News for hackers. Stuff that matters.

A comment on Open Source Isn't Dead. Cal.com Just Learned the Wrong Lesson. Parent comment

Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by Aurornis on Wednesday April 15, 2026 @12:22PM (#47781310)
> Closed source software won't receive any reports

Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates.

Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to spend their tokens on it.

[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by switchbak on Wednesday April 15, 2026 @12:47PM (#47781700)
Those bug bounty programs now have to compete against the market for 0-days. I suppose they always did, but it seems the economics have changed in the favour of the bad actors - at least from my uninformed standpoint.

That still exists in the OSS world too, having your code out there is no panacea. I think we'll see a real swarm of security issues across the board, but I would expect the OSS world to fare better (perhaps after a painful period).

[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by 0x457 on Wednesday April 15, 2026 @03:49PM (#47784300)
> Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates

So just like a pre-AI or worse?

[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by shakna on Wednesday April 15, 2026 @04:20PM (#47784688)
Worse. [0]

[0] https://hackerone.com/reports/3595764

[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by baileypumfleet on Wednesday April 15, 2026 @02:33PM (#47783238)
That's absolutely our plan. We have bug bounty programs, we have internal AI scanners, we have manual penetration testing, and a number of other things that enable us to push really hard to find this stuff internally rather than relying on either the good people in the open source community or hackers to find our vulnerabilities.
[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by tananaev on Wednesday April 15, 2026 @12:29PM (#47781445)
Of course everyone should do their own due diligence, but my point is mostly that open source will have many more eyes and more effort put into it, both by owners, but also community.
[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by LunicLynx on Wednesday April 15, 2026 @02:17PM (#47783032)
But also tools that might not be nice and report security vulnerabilities, but exploit them.

There is no guarantee that open means that they will be discovered.

[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by bearsyankees on Wednesday April 15, 2026 @12:24PM (#47781347)
+1, at this point all companies need to be continuously testing their whole stack. The dumb scanners are now a thing of the past, the second your site goes live it will get slammed by the latest AI hackers
[ Parent | on HN ]
Re:Open Source Isn't Dead. Cal.com Just Learned the Wrong Le... by bmurphy1976 on Wednesday April 15, 2026 @02:56PM (#47783567)
You don't even need a bug bounty program. In my experience there's an army of individuals running low-quality security tools spamming every endpoint they can think (webmaster@ support@ contact@ gdpr@ etc.) with silly non-vulnerabilities asking for $100. They suck now but they will get more sophisticated over time.
[ Parent | on HN ]