Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: Bitwarden compatible server written in Rust

#71

Post by seized »

Nullabillity wrote: post #18
darksaints wrote: post #13

I don't have any experience with running the bitwarden server, but the primary selling point for this is that it is less resource intensive than the official server backend. The official backend is written in C#, and is currently using .NET 5. I haven't ever felt like .NET apps were particularly bloated, but I guess it's possible to write bloated code in any language. Does anybody have any insights as to what is done…

Apart from the pain around dealing with .NET itself, Bitwarden's official server only supports MSSQL which is a nightmare in pretty much every conceivable way (licensing, tooling, packaging, and so on). Vaultwarden seems to support plain old Postgres and SQLite.

Bitwarden is working on support of other DBs as well.

Re: Bitwarden compatible server written in Rust

#72

Post by gkop »

jabart wrote: post #14
mikece wrote: post #4

As cool as a native code back-end for Bitwarden would be I would be more interested in seeing vendor native mobile apps (Swift/Xcode, Kotlin/Android Studio) and putting the Xamarin code out to pasture. Would also like to see an improvement in the desktop Electron app as well or at least get it to feature parity with the web vault. All of that said Bitwarden is a fantastic product and I recommend that over every other…

Why move away from Xamarin? It works. Reduces development needs. Xamarin iOS uses Ahead-of-Time compile which is pretty close to native at that point. Phones are fast enough now to handle a little extra UI layer code like I'm sure Swift and Kotlin have. Most end-users don't even know what Xamarin is.

Bitwarden on iOS suffers from high latency user interaction, it’s much less usable than the iOS native keychain for this reason. I assumed the bottleneck is the public API for password managers, but maybe part of it is Xamarin?

Re: Bitwarden compatible server written in Rust

#73

Post by jobu »

gen220 wrote: post #58

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords, even if they're encrypted at-rest, and I didn't want to have my life held hostage by a company that has a change of heart regarding the cost of password availability. I had heard of Bitwarden before, and looked into it. The stack struck me as incredible for a…

LastPass was great for almost 10 years until LogMeIn bought them and they've been messing around with the business model and pricing ever since. I paid $12/year for several years to get mobile access. Then after they were bought I was somehow automatically upgraded to their premium plan for $36/yr. They had given notice but it went into my Promotions inbox and it was months before I realized it. Every year since they've tried different pricing models and it's been frustrating to keep up with.

I had been planning on switching over to Bitwarden in a couple months when my current LastPass subscription runs out, but I just found out that LogMeIn is spinning them off into a separate company again - https://www.zdnet.com/article/logmein-announces-plan-to-spin...

Re: Bitwarden compatible server written in Rust

#74

Post by novok »

uncomputation wrote: post #42
mikece wrote: post #11

Earlier quoted context omitted.

I know this is off-topic but isn't Rust meant to be more of a systems-level language? It seems to me that Go would be a better choice for server-side API (assuming .NET 5 and 6 are too bloated and slow for your tastes). Or is Rust finding a niche in userpace apps even though it was designed for systems level use? I am not saying apps shouldn't be written in Rust, I just don't understand the appeal. What am I missing?

I personally don’t see the appeal of Go. With Rust, I can write a concurrent, safe, and C-performant program with modern programming features like matches, generic programming, and a dedicated package manager (never understood go get). To boot, Rust has a strong ecosystem and the fastest web framework out there (Actix). It takes roughly the same amount of code to do networking stuff in Rust and Go, but with Rust it i…

You choose golang because you basically want java with less memory usage and static single binary deploys for your backend server applications.

Go was designed to be a language that development scales very well with it's focus on simplicity and very fast compile speed.

Rust on the other hand, was designed to make certain hard things less hard, at the cost of complexity, ease of learning, speed of development (high amount of restrictions) and compile speed. If you have a multi-million line monolith made in rust, I bet your compile speed and edit-build-run cycle will take a very long time and be very painful compared to the same golang one. Hiring will also be harder because the minimum IQ & experience bar is higher and you couldn't have productive jr engineers get up to speed on it nearly as quickly.

Re: Bitwarden compatible server written in Rust

#75

Post by Caligatio »

sramam wrote: post #48
matthew-wegner wrote: post #24

Earlier quoted context omitted.

It's been a few years since I looked at the official server setup (I immediately switched to bitwarden_rs, this project), so maybe this isn't as true today: Mostly it's that the official setup is the same thing that runs their free/paid hosted service. By design, it is quite split apart into separate areas, presumably so they can scale independently of each other: https://github.com/bitwarden/server/blob/master/SETUP…

> Another benefit is that this flips all of the "paid" feature flags to true. If you self-host Bitwarden's official setup you still have to pay a subscription to use paid features. As a developer and cheapskate user myself, I understand the appeal of this. As a product builder, I struggle with what this means to build a business upon an open core model.

I would have more of a problem with this if it was a simple fork with a few variables modified to enable features rather than a complete rewrite with a compatible API. None of the paid features are technological breakthroughs (e.g. one just checks HIBP to see if passwords have been leaked) so, imo, it's really the re-implementor that did all the work.

I do feel a little bad using the client applications for free given their business model revolves charging for the backend only.

Re: Bitwarden compatible server written in Rust

#76

Post by cobertos »

jobu wrote: post #73
gen220 wrote: post #58

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords, even if they're encrypted at-rest, and I didn't want to have my life held hostage by a company that has a change of heart regarding the cost of password availability. I had heard of Bitwarden before, and looked into it. The stack struck me as incredible for a…

LastPass was great for almost 10 years until LogMeIn bought them and they've been messing around with the business model and pricing ever since. I paid $12/year for several years to get mobile access. Then after they were bought I was somehow automatically upgraded to their premium plan for $36/yr. They had given notice but it went into my Promotions inbox and it was months before I realized it. Every year since they…

This is why I switched to Vaultwarden. The migration was at least simple (self-host server, export LastPass, import to BitWarden) and now I can save TOTP too. And syncing works better.

Re: Bitwarden compatible server written in Rust

#77

Post by blub »

masklinn wrote: post #46
giancarlostoro wrote: post #34

Earlier quoted context omitted.

I remember a time when people called Go a systems language, is that time over now?

The only people who did that was the Go team itself, and they did so in contravention of the usual interpretation of the term, as by it they meant either the completely meaningless "you can built systems with it", or that you could build systems services or utilities (which is not what is usually meant by "systems language").

I'm not aware of any official or standard definition of system programming. There's application programming and anything which doesn't fit in there is system programming which can be low-level, middleware, etc.

Go is appropriate for writing services / daemons, command line tools, servers, etc. It's not well suited for writing operating system code and very performance-intensive code (databases, audio/video, etc), but there's still a big overlap with Rust.

It seems to me that this whole discussion keeps coming up because parts of the Rust community are worried about the competition. And they have reason to be :-)

Re: Bitwarden compatible server written in Rust

#78

Post by Isthatablackgsd »

jobu wrote: post #73
gen220 wrote: post #58

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords, even if they're encrypted at-rest, and I didn't want to have my life held hostage by a company that has a change of heart regarding the cost of password availability. I had heard of Bitwarden before, and looked into it. The stack struck me as incredible for a…

LastPass was great for almost 10 years until LogMeIn bought them and they've been messing around with the business model and pricing ever since. I paid $12/year for several years to get mobile access. Then after they were bought I was somehow automatically upgraded to their premium plan for $36/yr. They had given notice but it went into my Promotions inbox and it was months before I realized it. Every year since they…

> They had given notice but it went into my Promotions inbox and it was months before I realized it.

That's why I have them disabled in my gmail accounts, I have several missed important emails because they landed in the wrong section. I disabled them in my work email too. My boss keep it on and it causes my boss issues with missing RFQ and requests.

I went with Keepass, it is free, open source, cross-platform. Been using Keepass for 10 years. I control my data and my file, so I don't need to worry about potential data breach which several other SaaS password management failed to keep it secure. My keepass database (vault) resides in my OneDrive and synced across all of my devices that have Keepass. And I like Keepass will generate a backup of the database before saving the entry in case of corruption. It happened to me once 5 years ago and it was in Dropbox storage that time, somehow Dropbox failed to sync the change and ended up corrupting the synced vault across of my devices. I have 260+ entries in my keepass.

Neat thing about Keepass, it can check haveibeenpwned.com and compare the password in my vault. It generated a list of password that need to be changed.

Re: Bitwarden compatible server written in Rust

#79

Post by Tijdreiziger »

iandinwoodie wrote: post #22
mikece wrote: post #8

Earlier quoted context omitted.

Bitwarden Mobile: https://github.com/bitwarden/mobile I will freely admit I am strongly biased against Xamarin as there are so few cases where I think it's unequivocally the right choice, and Bitwarden isn't one of them. It would make more sense to take the work done in their desktop electron app and use that as part of an Ionic hybrid mobile app than to screw around with the layercake of bugs and mismatched APIs tha…

Do you know of any open source mobile apps that are full vendor native for iOS and Android? I'd really like to peruse some examples of that.

From a cursory look it seems that OsmAnd [1] and Signal [2] are native for both platforms. Signal Desktop looks like it's Electron-based, though.

[1] popular OpenStreetMap client, https://github.com/osmandapp/

[2] popular messaging app among privacy advocates, https://github.com/signalapp

Re: Bitwarden compatible server written in Rust

#80

Post by blub »

mikece wrote: post #11
todd3834 wrote: post #7

I’ve been really diving into Rust over this holiday break and reading through code bases like this is really helpful. Little things like a shared db connection are not intuitive on the first pass when everything is under such a strict borrow/move/release paradigm. I’m going to study this a little closer but it still isn’t super clear to me. In other languages I would probably implement a singleton of some sort. I kno…

I know this is off-topic but isn't Rust meant to be more of a systems-level language? It seems to me that Go would be a better choice for server-side API (assuming .NET 5 and 6 are too bloated and slow for your tastes). Or is Rust finding a niche in userpace apps even though it was designed for systems level use? I am not saying apps shouldn't be written in Rust, I just don't understand the appeal. What am I missing?

Programming languages like C and C++ have been used to write user space apps for decades. A language which can only be used for kernel space code is a niche within a niche within a niche. If Rust were only capable of that it would barely register on anyone's radar and be dead on arrival. In fact it's only recently that serious work was started on using Rust in a mainstream kernel (Linux); every project that Rust is known for is running in user space.

People are confused about what system programming means and a lot of that confusion comes from parts of the Rust community which want to carve out a niche for Rust and keep claiming that Rust is particularly suited to system programming, as opposed to Go or D or other languages which are in reality also capable of tackling many system programming jobs, but have a garbage collector.

Post reply on HN