Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Bitwarden compatible server written in Rust

#51

Post by fri_sch »

mikece wrote: post #4

As cool as a native code back-end for Bitwarden would be I would be more interested in seeing vendor native mobile apps (Swift/Xcode, Kotlin/Android Studio) and putting the Xamarin code out to pasture. Would also like to see an improvement in the desktop Electron app as well or at least get it to feature parity with the web vault. All of that said Bitwarden is a fantastic product and I recommend that over every other…

> All of that said Bitwarden is a fantastic product and I recommend that over every other server-based password manager out there.

Do you want to share what makes you think Bitwarden is superior to other selfhosted, open-source solutions (e. g. Passbolt, Passwork, Psono)?

Re: Bitwarden compatible server written in Rust

#52

Post by mikece »

rectang wrote: post #37
mikece wrote: post #11

Earlier quoted context omitted.

I know this is off-topic but isn't Rust meant to be more of a systems-level language? It seems to me that Go would be a better choice for server-side API (assuming .NET 5 and 6 are too bloated and slow for your tastes). Or is Rust finding a niche in userpace apps even though it was designed for systems level use? I am not saying apps shouldn't be written in Rust, I just don't understand the appeal. What am I missing?

Once I got used to writing in Rust, I found it really hard to mess up. I sort of like it for applications, although some idioms can be a bit verbose and hard to parse visually and mentally. First, thanks to default immutability of variables and the borrow checker, I trust that I'm far less likely to accidentally mutate something and cause an action-at-a-distance bug. Second, I absolutely love idiomatic Rust error han…

> "Once I got used to writing in Rust..."

How long did that take and what resources did you use to learn?

Re: Bitwarden compatible server written in Rust

#53

Post by teekert »

k8sToGo wrote: post #44
teekert wrote: post #33

I love this, it's how I run my password manager (Using docker-compose and traefik for the ui). Bitwarden works very well in iOS and Android and on Windows10 and in Firefox. Syncs are always instant, I used to use KeePassXC with NextCloud but inevitably I'd have syncing issues (admittedly, not very often). Not anymore. I still have to dig into the Organization feature to share passwords with my partner.

When I looked at it, it seemed that backing up bitwarden is much more complicated than a single KeePass file.

For me it’s just my docker mounted folder.

Re: Bitwarden compatible server written in Rust

#54

Post by simpleguitar »

tuetuopay wrote: post #15
darksaints wrote: post #13

I don't have any experience with running the bitwarden server, but the primary selling point for this is that it is less resource intensive than the official server backend. The official backend is written in C#, and is currently using .NET 5. I haven't ever felt like .NET apps were particularly bloated, but I guess it's possible to write bloated code in any language. Does anybody have any insights as to what is done…

I do still run the bitwarden official server. While I would not considered bloated by 2021 standards, it still eats up more that 2GB of RAM for my single-user setup... It prompted me to upgrade the VPS I run it to a more expensive version with more RAM. So yeah, resource usage is real, especially if you plan to run this on a Pi or on small cloud intances.

>it still eats up more that 2GB of RAM for my single-user setup

Call me old fashioned, but that seems like an insanely large amount of resources to host one person's passwords.

Re: Bitwarden compatible server written in Rust

#55

Post by opportune »

andrepd wrote: post #50
terhechte wrote: post #17

Earlier quoted context omitted.

I‘m on Mobile right now, but in that case you’d wrap your db in a Arc > (or Rc if you don’t need concurrency.). Then, anytime you need to access the DB, you’d try to lock the RwLock’s Writer or reader.

But isn't this imposing a runtime cost on safety? Isn't rust all about safety and performance?

Under the hood most (all? Hesitate to say all but probably all) clients will have some form of mutex lock to at the very least control access to the file (eg socket) they use to pass messages to the server. If you find an example otherwise I’d like to hear it, though do keep in mind the mutex may not even be implemented in userspace.

Which is to say, accessing a client may or may not be thread safe (depending on the client implementation) but assuming it’s not a multiplexing client, it almost certainly uses some kind of locking mechanism under the hood

Even if it is a multiplexing client, if you saturate the internal clients you will either need to wait for a client to stop writing to its socket (through perhaps a lockless consumer model) or create a new internal client (slow).

Re: Bitwarden compatible server written in Rust

#56

Post by ClumsyPilot »

mikece wrote: post #8
darksaints wrote: post #5

Earlier quoted context omitted.

The bitwarden mobile apps are using Xamarin? That's actually pretty impressive...I've never had any of the weird issues with the bitwarden app that I've had with other Xamarin apps in the past. The desktop app looks and feels like an electron app, so I'm far less impressed by it. At the very least it would be nice to have it in Qt or something like that.

Bitwarden Mobile: https://github.com/bitwarden/mobile I will freely admit I am strongly biased against Xamarin as there are so few cases where I think it's unequivocally the right choice, and Bitwarden isn't one of them. It would make more sense to take the work done in their desktop electron app and use that as part of an Ionic hybrid mobile app than to screw around with the layercake of bugs and mismatched APIs tha…

"desktop electron app and use that as part of an Ionic hybrid mobile app"

Whatever you think of Xamarin, there is a special place in hell for all the buggy JS based mobile software. Its not an improvement, just a different flavour of crap.

Re: Bitwarden compatible server written in Rust

#57

Post by dagmx »

mikece wrote: post #11
todd3834 wrote: post #7

I’ve been really diving into Rust over this holiday break and reading through code bases like this is really helpful. Little things like a shared db connection are not intuitive on the first pass when everything is under such a strict borrow/move/release paradigm. I’m going to study this a little closer but it still isn’t super clear to me. In other languages I would probably implement a singleton of some sort. I kno…

I know this is off-topic but isn't Rust meant to be more of a systems-level language? It seems to me that Go would be a better choice for server-side API (assuming .NET 5 and 6 are too bloated and slow for your tastes). Or is Rust finding a niche in userpace apps even though it was designed for systems level use? I am not saying apps shouldn't be written in Rust, I just don't understand the appeal. What am I missing?

Rust has found use in userspace apps. In fact I'd say most prominent use is stuff people interact with everyday.

Firefox has portions written in Rust. 1passwd, Dropbox etc...

If you use Visual Studio Code, it uses ripgrep which is built in rust.

I use Rust for most of my servers now. It's replaced Python + flask in many cases, without too big a difference in my code.

Re: Bitwarden compatible server written in Rust

#58

Post by gen220 »

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords, even if they're encrypted at-rest, and I didn't want to have my life held hostage by a company that has a change of heart regarding the cost of password availability.

I had heard of Bitwarden before, and looked into it. The stack struck me as incredible for a security product: numerous services that need to be updated in-sync provides a wide surface area for attack, and ultimately encourages you to use their managed solution, IMO. Keepass is better, but the surface area is still quite broad.

Ultimately, I settled on `pass`[1], made by the creator of wireguard. It takes advantage of a clever inversion of responsibilities, where clients store the passwords and sync with git. You can have a "dumb" git remote with no local private key; even if compromised there's not much to consume. Encryption is powered by GPG, so the security surface area is managing your private keys, which is a very well-understood problem.

It's probably the best product for security-minded hacker types. As a simple offering (a shell wrapper around GPG + git), it's easy to build clients for, which means there are many OS/browser-integrated clients to choose from. Similarly, it was trivial to import everything from Lastpass.

Maybe most important of all, once setup, it passed the spouse/parent test for me. They needed me there for setup, but once setup I haven't needed to give additional support for the last year, ymmv.

[1]: https://www.passwordstore.org/

Re: Bitwarden compatible server written in Rust

#59

Post by dagmx »

celliopia wrote: post #39
mikece wrote: post #11

Earlier quoted context omitted.

I know this is off-topic but isn't Rust meant to be more of a systems-level language? It seems to me that Go would be a better choice for server-side API (assuming .NET 5 and 6 are too bloated and slow for your tastes). Or is Rust finding a niche in userpace apps even though it was designed for systems level use? I am not saying apps shouldn't be written in Rust, I just don't understand the appeal. What am I missing?

Why are the Rust proponents so triggered by what seems to be an honest question about the popularity of Rust? I don't know the first thing about Elixir or Erlang but I realize there are some powerful properties of BEAM and if there seemed to be a trend to rewrite apps into BEAM apps I would want to know what am I missing out on that, if clued-in, I would join the rush as well. I think that's what OP is saying here (p…

Where are you seeing "triggered" comments? Every reply to that person has been very balanced and neutral, and the question seems to have a positive vote at this point.

Re: Bitwarden compatible server written in Rust

#60

Post by jjice »

andrepd wrote: post #50
terhechte wrote: post #17

Earlier quoted context omitted.

I‘m on Mobile right now, but in that case you’d wrap your db in a Arc > (or Rc if you don’t need concurrency.). Then, anytime you need to access the DB, you’d try to lock the RwLock’s Writer or reader.

But isn't this imposing a runtime cost on safety? Isn't rust all about safety and performance?

Yes, but I can see it being worth while when you can spare the tiny amount of overhead, especially in a project that's meant to be self hosted like this.
Post reply on HN