Bitwarden integrates with OneCLI agent vault
onecli.sh
onecli.sh
Often, we see a feature which is important to free use of a computer as a general-purpose tool locked behind an ever-changing and/or poorly documented API in a closed-source, centralized, de-facto-government-subsidized project.
The power dynamics of that situation are not symmetrical, so it does matter which project(s) are using which API(s) of the other(s).
https://bitwarden.com/blog/introducing-agent-access-sdk/#int...
What remains terrifying is the ability to exfil important data or run commands that are malicious.
I could not be anymore bearish on Bitwarden than before after looking at this and very glad that I don't use them.
Edit: I can see on Bitwarden's site they also call out their support for OneCLI, so I suppose that looks like Bitwarden saying they approve of and recommend OneCLI. But I see recommending an open source solution as a lot less problematic than recommending any other random private startup solution.
Lots of assumptions that the article is AI-authored (it could be but I'm not seeing overtly obvious signs - it's quite readable) & a lot of ungrounded assumptions that this is somehow related to Bitwarden integrating AI into their product.
I really thought reading comprehension among HN users was better than this.
Perhaps the most damning discovery is that they don't even do basic dependency pinning [1] [2] which just risks another supply chain attack.
As soon as I saw that, that was everything I needed to know about the project. No security audit whatsoever and Bitwarden believes this is something worth integrating.
[0] https://github.com/onecli/onecli/graphs/contributors
[1] https://github.com/onecli/onecli/blob/main/packages/ui/packa...
[2] https://github.com/onecli/onecli/blob/main/packages/db/packa...
The lack of package pinning is unfortunate but common enough that I'd simply open a ticket (& expect them to address it) rather than writing off the entire project.
The lack of a security audit for a project this young is also unsurprising & hardly notable.
‘Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die. I call this enshittification, and it is a seemingly inevitable consequence arising from the combination of the ease of changing how a platform allocates value, combined with the nature of a "two-sided market", where a platform sits between buyers and sellers, hold each hostage to the other, raking off an ever-larger share of the value that passes between them.’
- Cory Doctorow
I may be out of the loop, but how was Bitwarden not "good" to users? Does this relate to the recent price increase?
Is there anything that bitwarden did that is actually bad for you as a customer of theirs?
That is a pretty big price bump though, and I think it's going to cost them. It's certainly enough that I'll reconsider Bitwarden.
They sent an email a couple months ago stating prices were increasing as of Mar 27. The family plan went from $59.88 USD per year to $71.88 But it's still worth it IMO.