Oh, for fuck’s sake. Can we have a decent password manager that isn’t tied to a browser or company? I pay for Bitwarden. I’m not being cheap. But open source is more secure. We can look at the code ourselves if there’s a concern.
Concerns Raised Over Bitwarden Moving Further Away From Open-Source
Submitted 6 months ago by AsudoxDev@programming.dev to technology@lemmy.world
https://www.phoronix.com/news/Bitwarden-Open-Source-Concerns
Comments
ShittyBeatlesFCPres@lemmy.world 6 months ago
Telodzrum@lemmy.world 6 months ago
Keepass: Am I a joke to you?
sigmaklimgrindset@sopuli.xyz 6 months ago
Love Keepass. Love that I can sync it however I want. Love that there are multiple open source client options across several operating systems.
wetsuiterest@lemmy.blahaj.zone 6 months ago
Keepassxc? Vaultwarden?
pmc@lemmy.blahaj.zone 6 months ago
Isn’t Vaultwarden used with non-free Bitwarden clients?
shortwavesurfer@lemmy.zip 6 months ago
Its called Keepass. You are welcome
asap@lemmy.world 6 months ago
Nothing in the article or in the Bitwarden repo is moving away from open source
This hysteria is stupid at this point.
coolmojo@lemmy.world 6 months ago
It is a license problem. The license condition of the SDK which is required to build the client app change to limit the usage of it. The new license states that you can only use the Bitwarden SDK for Bitwarden. It is against the Freedoom-0 of the Free Software Foundation. The limitation of English language is that it is hard to differentiate between Free (as in Free bear) and Free (as in Freedoom). Also open source which could mean complaining with FOSS and that source is available. This been unfortunately have been abused before.
octopus_ink@lemmy.ml 6 months ago
They have confirmed it was a packaging bug and will be resolved.
01011@monero.town 6 months ago
Pass.
cy_narrator@discuss.tchncs.de 6 months ago
Notepad.exe
cmrn@lemmy.world 6 months ago
How many times do I need to pack up and move to the next “best option”
JustARaccoon@lemmy.world 6 months ago
Sadly as many times as needed, complacency is how these companies get “loyal customers” who are willing to put up with bs
cy_narrator@discuss.tchncs.de 6 months ago
Just go to Keepass and its over
doktormerlin@feddit.org 6 months ago
That’s far from the best option. It’s working, but it’s super complicated compared to Bitwarden and other cloud password managers. Imagine telling your grandma “just use keepass”, she would never be able to make it work. But Bitwarden? Lastpass? That’s possible
sugar_in_your_tea@sh.itjust.works 6 months ago
In this case, zero, because it’s a packaging bug, not an actual change in direction. Read the update on the article:
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
Next time, before jumping to conclusions, wait a day or two and see if the project says something.
Snowpix@lemmy.ca 6 months ago
Not sure who downvoted you, you literally quoted the article.
486@lemmy.world 6 months ago
I really hope that this is actually the case, but I am not very optimistic. This doesn’t seem to be a mistake. They intentionally move functionality of their clients to their proprietary SDK library. The Bitwarden person stated this in the Github issue and you can also check the commit history. Making that library a build-time dependency might actually have been a mistake. That does not change the fact, that the clients are no longer useful without that proprietary library going forward. Core functionality has been move to that lib. I really don’t care if they talk to that library via some protocol or have it linked at build time. I wouldn’t consider this open source, even if that client wrapper that talks to that library technically is still licensed under GPLv3.
Snowpix@lemmy.ca 6 months ago
john117@lemmy.jmsquared.net 6 months ago
oh thank god
WhyJiffie@sh.itjust.works 6 months ago
The community’s reaction is a but funny if this was a honest mistake
ayyy@sh.itjust.works 6 months ago
600 upvotes and only 10 downvotes on literal fake news. This community is brain dead trash.
ammonium@lemmy.world 6 months ago
How is it fake news? They are moving functionality into a proprietary SDK and have a whole framework ready to get around the GPL.
octopus_ink@lemmy.ml 6 months ago
No one is listening I’m sorry to say. I corrected a couple people but then realized it was pointless. The discussions in the crossposted communities (which - holy shit I don’t think I’ve seen something so thoroughly spammed across multiple tech communities before) are just as bad or worse.
locuester@lemmy.zip 6 months ago
Community is fine, your comment is at the top, along with others pointing this out.
It’s the “non-community” if you will booting this. The passerby’s not reading comments.
ghostface@lemmy.world 6 months ago
https://github.com/dani-garcia/vaultwarden Open source version of bitwarden written in rust.
Where is the foundation to support foss?!?
r00ty@kbin.life 6 months ago
If they're moving away from open source/more monetisation then they're going to do one of two things.
1: Make the client incompatible (e.g you'll need to get hold of and prevent updating of a current client).
2: DMCA the vaultwarden repoIf they're going all-in on a cash grab, they're not going to make it easy for you to get a free version.
potustheplant@feddit.nl 6 months ago
You can’t “dmca” the fork that was created while it was still open source. They could only prevent it from getting future updates (directly from them).
hedgehog@ttrpg.network 6 months ago
You have your link formatted backwards. It should be Vaultwarden, with the link in the parentheses.
ghostface@lemmy.world 6 months ago
This is by no means to a slight towards bitwarden. Solid product and community
Boozilla@lemmy.world 6 months ago
Goddammit. It’s getting to the point I’m going to have to figure out how to write my own app for this.
Humanius@lemmy.world 6 months ago
It shouldn’t even be that complex…
I might be mistaken, but ultimately a password manager is basically nothing more than a database of passwords in an encrypted zip file. That could entirely be self-hosted with off the shelf open source applications stringed together.
All you’d need is a nice UI stringing it all together.wintermute@discuss.tchncs.de 6 months ago
Keepass is exactly that. Basically all the client side parts, and the database is a single encrypted file that you can sync however you want.
xthexder@l.sw0.com 6 months ago
I’ve done basically this in the past by encrypting a text file with GPG. But a real password manager will integrate with your browser and helps prevent getting phished by verifying the domain before entering a password. It also syncs across all my devices, which my GPG file only worked well on my desktop.
LedgeDrop@lemm.ee 6 months ago
It’s the “stringing it all together” that could be problematic.
If you have multiple clients (desktop/cellphone) modifying the same entry (or even different entries in the same “database” ). You need something smart enough to gracefully handle this or atleast tell you about it.
I did the whole “syncing” KeePass and it was functional, but it also meant I needed to handle conflicts - which was annoying. I switched and really appreciate the whole “it just works” with self-hosted bitwarden.
HereIAm@lemmy.world 6 months ago
I see it as it’s easy to self host. But I’m not skilled nor rich enough to guarantee the availability of it. I don’t want to be stuck on a holiday without my passwords because my server back home died from black out or what have you.
I pay for bitwarden and the proton mail package to keep the password management market a bit more competitive and it actually works out cheaper. It would be nice to have protons anonymous emails built in, but I can live with it.
But I might have to reconsider if Bitwarden is going a different direction that what I’m paying for.
AsudoxDev@programming.dev 6 months ago
That is the bare minimum of a password manager like Bitwarden.
Boozilla@lemmy.world 6 months ago
Yup, thanks. Was thinking along these same lines.
Snowpix@lemmy.ca 6 months ago
Boozilla@lemmy.world 6 months ago
Thank you for the update! I would like to keep using it. I’ve been very happy with Bitwarden both as a password manager and a TOTP authenticator. I have even recommended it to my boss as an enterprise solution for us to use at work, and so far we are planning on replacing our current password database solution with Bitwarden.
Unfortunately, with “enshittification” being so common these days, it was very easy to believe they were also going to the dark side. I will remain cautiously optimistic after learning it was a packaging bug.
Here’s a link to the post on X (yes, I hate X, too) in case anyone else is doubtful:
NanoooK@sh.itjust.works 6 months ago
Great, I’ve just started to use it last week 🤡
Scrollone@feddit.it 6 months ago
Just switch to KeePassXC
NanoooK@sh.itjust.works 6 months ago
That’s what I’m using mostly, but the convenience of having auto fill in firefox and being able to share some logins made me want to try bitwarden. Also, it’s not complicated to sync between several devices.
octopus_ink@lemmy.ml 6 months ago
It’s just a packaging bug and they said they will fix it.
gwen@lemmy.dbzer0.com 6 months ago
can we start reading the articles and not just the headlines??? it literally says it’s a packaging bug
486@lemmy.world 6 months ago
It is really not just a packaging bug. If you read that comment of the Bitwarden person a little further, you’ll notice that he’s talking about that proprietary “SDK” library that they are integrating with their clients. Even if they manage to not actually link it directly with the client, but rather let the client talk to that library via some protocol - it doesn’t make the situation any better. The client won’t work without their proprietary “SDK”, no matter if they remove the build-time dependency or not.
Highsight@lemmy.world 6 months ago
When I read this this morning, I had concerns, but then I did some research. The SDKs source is fully available for all to look at and compile. The main issue that people bring up is the license that states:
3.3 You may not use this SDK to develop applications for use with software other than Bitwarden (including non-compatible implementations of Bitwarden) or to develop another SDK.
This part seems to be what most people take issue with, as it makes the sdk no longer modifiable, yet a requirement of the core source itself. The head of BitWarden has come out and stated the SDK being required to compile BitWarden was a mistake, however, and if this proves to be true (which I have no reason to doubt) then I see no reason why any of this is an issue.
From a security standpoint, since the SDK is source available, it can be audited by anyone still (and compiled) so personally, I’m fine with this.
gwen@lemmy.dbzer0.com 6 months ago
oh shit i didnt know that, mb man
cmrn@lemmy.world 6 months ago
…in the update that came out after this article was posted and the discussion took place.
gwen@lemmy.dbzer0.com 6 months ago
mb i didnt see the update part
sugar_in_your_tea@sh.itjust.works 6 months ago
In general, if it’s Phoronix, I assume the headline is a bit more exaggerated. They put out pretty good content, but they also put out a lot of content, so the editing can be a little lacking IMO.
mli@lemm.ee 6 months ago
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
According to Bitwardens post here, this is a “packaging bug” and will be resolved.
magnus@lemmy.ahall.se 6 months ago
Daniel García, owner of the Vaultwarden repo, has recently taken employment for Bitwarden.
The plot thickens.
sugar_in_your_tea@sh.itjust.works 6 months ago
Honestly, if he can replace the current Bitwarden BE w/ Vaultwarden, that would be awesome! The last time I looked at the Bitwarden self-hostable BE, it was super heavy, which is the entire reason I was interested in Vaultwarden.
magnus@lemmy.ahall.se 6 months ago
I’m running a couple of Vaultwarden instances, and it would be really nice if Bitwarden employed Garcia to improve the Rust backend. But as the bitter cynic I am, I guess it is an effort to shut down and control as much of the open source use of Bitwarden as possible.
The worst case, someone will most likely fork Vaultwarden and we can still access it with Keyguard on mobile and the excellent Vaultwarden web interface :)
ocassionallyaduck@lemmy.world 6 months ago
Keepass vault synced over syncthing.
I keep not regretting it.
druidjaidan@lemmy.world 6 months ago
Cris_Color@lemmy.world 6 months ago
Syncthing fork seems to still be under active development
cyberwolfie@lemmy.ml 6 months ago
Was going to be my solution as well, bjt Syncthing-Android just got discontinued.
ocassionallyaduck@lemmy.world 6 months ago
F-Droid syncthing-fork is still actively developed and had a patch in the last few weeks.
So hopefully this isn’t the end.
_edge@discuss.tchncs.de 6 months ago
What? I need syncthing-android, where is it going?
ArkyonVeil@lemmy.dbzer0.com 6 months ago
telescopius@lemm.ee 6 months ago
This is disheartening.
Suavevillain@lemmy.world 6 months ago
Well this ain’t good. I don’t really feel like switching apps.
ealoe@ani.social 6 months ago
Some guy at bitwarden clicks a button wrong on a license drop-down option and all these people crawl out of the woodwork to declare the end of bitwarden being trustworthy. Nothing in the article or the company’s statements indicates an actual move away from open source. Big nothingburger
solsangraal@lemmy.zip 6 months ago
so what’s the best pw manager?
DudeImMacGyver@sh.itjust.works 6 months ago
sigh
TunaCowboy@lemmy.world 6 months ago
Routhinator@startrek.website 6 months ago
Alright does anyone have opinions on Nextcloud Passwords? There’s apps for it and it would sync to my Nextcloud.
I hate this. Bitwarden has been a good app.
KingThrillgore@lemmy.ml 6 months ago
I’m going to keep using Bitwarden because KeepassXC sucks, but not as a paying user. Once this package inclusion is removed, if it is removed, i’ll pay again.
Shape4985@lemmy.ml 6 months ago
I use to always recommend bitwarden to people. Now i feel like an idiot for doing so with them switching up. Ill be making the effort to move to keepassxc soon and host it myself.
terminal@lemmy.ml 6 months ago
Keepass. Keep it simple.
No_Support_8363@lemm.ee 6 months ago
Thats not good :(
quissberry@lemmy.cafe 6 months ago
Well, I guess not having password manager yet did had some benefit because now I know not to use bitwarden
unskilled5117@feddit.org 6 months ago
This is an importang issue IMO that needs to be addressed and the official response by Bitwardens CTO fails to do so.
There is not even a reason provided why such a proprietary license is deemed necessary for the SDK. Furthermore this wasn’t proactively communicated but noticed by users. The locking of the Github Issue indicates that discussion isn’t desired and further communication is not to be expected.
It is a step in the wrong direction after having accepted Venture Capital funding, which already put Bitwardens opensource future in doubt for many users.
This is another step in the wrong direction of a Company that proudly uses the opensource slogan.
solsangraal@lemmy.zip 6 months ago
nothing lasts forever without being enshittified
umbrella@lemmy.ml 6 months ago
not in capitalism no
tabarnaski@sh.itjust.works 6 months ago
Except if it’s free software.
irotsoma@lemmy.world 6 months ago
They’re basically trying to get rid of vaultwarden and other open source forks. I expect they’ll get a cease and desist and be removed from github at some point in the not too distant future if they don’t make some changes. I have a vaultwarden instance and use the bit warden clients. Guess I’ll need to look for alternatives in case Bitwarden decides to get aggressive.