Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passbolt: Self hostable, open source, password manager for teams

passbolt.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: Passbolt: Self hostable, open source, password manager for teams

#71

Post by jeroenhd »

fraktl wrote: post #66
jeroenhd wrote: post #58

Earlier quoted context omitted.

> - Built with PHP. Same guy was uncomfortable with Python, Node, and all that, and insisted that he be able to maintain and troubleshoot the codebase himself if necessary, so it had to be PHP. Now that's an interesting perspective, I don't think I've heard anyone consider PHP to be more secure than Python before.

> I don't think I've heard anyone consider PHP to be more secure than Python before If you heard anyone discuss language X being more secure than language Y, then I'm sorry - but that person has no clue what they're talking about. PHP is as secure or insecure as Pythong / Ruby / Go / . Hammer depends on the one holding the hammer.

Of course; the best comparison you can make in security here is the amount of raw memory access.

People condemn languages for two security reasons: the average level of competence in products usually written in a language, and the amount of footguns a language provides.

PHP is very easy to learn, which is why a lot (really, a _lot_) of open source software is of very questionable quality. For many, it's the first programming language someone learns, which means the quality is often far from what a developer is capable of with a little more experience.

PHP also has a lot of weird functions and behaviourisms, all perfectly well documented (but nobody really reads up on the details of `isset`, it seems). APIs seem inconsistent and mysql_escape_string and its cousin mysql_real_escape_string tell a story of a problematic history. There's also the typing issue that plagues all loosely typed languages.

I personally consider Go to be more secure of a language than PHP or Python because the behaviour is a lot easier to understand.

Of course properly written, typed, well-tested PHP can be a lot better than many Go products, but the expectations for the different language are just different because of the different levels of experience programmers are when they start with each language.

Re: Passbolt: Self hostable, open source, password manager for teams

#73

Post by mark_story »

polskibus wrote: post #48
smartbit wrote: post #18

Pros - free open source - group management can be delegated - works fine with mac, linux & windows browsers - maintenance free self hosted on k8s for 2 years - lack of mobile apps has not been issue - UX is ok, no complaints - requires little end-user support Cons - only password field is encrypted - no warning that Notes are not encrypted - promises ‘Secure files & notes (Coming soon)’ for more than year - password…

Does sentry have password management options now?

Nope. The parent commenter came to some interesting conclusions, but I've never worked on passbolt. From what I remember passbolt based their repository on CakePHP (of which I'm a maintainer) and inherited all the git history from that project. There are no connections between passbolt and sentry though.

Re: Passbolt: Self hostable, open source, password manager for teams

#74

Post by mark_story »

smartbit wrote: post #18

Pros - free open source - group management can be delegated - works fine with mac, linux & windows browsers - maintenance free self hosted on k8s for 2 years - lack of mobile apps has not been issue - UX is ok, no complaints - requires little end-user support Cons - only password field is encrypted - no warning that Notes are not encrypted - promises ‘Secure files & notes (Coming soon)’ for more than year - password…

Just to clarify, I was never a developer of Passbolt. I think they based their repository off of CakePHP (which I do maintain) and inherited all the commit history that way.

Re: Passbolt: Self hostable, open source, password manager for teams

#75

Post by remy_ »

mark_story wrote: post #74
smartbit wrote: post #18

Pros - free open source - group management can be delegated - works fine with mac, linux & windows browsers - maintenance free self hosted on k8s for 2 years - lack of mobile apps has not been issue - UX is ok, no complaints - requires little end-user support Cons - only password field is encrypted - no warning that Notes are not encrypted - promises ‘Secure files & notes (Coming soon)’ for more than year - password…

Just to clarify, I was never a developer of Passbolt. I think they based their repository off of CakePHP (which I do maintain) and inherited all the commit history that way.

Yes the repository was forked from CakePHP v2, before the framework was moved as a composer dependency, so v2 contributors are shown as Passbolt contributors.

Re: Passbolt: Self hostable, open source, password manager for teams

#76

Post by senectus1 »

senectus1 wrote: post #27
edoceo wrote: post #10

Earlier quoted context omitted.

Hope you let the site operator know, or filed a bug on their github

That's possibly the first time I've ever done a bug report :-P Lets see where it goes #358

hey cool, they fixed it :-D

Re: Passbolt: Self hostable, open source, password manager for teams

#78

Post by half-kh-hacker »

8fingerlouie wrote: post #42
dmacedo wrote: post #25

Earlier quoted context omitted.

Likewise, and I'm loving Bitwarden so far! Although I'm using the dockerized rust API (1) for self-hosting it, and so far it's been working great for months! I am keeping a close eye on the container, and backing up the data hourly to ensure I don't need to worry about loosing anything. (1): https://github.com/dani-garcia/bitwarden_rs

I was evaluating Bitwarden years ago (before bitwarden_rs), but was thrown off by the lack of support for 2FA tokens without a subscription. Does selfhosting with bitwarden_rs solve this ? or do i still need a subscription for storing 2FA tokens along with passwords ? I have absolutely no problem paying once per major version for software, open source or not, but i refuse to pay any subscription. At least when buying…

bitwarden_rs solves this.

Re: Passbolt: Self hostable, open source, password manager for teams

#80

Post by kumarharsh »

httpsterio wrote: post #59
elric wrote: post #53

Earlier quoted context omitted.

How does that work? If it's open source, I can get the source and run it for free, hell, I could even redistribute it for free. What's stopping me from doing this? I assumed it was that the non-free features were distributed under a proprietary license which comes with an invoice attached?

Well, the law and moral basically. What stops you from torrenting all your games and apps and not distributing them forward?

speaking from a personal viewpoint.

I've pirated tons of stuff back in the days as a student, and know how to do all that even today. But now I've stopped pirating stuff.

It's partially because I've actually started earning money, but also because nowadays, it is incredibly easy to be able to PAY for stuff. And many companies actively integrate with local payment gateways and sell me stuff in my local currency too, which makes decision making much easier. It's actually become so easy that I straight-off decline when any friend of mine asks me to help them pirate softwares.

Post reply on HN