开源并未消亡。Cal.com 只是得出了错误的结论

2026-04-16 01:13·78天前·bearsyankees

AI 摘要

Cal.com 近期以"AI 威胁"为由宣布将其开源代码转为闭源，引发业界对开源模式可持续性的争议。文章指出，这一决定仅反映该公司对商业模式的误判，而非开源软件的系统性失败。尽管 AI 技术给开源商业化带来新挑战，但闭源并非应对冲击的唯一或正确选择，开源并未因个别公司的退出而消亡。

原文 · 未翻译

Open Source Isn't Dead. | Strix

April 15th, 2026

Open Source Isn't Dead.

Alex Schapiro

Today, Cal.com announced they are transitioning their core codebase away from open source. The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, making code scanning and exploitation "near zero-cost". In this new world, they argue, "transparency becomes exposure."

At Strix, we build autonomous AI security agents. We are an open-source project ourselves, recently crossing 24k stars, and our framework processes over 15 billion LLM tokens daily to find software vulnerabilities. In many ways, our platform is the exact technology Cal.com is worried about.

We have an immense amount of respect for the Cal.com team. Over the last few weeks, we have actually been working closely with them, using Strix to responsibly disclose vulnerabilities we found in their platform. Their engineering team has been incredibly responsive, professional, and genuinely dedicated to protecting their users. We know firsthand that this pivot to closed source is driven by a deep desire to keep their community safe. To honor our responsible disclosure timeline, we will not be discussing the specifics of those unpatched bugs here.

We agree with their premise: AI has fundamentally altered the security landscape. But we fundamentally disagree with their conclusion.

Closing your source code is not the solution to AI-driven security threats.

Here is why retreating from open source will not protect you from AI hackers.

Black-box AI does not care if your repo is private

The assumption behind closing source code is that attackers need to read your code to exploit it. This might have been true for static analysis tools, but modern autonomous AI agents do not work like that.

Tools like Strix excel at black-box and grey-box testing. They dynamically interact with live endpoints, manipulate browser states, analyze network traffic, and uncover complex business logic flaws without ever needing repo access.

Closing your source code does not stop an AI from probing your API or finding an authorization bypass in your webhooks. It just removes the good eyeballs from your codebase while leaving your attack surface completely visible to the bad ones.

Security through obscurity is a losing bet against automation

When code is closed, it relies heavily on internal security teams and periodic, manual pentesting. But as Cal.com correctly noted, attackers now have infinite, tireless AI interns probing for flaws 24/7 at near-zero cost.

Hacker News 热门（buzzing.cc 中文翻译）

导出 Markdown