Open Source Isn't Dead

Original Article ↗ Hacker News Discussion ↗

A scheduling SaaS vendor’s decision to close its formerly open-source codebase, citing AI-driven vulnerability scanning, has reignited debate over whether openness now weakens or strengthens security. Commenters argue over “security through obscurity” versus the benefits of many eyes and automated audits, while also highlighting business pressures: AI makes it easier both to clone products and to flood maintainers with low-quality PRs and bug reports. Many see the move less as a purely technical necessity and more as a symptom of the growing tension between open-source ideals and the economics of running a commercial software company in the AI era.

Motivations for going closed source

  • Many commenters see the AI-vulnerability argument as a pretext; they suspect the real driver is protecting revenue from clones and tightening control over a maturing SaaS business.
  • Others argue a company is entitled to change licensing for any reason, and that users are not owed perpetual free work.
  • Some feel misled by the security framing and want more transparency about the mix of business vs. security motives.

AI, vulnerability discovery, and security posture

  • Several maintainers report a surge of AI-driven vulnerability reports on OSS, ranging from trivial to serious.
  • Others note closed-source vendors can and do run the same AI scanners internally; attackers can also use AI against binaries and APIs.
  • Concern that bug discovery has scaled with AI, but patching capacity has not; security becomes a backlog/throughput problem.

Open vs closed source security debate

  • One camp: open source with “many eyes” plus AI tools yields more reports, faster fixes, and ultimately more secure software.
  • Opposing camp: exposing source makes automated exploitation vastly easier; black-box attacks remain harder and rate-limited by network/API constraints.
  • Nuanced view: “security through obscurity” is weak as a primary defense but valid as an extra layer that raises attacker cost, especially in an AI-rich world.

Business, licensing, and cloning concerns

  • AI makes it trivial to:
    • Rewrite OSS projects in another language or style to dodge licenses.
    • Strip freemium limits from open code.
    • Spin up feature-competitive clones quickly.
  • Many see this as undermining traditional “open core” and hosted-OSS business models.

Impact of AI on OSS maintenance and contributions

  • Some maintainers are overwhelmed by low-quality, AI-generated PRs and vulnerability reports; a few disable PRs entirely.
  • Others use AI for nightly pentests, sandbox-escape checks, or dependency removal, and share workflows as emerging best practice.

Broader implications for open source and content

  • Fears that AI scraping will push more code and content behind paywalls or closed licenses.
  • Counterpoint: free/open content still confers discovery and marketing advantages.
  • General worry that commercialization, VC pressures, and AI will further strain already fragile OSS sustainability.