From the docs, "It is strictly recommended for personal, non-production use."<p>Wow what a 180 from just a year ago when their blog said, "For companies that handle sensitive information, deploying open-source scheduling software on-premises can offer an extra layer of security. Unlike cloud services controlled by external vendors, on-prem installations let teams maintain full ownership of their infrastructure. " ¹<p>I just cannot trust a company that does a bait and switch like this.<p>¹ <a href="https://cal.com/blog/open-source-scheduling-empower-your-team-with-customizable-features" rel="nofollow">https://cal.com/blog/open-source-scheduling-empower-your-tea...</a>
I think this is less a bait and switch and more just a legal liability shield. They're not saying you 'cant' use it that way. They just don't recommend you do, and they won't support you at all for doing so. Which I think is completely fair. Also, these two things aren't in contradiction. Deploying on prem does offer more security, but then it's up to you to use it correctly.
But the OSS license already absolves them of responsibility. This might just be to set the tone that security fixes won't be prioritized to the standard that they used to be.
It being open source also allows you to actually have a read of the software and guarantee things yourself, which is the harder better path anyway.
This actually makes me wonder if cal.com has had a security breach in their hosted offering that they are not disclosing.
I still remember when they launched here. "Opensource Alternate to Calendly" was their post title.
[dead]
I just installed calrs, a recent alternative to cal.diy. It absolutely rocks! The only downside is that it requires me to activate STARTTLS as force-TLS-SMTP isn't supported (I had to check the source code). It’s young, very promising, and honestly, I don't know what I could ask for more.<p>I also replaced Radical with rustical, and I gained free push updates.<p><a href="https://cal.rs/" rel="nofollow">https://cal.rs/</a> and <a href="https://github.com/lennart-k/rustical" rel="nofollow">https://github.com/lennart-k/rustical</a><p>And if you wanna try it out.
<a href="https://cal.ache.one/u/ache" rel="nofollow">https://cal.ache.one/u/ache</a>
Tempted to buy cal.zone or cal.sucks just to add the paid features to cal.diy. They even made a list!<p><pre><code> Teams, Organizations, Insights, Workflows, SSO/SAML, and other EE-only features have been removed
</code></pre>
cal.ws is $630 on Namecheap... the tokens required to build this are cheaper than the domain.
It’s curious what they said in the email they sent me about the OSS version.<p>------<p>A few important changes to note:<p>We will no longer provide public Docker images, so your team will need to build the image yourselves.<p><i>Please do not use Cal.diy — it’s not intended for enterprise use.</i>
Wait, I didn't even realize Cal.diy is owned by Cal.com. It seems like they're trying to get ahead of the open source community forking by doing this themselves
Here is a simple trick: do accept plenty of open source contributions as-is, without any kind of copyright assignment nor requiring to sign anything that grants power to relicense.<p>There you go, guaranteed community ownership of the code, best face and "good will" as promised by choosing a FOSS license to begin with, and future rug pulls averted.<p>Seeing it from the other side of the fence: if you see that all contributors are required to cede controlling power into a single hand (except certain Foundations, yadda yadda), it's not proper Open Source in spirit, only in form; and closeups are just a change of mind away.
Cal.com has always had an open source community edition, I've been using it for some time. Is this just a rebrand of that line?
As a former cal.com advocate, I am now going to be switching my two companies to cal.diy or a similar alternative and canceling my cal.com subscriptions.<p>I am now actively rooting for cal.com to go out of business now as a cautionary tale for any company thinking about taking open source projects proprietary.<p>FOSS || GTFO
Can someone who's looked at the security of these systems give a bit more context on that?<p>The thing that's always concerned me with them is questions of "what level of access is required to the system(s) actually hosting my calendar data?" and "if this vendor is compromised, what level of access might an attacker in control of the vendor systems have?" Obviously this will vary by what kind of access controls backends have (e.g. M365, Google Workspace, assorted CRM systems, smaller cloud providers, self-hosted providers, etc.).<p>Edit: basically, with a lot of these systems, what's expected to be the authoritative data provider/storage?
It rubs me the wrong way that it says it's "the open source community edition". Who decided this was the one? How of the community is Claude? Why open source and not free software?<p>Maybe I'm being critical but the copy gives me the ick<p>Edit: I just realised this is by cal.com. I'm leaving my comment intact, if anything it adds to my ick
Good grief that codebase is absolute hell, almost too good of an example of accidental complexity.
are there notable open source forks or open source cal competitors that go for the "just keep it simple" vibe?
[dead]