Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

111–120 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#111

Post by fraktl »

Cu3PO42 wrote: post #32
polote wrote: post #28

There is really something broken in the dev word. Why are people wasting their time rebuilding things that already exists ? If that was a side project to learn Rust, to learn the API of bitwarden, or to add new features I would understand, but that doesn't seem to be the case. I'm really curious why? "perfect for self-hosted deployment where running the official resource-heavy service might not be ideal" is that real…

Because it’s fun? Because they just felt like it? Why are people wasting their time watching movies, reading books or doing literally anything that doesn’t create immediate value? Beside all of that, the reason given is an extremely good one. The official server deployment suggests you should have multiple GB of free RAM for it. Bitwarden_rs uses orders of magnitude less. Right now it's sitting at 20MB on my server.

I run Bitwarden official on a Hetzner dedicated box, the machine costs ~40€ a month, Bitwarden usage does not even register as statistical error, therefore resource consumption is really not such a concern.

There's really no objective reason to use bitwarden_rs. Subjectively - we can do whatever we like, I'm not trying to challenge anyone into providing their reasons or into justifying their decisions, there's no right or wrong here.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#112

Post by Barrin92 »

FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

I mean at the end of the day your data is encrypted before it leaves your device and unless someone breaks encryption you can display it on a banner ad on Times Square and it doesn't make a difference.

Personally I think hosting the server locally doesn't give much benefit because I'm more likely to screw things up than Bitwarden is on that front.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#113

Post by technorange »

jamienicol wrote: post #71
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

I would set it up locally on raspberrypi with PiVPN and only allow specific IP (bitwarden IP) to be accessible via that VPN connection. Also you will need self-signed cert installed on the devices where you want to access bitwarden if you dont have a public domain.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#114

Post by sirtaj »

holtalanm wrote: post #36

I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.

I switched over when I realised the Lastpass browser integration was chewing up CPU and significantly slowing down my browsing experience.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#115

Post by rubatuga »

AnIdiotOnTheNet wrote: post #85
rubatuga wrote: post #83

Earlier quoted context omitted.

You don’t even need docker if you build from source

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

Lmfao, you assume that docker is easy to install

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#116

Post by [deleted] »

FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

[deleted]

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#117

Post by zzyzxd »

arsome wrote: post #106
zzyzxd wrote: post #105

Earlier quoted context omitted.

> The peace of mind in having all your sensitive data under your control is totally worth it. I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true. I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with…

Just set up backups, enable apt unattended upgrades for major security patches and forget the rest. If you want to really get paranoid, pass it all through wireguard or ssh tunnels, but for bitwarden at least it's all client side encrypted anyways, you could probably run it on a very out of date system without issue.

Sure. But do you constantly verify backups, check hard drive health and file corruptions, practice disaster recovery?

And these are just for the integrity of your _encrypted_ data. There are a lot more to do to fully secure your home infra in general. How do you secure your wireguard client key on the go? Do you monitor access logs? What about Guest Wi-Fi access, vlan separation...

I don't know if worrying about all these considered being paranoid. End of day it's about risk management, and personally, the benefits of selfhosting does not justify the effort I will need to put into maintaining it.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#118

Post by AnIdiotOnTheNet »

rubatuga wrote: post #115
AnIdiotOnTheNet wrote: post #85

Earlier quoted context omitted.

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

Lmfao, you assume that docker is easy to install

Docker was an apt install, it wasn't exactly what I would call difficult.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#119

Post by AnIdiotOnTheNet »

smoldesu wrote: post #89
AnIdiotOnTheNet wrote: post #85

Earlier quoted context omitted.

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

Rust is designed to be built from source, and the development toolchain is light enough to keep on a VPS if that's your bag. If you have Cargo installed, compiling and installing from source is easier than using NPM.

I couldn't care less about Rust. The fact that this project used it is irrelevant to me and I have no desire to setup a Rust build env.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#120

Post by Graffur »

jillesvangurp wrote: post #99
ClumsyPilot wrote: post #62

Earlier quoted context omitted.

"3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS." Thats an outright fantasy, every day I rely on like 50 pieces of software written in 20 different languages and frameworks. They are updated multiple times a month. How many man hours would it take? 1000 a week? Proffesional developers couldn't find heartbleed for years, you really think anyone would notice a hi…

The keyword in that sentence is trust. Either trust or check. Your choice. Most people choose to trust certain software providers based on their reputation. But if you have serious doubts and you don't check, that would be your problem. Whining about an open source project maybe being insecure basically means either check it or don't use it. Nobody is twisting your arm to risk your passwords on some wonky self hosted…

Who is whining? OP even said they love the project. They're just asking a question.
Post reply on HN