Peer Richelsen
Co-founded and chairs Cal.com, the open source scheduling company, and spends most of his public commentary on the security and trust problems open source softw...
“My theory is that the majority of open source repositories are compromised right now. We just don't know yet.”
The Changelog · Hands-On Engineering Podcasts · September 2026
Context
Richelsen had just explained that Cal.com went open source partly to build the most secure codebase it could, and that until early this year he would have said flatly that open source is always more secure than closed source. He says he no longer believes that. He points at Firefox's open P0 vulnerabilities as the illustration: if a project that well resourced looks like that, most repositories are worse.
Transcript
And
…that we think are worth fixing. We're happy to hear your ideas. We want you to use Swamp, but it's issue-based co-contributions. And you'll give us the problem or the challenge or the solution in prose. And they may even bring that into context behind the source. And they may even write a problem.
…find and abuse vulnerabilities has like a hundred X in terms of ease of use, right? And so you're giving basically evil people a single prompt in their terminal to find and abuse open source repositories. So, the whole pendulum of like, oh, we're open source, we're more secure, has completely swung in the other direction where it's like, wow, this is so easy to hack any open source repository. My theory is that the majority of open source repositories are compromised right now. We just don't know yet.
Firefox
has Firefox. Firefox has 12 P0 vulnerabilities. Like, what do you think your open source repository is looking like? You know?
Yeah, that's funny.
More from The Changelog
