I’m nerdy enough to use bitwarden and lemmy. But not nerdy enough to truly understand this.
Can someone explain it like I’m 5?
Bitwarden Makes Change To Address Recent Open-Source Concerns
Submitted 3 weeks ago by moe90@feddit.nl to technology@lemmy.world
https://www.phoronix.com/news/Bitwarden-Code-Cleared-Up
Comments
inb4_FoundTheVegan@lemmy.world 3 weeks ago
CriticalMiss@lemmy.world 3 weeks ago
Sure. The majority of the BitWarden client is licensed under the GPL, which categorizes it as “free software”. However, one of the dependencies titled “BitWarden-SDK” was licensed under a different proprietary license which didn’t allow re-distribution of the SDK. For the most part, this was never a problem as FOSS package maintainers didn’t include the dependency (as it was optional) and were able to compile the various clients and keep the freedoms granted by the GPL license. However, a recent change made BitWarden-SDK a required dependency, which violated freedom 0 (the freedom to distribute the code as you please). BitWarden CTO came out and said this was an error and fixed this, making BitWarden SDK an optional dependency once again which now makes BitWarden free software again. For the average joe, this wouldn’t have mattered as BitWarden SDK contains features that are usually favored by businesses and the average Joe can live without. So everything now returns back to normal, hopefully.
JustEnoughDucks@feddit.nl 3 weeks ago
This seems like classic corporate backtracking when their customers spot a terrible, deliberate decision.
486@lemmy.world 3 weeks ago
I was really sceptical of the CTOs first response, but this does actually seem to be genuinely good news.
mannycalavera@feddit.uk 3 weeks ago
First Winamp and now Bitwarden. The open source ecosystem is truly dead /s.
b3an@lemmy.world 3 weeks ago
You didn’t read it then.
mannycalavera@feddit.uk 3 weeks ago
Wow, /s has really lost its meaning on the internet 😂
thann@lemmy.dbzer0.com 3 weeks ago
If you thnk they accidentally made a proprietary module, I have a bridge to sell you
net00@lemm.ee 3 weeks ago
Why would anyone trust any company with their passwords??
Just use keepass and not bother with BS
Telodzrum@lemmy.world 3 weeks ago
Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
net00@lemm.ee 3 weeks ago
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Companies can enshiffity at a moments notice.
CarbonatedPastaSauce@lemmy.world 3 weeks ago
Bitwarden can be fully self hosted, I’m doing it. My Bitwarden server doesn’t (and can’t) talk to them at all as it has no way to access the internet. They know nothing about my deployment except that I signed up for a free license key.
kameecoding@lemmy.world 3 weeks ago
Are you a software developer ? Because you are way out of touch with what users want.
drspod@lemmy.ml 3 weeks ago
I get why you’d suggest the previous commenter is out of touch with what users want, but what does that have to do with being a software engineer?
Contravariant@lemmy.world 3 weeks ago
Well, who did you trust to build your hardware?
mac@lemm.ee 3 weeks ago
I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there’s a better way to do it that I’m missing, but that was very annoying
cley_faye@lemmy.world 3 weeks ago
I use this setup for my personal passwords, using nextcloud as the sync solution. A semi-fix for that was using Keepass2Android (on Android obviously). It integrates with nextcloud directly, keep a local DB of passwords, and would only load the remote one (and merge) on unlock and updates, not keeping it “constantly” sync on every remote change. It works well… most of the time… with only two devices that almost always have connection to the server… and for only one user.
It’s overly clunky though. It’s the big advantage of “service based” password manager against “single file based” ones. They handle sync. We have plans to move to bitwarden at my workplace, and since the client supports multiple accounts on multiple servers, I’ll probably move to that for personal stuff too. The convenience is just there, without downside.
noxy@yiffit.net 3 weeks ago
cuz being able to log in is handy sometimes
jeena@piefed.jeena.net 3 weeks ago
If that wasn't on purpose than that was a big fuckup. I was sometimes thinking about testing Bitwarden but with this volatile license situation I'm not interested anymore.
dustyData@lemmy.world 3 weeks ago
That’s a poor understanding of the situation. Nothing in the licensing changed. The SDK has always been the proprietary business to business secrets management product. The client integrates with and can use that SDK to provide the paid service to businesses. The client and the server side management of password has always been and still is FOSS.
This was apparently an accidental change in the build code (not the client code, just the building scripts) that required the inclusion of the SDK to build the client when actually it has never and doesn’t really need any of that code. It prevented building the client without accepting the SDK license. Which it shouldn’t.
This was fixed and some things will be put in place so it doesn’t happen again. Nothing in the licensing scheme changed, at all. This is not a catastrophic enshittification event. A Dev was just being lazy and forgot to check the dependencies before their commit.
Telorand@reddthat.com 3 weeks ago
Thank you for bringing some sanity. I get that people experience capitalist enshittification on a regular basis, but sometimes people make honest mistakes.
BearOfaTime@lemm.ee 3 weeks ago
Thanks for the summary, it adds great clarity to seeing how it could happen
drspod@lemmy.ml 3 weeks ago
Nothing in the licensing scheme changed, at all.
This statement is incorrect. The SDK had specific source files placed exclusively under the SDK license, and the remainder of the repository dual licensed between GPL 3 and the SDK license. So the licensing scheme did change.
Telorand@reddthat.com 3 weeks ago
You can do what you like, but the change is sane, and they’ve now separated their Secrets Manager, which is their proprietary software for businesses, from their primary client, which is GPL.
IMO, the internet is doing that thing again where they invent villains.
umami_wasbi@lemmy.ml 3 weeks ago
If they tried once, there will be a second, but more subtle.
4am@lemm.ee 3 weeks ago
“I only read the headline and the comments from the threads a week ago, I am truly disappointed in Bitwarden’s stance against FOSS as I’ve misunderstood it.”
Quill7513@slrpnk.net 3 weeks ago
vaultwarden
Lettuceeatlettuce@lemmy.ml 3 weeks ago
Something tells me you’re the kind of person who sees a car turn the same direction as you twice and stars freaking out that you’re being followed…
patchwork@lemmy.dbzer0.com 3 weeks ago
Initially Bitwarden was one of the most impressive FOSS password managers, but their increasing willingness to trade user privacy for services and promotion by our favorite surveillance capitalist’s is the real issue imho. Believing Privacy and Security are inextricably linked, I cannot recommend, nor use them at this time.
A quick scan on Blacklight (TheMarkup’s Privacy Tool) is an eye opener.
Rockslide0482@discuss.tchncs.de 3 weeks ago
This is an interesting tool that I’m going to back pocket, so thanks for that. That being said, any trackers and such on Bitwarden.com root page isn’t really indicative of the real product, though I’ll say it reflects poorly. That page basically is a sales pitch put together by probably a completely separate marketing team.
patchwork@lemmy.dbzer0.com 3 weeks ago
Blacklight is basically a front-end for DuckDuckGo’s open source tracker radar tool. github.com/duckduckgo/tracker-radar
In a world increasing dominated by surveillance capitalists and dystopian tech, conscientious consumerism is one of the most effective tools we still have to effect change. Google chooses to sell tech to a Far-Right government’s engaged in ethnic cleansing, Bitwarden chooses Google as a business partner for analytics, marketing, cloud services, etc… I choose to not use Bitwarden.
Another resource to assist in choosing which services to use is the open project PrivacySpy. Bitwarden doesn’t score very well by their metrics either.
MrFunkEdude@piefed.social 3 weeks ago
Cool.
I just started using Bitwarden almost a year now. I don't know how I lived without it before? It's nice to know I wont have to switch to something else.
darkstar@sh.itjust.works 3 weeks ago
I’ve been using it for years, I’m so glad I don’t have to switch