How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

Companies like Buidler.io, PostHog, and Polar are notable for open-sourcing their entire platforms, rather than just a project or two. This raises a crucial question: What framework and rules should guide a company's decision to open-source? Furthermore, how much of a platform should be open-sourced, and which license such as MIT or BSL is most appropriate?

Comments (3)

ashwinsundar · 3h ago

Why should any given software be open-sourced? What is there to be gained by the company?

ripano · 59m ago

I'm not sure whether you're being serious or sarcastic. In the former case, the answer may span from easing the process of review from the outside, hence better the quality of software (e.g. a cybersecurity company would gain from that, given that all major cryptographic algorithms and such are produced by academia in public papers and depend on computational power, not secrecy of algorithms), to satisfying your ethics (I'd rather live in a world where everyone can see with their own eyes if you fulfill you promises about your code, Stallman can teach us a thing or two about this matter). Moreover, the open source community has produced the best software we, as humanity, have created so far: that alone is a good reason to believe in the power of opening your system.

Iolaum · 2h ago

Adoption, Community and more

Caveats apply

AGENTS.md – Open format for guiding coding agents (agents.md)

How to Think About GPUs (jax-ml.github.io)

Ask HN: Why does the US Visa application website do a port-scan of my network?

How to Draw a Space Invader (muffinman.io)

Modern CI is too complex and misdirected (2021) (gregoryszorc.com)

Copilot broke audit logs, but Microsoft won't tell customers (pistachioapp.com)

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

Tidewave Web: in-browser coding agent for Rails and Phoenix (tidewave.ai)

D2 (text to diagram tool) now supports ASCII renders (d2lang.com)

Tiny microbe challenges the definition of cellular life (nautil.us)

The Value of Hitting the HN Front Page (mooreds.com)

Type-machine (arthi-chaud.github.io)

How I Made Ruby Faster Than Ruby (noteflakes.com)

Gaussian Processes for Machine Learning [pdf] (gaussianprocess.org)

Fast and observable background job processing for .NET (github.com)

Emacs as your video-trimming tool (xenodium.com)

Show HN: I've made an easy to extend and flexible JavaScript logger (github.com)

Intel Foundry Demonstrates First Arm-Based Chip on 18A Node (hothardware.com)

Rails Charts Using ECharts from Apache (github.com)

Candle Flame Oscillations as a Clock (cpldcpu.com)

Without the futex, it's futile (h4x0r.org)

Customizing Lisp REPLs (aartaka.me)

CRDT: Text Buffer (madebyevan.com)

AnduinOS (anduinos.com)

How Figma’s multiplayer technology works (2019) (figma.com)

Drunken Bishop (2023) (re.factorcode.org)

We’re Not So Special: A new book challenges human exceptionalism (democracyjournal.org)

Show HN: OpenAI/reflect – Physical AI Assistant that illuminates your life (github.com)

Custom telescope mount using harmonic drives and ESP32 (svendewaerhert.com)

Why Semantic Layers Matter (and how to build one with DuckDB) (motherduck.com)

Show HN: Hanaco Weather – A poetic weather SNS from the OS Yamato project (github.com)

Launch HN: Uplift (YC S25) – Voice models for under-served languages

Geotoy – Shadertoy for 3D Geometry (3d.ameo.design)

Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025 (gfw.report)

The joy of recursion, immutable data, & pure functions: Making mazes with JS (jrsinclair.com)

A renovation project in Turkey led to the discovery of a lost city (2023) (atlasobscura.com)

Physically Based Rendering in Filament (google.github.io)

Monoid-Augmented FIFOs, Deamortised (pvk.ca)

Passive Microwave Repeaters (computer.rip)

Positron, a New Data Science IDE (posit.co)

PyPI Preventing Domain Resurrection Attacks (blog.pypi.org)

Databricks is raising a Series K Investment at >$100B valuation (databricks.com)

Notion releases offline mode (notion.com)

Critical Cache Poisoning Vulnerability in Dnsmasq (lists.thekelleys.org.uk)

Calling Their Bluff (anguscheng.com)

Perfect Freehand – Draw perfect pressure-sensitive freehand lines (perfectfreehand.com)

Lazy-brush – smooth drawing with mouse or finger (lazybrush.dulnan.net)

Launch HN: Parachute (YC S25) – Guardrails for Clinical AI

Why is it so hard for startups to compete with Cadence? (zach.be)

Rough Numbers Between Consecutive Primes (arxiv.org)

When to Open Source

Comments (3)