Hacker News Reader

Comment by darksaints | Hacker News Reader

I don't have any experience with running the bitwarden server, but the primary selling point for this is that it is less resource intensive than the official server backend. The official backend is written in C#, and is currently using .NET 5. I haven't ever felt like .NET apps were particularly bloated, but I guess it's possible to write bloated code in any language. Does anybody have any insights as to what is done poorly in the official version? I also wonder if the performance improvements in .NET 6 would make a difference.

View on HN

It's been a few years since I looked at the official server setup (I immediately switched to bitwarden_rs, this project), so maybe this isn't as true today:

Mostly it's that the official setup is the same thing that runs their free/paid hosted service. By design, it is quite split apart into separate areas, presumably so they can scale independently of each other: https://github.com/bitwarden/server/blob/master/SETUP.md

But most people are going to want to host self-hosted instances for themselves, their families, or maybe a small company. The official server might be the best route if you're deploying to thousand of users, but that won't be most people.

Another benefit is that this flips all of the "paid" feature flags to true. If you self-host Bitwarden's official setup you still have to pay a subscription to use paid features.

> Another benefit is that this flips all of the "paid" feature flags to true. If you self-host Bitwarden's official setup you still have to pay a subscription to use paid features.

As a developer and cheapskate user myself, I understand the appeal of this.

As a product builder, I struggle with what this means to build a business upon an open core model.

I would have more of a problem with this if it was a simple fork with a few variables modified to enable features rather than a complete rewrite with a compatible API. None of the paid features are technological breakthroughs (e.g. one just checks HIBP to see if passwords have been leaked) so, imo, it's really the re-implementor that did all the work.

I do feel a little bad using the client applications for free given their business model revolves charging for the backend only.

Why not pay for an inexpensive subscription to the hosted version, and just not use it?

Open core is bad, so things that make it more difficult to be successful with it are good.

Interesting perspective. Could you explain why and for whom it's bad? I can't completely tell from your comment - but do you tend open-source or closed-source as an alternative?

It's bad because profits off of open source's good name without actually being open source.

They start 12 containers and recommend 2 core cpu with 4GB RAM. At least 2 GB RAM. [1]

[1] https://bitwarden.com/help/article/install-on-premise-linux/

Apart from the pain around dealing with .NET itself, Bitwarden's official server only supports MSSQL which is a nightmare in pretty much every conceivable way (licensing, tooling, packaging, and so on). Vaultwarden seems to support plain old Postgres and SQLite.

I switched after my instance stock because of a failed migration - this was my fault cause I aborted the upgrade - and I couldn't get it to upgrade anymore. Iam very happy with vaultwarden ever since

Bitwarden is working on support of other DBs as well.

This is the biggest reason for me. I have no problem with .Net and have more experience with C# than Rust, but MSSQL was kind of a deal breaker for me to self host.

> MSSQL which is a nightmare in pretty much every conceivable way (licensing, tooling, packaging, and so on).

Licensing, sure. It's more convenient with Free software for small self-hosted instances... But the rest? You can even get a Linux build in a docker container supplied by MS...

Most of the resource usage is on the local installed MS SQL. .NET 5 (core) performance is great. .NET can look like it's uses a chunk of memory while that is configurable as it pre-allocates free space for garbage collection.

I do still run the bitwarden official server. While I would not considered bloated by 2021 standards, it still eats up more that 2GB of RAM for my single-user setup... It prompted me to upgrade the VPS I run it to a more expensive version with more RAM.

So yeah, resource usage is real, especially if you plan to run this on a Pi or on small cloud intances.

>it still eats up more that 2GB of RAM for my single-user setup

Call me old fashioned, but that seems like an insanely large amount of resources to host one person's passwords.

You are not old fashioned. 2 GB is way beyond acceptable for that purpose. Hell, even 1% of that is pushing it.

Reply on news.ycombinator.com