Everytime this happens I only hear either

• "We don't know security so we will hide our shitty code"

Or

• "We want to make more money but here is an excuse"

The silver lining of "AI" is that it's a convenient excuse to be anti-user. It's okay as long as you are "fighting the AI"

I expect to be chugging verification cans in 2027

They don’t seem to realize that higher level languages help us understand the code. Language models will be similarly capable of reading the binaries they ship. So what they doing is hiding code from users, not machines.

To clarify, I don’t mean right now. They haven’t been sufficiently trained on machine code and that lacks some semantic help. But the future they fear will have transformers just as capable with lower level code.

AI help us to make more money

So... In no time at all, they're going to be breached. Proving them wrong.

Will they go back to open source after that? No. Of course not. Because it was never about security to begin with. AI is just an excuse.

It's like saying, "anyone can scan the source for vulnerabilities! It's so easy. Too easy! That's why we're not going to justdo that ourselves and instead bury our heads in the sand and pretend the availability of source code was the problem."

Security through obscurity never works. This is a terrible decision, i don’t know anything about this project but it seems short sighted to focus on going closed source instead of fixing security vulnerabilities.

Open core, closed extensions. Not really clear how that significantly improves the situation. I doubt they'll diverge the two code bases(?).

The vault symbolism is pretty bad. A software product is much different to a vault, and a sister-vault-product you publish the blueprint for anyway.

At the same time, we still care deeply about open source. That’s why we are releasing a version of our codebase to the community under the MIT license as Cal.diy.

While our production codebase has significantly diverged, including major rewrites of core systems like authentication and data handling, we want to ensure there is still a truly open version available for developers, hobbyists, and anyone who wants to explore and experiment.

Huh? I don't get it. So the open product is an older, worse/different version/codebase? And they can do that without impacting their product risk because it's different?

I wasn't a huge fan of Cal.com anyways, at least the self hosted experience. Half the features, including multiple users, are blocked behind a subscription. It's absurd.

I switched over to Easy!Appointments

LOL.

Before, the whole world operated on "security through obscurity"...

AHAHAHAHAHAHAHAHAHAHAHAHA. 😂 🤡