Huh, nice to see my initial judgment was incorrect
this post was submitted on 25 Oct 2024
245 points (97.3% liked)
Linux
48338 readers
630 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
What does this mean for Vaultwarden?
All open source baby
And it’s made by a Bitwarden developer.
Cool. They got that sorted nice and quickly.
Edit:
I don’t get why people think they’re suddenly doing stuff under a different license to subvert the open nature of the project. They’ve been totally transparent on what isn’t part of the GPL/AGPL licensed code for years.
SSO, the password health service, organisation auth requests, member access report blah blah have been enterprise features under the Bitwarden License for ages and they architected the projects in a clear and transparent way to build without those features since they added them.
Until the situation now, this was limited to the server, not the clients. You could replace the server with Vaultwarden and build it without enterprise features. Not ideal but fine because the server isn't the critical part. It never handles your secrets in any way.
What they tried to do now was integrate proprietary code into the clients that everyone uses. This is a lot more critical as it can access the secrets in plain text.
This also wasn't a "mistake" or "bug", they openly admitted to doing this with the intention of subverting the client code's GPL.
Reference for the admission?
Two posts up from what I posted: https://github.com/bitwarden/clients/issues/11611#issuecomment-2424865225
Hi @brjsp, Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility.
- the SDK and the client are two separate programs
- code for each program is in separate repositories
- the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3
Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug.
What they've done in the past has earned them trust, but it is irrelevant to what they intend to do in the future. Bitwarden is growing company, not the scrappy little open source app they once were.
In 2022, a private equity firm injected 100m into Bitwarden. From that point forward, users are rightfully going to scrutinize any action they take because it's 2024 and the tech space is a hellscape of enshitification and acquisitions, thanks in part to VC money. We've seen this story play out too many times to assume there's nothing to worry about.
So yes, people are going to be suspicious. That's not irrational.
a private equity firm injected 100m
That's all that one needs to know. Once those leeches are involved as investors, it's over. They demand enshitification from our destroy everything that they touch for a quick buck.
I don’t get why people think they’re suddenly doing stuff under a different license to subvert the open nature of the project.
But then what will I do with my day if I don't have a good reason to be mad at them?
/s
(And thanks for the voice of reason)
Uhh what does this mean for us dummies? For reference I run a self hosted vaultwarden server and connect to it with Bitwarden clients.
With 2024.10, Bitwarden could no longer be built without their proprietary SDK.
That was deemed a bug and now the SDK is also licensed under the GPL.
To clarify, the desktop BitWarden client, only.
And this was corrected.
I think right now it doesn't mean anything :/. It's more a 'wait&see' situation... However as many many other stories in the past, this doesn't sound good and bitwarden is slowly and carefully following the 'enshitification' path !
Keep an eye open and get ready to switch to another password manager (maybe a fork?).
Yeah I'll willing to give them the benefit of the doubt on this one. Could very easily believe that a dev added the reference without realising the implications and they fixed it very quickly. Will be watching for any future attempts though.
If this was the case, the phrashing around the issue would've likely been different. Yet bitwarden remained very vague, and even locked github comments on the issue.
Especially considering that a move like this alienates their core target demographic (people who use FOSS), they would've been much more open and much quicker if it wasn't intentional.
I will personally be switching, likely to KeePassXC.
They highlighted it was a bug and said it would be fixed very soon after it was flagged. It was addressed in a matter of days. You can build the server with the /p:DefineConstants=“OSS” flag still and you can build the clients with the bitwarden_license folder deleted again (now they’ve fixed it).
I don’t understand why you’re throwing FUD about this. Building without the Bitwarden Licensed code has been possible for years and those components under that license have been enterprise focused (such as SSO). The client is still GPL and the server is still AGPL.
This has been the way for years.
It means all the code you run is open source.
Only the Bitwarden back-end uses proprietary code, which you aren't using when you're self-hosting vaultwarden.
Only the Bitwarden back-end uses proprietary code
So this was what it changed then?
I also self-host Vaultwarden because it is stupidly simple...
No, this comment was wrong. Most of the back end is not closed source. One piece of code for secrets management is closed source, that is not used in clients and was accidentally (allegedly) added to the clients, which they removed.
Vaultwarden is open source.
Personally I think people are overreacting. If BitWarden were to do something dumb like shift away from GPL, there would very quickly be a fork.