You must log in or register to comment.
oh thank god
600 upvotes and only 10 downvotes on literal fake news. I wish readers were less lazy, it’s very frustrating.
Edit: made my statement a bit less toxic. I was mad.
No one is listening I’m sorry to say. I corrected a couple people but then realized it was pointless. The discussions in the crossposted communities (which - holy shit I don’t think I’ve seen something so thoroughly spammed across multiple tech communities before) are just as bad or worse.
Community is fine, your comment is at the top, along with others pointing this out.
It’s the “non-community” if you will boosting this. The passerby’s not reading comments.
can we start reading the articles and not just the headlines??? it literally says it’s a packaging bug
It is really not just a packaging bug. If you read that comment of the Bitwarden person a little further, you’ll notice that he’s talking about that proprietary “SDK” library that they are integrating with their clients. Even if they manage to not actually link it directly with the client, but rather let the client talk to that library via some protocol - it doesn’t make the situation any better. The client won’t work without their proprietary “SDK”, no matter if they remove the build-time dependency or not.
…in the update that came out after this article was posted and the discussion took place.
In general, if it’s Phoronix, I assume the headline is a bit more exaggerated. They put out pretty good content, but they also put out a lot of content, so the editing can be a little lacking IMO.
Some guy at bitwarden clicks a button wrong on a license drop-down option and all these people crawl out of the woodwork to declare the end of bitwarden being trustworthy. Nothing in the article or the company’s statements indicates an actual move away from open source. Big nothingburger
Maybe you want to read the comment by kspearrin in that Github issue again. They are clearly moving away from open source. He explicitly states that they are in the process of moving more code to their proprietary “SDK” library.
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
According to Bitwardens post here, this is a “packaging bug” and will be resolved.
I wonder~ I wonder~ I wonder whyyyy…
Daniel García, owner of the Vaultwarden repo, has recently taken employment for Bitwarden.
The plot thickens.
Honestly, if he can replace the current Bitwarden BE w/ Vaultwarden, that would be awesome! The last time I looked at the Bitwarden self-hostable BE, it was super heavy, which is the entire reason I was interested in Vaultwarden.
I’m running a couple of Vaultwarden instances, and it would be really nice if Bitwarden employed Garcia to improve the Rust backend. But as the bitter cynic I am, I guess it is an effort to shut down and control as much of the open source use of Bitwarden as possible.
The worst case, someone will most likely fork Vaultwarden and we can still access it with Keyguard on mobile and the excellent Vaultwarden web interface :)
Phew, looks good on the news with the packaging bug (if they didn’t just got cold feet for worse PR/backlash than they expected and this is a backtracking).
In this case, hopefully Garcia is employed for his expertise and can be deployed to further open source relations :)
Keepass. Keep it simple.
If you want to roll your own with keepass that’s fine, but most people will want a more comprehensive solution.
I switched from keepass to Bitwarden because individual entries started randomly disappearing. I’m still discovering missing accounts after switching a couple of weeks ago. Sometime to do with how keepass was opening the files, because when an entry went missing it was gone even from backup files I hadn’t touched since before the entry disappeared.
Sound like something you did with replacing files. Bitwarden is dead simple, and that’s why it’s great.
Alright does anyone have opinions on Nextcloud Passwords? There’s apps for it and it would sync to my Nextcloud.
I hate this. Bitwarden has been a good app.
It’s a packaging bug, the headline is false.
Bitwarden has been a good app.
And it still is. There’s no reason to stop using Bitwarden, and I will continue my plans to switch to Vaultwarden.
As @Krzd@lemmy.world said, it’s a packaging bug, not an actual change in license. If you read the article, it says as much in the update.
Nextcloud passwords is just a client for a KeePass vault.
I guess it’s as good or bad as that can be, but I’m sure it’s limited in functionality to KeePassxc with plugins.
Are you sure?
Because last time I tried that it was THE worst password manager that i ever tried in my life. I’d feel safer with the ie6 password manager
Oh really? Where’s the keepass file stored? This would be very cool if so
TIL… Thanks.
EDIT: Been playing with it a bit now and if it uses keepass as the DB the advantage I see right now is that having it in Nextcloud means automatic sync, and there are several autofill and syncing apps for various OSes and password sharing and automated checks for breaches. It’s probably a better option for anyone with Nextcloud than going the Keepassxc/syncthing route.
EDIT: The article has been updated and it was described as a “packaging bug” and not an intended change.
How many times do I need to pack up and move to the next “best option”
In this case, zero, because it’s a packaging bug, not an actual change in direction. Read the update on the article:
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
Next time, before jumping to conclusions, wait a day or two and see if the project says something.
I really hope that this is actually the case, but I am not very optimistic. This doesn’t seem to be a mistake. They intentionally move functionality of their clients to their proprietary SDK library. The Bitwarden person stated this in the Github issue and you can also check the commit history. Making that library a build-time dependency might actually have been a mistake. That does not change the fact, that the clients are no longer useful without that proprietary library going forward. Core functionality has been move to that lib. I really don’t care if they talk to that library via some protocol or have it linked at build time. I wouldn’t consider this open source, even if that client wrapper that talks to that library technically is still licensed under GPLv3.
Not sure who downvoted you, you literally quoted the article.
Just go to Keepass and its over
That’s far from the best option. It’s working, but it’s super complicated compared to Bitwarden and other cloud password managers. Imagine telling your grandma “just use keepass”, she would never be able to make it work. But Bitwarden? Lastpass? That’s possible
Sadly as many times as needed, complacency is how these companies get “loyal customers” who are willing to put up with bs
Great, I’ve just started to use it last week 🤡
It’s just a packaging bug and they said they will fix it.
Just switch to KeePassXC
Oh, for fuck’s sake. Can we have a decent password manager that isn’t tied to a browser or company? I pay for Bitwarden. I’m not being cheap. But open source is more secure. We can look at the code ourselves if there’s a concern.
They have confirmed it was a packaging bug and will be resolved.
Its called Keepass. You are welcome
Nothing in the article or in the Bitwarden repo suggests that it’s moving away from open source
It is a license problem. The license condition of the SDK which is required to build the client app change to limit the usage of it. The new license states that you can only use the Bitwarden SDK for Bitwarden. It is against the Freedoom-0 of the Free Software Foundation. The limitation of English language is that it is hard to differentiate between Free (as in Free bear) and Free (as in Freedoom). Also open source which could mean complaining with FOSS and that source is available. This been unfortunately have been abused before.
From the article, it’s a packaging bug, not a change in direction.
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
I was referring to this which started it all.
Here is the code in question. Basically, it’s a source-available, but not FOSS internal SDK, with the following language:
The password manager SDK is not intended for public use and is not supported by Bitwarden at this stage. It is solely intended to centralize the business logic and to provide a single source of truth for the internal applications. As the SDK evolves into a more stable and feature complete state we will re-evaluate the possibility of publishing stable bindings for the public. The password manager interface is unstable and will change without warning.
So I think the “bug” here is in not linking the original repo in the NPM package, and there’s a decent chance that this internal SDK will become FOSS in the future once it stabilizes. That said, it’s currently not FOSS, but it’s too early IMO to determine whether Bitwarden is moving in a non-FOSS direction, or if they’re just trying to keep things simple while they do some heavy refactoring to remove redundancy across apps.
Given their past, I’m willing to give them the benefit of the doubt, but I’ll be making sure I have regular backups in case things change.
Keepass: Am I a joke to you?
Love Keepass. Love that I can sync it however I want. Love that there are multiple open source client options across several operating systems.
Android syncthing announced they’re stopping development this year. Open source got fucked double today
terrible day. There is a fork called syncthing-fork that is under current development. I hope both projects merge.
Keepassxc? Vaultwarden?
Isn’t Vaultwarden used with non-free Bitwarden clients?
This need not be the case, though! There’s an open source client on Android called Keyguard. I don’t think the desktop app was at all useful anyway. You can just log into your Vaultwarden through any browser. The desktop app is pointless.
True, but the firefox extension is nice.
The clients are free.
They now require a non-free Bitwarden SDK component. That’s what this whole conversation is about.
And the whole conversation is about a bug, not a change in direction…
Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”
Only the desktop client. And the response is that not being able to compile sans SDK is an issue they will resolve.
I still think this is bad directionally, but we need to see what happens.
Could you ELI5 please?
“You may not use this SDK to develop applications for use with software other than Bitwarden (including non-compatible implementations of Bitwarden) or to develop another SDK.”
This is a condition when using their SDK. This is not considered a free (as in freedom) component because it violates freedom 0: https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms
Notepad.exe
Its open source now right?
Pass.
I use to always recommend bitwarden to people. Now i feel like an idiot for doing so with them switching up. Ill be making the effort to move to keepassxc soon and host it myself.
They literally posted that this is a packaging bug and will be resolved.
…host it?
…is there something I’ve been missing out on? Can one host a KeePass vault online? We have web apps? I only know about the Nextcloud ones. I’ve just been using syncthing and merging the conflicts when they happen.
I used to keep a copy of my kepass file in a free Dropbox account.
This is an important issue IMO that needs to be addressed and the official response by Bitwardens CTO fails to do so.
There is not even a reason provided why such a proprietary license is deemed necessary for the SDK. Furthermore this wasn’t proactively communicated but noticed by users. The locking of the Github Issue indicates that discussion isn’t desired and further communication is not to be expected.
It is a step in the wrong direction after having accepted Venture Capital funding, which already put Bitwardens opensource future in doubt for many users.
This is another step in the wrong direction for a company that proudly uses the opensource slogan.
They’re basically trying to get rid of vaultwarden and other open source forks. I expect they’ll get a cease and desist and be removed from github at some point in the not too distant future if they don’t make some changes. I have a vaultwarden instance and use the bit warden clients. Guess I’ll need to look for alternatives in case Bitwarden decides to get aggressive.
nothing lasts forever without being enshittified
Except if it’s free software.
not in capitalism no
Welp, I guess another time to move here soon.
And I just fucking vouched for them to a friend recently 🤡
Didn’t know about VC funding these parasites using their funding to turn everything into shite.
What’s the current “best” alternative? Keepass?
It’s not open source, but I got a lifetime license for Enpass over a decade ago and it’s done everything I’ve ever needed it for. I think stacksocial occasionally has new lifetime codes for sale. I like the idea of Proton Pass as others have said, but it feels a bit like putting all my eggs in one basket, which is a mistake I already made with Google before (context: I use Proton for email). I think Keepass is the next best option if dedicated to staying FOSS.
I haven’t jumped yet, but the Proton suite is looking more and more appealing. I’ve been eyeing them as a Gmail replacement, but I’ve been happy with my VPN and password management providers. As this reduces the bundle makes more sense.
They have a solid value proposition but don’t like putting all my eggs all in one basket both for security and monopoly reasons.
They seem to be gunning for one stop shop and I think they are doing decent shop but I just don’t like the idea after what Google did to us.
Situation is a bit different but gonna need to tka the lessons and not let these corpos do this again.
That’s a good practice, and I think you’re right that is what they’re going for. I don’t think that means you shouldn’t consider them, but it does lower their value proposition as the bundle is the better deal.
this isnt a full solution obviously, but I figured it’d be nice to know: Proton lets you set different passwords for your email and password manager, so at least from a security standpoint its not all behind the same password, even if it is still from the same company
Vaultwarden updated link
Open source version of bitwarden written in rust.
Where is the foundation to support foss?!?
If they’re moving away from open source/more monetisation then they’re going to do one of two things.
1: Make the client incompatible (e.g you’ll need to get hold of and prevent updating of a current client).
2: DMCA the vaultwarden repoIf they’re going all-in on a cash grab, they’re not going to make it easy for you to get a free version.
You can’t “dmca” the fork that was created while it was still open source. They could only prevent it from getting future updates (directly from them).
If you mean they shouldn’t. I’d agree. But, as has been seen a lot on youtube. “They” can DMCA anything they want, and the only route out is usually to take them to court.
I mean I’d hope if they’re going in this direction they will be decent about it. But, it’s not the way things seem to be lately.
DMCA is a tool for suppression of free information. It doesn’t require evidence that you’ve made a good faith effort to consider fair use or other legal complexity as it’s meant to take down the information before that is settled in court, but most commonly used to suppress information from a person or group who can’t afford to fight it in court. Microsoft’s Github has a history of delete first without risking their own necks to stand up for obviously fraudulent takedowns much less ones with unsettled law like APIs/SDKs.
Don’t forget option 3: someone writes a vaultwarden client independent of the closed-source crap.
If you can write a server that fully supports the client via the documented API, then you know everything you’d need to do to make a client as well.
That’s not a third option in the same list (things they are going to do), it’s an item in an entirely different list (foss responses to their actions).
You have your link formatted backwards. It should be Vaultwarden, with the link in the parentheses.
This is by no means to a slight towards bitwarden. Solid product and community
