Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

Post reply on HN
Print view View original

311–320 of 333 posts

Re: The quiet renovation at Bitwarden

#311

Post by smallmancontrov »

wafflemaker wrote: post #183
smallmancontrov wrote: post #127

Earlier quoted context omitted.

Does a bear shit in the woods?

Interesting, where are you from? Where does this proverb come from? I know this proverb as (translating from Polish): You're asking the boar if he's shitting in the forest.

I don't know if it is exactly the same proverb -- it isn't about objecting to the bear (or boar) shitting in the woods, it is about our ability to infer that the bear shits in the woods even if we have never seen it happen. We know the bear shits, we know the bear lives in the woods, even people who have lived in the city their entire life and have never seen bear shit can infer that the bear shits in the woods.

In context, my intended meaning was that software enshittification works the same way: we don't have to see a particular private equity firm enshittify a particular piece of software to know that they do enshittify software, just as we do not have to see a bear shit in the woods to know that the bear does shit in the woods.

Re: The quiet renovation at Bitwarden

#312

Post by advisedwang »

hannofcart wrote: post #273
advisedwang wrote: post #209

Earlier quoted context omitted.

keepass files + syncthing works very nicely for me. For non technical people, I just recommend to use the browser built in password managers. traviso has a good writeup why: https://lock.cmpxchg8b.com/passmgrs.html

I was doing this too until recently. The problem with this setup is more at Syncthing. More specifically, Syncthing Android app has seen some troubling changes in maintainers. The latest maintainer has a very sparse Github profile and an AI generated avatar, so I noped out of installing it right then.

Previously I used keepass + drive. That also works well (I just wanted to avoid storing my password db in the cloud for multiple reasons).

Re: The quiet renovation at Bitwarden

#313

Post by msdz »

void-star wrote: post #215
duckmysick wrote: post #103

Earlier quoted context omitted.

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

I have my vaultwarden running on a container on my home-lab server acessible only from Tailscale. The container itself is only accessible as its own node on my Tailscale private network and can’t be reached any other way (there are no inbound port forwards for the container itself, tailscale handles this) My phone and laptop both use tailscale to access this and a few other containers I have set up similarly. I also…

What would happen if you lost access to phone and laptop? Is there another "backup" device, or a mechanism to register a new device to your Tailscale network that doesn't require vaultwarden?

Re: The quiet renovation at Bitwarden

#314

Post by LetsGetTechnicl »

Havoc wrote: post #223
LetsGetTechnicl wrote: post #57

Earlier quoted context omitted.

Vibecoding a password manager might be the worst idea ever. You'd be better off with an encrypted Excel sheet. But otherwise, 1Password is great imo and there are other free open source password managers.

>Vibecoding a password manager might be the worst idea ever. I mean I'm just spitballing here, but not convinced this is true. From a formal security theory perspective certainly, but practically...nobody with half an ounce of skill is going to spend their time breaking one individual's custom solution that almost certainly just contains their hn password. That's if you can even get to it - selfhosted password manage…

Part of it being a bad idea imo is just that it's wasteful to vibe code something that already exists and works well. But I guess that's my attitude to a lot of this AI hype.

Re: The quiet renovation at Bitwarden

#315

Post by Cyan488 »

> A 2022 blog post by Crandell — “Defining and sustaining value for Bitwarden users” — was quietly edited. The GRIT list in the body now shows the new values: Innovation and Trust.

You can assume incompetence for some things ("gosh I really didn't know I should communicate organizational changes more clearly!"), but re-writing history is a deliberate and conscious act of deception.

Re: The quiet renovation at Bitwarden

#316

Post by gchamonlive »

hypeatei wrote: post #97
gchamonlive wrote: post #94

Earlier quoted context omitted.

Yes, but vaultwarden isn't something you can casually run by yourself without some careful thinking. You are hosting secrets whose longevity is important, so if deploying yourself, take good care of backups and do regular drills, so you validate that the backups work, that they aren't corrupted and that you keep a copy off-site.

You should be doing regular exports/backups of your vault regardless of how it's hosted. Bitwarden could go belly up tomorrow and lose all their stored vault data.

Easier said than done. If done manually you will eventually forget, and to automate you have to wrap around a call to the bitwarden cli, which as we've seen already suffered a supply chain breach https://news.ycombinator.com/item?id=47876043

The API for managing secrets automatically is gated behind `bitwarden-cli serve` which is surprising for me that I can't call the API directly using urllib or requests directly. I have to pass it through the bitwarden-cli.

I've been using bitwarden for a while, but your comment prompted me to investigate how I could backup my secrets, and this is a surprise. I am considering moving to my own infrastructure, because I dread having to depend on this tool to automate regular backups for me. Better to do that at the service layer. Problem is just how to expose it. There is always tailscale but that's just shifting the problem around.

Re: The quiet renovation at Bitwarden

#317

Post by rafterydj »

DANmode wrote: post #280
cheriot wrote: post #227

Wild to me that Bitwarden raised > $100m from VC. Seems like the kind of thing that would make a nice lifestyle business. The enterprise version never went beyond password management so I'm not sure how this could have generated a viable ROI.

> Seems like the kind of thing that would make a nice lifestyle business. Don’t see too much of this talk around the comments, anymore! If you’re seeing this comment: Are lifestyle businesses on your radar? Please do share.

Maybe this is me being a little wet behind the ears, but I don't know if lifestyle businesses are really possible to start at the moment, given the uncertainty of the current software sector.

See this thread from a few days ago: https://news.ycombinator.com/item?id=48118727

The economics of software creation is changing, so it stands to reason how people engage with software will change too. Finding a niche may be a game of luck more than observation/perspiration at this stage, similar to discovering oil on your "barren" property rather than building a farm. As someone who's generally independent, though: I'd love to be wrong here!

Re: The quiet renovation at Bitwarden

#318

Post by borg16 »

DANmode wrote: post #233
venusenvy47 wrote: post #212

Earlier quoted context omitted.

You need a VPS, correct? Are there any concerns about hardening your VPS from attackers? I worry about my ability to harden a public - facing service that is handling something so critical for myself.

Use a host that takes care of this for you. My host has prebuilds for Vaultwarden.

can you recommend what host do you use? noob here, and looking for something like this.

Re: The quiet renovation at Bitwarden

#319

Post by ngruhn »

radley wrote: post #290
ngruhn wrote: post #268

Earlier quoted context omitted.

Serious questions: what's wrong with just using Firefox built in password manager?

If you only need to manage online passwords, only use Firefox, and aren't using an iOS device, then it's probably fine. But most people may also need to use native apps, other browsers, and iOS devices.

You can absolutely access firefox passwords from any iOS app. You can even configure it as the default password app.

Re: The quiet renovation at Bitwarden

#320

Post by DANmode »

rafterydj wrote: post #317
DANmode wrote: post #280

Earlier quoted context omitted.

> Seems like the kind of thing that would make a nice lifestyle business. Don’t see too much of this talk around the comments, anymore! If you’re seeing this comment: Are lifestyle businesses on your radar? Please do share.

Maybe this is me being a little wet behind the ears, but I don't know if lifestyle businesses are really possible to start at the moment, given the uncertainty of the current software sector. See this thread from a few days ago: https://news.ycombinator.com/item?id=48118727 The economics of software creation is changing, so it stands to reason how people engage with software will change too. Finding a niche may be a…

I’m betting the farm that you are =]

Your accountant will be configuring their own work software.

Your project manager will be developing their own work software.

Custodians will not necessarily be developing work software.

Most non-tech desk-staff start to lose focus after the fifth reply on a social media thread…

I do not believe they’re going to be able to perform the three required steps for building software solutions:

1. Know what you need (vs want).

2. Know how to ask for it.

3. Have a process for validating it.

I also don’t think it gets too much simpler than Docker et al for self-hosting, yet those concepts are genuinely a foreign language to even “tech-savvy” consumers.

I think we’re in a bubble, here,

and I am personally betting on one niche (of many) where value ($$$$) is still placed upon having another team to outsource responsibility to.

Responsibility for keeping an important tool up-to-date, keeping it able to capture data,

and most importantly: rigorously tested to ensure it’ll perform calculations correctly.

Responsibility for peak tooling, so a busy end-user can stay responsible for their craft without taking a sabbatical to build software is not going anywhere.

Whether these “peak tools” will be (validated, packaged, delivered to the user, maintained) by me,

or OpenAI/Anthropic instant-agents in 10 years,

is what I believe we should be watching.

Post reply on HN