Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

171–180 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#171

Post by throwaway290 »

FateOfNations wrote: post #60
sneak wrote: post #18

Doesn’t GPL mean that it can’t be forked and published into the Apple iOS app store? Presumably they are able to do it because they own the rights and can grant a non-GPL license to Apple for distribution. This seems to me to still be a “nobody can fork this [and still have a viable iOS app] but us”.

Whenever I've heard about someone having problems publishing a fork on the App Store, it was a trademark rather than a copyright issue. If you fork it, you must completely re-brand it to publish it on the App Store.

Don't forget disclosing the source to users!

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#172

Post by beAbU »

fy20 wrote: post #123
nocoder wrote: post #64

What would be a good way to backup the passwords stored in Bitwarden? I am worried that someday suddenly bitwarden could stop working and I will lose access to all the stored passwords? Should I have a physical copy of all the passwords stored in a vault at home?

If you have some sort of home server, I'd recommend hosting vaultwarden (an open-source implementation of the BitWarden server). It works fine with the official apps. Their enterprise model requires a standard API, so it's not going to break anytime soon.

This does not take the need for separate backups way though. In fact, I'd argue it makes it even more important to maintain a 3-2-1 backup of your vault.

Running vaultwarden on a home server is one small disaster away from losing everything. Homelabs typically don't enjoy the same level of protections and redundancies compared to a commercial DC.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#173

Post by bowsamic »

RamRodification wrote: post #161
gouggoug wrote: post #91

Earlier quoted context omitted.

> It asks you for a URL but you can put anything in. Well, that’s kind of the problem isn’t it? Yes, you can put bogus URLs, but it’s far from a great user experience

door://businesstreet/23/A/front

No end user understands URLs this way. Unless Firefox teaches them this, then this is nonsense

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#175

Post by ahiknsr »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good.

I use both Bitwarden and Firefox and I would strongly encourage everyone to not use the password manager in Firefox. Do you know the tab sync across devices is broken in firefox? It was broken since Aug 24 and it is still not fixed https://bugzilla.mozilla.org/show_bug.cgi?id=1913795 . If they can't sync tabs across devices, i wouldn't trust them to sync my passwords.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#176

Post by chx »

weikju wrote: post #4

Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do.

Repeatedly: when people post shit like this they more or less guarantee the next company won't even try. People! this is one of the few companies which open sources their product. The time to doubt and preach is not here yet... by far.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#177

Post by archi42 »

tjoff wrote: post #126
runiq wrote: post #124

Earlier quoted context omitted.

Is this... is this sarcasm? I honestly can't tell anymore.

It is not.

Would you care to elaborate? It also matters what counts as "bad password manager" to you - Poor crypto? Poor UX? A reddit post ;-)? LastPass?

With passkeys, both the website and the user can be pretty sure that the "password" is secure. The website knows that it's based on enough entropy, and the user knows that the website can not loose it.

Of course if I use a random generated 80 char password I only mildly care if the website stores it plain text or not.

But if I was a site operator, I could additionally trust that the users are using secure passwords. Without insane strength requirements (which people only work around anyway, e.g. Passw0rd!123 is usually accepted, but thisisasuperlongpassphrase often is not).

I'm in the business of testing security, which means I sometimes crack passwords. No matter how much training you put your employees through: Somebody gonna use ${some name}${0 or 1 special char}${some birthday} - is it's the spouse, kids or affairs data, your guess is as good as mine.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#178

Post by hexfish »

nocoder wrote: post #64

What would be a good way to backup the passwords stored in Bitwarden? I am worried that someday suddenly bitwarden could stop working and I will lose access to all the stored passwords? Should I have a physical copy of all the passwords stored in a vault at home?

Frankly I would worry about that with any third party that holds my data. There are a few Bitwarden exporters on Github that also account for attachments (something the builtin exporter doesn't for some reason).

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#179

Post by chx »

mbix77 wrote: post #156

Such a pity they are starting to try to move to proprietary model. I have been using them for years. I thought they were different than other "open-source" companies (e.g. Redis). What are the alternatives for an open-source cross-platform password manager? Anybody has used Vaultwarden already?

No, they are not. They have a separate product which is closed source and there was a accidental mixup between the dependencies of the two. They fixed it quick. As I posted repeatedly in this issue: we need to be much much more lenient and supportive of one of the very few companies which still try. If this is the support they get why would anyone else even bother?
Post reply on HN