• unskilled5117@feddit.org
    link
    fedilink
    English
    arrow-up
    215
    arrow-down
    2
    ·
    edit-2
    1 month ago

    This is an important issue IMO that needs to be addressed and the official response by Bitwardens CTO fails to do so.

    There is not even a reason provided why such a proprietary license is deemed necessary for the SDK. Furthermore this wasn’t proactively communicated but noticed by users. The locking of the Github Issue indicates that discussion isn’t desired and further communication is not to be expected.

    It is a step in the wrong direction after having accepted Venture Capital funding, which already put Bitwardens opensource future in doubt for many users.

    This is another step in the wrong direction for a company that proudly uses the opensource slogan.

    • sunzu2@thebrainbin.org
      link
      fedilink
      arrow-up
      68
      arrow-down
      4
      ·
      1 month ago

      Welp, I guess another time to move here soon.

      And I just fucking vouched for them to a friend recently 🤡

      Didn’t know about VC funding these parasites using their funding to turn everything into shite.

      What’s the current “best” alternative? Keepass?

      • foggenbooty@lemmy.world
        link
        fedilink
        English
        arrow-up
        18
        arrow-down
        1
        ·
        1 month ago

        I haven’t jumped yet, but the Proton suite is looking more and more appealing. I’ve been eyeing them as a Gmail replacement, but I’ve been happy with my VPN and password management providers. As this reduces the bundle makes more sense.

        • sunzu2@thebrainbin.org
          link
          fedilink
          arrow-up
          31
          arrow-down
          2
          ·
          1 month ago

          They have a solid value proposition but don’t like putting all my eggs all in one basket both for security and monopoly reasons.

          They seem to be gunning for one stop shop and I think they are doing decent shop but I just don’t like the idea after what Google did to us.

          Situation is a bit different but gonna need to tka the lessons and not let these corpos do this again.

          • foggenbooty@lemmy.world
            link
            fedilink
            English
            arrow-up
            7
            ·
            1 month ago

            That’s a good practice, and I think you’re right that is what they’re going for. I don’t think that means you shouldn’t consider them, but it does lower their value proposition as the bundle is the better deal.

          • Caboose12000@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            1 month ago

            this isnt a full solution obviously, but I figured it’d be nice to know: Proton lets you set different passwords for your email and password manager, so at least from a security standpoint its not all behind the same password, even if it is still from the same company

      • Artaca@lemdro.id
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        edit-2
        1 month ago

        It’s not open source, but I got a lifetime license for Enpass over a decade ago and it’s done everything I’ve ever needed it for. I think stacksocial occasionally has new lifetime codes for sale. I like the idea of Proton Pass as others have said, but it feels a bit like putting all my eggs in one basket, which is a mistake I already made with Google before (context: I use Proton for email). I think Keepass is the next best option if dedicated to staying FOSS.

    • irotsoma@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      1 month ago

      They’re basically trying to get rid of vaultwarden and other open source forks. I expect they’ll get a cease and desist and be removed from github at some point in the not too distant future if they don’t make some changes. I have a vaultwarden instance and use the bit warden clients. Guess I’ll need to look for alternatives in case Bitwarden decides to get aggressive.

  • ShittyBeatlesFCPres@lemmy.world
    link
    fedilink
    English
    arrow-up
    132
    arrow-down
    3
    ·
    1 month ago

    Oh, for fuck’s sake. Can we have a decent password manager that isn’t tied to a browser or company? I pay for Bitwarden. I’m not being cheap. But open source is more secure. We can look at the code ourselves if there’s a concern.

      • sigmaklimgrindset@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        28
        ·
        1 month ago

        Love Keepass. Love that I can sync it however I want. Love that there are multiple open source client options across several operating systems.

        • saddlebag@lemmy.world
          link
          fedilink
          English
          arrow-up
          30
          arrow-down
          1
          ·
          1 month ago

          Android syncthing announced they’re stopping development this year. Open source got fucked double today

          • prosp3kt@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            13
            ·
            1 month ago

            terrible day. There is a fork called syncthing-fork that is under current development. I hope both projects merge.

        • Bilb!A
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 month ago

          This need not be the case, though! There’s an open source client on Android called Keyguard. I don’t think the desktop app was at all useful anyway. You can just log into your Vaultwarden through any browser. The desktop app is pointless.

          • pmc@lemmy.blahaj.zone
            link
            fedilink
            English
            arrow-up
            21
            ·
            1 month ago

            They now require a non-free Bitwarden SDK component. That’s what this whole conversation is about.

            • sugar_in_your_tea@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 month ago

              And the whole conversation is about a bug, not a change in direction…

              Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”

            • fmstrat@lemmy.nowsci.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              Only the desktop client. And the response is that not being able to compile sans SDK is an issue they will resolve.

              I still think this is bad directionally, but we need to see what happens.

    • asap@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      edit-2
      1 month ago

      Nothing in the article or in the Bitwarden repo suggests that it’s moving away from open source

      • coolmojo@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 month ago

        It is a license problem. The license condition of the SDK which is required to build the client app change to limit the usage of it. The new license states that you can only use the Bitwarden SDK for Bitwarden. It is against the Freedoom-0 of the Free Software Foundation. The limitation of English language is that it is hard to differentiate between Free (as in Free bear) and Free (as in Freedoom). Also open source which could mean complaining with FOSS and that source is available. This been unfortunately have been abused before.

        • sugar_in_your_tea@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 month ago

          From the article, it’s a packaging bug, not a change in direction.

          Update: Bitwarden posted to X this evening to reaffirm that it’s a “packaging bug” and that “Bitwarden remains committed to the open source licensing model.”

            • sugar_in_your_tea@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              5
              ·
              1 month ago

              Here is the code in question. Basically, it’s a source-available, but not FOSS internal SDK, with the following language:

              The password manager SDK is not intended for public use and is not supported by Bitwarden at this stage. It is solely intended to centralize the business logic and to provide a single source of truth for the internal applications. As the SDK evolves into a more stable and feature complete state we will re-evaluate the possibility of publishing stable bindings for the public. The password manager interface is unstable and will change without warning.

              So I think the “bug” here is in not linking the original repo in the NPM package, and there’s a decent chance that this internal SDK will become FOSS in the future once it stabilizes. That said, it’s currently not FOSS, but it’s too early IMO to determine whether Bitwarden is moving in a non-FOSS direction, or if they’re just trying to keep things simple while they do some heavy refactoring to remove redundancy across apps.

              Given their past, I’m willing to give them the benefit of the doubt, but I’ll be making sure I have regular backups in case things change.

  • cmrn@lemmy.world
    link
    fedilink
    English
    arrow-up
    113
    arrow-down
    2
    ·
    edit-2
    1 month ago

    EDIT: The article has been updated and it was described as a “packaging bug” and not an intended change.

    How many times do I need to pack up and move to the next “best option”

    • JustARaccoon@lemmy.world
      link
      fedilink
      English
      arrow-up
      49
      ·
      1 month ago

      Sadly as many times as needed, complacency is how these companies get “loyal customers” who are willing to put up with bs

      • doktormerlin@feddit.org
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 month ago

        That’s far from the best option. It’s working, but it’s super complicated compared to Bitwarden and other cloud password managers. Imagine telling your grandma “just use keepass”, she would never be able to make it work. But Bitwarden? Lastpass? That’s possible