server

It's been a few years since I looked at the official server setup (I immediately switched to bitwarden_rs, this project), so maybe this isn't as true today: Mostly it's that the official setup is the same thing that runs their free/paid hosted service. By design, it is quite split apart into separate areas, presumably so they can scale independently of each other: https://github.com/bitwarden/server/blob/master/SETUP.md But most people are going to want to host self-hosted instances for themselves, their families, or maybe a small company. The official server might be the best route if you're deploying to thousand of users, but that won't be most people. Another benefit is that this flips all of the "paid" feature flags to true. If you self-host Bitwarden's official setup you still have to pay a subscription to use paid features.

> I considered Bitwarden, but I don't want to run the Mono/Windows server container, and I don't want to rely on the Rust port which is behind in features and is susceptible to the upstream breaking APIs. "The server project is written in C# using .NET Core with ASP.NET Core." https://github.com/bitwarden/server Seems like alternative DB providers is in alpha stage right now. Mono and netcore is not the same, netcore is one of the more wonderful things I've worked with if I'm to be completely honest. Then again, I also kinda like PowerShell

The Bitwarden server is source-available, but not open source. This is because, for example, section 2.3 of the license agreement (https://github.com/bitwarden/server/blob/master/LICENSE_BITW...) conflicts with section 6 of the Open Source Definition (https://opensource.org/osd), titled No Discrimination Against Fields of Endeavor. I think the specific terminology is what others here are disputing. The Bitwarden desktop and mobile clients are open source because they are under GPLv3, a license that meets the OSD. Vaultwarden is also GPLv3.

It's not "Open Source" except by the literal definition that the source is open to read (but by that definition, the software is free to access, too). It's just freeware / sample code. The license for this code https://github.com/bitwarden/server/blob/master/LICENSE_BITW... says, > 2.4 Third Party Software. The Commercial Modules may contain or be provided with third party open source libraries, components, utilities and other open source software (collectively, "Open Source Software"). which implies that the Commercial Modules, themselves, are not Open Source Software. (Also it clearly doesn't follow the Open Source Definition or any other standard definition of Open Source.)

Open Source, but not Free Software. Check out the custom licenced code within https://github.com/bitwarden/server/tree/master/bitwarden_li...

I hadn't realised half the "official" server was under a non-commercial custom licence. https://github.com/bitwarden/server Last I looked, it wasn't fun to self-host anyway. Vaultwarden ftw!

Is this not the server you are looking for? :-) https://github.com/bitwarden/server

Bitwarden is written in C# (https://github.com/bitwarden/server). If you want a project that impresses you, look at Ryujinx (https://github.com/Ryujinx/Ryujinx)

This issue claims they are starting work on PostgreSQL support this week. https://github.com/bitwarden/server/issues/453

By replacing the client code with code that exfiltrates the password the next time you enter it. Alternately, brute forcing the client password is straightforward due to their use of a too-fast KDF and low iteration count. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589

What do you think about this reply on that thread? https://github.com/bitwarden/server/issues/589#issuecomment-...

In theory, absolutely. In practice, bitwarden's server limits the max iteration count on a user account to something that remains insecure. They refuse to fix it. https://github.com/bitwarden/server/issues/589