- cross-posted to:
- linux@programming.dev
- linux@lemmy.world
- cross-posted to:
- linux@programming.dev
- linux@lemmy.world
RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone
If you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
You must log in or register to comment.
wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.
Side note: I just tried switching to KeePassXC and it seems pretty fine, except for one caveat. If you installed your browser (probs FF or Librewolf) through flatpak or snap on Linux, the browser extension will not work.
I had to change to the non-Flatpak ver of Librewolf on my Fedora PC, which sucked a little lol 😅
Fine to me as long as this doesnt impact Vaultwarden
Having only ever used keepass, what was the advantage of bitwarden? That you didn’t need to sync it yourself?
That you didn’t need to sync it yourself?
and that you have to never deal with sync conflicts. It’s a huge deal for those who are using tech but not understanding it, and a convenience for the rest
It’s also way easier to have shared passwords for family accounts.
That’s the main benefit yeah.
I use the send tool as well for sensitive files
There is no way I’m self hosting something this important… So now I’m not sure what to do actually.
That’s why I’m just using KeePass. It’s just an encrypted file that you can store on whatever storage you want and sync with existing solutions like Syncthing etc.
Yes it’s a bit finicky when you edit the file on multiple devices before they’ve synced but it works very well for me…
If self hosting is not an option. Ideas that come to mind:
Evaluate what it is worth to you and maybe pay for it, if they offer enough worth to you and it is affordable.
Then there are people who host it and provide it to others. Together with other apps, as a suite. Maybe that’s an option. But I suppose, donating or paying is expected here, too.
Or switch to another solution. Preferably one with an import feature.
Well, we all know how this ends…
It’s a really sad day for me, I love Bitwarden, it’s easily the best password manager I’ve used, and I’m in IT, I’ve used a bunch.
Fuck private equity, fuck it to death. But until then, I’ll be moving my test setup for KeyPassXC into production over the coming weeks and months.
I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto it’s platform. We had a good run, time to move on.
why not vaultwarden?
If I’m going to have to host my own infrastructure, I don’t want it tied to Bitwarden, given the new direction of the company.
I fully support Vaultwarden though, and I wish them well.
I’ll be going with KeyPassXC and Syncthing.
Vaultwarden (and all the client apps) depend on Bitwarden for the API spec. If Bitwarden introduces closed features in the API that Vaultwarden can’t/won’t implement, but the client apps do, it will split the spec. They can also introduce API license keys, which would render Vaultwarden mostly irrelevant.
The only way for Vaultwarden to remain relevant going forward is to own it and split ways from Bitwarden. This would in turn mean that the FOSS client apps have to decide which to support. But I think the ecosystem is going to fragment eventually anyway, so the sooner every app decides which way they want to go, the better.
Or you could just fork it when there’s a problem
Sounds like you’re volunteering to do that additional amount of work.
History shows this will happen. Or do you have any counter example?
Mariadb, libreoffice and most recently OpenCourant
Not arguing against it of course, just dislike when people make forking (and establishing a whole new standard) sound like not that big of a deal.
well, the first step of forking is clicking a button or execting a “git clone” command. thats trivial. publishing to android is a bit of work, but very one-time.
keeping up with development is a different story - but many foss projects thrive with support from whoever needs to have something fixed.
When presented a hypothetical between the commenter suggesting it be
A) forked now
And me suggesting
B) forking when there is a problem
You elect C) the commenter does the work?
Brilliant contribution
I’m. Using Vaultgarden but its not clear if the Android app will still be available.
I’ve been very happy with Vaultwarden+Keyguard
It currently doesn’t work with Vaultwarden. The Linux client doesn’t accept custom certificates. And the Android client is paid. It is a dead-end for self-hosting.
The license is also stupidly a single sentence. Which means that use could be nuked at any minute, and any money you use to pay the developer means nothing. If they wanted to kill the project today and nuke the repo, you have no legal rights, the project dies and fuck you and your passwords. That doesn’t exactly inspires confidence.
But that’s not Foss, so I didn’t consider it
It is free and open-source on Desktop at this moment.
Keyguard is a commercial app and unlocking a premium funds its further development and supports me (Artem Chepurnyi) directly. As of right now, only the Android builds distributed via Google Play store have main features locked behind a paywall, other distribution channels have a build with everything unlocked.
But it makes sense to pay for it, since Bitwarden is a constantly changing system and these projects based on it must always be up-to-date with their API changes, too. This is time and worry consuming, and should be compensated.
License is: all rights reserved.
That’s free like in beer, and open like ‘allowed to inspect’ that’s not what most people mean when they talk of Foss.
source: https://github.com/AChep/keyguard-app/blob/master/LICENSE
Awesome!
Thank you very much for the awesome project mentioned! I had no idea about it!
The marvel works great with Vaultwarden, too, it seems!Though, Bitwarden system/clients are not so featureful as KeePassXC, for example, it’s a great alternative for a more adequate synchronization.
There will be… Some fork at least
100% but move where? I’m not going to self host something this critical. KeypassX is so much worse. I can’t even use it on mobile probably.
You can use KeePass on mobile, look for KeePassDX on fdroid.
All these people keep saying that Vaultwarden won’t work because it relies on bitwarden’s API but if there is an incompatibility then wouldn’t vaultwarden just be left in a functional limbo? Like it’ll still work because self hosted but no more new features in parity with official client? Or have I misunderstood the connection between the two
this year there were 2 separate updates to bitwarden clients that fucked up vaultwarden servers, because the bitwarden developers “accidentally” reused a variable name in the data that was unused for a few years. but vaultwarden forgot to remove it, and now it is used in a different way, and the clients bugged away so hard that you had to uninstall them, because even if you was fortunate to be able to get to your passwords list you could not get it to sync otherwise
So, Vaultwarden it is?
This seems to be clients for the end devices, which I’m worried may actually be a move towards locking out VaultWarden which will uses the BW Clients
Sure, it’s no change for self hosters currently, but it’s one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I’ve been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven’t hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I’d love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I’ve thought about doing some myself, but I have too many other projects and I also don’t have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS’s.
Heh, I’m looking at you to those people that looked at me weird because I told them I was good with Keepass!
I guess we’re gonna see more open-source apps soon, aimed at Vaultwarden first
Are they still going to publish the Android client app via their own F-Droid repository?
Not surprised in the slightest sadly.
@Mustachius_Grumpius “The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone”
If there is no intention to put the screws to the user base, then why do it on the first place?
We all know how this game ends when venture capital gets involved.
@flop_leash_973 Where are the screws here?
Split versions is usually the first step. Many projects have done so before. Next year there will be some technical reason they can’t keep feature parity with the commercial repository, and it will drift from the OSS repository. Oops, we broke compatibility, sowwy guys. A couple of years later the OSS repository will be closed because it is a security risk. By that point the company and management would’ve drifted so far from the initial values of the project that people won’t notice. Those who cared will have jumped ship to alternatives sooner, those who noticed later will be already too deep into depending on the software that they will keep paying the subscription.
I have no evidence, but I also don’t have any doubts this is the plan.
Unfortunately, there is no historical example where this hasn’t turned predatory. It’s a tale as old as venture capital has been in software development:
- get free contributions from altruistic people donating their time and expertise to your FOSS project that you’re selling
- make a closed-source set of extensions as optional dependencies
- slowly diverge the closed source feature set to include developer and user “must-haves” you do not contribute upstream
- slow or functionally halt open source contributions
It is an oft-repeated long con to pull off a mass heist of donated skill and time while imposing vendor lock-in on your users through a back door.
"As the poison spread through his body, the frog cried out, “Why did you sting me? You have killed us both!”
The scorpion replied, “I couldn’t help it. It’s my nature.”
- Embrace
- Extend
- Extinguish
I swear most of Grafana’s new features are enterprise only now
yeah but its typical double speak
Why do you think so?
@surewhynotlem @Mustachius_Grumpius
Experience…all “current” features. further down its asked about the future and they arent always clear but the fo state there wont be feature parity moving forward
Yup. All CURRENT, these will start to diverge…
I kinda thought the paid plan already had extra features no? Like silly ones but I swear it isn’t just donations right?
It had cloud storage, built in TOTP with autofill, and some had features like organizations and sharing
Still, this fucking sucks. Bitwarden was literally created as a ln answer to this shit happening to LastPass and Dashlane.
I get it because minio dying burned me hard but so long as it keeps operating as it does now do we need more features? I would be fine with a continuously secure version of exactly what it does now. I kinda hate feature bloat
Does anyone know if there’s any chance for a fork before this situation inevitably deteriorates? I dont know the license on that software enough to know if its an option.
are u gonna maintain clients?
No, I have money to pay instead. If I were able to contribute to the effort, I would have said that. Just picking fights in response to open questions today?
