Hacker News Reader

Comment by omnicognate | Hacker News Reader

Vaultwarden's great. I use it. I use the Bitwarden Android client, though. Not sure what there is to replace that.

It's open source and can be forked if necessary: https://github.com/bitwarden/mobile

To add onto this, if you care about supply chain attacks, bitwarden mobile supports Fdroid builds (albeit not part of the main repo because they rely on xamarin) so you can host your own fdroid repo and run your own builds if so desired.

If you are making your own build, is there a benefit to using f-droid? Why not just install the APK?

Update notifications?

You can just use local CI to build it and then when your F-droid checks for updates you get a push notification on your phone.

If you want to gate it, you can just periodically update the local git repo after you reviewed it (or just follow up to main minus a few days).

you don't need to fork it... just add an account at the main screen and set the backend url to whatever your server resolves to.

I think they meant if they don't like the direction that the Android client takes, i.e. they stop allowing you to change the backend url for example in which case, yes you would need to fork or rewrite it

Is it not possible to point BW Android to your Vaultwarden instance?

It's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.

This is interesting. I use BW daily (many times) on Android against my self-updating VW instance.

I did not notice anything, maybe the break happened during the night in Europe. Or the Android app did not want about problems.

In my case I could continue to use the app, it broke the ability to sign into the vault. If you only lock your vault and not fully logout you may not have noticed it.

https://github.com/dani-garcia/vaultwarden/issues/3082

Thanks. I do not even lock BW, not to mention logging out, and almost never connect to the vault via the web interface - so yes I must have simply missed it.

I'm confused: what do they have to reverse-engineer if it's open source?

Sorry probably not the best wording. If Bitwarden changes their API the Vaultwarden team has to act fast enough to get the same changes into the Rust version before Bitwarden updates the clients. In one case they weren't fast enough https://github.com/dani-garcia/vaultwarden/issues/3082

Reply on news.ycombinator.com