I've been recommending Bitwarden for a few years now and have also been paying a yearly sub since 2022, as I always thought 10$ was a really good value.
But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out.
Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt to do an encrypted export for backup purposes, start looking at alternatives, and reach out to people I know use Bitwarden to do the same.
Agreed. I will continue using it as it currently fulfills my needs. But I’m not going to shout it at everybody I catch not using a password manager anymore. I’m just not willing to take responsibility for the changes they may make in the near future.
As an aside, since it seems like they’re trying to make money: The aforementioned enthusiasm has gotten it adopted at a workplace of mine. The experience hasn’t been good, so no recommendation here either.
Their moat was being a trusted name in FOSS and it’s a bit sad to see them going in the direction of abandoning it.
But somebody else will probably step up and build on the ruins, like vaultwarden already has. That’s the beauty of choosing FOSS in the first place.
It is absurdly easy to fire off the docker container you mean.
Because you need to back up, verify backups, monitor availability, manage updates, manage MFA, and a zillion things.
Don't get me wrong, I work in hardcore, high tech IT for 30 years and I selfhost two dozen or so of services. It is far, very far from "absurdly easy" when you start .
Sure you can run a container on your pc, and hope for the best
I’ve seen this idea so many times on HN. “Just stand up a docker container and self-host”. Or even worse: “why does anyone need GitHub - just host Bitbucket yourself”
This seems crazy to me. I have a home server and host lots of my own stuff. But a password manager is tier-0, it cannot fail me.
I need to access my accounts while I'm overseas - in fact I'm prompted for passwords far more often when I cross borders. I need my passwords at urgent moments like when I need to make a large bank transfer. I need passwords unexpectedly at all times when sessions expire or I need a new session for a device I've never logged in with.
If my home server went down for any reason at these critical moments it could be extremely bad. There are some kinds of outages I can't recover from without physically attending my server. And if I'm not very very careful there are some kinds of failures I cannot recover from at all - I have a working backup solution but so did every company that lost customer data before.
And this doesn't even touch on the security risk of hosting a database of credentials on a publicly available endpoint.
Syncthing works on Android just fine, though I'm not familiar with iOS. There also several keepass compatible clients, some support sync via cloud storage. Don't need to host anything. But I admit, for corporate shared secrets storage it is not a right tool.
That's what I'm saying, a lot of people are coping with a product they admit will need a fork.
Not only is it incurring the cost of project fragmentation, but also incurring an always online cost with overly-complicated docker solutions, when a fully offline and airgapped solution already exists.
Furthermore, staying with the same ecosystem invokes the sunken cost fallacy. But the migration from Bitwarden couldn't be simpler (just export Bitwarden json file). It's almost a form of battered woman syndrome people are inflicting on themselves when quite simply they can hop onto an already proven ecosystem that doesn't bait and switch.
I was on keepass before bitwarden. Bitwarden just solves more things for me. I am sure the keepass ecosystem improved a lot over the years but fundamentally i find vaultwarden docker to be far easier. Especially for my work and family members that i convinced to use bitwarden. If they were also in charge of the sync it wouldn't be possible.
Afaik vaultwarden and bitwarden clients are as proven as keepass.
It's entirely compatible with the clients. It also removes a lot of "rug-pull" potential, and gives you the ability to access all the nice features (ex - multi-org, multi-user, shared vaults, totp, etc...)
Honestly - part of the reason I like Bitwarden is that if they ever go full "enshittification", it's going to be relatively easy and straight-forward to just move entirely off their projects and onto open-source forks.
Cant tell if this is satire. But I'm not self hosting my passwords unless I fully understand exactly what's happening. Trusting that to an LLM without really understanding what's happening seems very risky to me.
My experience with code review tools has been dreadful. In most cases I can remember the reviews are inaccurate, "you are absolutely right" sycophantic garbage, or missing the big picture. The worst feature of all is the "PR summary" which is usually pure slop lacking the context around why a PR was made. Thankfully that can be turned off.
I have to be fair and say that yes, occasionally, some bug slips past the humans and is caught by the robot. But these bugs are usually also caught by automated unit/integration tests or by linters. All in all, you have to balance the occasional bug with all the time lost "reviewing the code review" to make sure the robot didn't just hallucinate something.
I switched to uv in an open source project I maintain as our builds were taking dozens of minutes to resolve dependencies using Poetry. The migration itself was pretty easy as both tools use pyproject.toml, so it was a matter of changing headers and minor adjustments.
After the switch, the same dependency resolution was done in seconds. This tool single-handedly made iteration possible again.
How would one go about acquiring the skills for this job? I have experience in other languages and stacks but never worked much with C beyond educational level.
I am plenty interested in learning more, so I'm wondering if anybody has any recommendations beyond diving into wine/proton and looking for low-hanging fruit.
Any plans to support SPN installation on an edge router?
I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though...
Regardless, I'll try out for the firewall and network monitoring.
But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out.
Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt to do an encrypted export for backup purposes, start looking at alternatives, and reach out to people I know use Bitwarden to do the same.
Keeping an eye out on how this develops.