118
Replies
0
Boosts
It is effectively going closed source
They don’t make any money off of the open source version. It is just a matter of the before they “discontinue” the open source version and move to source available.
If you have any doubts just look at Redis, Vagrant or Terraform
Yeah we have seen the same process many times now.
You can watch this same process unfold live before your eyes with Android OS, or if you don’t want to miss the beginning of the show, grab some popcorn and watch these guys.
Not surprised in the slightest sadly.
Does anyone have a handy guide to switching to selfhosted version? I was considering doing that but I let my plan renew out of laziness.
My knowledge of network security is very limited, right now I only self-host things like movies, music, ROMs, etc. I would love to do the same with my passwords, but I don’t think I would feel comfortable doing it with such sensitive data.
A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.
If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.
Works fine with acme certs though
I’m personally using Let’s Encrypt and duckdns.org for a completely free solution.
Currently only hosting everything on my local network though with VPN to access when not at home.
Here it explains some self host options with links to “Get Started” for each:
bitwarden.com/help/self-host-bitwarden/
For example, here’s the link to “Linux standard deployment”
bitwarden.com/help/install-on-premise-linux/
You may also want to consider not making your server available to the open internet, and instead access it only on your LAN via VPN.
That or jump to Vaultwarden github.com/dani-garcia/vaultwarden
That or jump to Vaultwarden github.com/dani-garcia/vaultwarden
Idk how it compares feature wise, but i have been running keepassxc/keepassdx combined with syncthing (or any file synchronization/cloud system) for many years without issues. The entire password manager database sits in one encrypted .kdbx file that you keep synced between your devices. Syncthing is nice because its p2p, so no self-/hosting required.
keepassxc.org
github.com/keepassxreboot/keepassxc
I had done that for a long time. It worked until it didn’t and I lost passwords. I tried again with keepass2android and it’s built-in sync. It again worked fine until at some point it wasn’t able to sync anymore for no discernible reason. I’d love for this to be a reliable setup, but it just isn’t in my experience, at least when there are 3+ devices involved with different clients and no proper awareness of the password manager and the sync sides of each other.
Exactly. No way I’m going to use this for something critical.
Every single time Bitwarden is mentioned on the internet, someone comes in here and proudly recites the anthem “I have been using Keep ass with sink things”
It sucks compared to a dedicated extension.
No autofill No TOTP or 2FA support Doesn’t do passkeys Doesn’t have organizational sharing Doesn’t sync to mobile devices Doesn’t integrate with mobile browsers without trusting some compatible 3rd party app Requires selfhosting your passwords (don’t fuck it up!)
It’s actually pretty sad that the open source world doesn’t have a better solution for this. I mean I guess BitWarden was it but that’s been stolen by venture capital so
Why is it that every time i comment about keepass, its because some web based password manager once again broke, got hacked, or stopped development. Keepass users just stay winning :)
Also i have been using keepass with TOTP 2FA for years what are you on about?
Also also, you shouldnt use fido passkeys. Its a failed technology that is worse than what it tries to replace.
There isn’t anything wrong with passkeys that can’t also be made wrong with passwords, and there isn’t anything more secure about passwords, at all.
Please don’t tell me you took that article that was spammed all over here a few days ago at face value…
Both KeepassXC on desktop and KeepassDX on mobile support autofill, passkeys, and TOTP. Syncing to mobile devices is handled by Syncthing (I use BasicSync on Android) and is quite seamless after setup.
Integration with mobile browsers and other applications is handled by the OS-level autofill service (at least on Android). Trusting a third party app that is completely open source and has a ton of eyes on it? I don’t see a problem with that.
Selfhosting is literally the entire point, since who more can you trust with your most sensitive information than yourself? And even if you don’t trust yourself with being able to keep good backups and following the 3-2-1 rule, you’re more than welcome to sync with a third party cloud provider of your choosing since the password file is fully encrypted.
I just wish Syncthing didn’t have such a convoluted port usage, and also that its Android usage didn’t revolve around an unofficial app.
So I’ll stick to apps that do sync over SSH (using FolderSync atm).
That’s my stack, except swap keepassdx for keepass2android, and add the Firefox plugin.
I’ve been using that for a while. I like the control I have in that I understand where everything is stored and encrypted. I miss the way that Google password manager had the autofill for seemingly every page nailed though.
Yup great combo. It baffles me why anyone one would favour to depend oneself on an online service instead
I used keepass but switched to vaultwarden, i might consider switching back, but is there a good self hostable web front end for a keepass database? (I need to access it on my work laptop and can’t install stuff there)
There is KeeWeb but I am not sure how well maintained it is. This issue is still open. It might be worth contacting your employers IT department instead. Asking for a well known password manager like KeePass shouldn’t raise any eyebrows.
I dont think there is. Keepass is trying to be as offline as possible. Just makes for a piece of software with much less attack surface.
@Mustachius_Grumpius “The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone”
If there is no intention to put the screws to the user base, then why do it on the first place?
We all know how this game ends when venture capital gets involved.
@flop_leash_973 Where are the screws here?
Split versions is usually the first step. Many projects have done so before. Next year there will be some technical reason they can’t keep feature parity with the commercial repository, and it will drift from the OSS repository. Oops, we broke compatibility, sowwy guys. A couple of years later the OSS repository will be closed because it is a security risk. By that point the company and management would’ve drifted so far from the initial values of the project that people won’t notice. Those who cared will have jumped ship to alternatives sooner, those who noticed later will be already too deep into depending on the software that they will keep paying the subscription.
I have no evidence, but I also don’t have any doubts this is the plan.
Unfortunately, there is no historical example where this hasn’t turned predatory. It’s a tale as old as venture capital has been in software development:
- get free contributions from altruistic people donating their time and expertise to your FOSS project that you’re selling
- make a closed-source set of extensions as optional dependencies
- slowly diverge the closed source feature set to include developer and user “must-haves” you do not contribute upstream
- slow or functionally halt open source contributions
It is an oft-repeated long con to pull off a mass heist of donated skill and time while imposing vendor lock-in on your users through a back door.
"As the poison spread through his body, the frog cried out, “Why did you sting me? You have killed us both!”
The scorpion replied, “I couldn’t help it. It’s my nature.”
I swear most of Grafana’s new features are enterprise only now
- Embrace
- Extend
- Extinguish
I kinda thought the paid plan already had extra features no? Like silly ones but I swear it isn’t just donations right?
It had cloud storage, built in TOTP with autofill, and some had features like organizations and sharing
Still, this fucking sucks. Bitwarden was literally created as a ln answer to this shit happening to LastPass and Dashlane.
I get it because minio dying burned me hard but so long as it keeps operating as it does now do we need more features? I would be fine with a continuously secure version of exactly what it does now. I kinda hate feature bloat
Yup. All CURRENT, these will start to diverge…
yeah but its typical double speak
Why do you think so?
all “current” features. further down its asked about the future and they arent always clear but the fo state there wont be feature parity moving forward
