predict more such replacements.