Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

361–370 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#361

Post by JoshTriplett »

wruza wrote: post #216
JoshTriplett wrote: post #107

Earlier quoted context omitted.

> Interesting, I've always felt that browser-based password managers provided remarkably little value for most people. They provide the value of "you should, by design, have no idea what most of your passwords are; if you know any significant number of your passwords you probably have bad passwords". And both Firefox and Chrome sync passwords between devices.

This is the value of any password manager, not a browser-based one.

The comment I was replying to said "browser-based password managers provided remarkably little value"; it didn't say "little value relative to other password managers".

Much as with cell phone cameras, "the best camera is the one you have with you"; the best password manager is the one you have with you.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#362

Post by Dylan16807 »

teo_zero wrote: post #360
Dylan16807 wrote: post #348

Earlier quoted context omitted.

> No local backup? Do you rely on the network working all the time? Normal dropbox behavior keeps a copy on every computer.

> Normal dropbox behavior Ah, you mean by using some app or daemon. I excluded that possibility because on at least one of my laptops I'm not allowed to install anything, so for me "normal" behavior is using Dropbox as a container for files to download when needed.

Well if you do that then you get plenty of copies; just restrain your delete key finger a bit. It does risk some staleness, but only rarely.

And maybe you could write a small shell script to keep that particular file up to date?

Also the one program I've used that opens keepass files directly from dropbox servers keeps a local copy.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#363

Post by Capricorn2481 »

ValentineC wrote: post #139
Capricorn2481 wrote: post #66

Earlier quoted context omitted.

Sounds like this is what they open sourced? So I don't really see the issue.

It was "source available", but licensed under their proprietary Bitwarden licence and not GPLv3.

What I mean is the problem is remedied now and was likely not the big deal people thought it was. Sounds like they packaged something into the software forgetting it was under a different license and quickly relicensed it. But this thread is framing it like they burned a bridge.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#364

Post by Capricorn2481 »

crossroadsguy wrote: post #125
Capricorn2481 wrote: post #63

Earlier quoted context omitted.

What app got worse after going open source that you're thinking of?

> after going open source I wasn't thinking that at all. BW started as open source afaik.

That's the point.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#365

Post by Capricorn2481 »

alt227 wrote: post #235
Capricorn2481 wrote: post #63

Earlier quoted context omitted.

What app got worse after going open source that you're thinking of?

Its not 'going open source' as they were always open source, its change of license. Plenty of other products started slipping downhill after management saw a need to change the license. Why else would you change your license terms if its not to then be able to change your business practises down the road?

I was posing a hypothetical for people that seem to think they were never open source. They packaged a proprietary part of Bitwarden into the app and quickly relicensed it to GPL.

I don't see how you think introducing a GPL license is gonna lead to worse business practices? Unless you don't know what the license is.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#366

Post by ferbivore »

ValentineC wrote: post #351
ferbivore wrote: post #170

Earlier quoted context omitted.

The iOS client can never be meaningfully forked, ironically due to the GPL. If Bitwarden goes fully hostile that's lost forever.

I don't understand; isn't the repo licensed under GPLv3? https://github.com/bitwarden/ios?tab=GPL-3.0-1-ov-file Is proprietary config required to build the IPA file?

I was under the impression that Apple requires apps to be distributed under terms which conflict with the GPLv3, so the copyright holders effectively need to dual-license an app for it to be suitable for the App Store. Uploading your own version of bitwarden/ios would then open you up to a takedown notice from Bitwarden Inc. since they didn't consent to this.

Looking into it again, it seems like the Apple Media Services T&C now has provisions for distributing apps under a "Custom EULA", but it still has weird clauses like the one saying you can't "scrape, copy, or perform measurement, analysis, or monitoring of, any portion of the Content", which their definition of includes apps. (Ridiculous clause since it prohibits so much as looking at an app with Activity Monitor, but whatever.) The GPLv3 has a provision saying users can ignore additional restrictions, but you as an App Store uploader aren't in a position to grant that right, so... the situation still seems legally iffy enough that I'm not sure you could win against Bitwarden if they objected to a fork.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#367

Post by xigoi »

alwayslikethis wrote: post #355
EasyMark wrote: post #344

Earlier quoted context omitted.

There is little chance I’ll ever move to keepassxc as that requires me to maintain it myself and take the chance on deleting something very precious. I’ll stick with the cloud solutions for now.

Synchronizing is not too difficult. You can use syncthing or any cloud-based storage solutions you are already using. You can also back stuff up. Given it has a recycle bin I wouldn't think accidentally deleting stuff is any more likely than a cloud solution. It's probably harder to back up a cloud solution as you don't have direct access to the file.

How does Syncthing handle concurrent writes?

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#368

Post by retrochameleon »

apitman wrote: post #325
solarkraft wrote: post #282

I’m relieved. Maybe the company would have survived this somehow, but they sure wouldn’t have been the techies’ darling anymore and that was going to be expensive. I hope they realized that being FOSS is their moat and it nets them a lot of goodwill (it’s the whole reason I bother with their not-quite-the-best product in the first place). The bold claim „the most trusted password manager“ was kind of justifiable whil…

I'm cautiously optimistic, but still concerned about the long term. * I just don't see how taking $100 million can be good for users in the long run. By far the most likely outcomes are bloat or enshittification. * bitwarden does not appear to be very forkable, ie it's a complex system written in C#. The existence of Vaultwarden helps a lot with this, but what about the client apps? Forkability is the second most imp…

The UX of Bitwarden is pretty lacking compared to 1Password. I finally made the switch after years of Bitwarden because of the vast UX improvements.

For one, it's much easier and natural to add additional pieces of information on entries in 1Password. Bitwarden's implementation of this always feels like a poorly integrated afterthought.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#370

Post by KeePassium »

BodyCulture wrote: post #307
phs318u wrote: post #226

Earlier quoted context omitted.

I use the Strongbox app on iOS [0] and the KeepassXC app my Linux laptop. The passwords.kdbx file sits on my Onedrive, which the Strongbox app can access. On Linux I use a Onedrive client [0] that I use to sync several folders within my home folder. Strongbox supports both Keepass and pwSafe database formats. It also integrates well with iOS, with autofill supported (also supports Yubikey unlock and Apple Watch unloc…

This discussion is about an open source password manager. I wonder why you are recommending a closed source software? Are you aware that many people prefer open source for security software for a reason?

I think most Strongbox users did not notice it turned proprietary. It's not like Strongbox advertised the change :)

Context: https://github.com/strongbox-password-safe/Strongbox/issues/...

Post reply on HN