Peer Richelsen

And they may even write the initial prompt that starts the journey. I agree. So there are clearly, there's multiple reasons and benefits to be open source, right? Like some things simply have to be open source. React.js has to be open source. JavaScript has to be open source. Python has to be open source just to run the thing. Calcom necessarily doesn't have to be open source, right? So we've been open source for many different reasons, but in order to run it, that's not what we open source, right? We're not a JavaScript framework. We're not a UI library. So for us, the pitch and the idea was always like, build in public, build trust, build them, and then another thing, build the most secure code base. Because I would say up until January 26, I would say open source is always more secure than closed source. Like I would stand by that statement. And that's the problem. Today, I no longer think that. So the pendulum has swung. This is like very safe, open source, because bear in mind, when you were open source, you had security researchers making really good PRs, fixing the holes, fixing vulnerabilities, reporting vulnerabilities. There was a reporting culture. The reporting culture no longer exists. 99% of the reportings we get are AI generated. Like we have an inbox security at Cal.com that people send vulnerabilities. And 99% of them are AI generated, like including that email that sends it. Because people are spamming repositories. And half of those vulnerabilities are also hallucinated. Like they just simply don't exist. You reproduce it and it's not there. Or it got something wrong and it's using the wrong API endpoint. And so the culture of like open source makes you more secure because you have actual human beings who know what they're doing checking your code base has kind of fallen behind. And then at the same time, so that's gone. And then at the same time, the autonomous attack attacking tools have gotten so good. That the amount of knowledge needed to attack a repository is basically: can you run a shell command in your terminal? So, like we went from pen testing requires crazy amounts of tooling and knowledge and reverse engineering of APIs and man-in-the-middle attacks and yada yada yada. Like, so much work had to go in into basically finding and abusing vulnerability. Let's say you're a black hat hacker, right? Like, let's say you are an evil person, you want to extort people. It was really hard. You had to be really good. These are really smart people who would execute those attacks. Nowadays, maybe not with cloud because of all the security features, but there are large language models out there that are so good at pen testing and cloud security, to be honest, of their product, that it's really easy to find dormant vulnerabilities. Like, Firefox had like 12 P0 vulnerabilities reported by AI. React, React, React had vulnerabilities found by AI. Next.js had its own fair shares of vulnerabilities reported by AI. So, it's like we're really in trouble because I'm not saying our engineering team is flawless from pre-AI. Like, obviously, this is not AI versus pre-AI code, but the amount of money, resources, and talent to find and abuse vulnerabilities has like a hundred X in terms of ease of use, right? And so you're giving basically evil people a single prompt in their terminal to find and abuse open source repositories. So, the whole pendulum of like, oh, we're open source, we're more secure, has completely swung in the other direction where it's like, wow, this is so easy to hack any open source repository. My theory is that the majority of open source repositories are compromised right now. We just don't know yet.