Hacker News Reader

Comment by yewenjie | Hacker News Reader

> The Bitwarden business model will not change

  Bitwarden remains committed to
   A fully featured free version, forever
   An open source architecture
   The ability to self-host
   Advanced business features

This is great!

View on HN

If you can trust that will stay at the end of the honeymoon, which is very much not a given in these cases.

At least vaultwarden is independent and someone can fork the clients when needed.

Right - the benefit of FOSS is that we can keep using it as-is if we need to. I think that leads to excellent business incentives from the user’s standpoint. I’m currently a paying Bitwarden customer for convenience’s sake, but if they start messing it up I’ll just go host it myself.

How is vaultwarden more independent than bitwarden? Aren't they both FOSS and can be forked?

bitwarden server is mostly written by bitwarden's CTO. [1]

If tomorrow bitwarden decides to do "a mongodb" (= violating the AGPL, and make it closed-source), you would have to spin up a new community to maintain the AGPL fork.

[1] https://github.com/bitwarden/server/graphs/contributors

That's only possible if Bitwarden requires a CLA, do they require a CLA for commits/PRs?

Yep, https://contributing.bitwarden.com/contributing/#contributor...

Yup: Section 2.1: "By submitting a Contribution, you assign to Bitwarden all right, title, and interest in any copyright in the Contribution and you waive any rights, including any moral rights or database rights, that may affect our ownership of the copyright in the Contribution.

It’s a fascinating situation, really: this kind of asymmetry (AGPL for you, but not for us, even if you contribute) is antithetical to the purpose of the AGPL, but desirable for the leaders of quite a large fraction of projects that choose the license (to the point that they might either not use the AGPL or not accept contributions if they couldn’t do it).

I think a CLA that says "You provide us with an additional license to re-publish your code under any license we choose" with modifications to limit attribution, might work. That way the code is perpetually AGPL, but the company is free to offer derivative works under other licenses. Hence you can always use your code, you can fork, you can do all you want, and the company cannot take the code, as it stands at that point, away from the public.

Isn't a CLA just a standard CYA move from more established open source projects? I had to sign one to contribute to Django as well and I don't see them "pulling a MongoDB" any time soon.

My assumption is this is so that they're legally protected from contributors revoking the right to use their contribution at some later point or other obnoxious legal shenanigans.

It depends on the CLA. Some just require you to affirm that you have the rights to license your contribution, and that you license it under the license of the project, which is indeed mostly just a CYA. It doesn't allow the project to unilaterally change the license of your contribution, and I haven't seen much people have a problem with this kind of CLA.

The other common form of CLA is a copyright assignment (or something equivalent) to a foundation or company representing the project, which is much more troublesome. This allows them to basically do whatever they want with your contribution, including charging for it, or closing the source all together.

Linux Kernel doesn't require attributing the code to the linux kernel for example

How exactly is it violating the AGPL for the author to change licenses? They require contributors to assign copyright so... BitWarden belongs entirely to BitWarden.

Because if you've accepted patches you're not the author of the entire code base anymore. So it's not your own work, but a collaboration.

This is why I never sign CLA. Since I'm basically signing my rights away.

Right, but if you had signed a CLA then it's absolutely not violating the AGPL if the host decides to close the source. Since these organisations require that, they're not violating the AGPL.

That's not to say I agree with them and it's obviously shitty behaviour – but license violation is a specific act that they aren't guilty of.

Bitwarden/server has some proprietary components: https://github.com/bitwarden/server/tree/master/bitwarden_li...

Plus it is AGPL + CLA so bitwarden themselves can do what they want

"I promise I will never die." - Gary Johnston, Team America: World Police

But I agree it's a great thing to strive for.

Why has someone put 100m in? Because they expect 200m back.

*10 billion back.

How is that realistic? If they expect to get 10 billion in 10 years, they need to have 100 million paying users (if they charge $10 per user per year), which is like the entire active users count of StackOverflow - https://en.wikipedia.org/wiki/List_of_social_platforms_with_...

Or they launch entirely new products, in the same general space, with new pricing structures that aren't tied to their current offerings. They're Okta + 1Password + ...

To clarify: I'm not sure I buy the above thesis, but VCs don't expect 2x returns at this stage was my general point. They're aiming for higher.

For sure. The way I sum it up: VCs are looking for 10-to-1 odds on 100-to-1 gains. It depends on the stage, of course. This is listed as a series B, but feels kinda C-ish to me. Later stage rounds like that are unlikely to be 100-to-1, but I agree the goal is still well over 2-to-1.

$10B back in equity, not in profits. Depending on government policy and market sentiments, then it may only require keeping a promising trajectory.

Getting money back has nothing to do with revenue.

It just means the VC was able to sell their shares for that 10 billion -a price which may or may not be related to the company’s actual fiscal performance

"Fully featured" does not mean "all features"

"Open source architecture" doesn't mean all the parts you need to self host it is open.

Their "ability to self-host" already includes having to buy a license to even get 2FA

How do you trust the word of a company that doesn’t have a profitable business model?

Just wait for the inevitable “Our Amazing Journey” post on their website.

I don't understand, how is their business model not profitable? Their business model is, as I understand it, paid subscriptions.

Their business model is not profitable by definition if they are spending more money than they are bringing in requiring outside funding.

There is the option that they are profitable, but need the investment to expand the business somehow. There is some indication of that in the press release, but it does seem a little fluffy, and a $100M is a pretty big sum of money.

I can see what you mean, but another way of looking at it is: Most investments are done with the expectation of it being worth more down the line, so someone(s) thinks there are a hundred million reasons why it is a profitable business. :-)

But maybe "are they profitable" is the wrong question. I remember 5 years ago my brother in law said "Tesla isn't profitable" and I countered with "They don't want to be profitable right now, they are growing an inventory and investing heavily in that. Showing a profit is the last thing they want to do." He seemed to be accept that answer, I mean now he has 2 Teslas. :-)

The way I read it is that they already have one minority investor, Battery Ventures and they are now adding another, PSG. PSG will get a seat on the board of directors, it's unclear if Battery Ventures have a seat. It is also unclear if the two minority investors combined holds a majority.

I hope things goes well for Bitwarden, but I'm also expecting an amazing journey in their future. I really doubt that there's enough money to be made as is to yield an acceptable return on investments for the $100M, plus whatever Battery Ventures have already put forward.

I doubt the company will just disappear. They will probably get acquired. But what it morphs into is probably not something consumers who like it now will want.

The only company that I can think of that has managed the transition well and gone public is BackBlaze.

(I’m outside of the edit window)

When I ask “how can you trust the company”, I don’t mean to imply that the founders have less than good intentions. But once you take VC money, the founders intentions don’t mean much.

I’m sure the founders of both Instagram and WhatsApp - just two companies that come to mind where the founders were idealistic and they were hit hard with the reality stick once they got acquired - really believed that their company wouldn’t change for the worse once they were acquired.

I love that they offer a free version and are committed to it. But I depend on it for password management so much so that even if they didn't just raise 100M I'd pay for it in hopes that they stayed around. I think everyone who can, should.

> This is great!

Why? What is a promise like that supposed to be worth? Even if the people making it are completely honest when saying this (which I now doubt), once leadership changes this will go out the window quick.

This is in line with "Keeping our users happy is our main priority" and other quotes from the infinite pool of empty PR speak.

> A fully featured free version, forever

It doesn't say they won't have ads or sell your data. Hint: their privacy policy is already terrible. No mention of GDPR or of them complying with any privacy laws. Their privacy policy mentions "EU-U.S. Privacy Shield Frameworks" for exporting user data to the US, a framework which has been declared bogus by the EU courts years ago.

> An open source architecture

There's no many examples of "open core" calling itself "open source" that if they decide to switch to open core they'll just be another drop in the bucket.

They also require contributors to sign a CLA, which is always a huge red flag.

> Advanced business features

What happened to "fully featured free version" above? Are the business ones separate?

> This is great!

Keybase said the same thing.

Keybase was providing a solution to something most normal people did not even realize could be a problem. It was a great idea, solving a really big problem. But the awareness of that problem was very small. Hence the ability to monetize a solution aimed at the general public was also very low.

I still love the idea, but I don't see how it is a business.

Remind me when they are on their 3rd CEO, 5th product head, and brand new funding sources.

Reply on news.ycombinator.com