Hacker News Reader

Comment by smartbit | Hacker News Reader

Pros

  - free open source
  - group management can be delegated
  - works fine with mac, linux & windows browsers
  - maintenance free self hosted on k8s for 2 years
  - lack of mobile apps has not been issue
  - UX is ok, no complaints
  - requires little end-user support

Cons

  - only password field is encrypted
  - no warning that Notes are not encrypted 
  - promises ‘Secure files & notes (Coming soon)’
    for more than year
  - password generator has no complexity options
  - requires browser plugin
  - user passwords have no minimum entropy requirements
  - no helm chart, used our own

Experience based on free version with ~75 users. Plan to switch to paid version when Secure files & notes become available.

Noticed that former lead developer https://github.com/markstory now works on Sentry. Sentry has same list of Pros as above: it ’just works’ without maintenance or support, running self hosted on k8s for free.

View on HN

More like "fauxpensource". All the useful features are part of the expensive looking Business plan. I don't mind people charging money for software, but I really wish they wouldn't pretend to be open source when they're not.

So many "open core" projects are really crippleware. The open core business model just makes too much of an incentive to make core functionality proprietary. I guess one nice thing is you could fork the open-source version and add the "business/enterprise" features to it yourself. I'm sure that would earn you the ire of the company that makes said software though. I'd love to see the pull request to add such features to the open source version. Would you get a response like "The PR looks great, but it doesn't align with our business model, so we'll have to reject it."?

Gitlab regularly considers moving features to Open Source version.

The paid version is also distributed under Open Source license, but is not free (as in free beer).

How does that work? If it's open source, I can get the source and run it for free, hell, I could even redistribute it for free. What's stopping me from doing this? I assumed it was that the non-free features were distributed under a proprietary license which comes with an invoice attached?

It's the same model than redhat, you buy a subscription, and the software checks if you have a valid subscription. Nothing is stopping you from modifying the source to remove that check, re-build and re-distribute for free (or for a fee) under another name. This allows community-driven projects like Centos or Fedora to exist. It's an ambitious business model, which doesn't prevent other to compete. The bet is companies that rely on the service will want to pay and will prefer getting professional services / hosting from the original maintainers.

Thanks for clarifying that, I'll have to reconsider my opinion on passbolt.

Well, the law and moral basically. What stops you from torrenting all your games and apps and not distributing them forward?

Open source implies that the law doesn’t prevent you from doing whatever you want with it.

speaking from a personal viewpoint.

I've pirated tons of stuff back in the days as a student, and know how to do all that even today. But now I've stopped pirating stuff.

It's partially because I've actually started earning money, but also because nowadays, it is incredibly easy to be able to PAY for stuff. And many companies actively integrate with local payment gateways and sell me stuff in my local currency too, which makes decision making much easier. It's actually become so easy that I straight-off decline when any friend of mine asks me to help them pirate softwares.

Just to clarify, I was never a developer of Passbolt. I think they based their repository off of CakePHP (which I do maintain) and inherited all the commit history that way.

Thank for the clarification. Sorry for the misunderstanding this caused.

I'm guessing GitHub's contribution insights sort of gave you this impression.

https://github.com/passbolt/passbolt_api/graphs/contributors

What I'm working on are developer insights and I've found the most intuitive way to look at contributions is to sort them by latest commits.

https://imgur.com/msfE9vS

With this type of display, you can quickly see who is contributing on an active basis, and for how long. A good example would be the vscode repository.

https://imgur.com/aX66Gj5

Here you can see a lot of developers have been contributing on a steady basis for quite some time.

Indeed GitHub's contributors graphs gave me the impression that https://github.com/markstory worked on passbolt. Isn't that is what they are supposed to?

Wish you all the best with your enhanced developer insights.

Yes the repository was forked from CakePHP v2, before the framework was moved as a composer dependency, so v2 contributors are shown as Passbolt contributors.

Here's some extra context.

https://imgur.com/mzdeA65

The last contribution was over 4 years ago (first contribution was 12 years ago), which would be the remnants of the fork.

> - lack of mobile apps has not been issue

Why hasn't it been an issue? How do I access my passwords with Passbolt on my mobile device when I'm offline?

In our use case Passbolt is used for shared Company passwords. Seemingly these have are not used on mobile devices. Our company has an healthy work life balance and we don’t perform deployments, upgrades and maintenance outside office hours from our mobile devices.

Passwords for personal Company accounts, like Active Directory & passbolt private key, we store in our private password manager. These accounts get disabled when leaving the company.

What use cases do you have where you can’t use a laptop for company related activities?

I don't think you can dictate others' practices. They might as well want to deploy stuff from their mobiles.

Full of rootkits.

If you want secure files and notes too then have you ever tried out Psono? The free version supports those and solves most of the Cons (e.g. Psono has no offical helm yet either). (Full disclosure, I am the main developer behind Psono)

Thanks for mentioning. Wasn’t aware of it, see it on https://alternativeto.net/software/passbolt/?platform=self-h.... Wish you all the best.

Having a migration tool, would make considering a migration much easier ;-). No immediate plans to migrate BTW.

No problem. If you ever plan to move to Psono, then feel free to provide me a dummy export and Ill create you the necessary import functionality.

Does sentry have password management options now?

Pros of Sentry (imho)

  - free open source
  - teams management can be delegated
  - works fine with mac, linux & windows browsers
  - maintenance free self hosted on k8s for 2 years
  - lack of mobile apps has not been issue
  - UX is ok, no complaints
  - requires little end-user support

This is the same list as the Pros for passbolt. And both ’just work’ without much maintenance or support, running self hosted on k8s for free.

Nope. The parent commenter came to some interesting conclusions, but I've never worked on passbolt. From what I remember passbolt based their repository on CakePHP (of which I'm a maintainer) and inherited all the git history from that project. There are no connections between passbolt and sentry though.

Reply on news.ycombinator.com