Changelog Interviews – Episode #685
Forking Cal.com to closed source
Peer Richelsen, co-founder of Cal.com
This week I’m joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don’t know it yet? That’s the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com’s move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping “$1 of AI tokens for pennies on the dollar” is now a common startup business model.
Featuring
Sponsors
Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default.
Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace.
WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com
Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes.
Notes & Links
Editorial disclosure: Adam states in the episode that he is a small seed investor in Cal.com.
Cal.com and Cal.diy
- Cal.com is going closed source — here’s why
- Moving to closed-source: the technical changes
- Cal.diy on GitHub
- Cal.diy contributing guide
- Cal.com
Open source, agents, and contribution workflows
- Swamp Club
- OpenClaw
- Mitchell Hashimoto: Vibing a Non-Trivial Ghostty Feature
- GitHub Agentic Workflows
- GitHub issue-intent, rationale, confidence, and approvals
AI-assisted security
Chapters
| Chapter Number | Chapter Start Time | Chapter Title | Chapter Duration |
| 1 | 00:00 | It's The Changelog! | 01:23 |
| 2 | 01:23 | Sponsor: Coder.com | 03:08 |
| 3 | 04:30 | It's about time | 02:30 |
| 4 | 07:01 | AI reshuffles the startup playbook | 06:14 |
| 5 | 13:15 | Slop is overwhelming maintainers | 04:28 |
| 6 | 17:42 | The security pendulum swings back | 07:55 |
| 7 | 25:38 | Most open source repos are compromised | 05:03 |
| 8 | 30:41 | Commercial open source as a target | 05:35 |
| 9 | 36:16 | Sponsor: Buildkite | 02:47 |
| 10 | 39:03 | Forking Cal.com's code private | 07:08 |
| 11 | 46:10 | Other COSS companies struggling | 06:00 |
| 12 | 52:11 | Prescription: go private, patch vulnerabilities | 02:21 |
| 13 | 54:32 | Is GitHub at risk? | 05:43 |
| 14 | 1:00:15 | Sponsor: WorkOS | 02:15 |
| 15 | 1:02:30 | Mitchell Hashimoto's GitHub fix | 02:32 |
| 16 | 1:05:02 | The AI coding landscape | 06:05 |
| 17 | 1:11:07 | The autonomous agent future | 04:55 |
| 18 | 1:16:01 | Cal.com's growth story | 01:53 |
| 19 | 1:17:54 | Burning money to grow | 07:55 |
| 20 | 1:25:49 | Growing SaaS without AI | 02:11 |
| 21 | 1:28:01 | The reschedule UX problem | 04:26 |
| 22 | 1:32:26 | Racing toward 10 million ARR | 08:26 |
| 23 | 1:40:53 | Closed source and the tldraw license | 07:43 |
| 24 | 1:48:35 | Open source isn't dead, it's changing | 03:00 |
| 25 | 1:51:35 | Wrapping up | 01:08 |
| 26 | 1:52:43 | Closing thoughts and stuff | 01:47 |