Forking Cal.com to closed source (Interview)

**Adam Stacoviak** (0:00)
What's up, friends? Welcome back. This is The Changelog. What if the majority of open source repos out there, they're already compromised, and we just don't know it yet? That is the unsettling theory Peer Richelsen, co-founder of cow.com, brings to this podcast this week. We dig into how AI has flattened the knowledge graph so a 16-year-old can vibe hack a power station as easily as their mom can vibe code an iOS app. Why the reporting culture that has kept open source safe and secure all these years is collapsing under the AI-generated noise, slop, whatever you want to call it. Cow.com's move to fork its own codebase and take the sensitive parts private, and the eye-opening reality that shipping $1 of AI tokens for pennies on a dollar, that is now a common startup business model.
Lots going on, lots changing, a massive thank you to our friends and our partners at fly.io. Your agents, they need computers. My agents, they need computers. We host everything we do on fly.io. And you should too. Check them out at fly.io.
Okay, let's do this.
Well, friends, this episode is brought to you by our friends at coder.com, Secure Environments, where developers and agents work in parallel. And I'm joined by Nicky Pike, Field CTO for Coder. Nicky, what is a Field CTO?

**Nicky Pike** (1:38)
So, I get that question a lot and it's, you know, half the people understand it, half the people don't. So, a Field CTO, I describe it very simply as we're DevRel for the C-suite. So, we provide a bridge between the customer voice, between the C-suite and the managers and the leadership teams of our customers back into our product, and then we go through and we help enable our teams to have the same message to make sure that the message is correct, and that we're building on something that people actually want, not just something that we think they want.

**Adam Stacoviak** (2:05)
Okay. So, we're taking the laptop away from the developer. Not really though, we're putting them in a cloud development environment, a secure environment where they can work with their agents in parallel. These are blessed environments. What's wrong with the laptop?

**Nicky Pike** (2:18)
The laptop is the trap here. And not only because the fact that it could be stolen, you could lose it, it breaks, and you're out of work while you're waiting for a new one. But there's also just the consistency that you got there. We all know developers. Developers are going to be looking for some of the latest and greatest. And if you're not really controlling how they get out there, that's where you get this. It works on my machine. It doesn't work in production. It doesn't work anywhere else because you don't have that consistency. You don't have that ability to really standardize what that environment looks like. And this is a problem not only for new people coming in. You know, the onboarding statement is, average, I think, is like four to five weeks for a new employee to really get their local laptop set up and ready to start doing their first time of code. And, you know, the time to first commit is a metric that almost everybody knows. And the reason they can't do that is because there's a lot of tribal knowledge out there. They got to go talk to other developers. What are we using? Where do we get our dependencies? Are we getting them from public? Are we getting them from private repositories? But there's also the security and the supply chain aspect of this. When you have local machines out there, look at it like the shy hulud, that virus that went out not long ago. This was a compromise of the MPM public repositories. They went and downloaded things. MPM did what it did. Next thing you know, you're compromised. But when you use something like what we're doing with cloud development environments, then you can mandate and you can put restrictions on there to say, hey, you can only go get your packages from our private repo. Those packages are expected to have been thoroughly vetted. We know that they're clean. Now, does this stop everything like shy hulud? No, if that compromised package gets into your private repo, you can still have that, but it really reduces the surface area of the attack, and it also reduces the blast area of the compromise should it happen, because if your laptop gets compromised and you have to kill the laptop for whatever reason, that's weeks out of work while you're either fixing that or you're getting a new laptop in. The cloud development environments allows you to kill that, start back up fresh, and you're back and running in five minutes. You don't have to wait all that time.