Bitwarden is no longer free software

https://github.com/bitwarden/clients/issues/11611

by ferbivore • 2 years ago

260 91 2 years ago

wg02• 2 years ago

Earlier, open source was about creativity, innovation, curiosity and sharing that with a wider ecosystem as a reactionary movement to closed walls that hinder curious minds to look under the hood how things exactly work.

Lately, it seems like open source is mostly a marketing gimmick of gathering free traction early on without spending tons of money on advertising and then later gradually pulling the rug.

Examples galore. At this point, I'd assume any open source project in past five to eight years taking this trajectory at any point.

OutOfHere2• 2 years ago

Open source software by organizations is at risk of becoming not open. Open source software by individuals is still fine, however.

bigfatkitten• 2 years ago

Until those individuals form a company around their project.

wg02• 2 years ago

True, VCs and private equity wherever they touch, things will change. These companies would love to build their empires on open source libraries, tools, frameworks and languages off the efforts of such individuals but would not give back enough and in most cases nothing at all.

This imbalance needs to be recognised.

de6u99er2• 2 years ago

More like having the open source community report bugs, feature requests (ideas) and code until the product is good enough to transition into full commercial.

pikdum• 2 years ago

I never really looked into it, but I thought Bitwarden was completely free software based on their marketing. Looks like it's had some weird proprietary bits introduced around 2020, though?

beretguy• 2 years ago

The actually git issue title in linked web page:

Desktop version 2024.10.0 is no longer free software

I'll have to watch the situation closely and migrate away when need be.

ferbivore5• 2 years ago

The mobile clients also have this proprietary dependency, from what I was able to tell.

dicytea• 2 years ago

From a comment in the linked issue:

Note that the SDK is used (and enabled as a feature flag) not only in the release of desktop app, but also in the browser, CLI and web clients.

colesantiago• 2 years ago

You should not trust any software that needs to raise money from VCs that markets itself as 'free software'

https://techcrunch.com/2022/09/06/open-source-password-manag...

Gys• 2 years ago

https://www.vcnewsdaily.com/Bitwarden/venture-funding.php

andag• 2 years ago

Going proprietary is one thing, but doing it in several steps in different repos and saying nothing about it I really don't like...

What are open alternatives at this point?

ferbivore5• 2 years ago

The KeePass ecosystem has gotten a little bit better. It's still not exactly seamless. File sync across all of Windows, Linux, macOS, iOS and Android seems to involve either proprietary user-hostile sync tools or dealing with lots of jank.

As far as I can tell, the only competitor with a similar feature set that even claims to be open-source is Proton Pass. But I can't find any information on whether the server side can be self-hosted.

selfhoster113• 2 years ago

KeePass as an ecosystem (and possibly other file-based ecosystems) is something I’ve used for around a decade, and while it’s not perfect, I am 100% sure it will be there for me in another decade. I want to own my passwords, and KeePass feels like a safe pair of hands that won’t turn hostile when I’m not looking.

IMO, the secret to keeping the passwords synced with KeePass, is to make sure your client has a direct feature to sync the passwords database to a remote server - SFTP, DAV, SMB, etc. Then all you need to do is to set up a single remote file share to serve that file. Or sync manually, assuming your passwords change slowly - KeePass 2 can sync changes automatically between KDBX files.

jasonjayr• 2 years ago

Windows, Linux, Android are pretty easily + reliably covered by SyncThing.

What's the best story for iOS or MacOS?

apitman2• 2 years ago

Buttercup[0] looks promising.

[0] https://buttercup.pw/

moepstar• 2 years ago

Truely does, yeah - just in case you were wondering like me: it syncs to file, which are supposed to be shared via some cloud sync mechanism you provide.

elliotwu• 2 years ago

Enshittification is a natural process, like aging and corrosion.

I adopt a 3-2-1 backup strategy for my Bitwarden password-protected exports, which can be decrypted without needing Bitwarden. In addition, I use a separate non-Bitwarden solution for my MFA secrets. This minimizes damage and facilitates migration in the event Bitwarden degrades, or becomes outright malicious like Raivo. The same would apply to the password manager I'd switch to after Bitwarden in the near future, and any other password manager thereafter.

6ak74rfy3• 2 years ago

This enshittification is surprising for Bitwarden, given how much it emphasized its open source strategy and that practically made a bunch of us recommending it to our friends and family. But maybe not too much because, as you say, its a natural process for organizations.

This is primarily the reason I am careful going deep into the Tailscale ecosystem (which, similar to earlier Bitwarden, is touting a "hey, we are the good guys" horn for now). My network is a critical piece of my infra and I don't want to put too much trust in one company.

drio• 2 years ago

This is primarily the reason I am careful going deep into the Tailscale ecosystem (which, similar to earlier Bitwarden, is touting a "hey, we are the good guys" horn for now). My network is a critical piece of my infra and I don't want to put too much trust in one company

I love Tailscale, but this has been bothering me too. Actually, I think it's an even bigger concern than with Bitwarden because of what Tailscale does - once you start using it, it literally becomes your entire network.

That said, what Tailscale provides is really important. We need tools like this to push back against how rigid and centralized the Internet has become over the years.

For those worried about this: what are you doing about it? Did you just move to Headscale? Or are you using something completely different? How has that worked out for you?

brimstedt• 2 years ago

Haven't used bitwarden so not sure about it's festureset, but I'm looking into passbolt which seems nice and with self hosting options.

minebreaker• 2 years ago

I loved it, I paid for it, I even recommended it to my friends and they loved it too...

Now I'm gonna move to KeePassXC. What is the recommended way to sync the db with Android? I only have a Raspberry PI server running cloudflared.

bmicraft• 2 years ago

Keepass2Android can sync over ssh (sftp), Nextcloud and many other others. I'm sure you'll find something that works for you.

blooalien• 2 years ago

I just use SyncThing to distribute my KeePass vault to exactly and only those devices where I need it. Works great for me. YMMV depending upon your needs.

TheChaplain• 2 years ago

Another SyncThing user here, it works well with KeePass.

terminalbraid2• 2 years ago

Heads up if you're using this on Android

https://forum.syncthing.net/t/discontinuing-syncthing-androi...

strijelac• 2 years ago

KeePassXC with Nextcloud client for Android is a perfect match for me. Using it for years with zero problems.

mdaniel3• 2 years ago

If you want to stay with the convenience of cloud without going back to sync conflicts due to moving a file around, Proton Pass is GPLv3 although I don't personally know what the self hosting story is like if they were to rug pull

https://github.com/ProtonMail/WebClients/tree/proton-pass%40...

https://github.com/protonpass/android-pass/blob/1.26.1/LICEN...

https://github.com/protonpass/ios-pass/blob/1.12.3/LICENSE

pickledoyster• 2 years ago

Still astounds me anything from proton is recommended years after 'their' vpn was made by tesonet/nordvpn[0] which also owns a botnet/data-mining company[1]

[0]https://news.ycombinator.com/item?id=18609655 [1]https://news.ycombinator.com/item?id=29285988

6ak74rfy3• 2 years ago

I really want to use KeePass and its ecosystem but the password sharing story isn't great there. I and wife have a lot of shared passwords and Bitwarden works really good for that. So, I don't know what's a good viable alternative for us.

selfhoster113• 2 years ago

I was hoping to move to Bitwarden eventually, but unless I can find a healthy open ecosystem, that’s not happening now. I will keep monitoring to see how this develops.

davidee• 2 years ago

Chiming in as someone who switched, completely, to Bitwarden w/ Vaultwarden backend for a year: the experience was dramatically sub-par when compared to 1password (which I was coming from).

Part of my framing for the assessment was "everyone in my family uses 1P and they're happy with it, will this be good enough to convince them to switch." While I ultimately can make the call for the switch, user experience is very important when you're trying to get elderly parents to do something new.

It was not to be.

Aside from the generally poor UX, Bitwarden's clients (on linux, mac, windows, and ios) were also dramatically slower (in every way, from search to login), had fewer features (sorting passwords, favourites, good organization tools to name the most glaring omissions), and I found autofill far less reliable.

I've taken great issue with 1password's way of doing business and dealing with customers over the years. Sadly, and with some regret, I went back, because a password manager (really a secret manager at this point with so much more than passwords in it) is so central to daily life, I feel that I need one that is as as painless as possible.

I wasn't one that used Bitwarden because it was open, I tried to use the best password manager possible.

However, I LIKED that it was Open. And Vaultwarden is a gem. Wish I had the time and skills to make a better front-end for it really.

selfhoster113• 2 years ago

Thank you. I find it quite valuable that you shared your experiences, especially as I come from a background of never having used proprietary password managers and so haven’t been familiar with that world.

wooque• 2 years ago

CTO response:

Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility.

the SDK and the client are two separate programs code for each program is in separate repositories the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3 Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug.

ferbivore5• 2 years ago

In other words: bitwarden/clients is GPLv3; any Bitwarden client as a functioning whole is proprietary; the CTO does not see a problem with this; issue locked.

ferbivore5• 2 years ago

The SDK has now been relicensed as GPLv3, so it looks like the CTO did see the problem in the end.

mattdm• 2 years ago

It's not necessarily about being "one program". It's this part:

"The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

I get that it's really hard to make money as an open source company. (That's why I am one of your paying customers.)

The exclusion you are putting on your SDK seems very similar to that of the "bitkeeper" version control software used for the Linux kernel for a short time. Look how that turned out.

atanasi• 2 years ago

FSF has published a commentary: https://www.gnu.org/licenses/gpl-faq.html#MereAggregation

GPL licenses have allowed so-called "mere aggregation", where separate programs are distributed together. Such programs don't have to be all covered by GPL.

On the other hand, if parts are intimately tied to each other such that they are effectively a single program, GPL applies to the whole.

The FSF commentary explains that the judgment depends both on the mechanisms and the semantics of the co-operation. Technical implementation details don't make programs separate if they are intimately designed to work together: "But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program."

wanderfowl• 2 years ago

I find this response (and the class of responses like it) really frustrating, because it uses a (likely feigned) misunderstanding of the scope of the question to attempt to sidestep the real question. My question for the CTO would be, roughly:

You've now answered "Do your lawyers think you can get away with this?". But the questions you're not answering directly, which I think underlie the 'concerns' you're appreciating our sharing, are things like...

- Does the Bitwarden team see no ethical problems with making proprietary a project which many supported and contributed to explicitly because it was open source?

- Given that password management is explicitly a high-trust enterprise, how does your organization intend to navigate the rupture of trust, and subsequent forks and waves of departure, caused by an open-to-proprietary rugpull?

- Is there something that the community could do together which would help your company navigate through the dire situation you must be in to be considering something like this, without resorting to proprietarization?

I know it's his job as CTO right now to be feigning concern, particularly in forums where you can't close the conversation, but the current approach is basically confirming the worst fears ("They believe they can legally do it, and see no problem with their actions"), and that seems like exactly the wrong vibe for a company whose bottom line depends on users trusting the code and the people updating it.

jaggs3• 2 years ago

They've now locked the Github issue to further discussion. Apparently one possible alternative is Vaultwarden?

https://github.com/dani-garcia/vaultwarden

Such a shame that this keeps happening with open source projects once the money people step in.

echoangle• 2 years ago

Vaultwarden is a replacement for the server, the issue here is the license of the desktop client as I understand it.

jaggs3• 2 years ago

Yes indeed. I was thinking this might spur more Vaultwarden client dev?

noveltyaccount2• 2 years ago

Are there any open source frontends compatible with Vaultwarden backend?

apitman2• 2 years ago

Does Vaultwarden support passkeys?

azophy_2• 2 years ago

havent used it yet, but Github's readme contain "feature" section that lists "YubiKey and Duo support"

jaggs3• 2 years ago

I believe so -https://github.com/dani-garcia/vaultwarden/discussions/3355

trissi19962• 2 years ago

Yes, they work flawlessly for me.

jpeeler• 2 years ago

Speaking of Mr García, he recently started working at Bitwarden. Would be interesting to hear his thoughts.

transportheap• 2 years ago

source?

robshep3• 2 years ago

So much whining here.

You have absolute freedom in truly open source software at the point of any particular release.

So, you have the freedom to fork or self-build/host at discrete time points.

Assuming software made by a company to remain and persist truly open source (compatible)is idiotic.

Praise the freedoms you have had for this time.

The constant criticisms will likely mean that new companies or new products will never opt for open source in the future . And that is a poorer outcome for the world.

mhx1138• 2 years ago

Companies should not opt for and advertise with open source, if they don’t stand behind open source principles. Classic bait and switch. That’s what upsets users. They chose Bitwarden over e.g. LastPass, because they believed in FOSS. Companies exploit that and it’s sad.

robshep3• 2 years ago

The "bait and switch" argument is based on the assumption that it was their strategy from day one? I think the company has evolved around the orignal code and they'd like it to be more profitable / sustainable.

Assuming they stick with openly auditable code (albeit not FOSS) then it's still than purely commercial options.

Nevertheless, my argument is that it should be cherished that we've had (guessing) best part of a decade of opensource BitWarden that cannot be taken away from us. The FOSS bit is purely temporal ... $now, the exact commit/release/tag/head when an FOSS license is in play, it remains FOSS - it's just the next commit isn't FOSS ... but there's no binding license that says it is/should/has-to remain for future commits.

Nobody's rights are being taken away here.

"Beleiving in FOSS" just needs to be more short-term focussed or prepare for continual dissappointment.

pixxel2• 2 years ago

You blew the dust off this barely used account to post your position. Want to add a disclaimer?

robshep3• 2 years ago

I have no disclaimer to offer.

Just a long time BitWarden user and subscriber. Content that it'll likely remain openly auditable - which is the principal benefit here - and do not care that the authors want to make it more profitable/sustainable. For a system keeping all my stuff safe, when they're probably fending off nation-state attackers, that's a position that is satisfactory to me.

Re: the dusty account, the Internet seldom offers me stuff I can be bothered to comment on.

pixxel2• 2 years ago

Spirit of open source died long time ago. Open source is now a business model.
According to me, the spirit of open source still lives in free software philosophy.

The spirit of.

AnonC• 2 years ago

I’m not too surprised with this move. Bitwarden has been moving strongly to enterprise sales over the last several years, and while doing so, neglected the consumer side. It’s only recently that somehow they switched to a native iOS app from the previous MAUI base that stood out like a sore thumb in more ways than one. The current iOS client still has some catching up to do.

After getting VC funding, the focus also seemed to be more revenue and profit driven. There’s nothing wrong with this choice, but it does push companies in a direction that’s very different from how they started and grew.

Proton Pass looked a little interesting, but its pricing model is always a bit on the higher side (like with other Proton services). I’ve been trying Proton Pass free for a while, and will see if it’s worth switching to as a replacement for Bitwarden (because the latter wasn’t improving in a way that I was waiting for, over many years).

The built-in password manager on iOS is also good enough, but it’s only for passwords and doesn’t support storing, retrieving and filling other types of data.

nedt• 2 years ago

Oh the irony. At least some enterprise companies might only use Bitwarden because of its openess and not having to go through some enterprise sales calls to get something superusefull. Make your product hard to use and you lose customers and sales opportunities. Reminds me of those awful calls we had with postman recently. Instead of having yet another call it looks like we will be now much happier with hoppscotch.

solarkraft2• 2 years ago

I know a company that uses bitwarden due to mindshare for openness reasons.

Using BW privately is a bit annoying, but fine. Using it in an enterprise setting is a huge pain in the ass.

ktosobcy• 2 years ago

"After getting VC funding, the focus also seemed to be more revenue and profit driven."

Why is it that almost always "VC funding" turns everything into bullcrap? :|

wolvesechoes• 2 years ago

"Why is it that almost always "VC funding" turns everything into bullcrap?"

Because the goal of capital is more capital. Doing ethical things and contributing to commons doesn't align with such goal.

So every time "investors" arrive the outcome is known.

Technetium• 2 years ago

When I paid, it was with the expectation of supporting something open source. That's why I came to Bitwarden from Lastpass. This is really twisting the dagger in my back. They're probably preparing for an acquisition, since they have hit the same financial inflection point that CEO Michael Crandell was at previously when selling RightScale: https://bitwarden.com/blog/accelerating-value-for-bitwarden-...

rstuart4133• 2 years ago

Right on that page, data 2022, it says:

    What’s going to change?
    * Bitwarden remains committed to
        * An open source architecture

Not any more, apparently. It's a dangerous move. Open source has lots of nice properties, but the one that matters here is its security. It never ceases to amaze me how companies champion their opaque binary blobs as secure. (Hello Intel Management Engine!) Well, now has joined the ranks of IME and Juniper switches.

Moving to closed source is a high risk move for them. While I haven't paid for software in a long while I can and do pay for the security. Bitwarden stores the information I consider my most precious, and private. Which is why I'm paying for bitwarden. But it's just software, it doesn't matter where the bytes that call themselves "bitwarden" come from. Anybody can fork it and serve up those same bytes. Someone setting up a mirror of bitwarden that only uses open source software will get my money. (Suggestion: if you do this, each to reproduce built instructions that yield the same binaries you are running, and that I download into my various devices would be very nice.) I don't consider my passwords to be secure unless they that are managed by open source software.

chickahoona• 2 years ago

I hope not to offend anyone, but if you want a real open source password manager take a look at Psono.

I am Sascha, the main developer behind it and we have no VC money nor any plan to do a stunt like this.

SushiHippie• 2 years ago

There are no plans to adjust the SDK license at this time. We will continue to publish to our own F-Droid repo at https://mobileapp.bitwarden.com/fdroid/repo/

https://github.com/bitwarden/sdk/issues/898#issuecomment-222...

This was a reply in July, where someone raised this issue already on the SDK repository, which has this license since over a year ago.

de6u99er2• 2 years ago

This is dumb becaue a lot of companies gladly pay for a supported versions of open source products. At many vompanies the use of open source us actually prohibited because of the lack of warranties.

But it's a combination of greed and managment iconpetence which leads many succesful open source products from quick wins (after the initial shock) into gradually losing customers to alternative technologies

johng• 2 years ago

I use BitWarden on iOS, PC and Mac. Now I have to find an alternative. What a sad day.

I'm a premium member @$10/year as well. There goes lost business because of shady practices.

Is there a way to export and move to an alternative?

mdaniel3• 2 years ago

https://bitwarden.com/help/export-your-data/

https://support.1password.com/import-bitwarden/

https://proton.me/support/pass-import-bitwarden

I'm sure there are others

krick• 2 years ago

I was long thinking to move to bitwarden/vaultwarden from KeePass to solve sync problems, but never did. Is it now useless w/o that client? Is some sort of WebUI not enough? Does it apply to Android as well?

EasyMark2• 2 years ago

the browser plugin works fine. I have no idea if it's proprietary software or not though

sub7• 2 years ago

keepassXC is and was always better

EasyMark2• 2 years ago

Not for ease of use and syncing, at least if you don't want to maintain cloud sync and set it up on your own. Bitwarden just works with an app install and not much user intervention involved.

npteljes• 2 years ago

I was keeping an eye on this project as a nicer Keepass(X,XC) alternative for me, but now it looks like I won't make the move after all.

steakscience• 2 years ago

Sigh. Every good thing dies huh

solarkraft2• 2 years ago

I will not renew my family plan due to this and will try to use a fork of the last available FOSS version.

This was your moat. You just set yourselves up to be forked away.

nilsherzig• 2 years ago

Wow I just paid for the premium version, not because of the features it has (I really don't need them) but I thought I would support something good :(

Bitwarden is no longer free software

Related Stories