cross-posted from: https://thelemmy.club/post/57178743

RyanL Bitwarden Employee

Hello everyone!

Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.

Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone

If you have any questions, please ask them in this thread. Thanks all!

EDIT:

Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
  • WhyJiffie@sh.itjust.worksEnglish
    1·
    4 days ago

    The chances of all sessions logging out at the same time would be extremely low.

    not all devices, but multiple of them did log out roughly the same time. so, don’t rely on storing the 2FA authenticator app’s password in it.

    • potustheplant@feddit.nlEnglish
      1·
      4 days ago

      Or just use and maintain Vaultwarden properly. All you need to do is set up watchtower along with vaultarden and you’ll always be up to date. I’ve never had this problem so yes, I will continue to store my credentials there :)

      • WhyJiffie@sh.itjust.worksEnglish
        0·
        3 days ago

        if the official, commercial servers can’t avoid this, what more could I do? I can’t even provide redundancy.

        on top of that, we run vaultwarden at work. both times this year compatibility was fucked up by a client update, me and my colleagues had to completely reset the client because it bugged away so hard.

        All you need to do is set up watchtower along with vaultarden and you’ll always be up to date.

        sounds like a horrible idea with any software. patch versions could be fine, perhaps, but vaultwarden does not follow semver.

        • potustheplant@feddit.nlEnglish
          0·
          3 days ago

          You can set a custom delay for automatic updates in watchtower. Also, what does “compatibility was fucked up by a client update” mean? Compatibility between Vaultwarden and the oficial bitwarden client? I’ve been running it for more than a year and did not have any problems whatsoever. Sounds like the reset worked for you guys, but the issue wasn’t that “compatibility was fucked up”. Even if something like that were to happen, why not switch to another client temporarily? Nuking the whole thing sounds like a lazy fix.

          • WhyJiffie@sh.itjust.worksEnglish
            0·
            2 days ago

            Also, what does “compatibility was fucked up by a client update” mean? Compatibility between Vaultwarden and the oficial bitwarden client?

            yes, that’s what I meant. multiple people noted in the respective vaultwarden github issue.

            Sounds like the reset worked for you guys, but the issue wasn’t that “compatibility was fucked up”.

            yes. it was that. look up the vaultwarden issues, they were very popular.

            Even if something like that were to happen, why not switch to another client temporarily?

            well, the web client served by vaultwarden continued to work

            Nuking the whole thing sounds like a lazy fix.

            there were no other options with the clients. simple as that. if you can’t even go to the settings what would you do? what would you do if you can, but the sync button prints failure every single time, even after updating vaultwarden to a fixed version? lazy fix my ass.

            • potustheplant@feddit.nlEnglish
              0·
              2 days ago

              there were no other options with the clients

              They couldn’t downgrade the clients? Sounds like that was the easiest option. You can also temporarily use something Keyguard, or why not, permanently given the latest news from Bitwarden.

              yes. it was that. look up the vaultwarden issues, they were very popular.

              Since providing sources was too hard, apparently. I think you’re referring to this issue from August for example? Issue was reported on August 20th and was fixed by September 7th. Kinda sounds like you wouldn’t have problems if you restricted updates for your users. Delay updates by a few weeks (or why not, a month) unless they’re absolutely necessary and you’re golden.

              Like I said, there are options. Maybe instead of blaming Vaultwarden, you could learn from your own mistakes.

              • WhyJiffie@sh.itjust.worksEnglish
                0·
                12 hours ago

                They couldn’t downgrade the clients?

                downgrading? without resetting them? how do you do that? often when complex software updates, they update their database structure, and you can’t just go back without reset because the older version does not know what to do with those new columns or that renamed one. I don’t know about browser addon stores but I do know android does not allow downgrading apps without uninstalling them first, for exactly this reason.

                we updated vaultwarden, but after that the clients were still broken because they have already stored the state they couldn’t process.

                You can also temporarily use something Keyguard, or why not, permanently given the latest news from Bitwarden.

                yes we were using the webapp for a short while, but that always locks to password, can’t do autocomplete, and you need to always have yet another tab or browser window around for it.

                Kinda sounds like you wouldn’t have problems if you restricted updates for your users.

                “my users” don’t have corporate controlled devices. even our own devices we mostly manage how we want, this is not big tech or fortune 500 top high security with mandated keystroke logging spyware. it does not matter even, as vaultwarden is not primarily for businesses. I could not prevent it for anyone for whom I’m hosting vaultwarden as a favor, even. are you suggesting to install remote monitoring and lockdown software for them all, to fix issues made by bitwarden? that would be insane.

                Maybe instead of blaming Vvvalue

                where did I blame vaultwarden? its bitwarden official clients are whats so unstable.