Bitwarden switches password manager and SDK to GPL3 after FOSS-iness drama Fear not, FOSS fans. Bitwarden isn't going proprietary after all. The company has changed its license terms once again – but this time, it has switched the license of its software development kit from its own homegrown one to version three of the GPL instead. The move comes just weeks after we reported that it wasn't strictly …
> It does, however, look as if the company is leaving itself room to build more non-FOSS tools in the future.
As is their right, of course, and good luck to them.
It's the "bait and switch" that annoys everyone, as it's usually the first step on a path that leads to them charging for (or closing) services people have come to depend on. It sounds like that's not what's happening here, so a tip-of-the-hat to Bitwarden from a satisfied and now largely reassured user.
That's the other bit I like about them - no BS licensing from a corporate perspective. Self hosting or cloudy - no games, simply costs the same. Full stop. And if you want to self host, here's the code.
I need to see if I can get this to run on FreeBSD so I can stick on the facilities I have with my ISP.
Vaultwarden appears to suffer heavily from the "We'll just throw everything in Docker" method of package deployment.
I'm going to have to dig through all those "unofficial" repos to generate an deb package or deploy with apt by the look of it.
It seems that in the last decade we have thrown away everything to do with basic package management in favour of absolute overblown nonsense like docker, snap, etc.
It's trivially simple to extract the minimum necessary files from the container and run this "native". You don't even need docker engine to do the extract.
Even better, they document the process at https://github.com/dani-garcia/vaultwarden/wiki/Pre-built-binaries using the docker-image-extract script
I was about to set up vaultwarden or Proton Pass. Hell, I even had imported all my passwords into Proton Pass (but sadly it didn't import my passkeys). I'm very glad to see Bitwarden not being the typical company that does these bates and switches and that they actually give a damn about something like this. I don't mind them making closed offerings in the future, that's one thing, but I do mind when they take an open-source offering and make it closed.
We had a corporate demo from them, with Q&A after.
Frankly, they were simply the most convincing of all the ones we reviewed, and complete to boot. I did have to laugh as I saw the sales exec cringe when the tech guy said "there's no such thing as perfect security", but that's actually what I liked: zero BS. I prefer companies that are brutally realistic when it comes to security, especially when they're about to supply you with tools to protect your own.
Hiding from the stark reality benefits nobody. They're out there, and they're getting WAY too smart. The days of script kiddies are gone and you best learn to deal with it.
These people offer a decent product in the only way to inspire trust: by being open.
100-percent agreed. I'm glad that they're that open. For me, if the sales guy cringes, well, why should I care? I'd rather have a brutally honest company that wants to be blunt and direct about their offering when they're trying to sell me on their product (especially when they're protecting my data!) instead of a company that gives me lots of word salad that sounds and tastes really good but turns out to have incredibly toxic ingredients in it. (Bad metaphor, I know, I was never good with those...)
Current list of ways to circumvent the GPL:
- Tivoization (solved by GPL 3)
- Apps that are run on a server (solved by AGPL)
- Apps that cannot be compiled without a proprietary SDK (another example would be the OnlyOffice Android app)
- Separate contract that punishes you if you share the source code (such as Red Hat Enterprise Linux, where they can end your support contract and future updates)
- maybe you could count AI to some degree, such as Copilot spitting out GPL'd code
> - Separate contract that punishes you if you share the source code (such as Red Hat Enterprise Linux, where they can end your support contract and future updates)
From the GPLv3:
> You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
Is punishing you for exercising your rights under the GPL an “additional term”? I don’t know, I’m not a lawyer.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
