Hacker News Reader

Comment by MaKleSoft | Hacker News Reader

If you're a Bitwarden user and this doesn't worry you, you haven't been paying attention to the history of almost every company that has accepted VC funds.

It doesn't matter how well intentioned the founders are - once you accept that kind of money, it's not your product anymore. You are now in the business of making money, nothing else, and those skewed incentives will start bleeding into their product and business practices sooner or later.

As a company, Bitwarden has been a huge role model for me, and I hope they'll be the exception to the rule. But $100M is a lot of money, and I simply can't imagine it having a net-positive effect on the company and product. But we'll see...

For anyone looking for a bootstrapped, open source alternative to Bitwarden, check out Padloc:

https://padloc.app/ https://github.com/padloc/padloc

(Disclaimer: I'm the founder)

View on HN

That’s a hell of a disclaimer after a decently alarmist comment. You may be correct, but I’m not sure it’s appropriate for you to raise that point given the conflict of interest.

Seriously, talk about burying the lede.

I would have simply reversed the order of the post.

"We're building padloc because we see no way to avoid X Y Z"

I fear for this world if one cannot responsibly process the data they're given after all the cards are put on the table.

The only conflict of interest here is the VC looking for a quick exit as rates are rising and your comment shooting down what appears to be a bootstrapped alternative/competition.

Althought I wonder how much it will take for this padloc fellow to turn around and announce that he decided to accept VC or even worse, issuing tokens on Ethereum.

We are almost at the Minsky moment and lot of founders are going to realize they no longer own the companies built.

disclaimer is good tho.

Isn't bitwarden[0] already open source and aren't you just asking people to trust you till you take VC money?

[0] - https://github.com/bitwarden/server

Not only that but even the clients are open source ( https://github.com/bitwarden/clients ).

There's even an unofficial Rust reimplementation of the server which is even better.

Parent post is spreading FUD on this one.

The product being open source doesn't prevent the situation the OP mentions. It just provides a mitigation or a workaround by forking.

I also hope it won't happen but many good projects have gone this way before.

In this case the investment is not for the password manager but for a new identity service. However if that doesn't end up providing the promised results, the shareholders will start looking at the existing successful product to extract more value. After all they own part of that now and they want their returns. It's just what they do. This will clash with the users' best interests sooner rather than later.

Then it becomes forking time but can they find a good maintainer? Open source is not always a guarantee for continuity.

Of course if the new project pans out this won't happen but it's a gamble, and one the existing userbase never asked for.

There is already a well-maintained third party implementation of the server.

The server and client are open-source, and independently audited regularly since 2018

https://bitwarden.com/blog/bitwarden-network-security-assess...

Yeah the Rust version works well. I had an issue with it when importing passwords from a file exported from Dashlane, but other than that no issues. And I run it on a bottom tier Digital Ocean vm.

Lots of people can't set up their own bitwarden servers on a slow weekend. Yeah I can, but I venture 98% of people can't. Sorry, you're assuming everyone (including every HN audience) member can do that. Are we supposed to just keep quiet? I think we all know what happens when the VC folks come in. If you haven't lived through it (I have a few times now) you've at least heard about it if you read tech news at all. As long as the comments are respectful I don't see any reason to gatekeep them

That's how it looks to me as well. OP's claim borders on FUD and comes a bit disingenuous while shilling their project. Bitwarden is opensource as well and there's also this independent popular 3rd party project that uses the bitwarden protocol that is much loved by the community.[1]

1: https://github.com/dani-garcia/vaultwarden

When the person declares it's their project, it's not disingenuous.

Paying Bitwarden user here.

This doesn't worry me that much. In the event that incentives get skewed (which isn't certain), I guess I could just stop updating the app before that happens, or fork the last good version?

I'm interested in your alternative. I hadn't heard of it, went on your site and it looked decent, I think if I had seen this before going with Bitwarden I'd have seriously considered it, BUT now that I'm a keen BW user, it doesn't seem as if there is enough for me to switch.

Are you also definitely never going to take VC money? Or an acquisition, say, by Bitwarden? Why should I trust you (and a product I've only just learned about)?

> This doesn't worry me that much. In the event that incentives get skewed (which isn't certain), I guess I could just stop updating the app before that happens, or fork the last good version?

This is easily said, but remember you're talking about a security-sensitive application. Do you really trust yourself to keep your fork secure? I know it doesn't look like it on the surface, but password managers have become wickedly complex, especially if you require things such as shared vaults, audit logs, a zero-knowledge architecture etc. The reality is maintaining your own fork won't be feasible for the vast majority of users, even those with a technical background.

> Why should I trust you (and a product I've only just learned about)?

The simple answer is that you shouldn't. You should ALWAYS be sceptical, and look for possible indicators of a company heading down the path to the dark side. Like taking a 9-figure sum of VC money for example ;)

> Do you really trust yourself to keep your fork secure?

No, but I don't need to. Considering how many people are already contributing to Bitwarden's Github in the form of PRs and such, if worst comes to worst, there should be plenty of people who can maintain it.

So just to be clear, "bootstrapped" means that you won't accept an offer of $100m, so we should trust you rather than bitwarden?

Well, yes. But to be fair, I bet there is a 5-year-old HN comment of a Bitwarden founder somewhere saying the same thing...

Bitwarden probably isn't worth 100M in it's current shape, and investors will want their money back (plus profits!). This means things have to change.

Change how exactly? More money needs to flow.

VC investments: a mechanism where the rich invest their spare money on other in order to extract more wealth for themselves.

Bitwarden is also open source and self hosted. If they should ever make their product not free, I can just keep running the last version and fork it to further improve it together with other people, can't I?

You can, but will you?

The points I was trying to make is that...

1. sure, it's great that it is open source and that I could self host, but honestly, it's just not worth the trouble for me and I'd rather pay 10-20 euros for someone to take care of that for me. Self hosting my password manager would take a significant time investment and constant worry whether I'm doing it right. It might be because I'm primarily an app developer now and not a backend expert anymore.

2. Most big projects like Bitwarden are alive because there is a company and many full time employees behind it. Once that's gone, relying on a couple of passionate volunteers might not be enough to keep the project alive.

All in all, I've been using Bitwarden since the LastPass fiasco, I'm very happy with it, paid user with my family, but if I had to self host or volunteer, I'd not have the bandwidth to do so and I'd rather switch to another solution, even if it would mean I need to pay.

I think that when people say "it's open source, I could just self host and maintain the project" often underestimate how much effort that really is. Sure, it's possible, but will you actually do it?

I'm already self hosting it, took 3 minutes to set up a self updating docker container.

Then I must have overestimated the effort needed for an experienced dev to set things up. I assume I would need a day to figure out how to best self host. Thanks for the info, I'll give it a try this weekend.

I just looked at your CI. Very very few automated tests. It isn't a deal breaker (Bitwarden honestly isn't much better), but it doesn't instill much confidence in your application either.

https://github.com/padloc/padloc/runs/8205722258?check_suite...

I think your conflict of interest / disclaimer should be stated at the beginning of your post

You're right. It's too late to edit it now but I'll keep it in mind for next time.

They're right you know. This happened to Keybase a while back and some nasty stuff happened to it and it is now in someone else's hands.

Hope this won't happen to Bitwarden but we'll see. But anything is still possible.

Keybase was an entirely different case... first of all, they didn't just take VC funding, they were bought outright ("acqui-hired" by Zoom for their skillset). Secondly, they didn't have any significant income, whereas Bitwarden has been a profitable business all along.

I don't have a well-formed opinion one way or the other, but it is interesting to me that this comment made it to the top of HN. By contrast, a submission about Tailscale raising the same amount of money had comments that simply sounded exuberant about the implications (https://news.ycombinator.com/item?id=31259950).

Is it just that our anticipation (or foreboding) of the effects of capital infusion is biased by our priors about the company? Or, some other reason?

Have you undergone a security audit like Bitwarden? Why would I trust you instead?

I'm (casually) looking to move off LastPass. Padloc looks pretty good, but I'm hesitant to go with an 'unproven' solution.

Yes. We've been around for quite a while actually, and have completed three independent audits. One just recently by Radically Open Security [0].

[0] https://padloc.app/blog/security-audit-ros/

Thanks, I’ll take a look.

Questions:

* What makes you invincible to investment? * What makes you different from BitWarden? (they are also opensource, might have been bootstrapped too, also claim being autdited) You seem to only really be "an alternative", which is great, but you kind of oversell it I think. * "I simply can't imagine it having a net-positive effect" --> or do you mean on "your" company? Because, you seem to also sell a product: access to the hosted solution of your open source product. * Open source BitWarden server-side API implementations exist... Even in Rust (not that that matter that much given the nature of e2e encryption). * Are you not interested to one day provide an enterprise tier over you family tier?

Disclaimer, I'm a satisfied user of BitWarden's free tier for some years.

So here my main gripes with BitWarden:

* There is an option to send them your password file for them to import it. This goes against their e2e philosophy that I believe it should have huuuuuge red tape, and it does not. They should deliver this type of functionality in a manner that I can run it on my local machine.

* Horrible UX. I've often been searching where they hide the save or edit button this time. You're product looks nicer in this department.

Good luck with your product! I'm a little busy, but I may give it a try some day. To me there is a safety in BitWarden not going belly up, and alternatives (self-hosting and your product) existing.

Not gonna lie, I'm having a hard time justifying the 3-4x increase in cost for Padloc vs. Bitwarden. The pricing is only rivaled by 1Password, which makes it a hard sell to me...

Well, there is the problem, isn't it? If people aren't willing to pay what amounts to a cup of coffee a month for a service they rely on daily, how are companies supposed to build a sustainable business without raising money?

Now that every single damn service out there is costing me a cup of coffee every month, I end up paying a couple of coffee jugs a month. Are we seriously going to shame customers for trying to cut some costs in this economic context?

As a customer, what I can do is compare with the competition. Padloc is more expensive than basically every other option out there. And as far as we can tell, Bitwarden was already running privately before this VC round (which seems aimed at expanding their offerings past password management) which doesn't seem to point to it being unprofitable at its current price point.

> Are we seriously going to shame customers for trying to cut some costs in this economic context?

That all depends on the margins of what is being offered. If you are proposing they sell a dime's worth of product for a nickel, then I would see the above post as a much more polite version of the correct response, which is "get lost."

I have no idea of the margins, and expecting customers to know about your operating costs without either disclosing them outright or asking the question is an... interesting take. All I can realistically do is compare with the competition, and the competition is cheaper across the board. Therefore my initial comment.

I'd have no problem paying more for a good product if it brings me something. In the meantime, I'm still left pondering. "Get lost" would be a rather crappy way to treat customers simply asking questions, wouldn't it?

I wish we’d stop with the cup of coffee comparison. Not everyone lives in the USA and drinks Starbucks. A cup of coffee costs 0.70€ where I live¹, cheaper than the cheapest (non-free) App Store app. Furthermore, I don’t drink coffee.

For me it’s not about the price but the recurring cost and the lock in. I’d rather pay a larger sum upfront when I’m sure I can afford it and reevaluate when it’s time to upgrade than be sucked dry bit by bit and have to drop everything to scramble to find an alternative when the developer decides to remove features and jack up the price overnight as they keep the data hostage.

¹ Smaller than a Starbucks coffee, but also higher quality.

Totally agree. Every single new subscription product someone buys that can't be run independently or avoid updates adds tech debt to their personal life. At some point that product will be killed, degraded, or made much more expensive. Software that can be purchased once and run indefinitely is all upside on the long tail.

I wish more companies followed the Jetbrains model where a subscription buys lasting access to the current version and recurring payments gets you continuous updates. It's easy to see why companies mostly avoid this model though; it's easier to squeeze users for money when you have them held captive.

I watch Netflix daily and the content costs much more to create maintain and serve. costs less than a cup of coffee per month

This.

FFS, changing password manager is a pain in the ass. I've already migrated from 1Password, now I have to do it again?

Argh. If only there was a decent cloud-based open source alternative that worked on Windows, Linux, iOS, macOS, Firefox and Chrome.

Vaultwarden is an open-source password management server option that implements the Bitwarden server API which makes it compatible with all the existing client applications and browser plugins.

Since the Bitwarden feature-set is pretty darn good my hope is that some foss "bitwarden-api" client applications come along and that'll offer a more independent solution.

A dedicated import feature for Bitwarden is coming in v4.1 later this week: https://github.com/padloc/padloc/issues/561

Yeah, that's why I have just stuck with Apple's keychain.

This is the real answer for most people - especially if they've drunk the coolaid as it were.

Keychain will continue to get better and better for those in the Apple ecosystem, and for much of those outside it, Chrome provides enough.

But only if you are deeply in, like use safari on osx instead of say firefox.

Having a windows box as well as all my macs make it less nice.

Thanks for the recommendation of padloc. I will be checking it out tonight. I really enjoyed my time with Bitwarden, it was quiet and calm and no sudden surprises.

Now that you criticized Bitwarden for accepting the funding, please explain how is your approach different. Are you really not interested in monetization of your own product, and developing it only for the benefit of your users, without any economic incentive from your side?

Reply on news.ycombinator.com