Earlier quoted context omitted.
You don’t even need docker if you build from source
Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.
[deleted]
Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
91–100 of 162 posts
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#92I switched to using this because keepass didn’t have a good way of syncing its database with iOS devices, and the official bitwarden server has too many moving parts (including MS-SQL with no support for open source databases??) - aside from missing ssh-agent support, I’m loving all of it :)
SQL isn't as portable as people would like. Especially when you're trying to stay high performance as you're dealing with millions of customers. Once you start building for a specific SQL server, it hard to switch to another variant.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#93Earlier quoted context omitted.
Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.
It really depends. Go and Rust softwares are generally easy to build from source
Yes but coming from a go or rust neophyte to trusting that you've installed correctly from source is probably a higher bar than knowing that you've run a container correctly.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#94Earlier quoted context omitted.
Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.
Just connect to it via wireguard or tailscale instead of exposing it to the entire internet.
Bingo.
If you're going to host services as home such as your password manager, set up a WireGuard VPN, you can use a Pi and it'll be perfectly sufficient, leave only the VPN open on the internet, VPN in from your phone, laptop, whatever for anything you need access to, and you don't need to rely on Nextcloud or Bitwarden having vulnerabilities discovered in them.
I was using Nextcloud previously for password sync because my password manager needs WebDAV, it was too much to maintain so I wrote a small server in Golang using the WebDAV library and it sits behind NGINX which handles the auth. I run Minio (S3 compatible) for syncing our family photos from our phones and Folder Sync app on Android. They both run on a VM and write out to a ZFS pool.
I have a Pi 3B+ running Raspbian mounted read-only as a WireGuard VPN for remote access, and we use the official WireGuard app. VPN is always on because we have fast, symmetric fibre, and we don't need to worry about trusting public networks.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#95Earlier quoted context omitted.
Same here. I switched from LastPass and I really like the UX more than LastPass. It is less intrusive and feels more polished and snappier.
The UX is actually kind of bad. I think it is electron-based, the menus are far from a work of art, and the folder management seems very primitive. But that said, it is by far the best product despite this.
What do you mean Electron based? There's no such thing as an "Electron-based UX".
Bitwarden clients have the same UX across OSes and platforms ( browser extension, mobile app, thick client". The thick clients are indeed Electron based.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#96I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.
Did you consider KeePass or one of the variants?
I do use KeePass for work, since we're not authorized to put passwords on the cloud, but device synchronization and browser auto fill is a pain.
For personal, Bitwarden is much better. Browser plugins just work, android auto fill just works, passwords synchronized across devices, support for auto filling payment information. 2FA support.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#97Earlier quoted context omitted.
Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.
Rust is designed to be built from source, and the development toolchain is light enough to keep on a VPS if that's your bag. If you have Cargo installed, compiling and installing from source is easier than using NPM.
> and the development toolchain is light enough to keep on a VPS
Or, you know, in a Docker container...
I build pretty much everything that's not C/C++ and/or Go using a Docker container now.
When you're working in a team, it's also an amazing way to share the build environment
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#98Earlier quoted context omitted.
Just connect to it via wireguard or tailscale instead of exposing it to the entire internet.
Bingo. If you're going to host services as home such as your password manager, set up a WireGuard VPN, you can use a Pi and it'll be perfectly sufficient, leave only the VPN open on the internet, VPN in from your phone, laptop, whatever for anything you need access to, and you don't need to rely on Nextcloud or Bitwarden having vulnerabilities discovered in them. I was using Nextcloud previously for password sync bec…
Why would you mount read only, out of interest? How do you keep packages up to date? And what about logging? I'd want to be logging connection attempts.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#99Earlier quoted context omitted.
You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly. 1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through…
"3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS." Thats an outright fantasy, every day I rely on like 50 pieces of software written in 20 different languages and frameworks. They are updated multiple times a month. How many man hours would it take? 1000 a week? Proffesional developers couldn't find heartbleed for years, you really think anyone would notice a hi…
The keyword in that sentence is trust. Either trust or check. Your choice.
Most people choose to trust certain software providers based on their reputation. But if you have serious doubts and you don't check, that would be your problem.
Whining about an open source project maybe being insecure basically means either check it or don't use it. Nobody is twisting your arm to risk your passwords on some wonky self hosted setup. Your problem if it blows up in your face. That's also what it spells out in a typical OSS license (that would be the section talking about limited liability). That's another thing people tend to not check that they probably should pay some attention to. Using the software means accepting that it's your responsibility.
If like most you are unable to make a sound judgment on this front; consider paying a service provider providing you a service. That would be Bitwarden in this case. They kindly provide a free version even. Easy choice IMHO.
Heart-bleed slipped through the cracks for a while and then certain software providers lived up to their reputation by providing fixes in a timely fashion. And certain others messed up by not doing that. I care more about how developers act when something like this happens than the fact that it happens.
OSS software providers are no different than other providers when it comes to trust. Except you have the option of looking at their code. Lots of people doing that builds trust. I tend to look at things like number of stars, commit frequency, and other things when deciding to use a random Github thing. When it comes to software that is safety critical, I prefer the scrutiny of an active community of developers. That just increases my level of trust.
IMHO Bitwarden's trustworthiness just went up by virtue of there being multiple implementations of the thing and apparently a growing community of users and developers depending on these things. I'm already using it and vastly prefer this over some closed source solution with opaque development processes. I probably would not self host but it is nice to have that option available.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#100Earlier quoted context omitted.
Did you consider KeePass or one of the variants?
I do use KeePass for work, since we're not authorized to put passwords on the cloud, but device synchronization and browser auto fill is a pain. For personal, Bitwarden is much better. Browser plugins just work, android auto fill just works, passwords synchronized across devices, support for auto filling payment information. 2FA support.
Did you try KeePassXC? It's much more actively developed and runs circles around the original KeePass:
— it's a native application (starts instantly on less powerful machines)
— can check your accounts against haveibeenpwnd.com database
— has full browser integration which works flawlessly IME
— can store SSH keys and work as an SSH agent
edit: it does not support synchronization, I misremembered. Sorry.