Hacker News Reader

Comment by solarkraft | Hacker News Reader

I’m willing to commit money to a project committed to release free builds without these shenanigans.

Bitwarden is still releasing free builds but yeah you'd need a new project with a new name to use it from the Play Store or App Store.

Turns out Keyguard, an alternative Bitwarden client is already on the Play Store.

https://github.com/AChep/keyguard-app

Edit: turns out Keyguard is source available but fully copyrighted.

So if we now have Vaultwarden + keyguard can these things move away from Bitwardens api and pursue their own?

Is there any reason to? It's kinda nice that they all stick to the same contract. I don't really like the Bitwarden desktop app, but because there's so much code out there, it was pretty easy to have an LLM write a detailed spec for a client and then implement something that works for me.

The Bitwarden web client has actively broken Vaultwarden compatibility at least once <https://github.com/dani-garcia/vaultwarden/issues/7607>. It’s reasonable to expect they’ll do so more, carelessly or deliberately. They already have features and UI that don’t make sense for Vaultwarden, and the rate of such things feels to me (as a mere user) to have increased. When Bitwarden continues in the direction they’re going, I think a hard fork of the entire ecosystem for Vaultwarden is fairly likely, and it will almost certainly be a good thing, and in hindsight we’ll probably wish the fork branched off earlier.

> The Bitwarden web client has actively broken Vaultwarden compatibility at least once

I skimmed the thread, so maybe I missed it, but from what I saw, saying they deliberately broke Vaultwarden is a bit if a stretch. They likely develop their apps without taking into account others (and rightfully so), and it happened to break an unsanctioned 3rd party implementation. Nothing nefarious.

I didn’t say deliberately, but I did say actively. It sounds like this was something that would have broken older Bitwarden self-hosting servers too (no idea how old, or whether this is true at all, for I haven’t checked).

The “nefarious” dividing line is often hard to assess. For a better-known example, it’s interesting just how many times Google has done things like degrading their stuff on Firefox by user-agent string detection, and then been all apologetic about it, it was a mistake, &c. Malice and incompetence can be indistinguishable.

The question is, what structure can protect this in an ongoing way? Say you setup a non-profit foundation, even those seemingly can be perverted to become for-profit businesses with corporate shenanigans (see OpenAI), so if you wanted to somehow "guarantee this group always release things this way", is there any legal structure that can enforce this somehow, "forever"?

I was going to say that’s not the level of security I require from that hypothetical organization: OpenAI was subverted by the perspective of many billions in profit, while many projects are running on idealism just fine (because there’s no profit on it).

I stand by that, but then again, this is about secrets management we’re talking about, so the organization would need a pretty high level of seriousness to be able to be trusted.

That’s a high bar for sure, but it looks to me like Bitwarden is trying to approach it from the top.

Reply on news.ycombinator.com