Susan Moeller
4.3K posts
Susan Moeller
@SusanCMoeller
Growth Marketing Manager at https://t.co/nTbGgdY8lX Data, marketing, and coffee make my world go round. Founder Women in #contentmarketing https://t.co/kCeDP3Je4p
New Jersey, USA Katılım Şubat 2015
3.5K Takip Edilen2.8K Takipçiler
@zeeg @pumfleet Quote: “System security should not depend on the secrecy of the implementation or its components”
csrc.nist.gov/pubs/sp/800/12…
At best security trough obscurity is a delay mechanism
English
I think they mean well, but closed source doesnt improve security at all. In fact, most security researchers dont even bother digging into the source code because its not needed.
If you told me you're worried about folks ripping off your product because its source available and you're not sure you can defend, identify, prosecute, etc that would make a lot more sense.
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English
has anyone from the #OSS community made an argument different than "it's fine. nothing to see here"?
The only chatter I'm seeing is based on a blind faith in things as they were being good enough for the future.
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English
Genuinely curious to see more detailed defense of security through transparency that isn’t based on long standing community wisdom. That is necessarily biased toward what WAS true. What’s the rationale in current reality where there are motivated malicious actors in the picture at massive scale
English
@pumfleet @calcom Security through obscurity is never a good idea, sure having access to the source code makes hacking it easier but it also allows for more eyes to report issues faster, and truth to be told 90% of hacks are because of people not because of software. Anyway whatever works for you!
English
Open source is dead.
That’s not a statement we ever thought we’d make.
@calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up.
AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost.
In that world, transparency becomes exposure. Especially at scale.
After a lot of deliberation, we’ve made the decision to close the core @calcom codebase.
This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible.
We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple:
Protecting our customers and community at all costs.
This may not be the most popular call.
But we believe many companies will come to the same conclusion.
My full explanation below ↓
English
English
English
@RockPreddy @pumfleet @calcom In businesses that rely on technology the two decisions are often the same.
English
Susan Moeller retweetledi
I empathise deeply with this stance. Reality meets Idealism. I don't blame them at all.
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English
English
@SusanCMoeller @pumfleet @calcom 1) violates the implicit trust established with your community (if you were closing for $ this doesn't matter)
2) vendor lock in: when closed: if you change X, i cant fork to save X
3)transparency and trust-but-verify: what _are_ those cache servers doing?
English
@JonSnyderHQ @pumfleet @calcom Yes— we are all functioning in a psychopathic hurricane environment. Making decisions and calling it like we see it and not knowing if the whole thing will spin a different direction in the next week.
English
@smakosh @pumfleet @calcom @llmgateway That’s the kind of statement you can live to regret— rate of change is so fast right now that “always” and “forever” statements are dangerous and/or laughable.
English
@AkshayApsingi @pumfleet @calcom I think it will. What will replace this model? That’s what’s interesting me at the moment— what’s next?
English
cal once paid developers to fix live issues in github, anybody with internet connection and some coding skills was curious enough to understand the product end to end and fix issues and make some $$$.
Now its closed source - vibe coders just wanted open source contribution in their Resume and flooded with 100s of PRs, Many possible vulnerabilities in so many PRs
>Code became entire surface area for attack
>team can't keep up with risk of attack for every PR that gets merged, Even Human developers have high chance to miss these.
> Realise only few need to be eligible to read/write code, cause everybody is just trying to push slop.
> make it closed source, cut down AI slop, reduce cyber attack threat
is this going to happen with more community projects?
English
English
@maxintechnology @pumfleet I dont see this as a statement on what is best forever. The speed of change is so fast now that permanent decisions are kind of a laughable idea.
English
@pumfleet It's not about whether it's popular or not. It's about whether it's the right decision. If you keep the source closed while you wait it out and weather the storm, fine. If you think closed source is now the superior model permanently, you don't understand the new environment.
English
Appreciate the support 🙏
I knew this would be an unpopular decision but I care way more about our customers and the trust we have with them than random haters on Twitter
austin petersmith@awwstn
everybody is furious with @peer and @pumfleet for doing this well, everybody except their actual customers who care a lot more about security than they do about indie devs having the right to self-host enterprise software this is clearly the right call
English
The response to this is so polarizing. What O/S maintainers are facing right now is real. The looming security threats are real.
For context, we built a frontier zero-day factory called Apex. Yes, factory: you feed in code or other assets, let it rip for hours or days, and get zero-days out of the system. The tool has received almost a million dollars from bug bounty programs.
The cost of hacking is slowly going to zero, and defenders today are at a disadvantage compared to attackers. If you're a business, the expectation to ship fast is going through the roof with agents building software. If you have customer data or money worth protecting, it's irresponsible to be ignoring what's happening in security right now. It's commendable for @pumfleet and @calcom to be having this difficult conversation out in the open.
The counterpoints
1. "But Codex/Claude/Gemini is very good at decompiling, so this doesn't achieve anything": right now, it's an order of magnitude easier to find bugs in O/S code than decompiled or reverse-engineered ones. We've first hand experience here, having found severe bugs in both O/S and closed sourced assets with our 0-day factory. Closed source assets are still hit or miss. But I expect the gap to be lower as we work more. But O/S will always be easier to find bugs in and exploit compared to the reversed version. This applies not just to AI tools, but also for humans.
2. "Security through obscurity doesn't work": I agree, what @calcom and many others are doing is buying time. We're living in a unique moment in time where old dogmas need to be questioned. We went from "AI can't do basic" to "frontier models solving unsolved math problems" pretty quickly. There's a similar phenomenon happening in security
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English
Respect for the team here. AI has massively muddied the water. Choosing to protect customers is the right call.
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English
Never been a founder, but I've worked for several. The decisions they make are consequential. Deciding based on what's best for the people who trust you enough to pay you for your service is the right choice always.
austin petersmith@awwstn
everybody is furious with @peer and @pumfleet for doing this well, everybody except their actual customers who care a lot more about security than they do about indie devs having the right to self-host enterprise software this is clearly the right call
English
Susan Moeller retweetledi
I agree 100%. One one hand, @calcom news are really sad to hear. On the other hand... Completely understandable.
OpenSource is dead, and will either be rich folks doing it bc they don't need to work, or corporate pseudo-opensource :(
Bailey Pumfleet@pumfleet
Open source is dead. That’s not a statement we ever thought we’d make. @calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up. AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost. In that world, transparency becomes exposure. Especially at scale. After a lot of deliberation, we’ve made the decision to close the core @calcom codebase. This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible. We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple: Protecting our customers and community at all costs. This may not be the most popular call. But we believe many companies will come to the same conclusion. My full explanation below ↓
English