3 ms·

The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but

by _pdp_ 6mo ago

The real threat is not security but bad actors copying your code and calling it theirs. IMHO, open source will continue to exist and it will be successful but the existence of AI is deterrent for most. Lets be honest, in recent times the only reason startups went open source first was to build a community and build organic growth engine powered by early adaptors. Now this is no longer viable and in fact it is simply helping competitors. So why do it then? The only open source that will remain will be the real open source projects that are true to the ethos.

fcarraldo 6mo ago
> The real threat is not security but bad actors copying your code and calling it theirs. How has this changed?
- HyprMusic 6mo ago
  Bad actors can rewrite it with AI and claim ownership of the result.
evanjrowley 6mo ago
I agree with you that AI's disruption of attribution is a much bigger problem, but it's also worth recognizing that not everyone has this same motivation. It mostly affects copyleft open source licenses. Attribution isn't required for permissive many open source licenses. Dependencies with those licenses will oftentimes end up inside closed source software. Even if there isn't FOSS in the closed-source software, basically everyone's threat model includes (or should include) "OpenSSL CVE". On that basis, I doubt Cal is accomplishing as much as they hope to by going closed source.
fedeb95 6mo ago
If you copy the code infringing licenses, yes, it will be harder to legally sort things out. Otherwise, copying code and improving it with AI or with humans is the same, as long as the product improves. I doubt that many semi-automatic AI copies can really improve a product more than the original team, for really valid products. AI will be a filter of bad quality.
Gormo 6mo ago
> Now this is no longer viable and in fact it is simply helping competitors. So why do it then? > The only open source that will remain will be the real open source projects that are true to the ethos. Well, the second point seems like the answer to the previous question. The original model of monetizing FOSS -- support contracts, risk indemnification, etc., for an otherwise functionally equivalent product -- will still remain viable. But those trying to thread the needle of trying to use open-source to push a "freemium" model are now going to hit a wall: if you were withholding features from the community version in order to paywall them for the premium version, and now AI has made it easy for users to add those features back without paying you, then you're screwed. The people who were going to use AI to bypass your paywall are still not going to be your customers, but you no longer have the differentiator to put you ahead of the competitors that were already closed-source to begin with for the customers who are willing to pay. I originally deployed Cal.com because I wanted an open-source solution. But now, why would I choose a closed-source Cal.com over Calendly? If I'm forced to go SaaS, I'll probably go with the more widely used Calendly. If I'm not forced to go SaaS, I'll forego them both, and go back to something like EasyAppointments, knowing that I won't be in conflict with the authors if I choose to add my own "premium" features to it, whether with AI or by hand. All Cal.com did here was remove any chance that I'd ever pay them anything.

by _pdp_ 6mo ago

fcarraldo 6mo ago

> The real threat is not security but bad actors copying your code and calling it theirs. How has this changed?

HyprMusic 6mo ago
Bad actors can rewrite it with AI and claim ownership of the result.

evanjrowley 6mo ago

I agree with you that AI's disruption of attribution is a much bigger problem, but it's also worth recognizing that not everyone has this same motivation. It mostly affects copyleft open source licenses. Attribution isn't required for permissive many open source licenses. Dependencies with those licenses will oftentimes end up inside closed source software. Even if there isn't FOSS in the closed-source software, basically everyone's threat model includes (or should include) "OpenSSL CVE". On that basis, I doubt Cal is accomplishing as much as they hope to by going closed source.

fedeb95 6mo ago

If you copy the code infringing licenses, yes, it will be harder to legally sort things out. Otherwise, copying code and improving it with AI or with humans is the same, as long as the product improves. I doubt that many semi-automatic AI copies can really improve a product more than the original team, for really valid products. AI will be a filter of bad quality.

Gormo 6mo ago

> Now this is no longer viable and in fact it is simply helping competitors. So why do it then? > The only open source that will remain will be the real open source projects that are true to the ethos. Well, the second point seems like the answer to the previous question. The original model of monetizing FOSS -- support contracts, risk indemnification, etc., for an otherwise functionally equivalent product -- will still remain viable. But those trying to thread the needle of trying to use open-source to push a "freemium" model are now going to hit a wall: if you were withholding features from the community version in order to paywall them for the premium version, and now AI has made it easy for users to add those features back without paying you, then you're screwed. The people who were going to use AI to bypass your paywall are still not going to be your customers, but you no longer have the differentiator to put you ahead of the competitors that were already closed-source to begin with for the customers who are willing to pay. I originally deployed Cal.com because I wanted an open-source solution. But now, why would I choose a closed-source Cal.com over Calendly? If I'm forced to go SaaS, I'll probably go with the more widely used Calendly. If I'm not forced to go SaaS, I'll forego them both, and go back to something like EasyAppointments, knowing that I won't be in conflict with the authors if I choose to add my own "premium" features to it, whether with AI or by hand. All Cal.com did here was remove any chance that I'd ever pay them anything.