Forking Cal.com to closed source
Summary
This week I'm joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don't know it yet? That's the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com's move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping "$1 of AI tokens for pennies on the dollar" is now a common startup business model.
Original Text
This week I’m joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don’t know it yet? That’s the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com’s move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping “$1 of AI tokens for pennies on the dollar” is now a common startup business model.
Join the discussion
Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default.
Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace.
WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com
Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes.
Featuring:
Peer Richelsen – Website, GitHub, LinkedIn, X
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
Editorial disclosure: Adam states in the episode that he is a small seed investor in Cal.com.
Cal.com and Cal.diy
Cal.com is going closed source — here’s why
Moving to closed-source: the technical changes
Cal.diy on GitHub
Cal.diy contributing guide
Cal.com
Open source, agents, and contribution workflows
Swamp Club
OpenClaw
Mitchell Hashimoto: Vibing a Non-Trivial Ghostty Feature
GitHub Agentic Workflows
GitHub issue-intent, rationale, confidence, and approvals
AI-assisted security
Mozilla: Hardening Firefox with Anthropic’s Red Team
Mozilla: The zero-days are numbered
Anthropic and Mozilla’s Firefox security collaboration
Next.js security advisories
LiteLLM issue: malicious package and credential stealer
Something missing or broken? PRs welcome!
Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.