this post was submitted on 20 Oct 2024
525 points (95.7% liked)

Open Source

30826 readers
533 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
 

Pull request #10974 introduces the @bitwarden/sdk-internal dependency which is needed to build the desktop client. The dependency contains a licence statement which contains the following clause:

You may not use this SDK to develop applications for use with software other than Bitwarden (including non-compatible implementations of Bitwarden) or to develop another SDK.

This violates freedom 0.

It is not possible to build desktop-v2024.10.0 (or, likely, current master) without removing this dependency.

(page 2) 50 comments
sorted by: hot top controversial new old
[–] [email protected] 18 points 1 day ago (6 children)

A few questions out of ignorance. How different is this to gitlab's open core model? Is this a permanent change? Is the involvement of investors the root of this? Are we overreacting as it doesn't meet our strict definition of foss?

load more comments (6 replies)
[–] [email protected] 46 points 2 days ago (2 children)

Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility.

  • the SDK and the client are two separate programs
  • code for each program is in separate repositories
  • the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3

Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug.

I.e. "fuck you and your foss"

[–] [email protected] 19 points 2 days ago (1 children)
[–] [email protected] 31 points 2 days ago (2 children)

I doubt it. What'll probably happen is them moving more and more of the logic into the SDK (or adding the back-end of new features there), and leaving the original app to be more or less an agpl-licensed ui, while the actual logic becomes source-available. Soo, somewhat red-hat-esque vibes: no-no, we don't violate no stupid licenses, we just completely go against their spirit.

load more comments (2 replies)
load more comments (1 replies)
[–] [email protected] 2 points 1 day ago (2 children)

I just exported my data from BitWarden and imported into ProtonPass. Was pretty easy. Hate the color palette of the app and browser extension though, lol.

load more comments (2 replies)
[–] [email protected] 11 points 1 day ago (1 children)

Looks like I might be moving to Proton Pass after all! I'll give them some time to see what they do about this, but will happily give my money to someone else and migrate friends/family as well.

[–] [email protected] 2 points 1 day ago (2 children)

I know little about Proton Pass, but how confident are you they don't also used a proprietary SDK with their open source apps?

load more comments (2 replies)
[–] [email protected] 10 points 1 day ago* (last edited 1 day ago) (1 children)

i was about to replace my glorified encrypted text file for a password manager. guess relying on 3rd parties in a late-stage capitalist world is not a viable alternative.

ill stay with my encrypted text file until they privatize encryption. by then ill probably be carving my passwords out on stone. or burning down the servers of these fucking pigs trying to make us identify ourselves for everything on the internet now.

[–] [email protected] 11 points 1 day ago (4 children)

KeePassXC is pretty amazing. :)

load more comments (4 replies)
[–] [email protected] 3 points 1 day ago (6 children)

@bitwarden bitwarden locked and limited conversation to collaborators

They also locked the thread 16 hours ago (as of writing this comment), with no explanation.

load more comments (6 replies)
[–] [email protected] 14 points 1 day ago (2 children)

Does this affect valtwarden?

[–] [email protected] 22 points 1 day ago

Vaultwarden is only the server, no? So any clients that you use to access Vaultwarden are built and maintained by 8bit solutions a.k.a. Bitwarden, including the desktop client that is the subject of this post.

load more comments (1 replies)
[–] [email protected] 2 points 1 day ago* (last edited 1 day ago) (4 children)

pass is enough (+ xdotool + rofi + pass-menu). Synchronization via git or Syncthing.

[–] [email protected] 1 points 1 day ago (6 children)

How does this play with mobile?

[–] [email protected] 2 points 1 day ago* (last edited 1 day ago)

Integration with Android

The GnuPG implementation for Android is called OpenKeychain. To configure it, just go to the "key management" menu and import the previously created secret key. The only drawback of OpenKeychain for me personally is that there is no fingerprint unlocking.

The pass implementation for Android is called android-password-store, or simply APS.

Install and launch APS. Before synchronizing the password store, go to the "Settings" menu. There we will need the following items:

  1. Git server settings. The resulting URL should be the same as that specified on the repository page on github. Authorization type - OpenKeychain.

  2. Git utils. In this section, specify the username and email from the gpg key.

  3. OpenPGP provider. Select OpenKeychain.

  4. Autofill.

Now you can clone. Select "clone from server" on the main screen, specify the desired location of the repository, check the git settings.

Of course, pass is not that easy to set up. However, this price buys confidence that the tools we use will not one day be declared obsolete, will not change their data format, and will not be left without support.

load more comments (5 replies)
load more comments (3 replies)
load more comments
view more: ‹ prev next ›