Bitwarden update: sdk-internal now GPL, sdk/sdk-secrets to remain proprietary but not used in clients
Bitwarden update: sdk-internal now GPL, sdk/sdk-secrets to remain proprietary but not used in clients
Pull request #10974 introduces the @bitwarden/sdk-internal dependency which is needed to build the desktop client. The dependency contains a licence statement which contains the following clause: Y...
@brjsp thanks again for submitting the concern here. We have made some adjustments to how the SDK code is organized and packaged to allow you to build and run the app with only GPL/OSI licenses included. The sdk-internal package references in the clients now come from a new sdk-internal repository, which follows the licensing model we have historically used for all of our clients (see LICENSE_FAQ.md for more info). The sdk-internal reference only uses GPL licenses at this time. If the reference were to include Bitwarden License code in the future, we will provide a way to produce multiple build variants of the client, similar to what we do with web vault client builds.
The original sdk repository will be renamed to sdk-secrets, and retains its existing Bitwarden SDK License structure for our Secrets Manager business products. The sdk-secrets repository and packages will no longer be referenced from the client apps, since that code is not used there.
This appears at least okay on the surface. The clients' dependency on sdk-internal didn't change but that's okay now because they have licensed sdk-internal as GPL.
The sdk-secret will remain proprietary but that's a separate product (Secrets Manager) and will apparently not be used in the regular clients. Who knows for how long though because, if you read carefully, they didn't promise that it will not be used in the future.
The fact that they had ever intended to make parts of the client proprietary without telling anyone and attempted to subvert the GPL while doing so still remains utterly unacceptable. They didn't even attempt to apologise for that.
Bitwarden has now landed itself in the category of software that I would rather move away from and cannot wholeheartedly recommend anymore. That's pretty sad.
This makes sense and is quite common for opensource businesses. They have the main product which is open then they have a business only element either a module or plugin part which is designed for businesses not gen pop and isnt open. They screwed up the delivery on here and badly communicated it but if they did it right nobody would have noticed the secrets managment part at all because they don't use bw business.
The way the founder replied coldly and closed the GitHub issue is pretty telling. Now they're doing damage control.
It's usually better to stay away from VC funded software. They exist for the sole purpose of turning a rich guy's million dollars into 100.
They literally said the issue was an unintentional bug and then fixed it. How is that damage control?
They were doing the same on other repos for months.
Both their npm module and android client.
On android they tried to get people to add their own fdroid repo because the official fdroid has not had updates for 3 months due to the license changes.Edit: Looking at it now compared to 4 days ago, they apparently got frdoid to remove bitwarden entirely from the repo. To me this looks like they are sweeping it under the rug, hiding the change pretending it has always been on their own repo they control.
Next time they try this the mobile app won't run into issues, the exact issues that this time raised awareness and caused the outcry on the desktop app, which similarly is present in repos with license requirements.
If they were giving up on their plan, wouldn't they "fix" the android license issue and resume updating fdroid, instead of burning all bridges and dropping it from the repo entirely, still pushing their own ustom repo? Where is the npm license revert?
One does not "accidentally" build a proprietary SDK for months and make the clients depend on it, intentionally violating the GPL.
They even publicly admitted to doing precisely that, defending their GPL violation with dubious claims how the GPL supposedly works.
Open source community getting too reactionary ngl
Gotta let companies know you're watching
Drama and pitchforks over nothing, as usual.
Who knows for how long though because, if you read carefully, they didn't promise that it will not be used in the future.
This is conspiratorial thinking, and it's a fallacy called the Argument from Silence (i.e. asserting intent based on what they didn't say). If I say I'm going to give you a handshake, but you say, "But you didn't promise you won't punch me in the face," most people would recognize that as a ridiculous line of reasoning.
Bitwarden has now landed itself in the category of software that I would rather move away from and cannot wholeheartedly recommend anymore. That's pretty sad.
You do you. This doesn't seem all that problematic to me, as I don't need Secrets Manager, and I'll still recommend it to anyone looking for a password manager.
Seems to me that it makes more sense to vilify them when they become villains, not before based on paranoid reasoning that they might.
Not trusting a company that has been quietly undermining open source builds of their android client and being cagey + using guarded and laconic PR speak on this is not fallacious thinking, it is just recognizing behaviors and knowing why a company would be doing that. These companies hire people to craft responses and otherwise manage their "community", and providing no assurances of permanently open clients when they tried to pull this is an intentional omission.
I hate to say this, but there's no real assurances of permanently open clients from anyone. Also, their client is still open, and if they do drop the OSS model, people can just fork it and still have a working client (or fork an old version that meets whatever standards they have).
But unless we can prove that they have actually done something ethically wrong, I don't see why the internet feels the need to waste energy creating villains from conjecture.
Nah, I've switched to KeePassXC already. I've never been happier.
Does it work well from a user experience standpoint? I am considering switching from my current provider to KeePass XC. Usability is important, I also need to share some passwords with my SO. She is good with technology and computers, but not a dev.
Check out Proton Pass. I migrated my Bitwarden to it and its not just fast compared to Bitwarden but the UX is really nice. That said, I'm still sticking with Bitwarden, but will happily move away and give my money to Proton if they ever actually stop making their client open source.
Yes, it does works well, but has its caveats. You have to set up your own sync, either using a Syncthing or any other 3rd party app as KeePassXC does not have any sync option built in. KeePassDX has a good article about syncing a database.
It absolutely rules for all kinds of info you don't want laying around loose on a device. The sync issues others have mentioned are just a result of it giving you more control over file management. I don't even sync I just use an SD card
Too bad because there are no other Bitwarden cons for me. Any recommendations?
Tried Proton Pass yesterday, and while it looks nice, browser extension not having a password lock is a deal breaker for me.
Also, I found out in the evening that after trying out Pass during the day and quitting on it, all my aliases in the SimpleLogin are gone. I know Proton owns it, but I wasn't expecting that by deleting data on Proton (not the account itself), aliases could get deleted...
Still, not sure if it's connected. I use SimpleLogin independently of other Proton services, but same primary email. Waiting for support.
I've switched to KeePassXC on pc + KeePassDX on mobile after that whole drama. Proton Pass is also interesting, but there's no way I'm gonna use cloud-based password managers anymore.
Keepass2Android Offline also works very well. It has a somewhat different feature set compared to DX.
I found it to be more stable at remaining permanentl unlocked, and DX dropped the 3rd domain level for password matching on either websites or apps, I don't remember.
On the other hand DX works better for adding new credentials or making changes. Since I usually do that on desktop it doesn't matter much for me.
The browser extension has a pin lock feature.
@Atemu While I don't necessarily think all of this stuff makes #bitwarden #evil, I do think it would be smart to remain #wary and #vigilant.
There have been a spate of #opensource #projects run by #commercial #companies lately that have done / tried to do nasty #license changes.