Diseased Open Source Software Community - it's about ethics in Code of Conducts

[skunt]

Yeah, it’s a real shame BitWarden has went down this path. Probably going to need to look into self-hosted solutions next.

vaultwarden is the best alternative. i still use keepassxc with nextcloud but if i ever have to move for whatever reason, it'll be to vaultwarden.

https://github.com/dani-garcia/vaultwarden

 

[galah]

You didn't even bother to check and they're working on it around the clock: https://git.savannah.gnu.org/cgit/gawk.git/log/

lmao, don't go calling out people for not bothering to check if you're not going to either, the changes you linked to are absolutely indicative of feature complete software. Considering everything on the front page of that log, so about 1 month + 1 week of working around the clock, here's what's changed in the files outside of documentation, translation, and the build system:

But once you further filter out files with only changes to comments and removal of some newline output in the profiler's pretty printer, here is the whole diff:

slightly faster regexes in (fairly literal) edge cases. Wow. Software really can be called finished, as much as people seem to not want to believe that.

 

[Casshern]

VaultWarden is good (in spite of being Rustwarez). The only thing that kind of sucked was having to extract it out of a Docker container (since I prefer to run my infra in LXC containers), but it's been absolutely rock solid. I really dislike having keyrings and vaults in the cloud (inb4 "the cloud datacenter is safer than your home network", for my own network and physical location I really doubt it). It might, unfortunately be time to go back to using KeepassXC.

vaultwarden is the best alternative. i still use keepassxc with nextcloud but if i ever have to move for whatever reason, it'll be to vaultwarden.

https://github.com/dani-garcia/vaultwarden

VW is a BW-compatible rust server, correct? The problem there is that the BW clients are now non-free. So far there hasn't been any indication they will lock down third-party servers, but given that just a month ago I would have said there was no indication of them becoming non-free, I would definitely say it would be best to find alternatives. Hopefully there will be a fork of the SDK and an alternative client. A real shame that they make it *really* hard for me to recommend them now, I may need to look into ProtonPass for normies, even if it is more restricted it's at least GPLv3. KeepassXC with Nextcloud/Syncthing is definitely the gold standard though, and something I'll look into. Thank you!

So much of the churn is at least partially driven by having every pile of shit needlessly built to connect and phone home to the Internet. I think people underestimate how much software is just done (it's just not sexy and usually not hooked up to an IP network). I've got a lot of older PIC16F firmware for various things that does the job just as well as when I wrote it many years ago. Lots of industrial equipment like the older CNCs I look at occasionally are "done" and "just work", even if they're running on DOS or Windows 95. Knuth's O.G. TeX also comes to mind as something that's truly "complete" (though LaTeX users may disagree).

A lot of the world behind closed doors is ran on older "just works" tech, I remember a job listing like a year ago in Germany for Windows XP techs to help maintain their (hopefully isolated) computers for the trains. Although, given how absolutely abhorrent the German train system is, that may not be the best example. Point is, too much software today is re-inventing the wheel using Electron, is always online from a central server, has tons of gimmicks, and uses high-level languages working so far away from the bare metal it may as well have dug a whole back to the Chinese fabs. Really hope we can see a return to more efficient low-level languages and local-only software.

 

[Autistic Integrity]

A lot of the world behind closed doors is ran on older "just works" tech, I remember a job listing like a year ago in Germany for Windows XP techs to help maintain their (hopefully isolated) computers for the trains. Although, given how absolutely abhorrent the German train system is, that may not be the best example. Point is, too much software today is re-inventing the wheel using Electron, is always online from a central server, has tons of gimmicks, and uses high-level languages working so far away from the bare metal it may as well have dug a whole back to the Chinese fabs. Really hope we can see a return to more efficient low-level languages and local-only software.

I remember these country auctioneers who had a hard drive crash on their windows 98 pc. The computer never went on the internet and just worked with their auction software. They also kept weekly backups to another hard drive so it was really no sweat once i could find an IDE drive for them to use. IIRC they ended up upgrading to a shitbox core2duo or something and ran win10 and the program in compatibility mode before it was over. If it ain't broke why fix it. (the system that is not the hardware)

 

[Rob Wolchek]

This news is extremely disappointing. I have been using BW for as long as I can remember due to how reliable it has been with syncing passwords. This seems to be a trend in the FOSS community that once a project gets big, regret starts seeping in with using GPL and they try to find ways to get around it. First it's this shitty SDK, next it will be them pulling a Lastpass and telling everyone to pay up asshole.

 

[skunt]

next it will be them pulling a Lastpass and getting breached like 5 times.

fixed. on that note, if anyones still actually using lastpass you're asking for trouble.

 

[UERISIMILITUDO]

I'll post it again: Password managers are fucking retarded. Use a piece of paper.

 

[Kola]

I'll post it again: Password managers are fucking retarded. Use a piece of paper.

Now show me a way to securely send that piece of paper to a group of people over the internet.

 

[Edict of Expulsion]

https://apps.nextcloud.com/apps/passwords

I’ve been a happy user of Strongbox (and KeepassXC) and haven’t used the above but I like that it’s there in case I ever need to use it.

I just saw on lobste.rs you can use KeepassXC in place of the gnome and kde password managers, and anything that uses the “Secret Service API”.

Keepass chads stay winning.

(Dynamic dns or some few-dollars-a-month VPS is very worth having to have a set-and-forget NextCloud. Don’t forget unattended-upgrades)

 

[Oliver Onions]

Now show me a way to securely send that piece of paper to a group of people over the internet.

Take a photo of the paper and post it on Twitter. Duh.

 

[AmpleApricots]

Yes, but to too many it's a tool to inflate egos.

It's kinda like the ancient medicine man of the tribe. People thought he has secret knowledge about the world and came to him when they were in need but he himself probably knew at some point he's just bullshitting his way through life, maybe to a point where he believed it himself, out of desperation, or maybe just out of the innate need to have his life make sense. Are modern programmers medicine men that stand on the shoulders of ancient tech they don't understand? What an interesting mental picture.

see complicated and incomplete tools as a good thing,

Which is a perversion of the do one thing and do it well mantra. But getting upset about that is like getting upset that the house that is on fire has a shoddy roofing, there's a lot of things broken and illogical in *xes and their userspace. Still the best we have right now I'm afraid.

What, you don't think ls and cat and grep need to be updated every five minutes to add new features?

It's funny because the GNU coreutils are not exactly a good example of elegant, focused code. The codebase is borderline incomprehensible because of the bizarre amount of edge cases and very special flags implemented and then so much stuff builds on them. It's still better than a lot of the garbage you see in other places.

I've got a lot of older PIC16F firmware for various things that does the job just as well as when I wrote it many years ago. Lots of industrial equipment like the older CNCs I look at occasionally are "done" and "just work", even if they're running on DOS or Windows 95.

I had to go back to work a while ago because I was desperately called in because parts for a very important piece of hardware were running out and nobody quite understood either the sources nor how it actually worked in detail, nor were they clear how to reverse engineer it efficently because it was basically stuff that was made before many of the people working there were born. So in a way, they just knew the ancient magic words, too. Reverse engineered and build better ones with modern, off the shelf parts. It's not that modern technology isn't a lot better, it's that people do not understand the principles on which it stands anymore, and that's a bit scary. My scifi guess is that eventually a lot of engineering (amongst other disciplines) will just rely on AI and nobody will actually understand the AIs' decisions or designs, or if they are even any good. It'll seem like magic. That has the capacity to be quite dystopian.

 

[Post Reply]

I used to use Bitwarden, I was even a paying customer for a bit, but I migrated away when they started firing people over not obeying pronoun bullshit. I would not be surprised if this is another instance of trannies working to ruin good free software. I use KeePass and ProtonPass now, but neither are as convenient as BW used to be.

 

[Redeemer]

No such thing as "feature complete". I was naive once too and added some packages that looked abandoned as dependencies because they were "feature complete". A few years later and there are gaping security holes that were discovered in the meantime

When's Euclid going to update the Pythagorean theorem?

I think there's truth to both sides of this. I definitely don't want people continually "working" on something that is finished. That's just a recipe for bloat.

However, if a project has not even had a minor revision bump in over say two or three years, that is not a good sign. If no one has updated docs, made a minor improvement/non-breaking change, responded to github issues (even stupid ones like "hlep it don work!!!") in over 1000 days, it's probably abandonware. That means relying on it is totally caveat emptor. If something goes wrong, I probably couldn't even get a single contributor to respond. Best to avoid that when possible.

 

[Stumbling7]

I'll post it again: Password managers are fucking retarded. Use a piece of paper.

Paper work until you lose it, or misspelled it.
Not as bad as some tell me to use Notepad for passwords.

 

[Flaming Dumpster]

This may not be the place to post, but as of a few days ago BitWarden has became non-free software. They have added restrictions to an internal SDK that the entire set of programs cannot work without, and the CTO claims that this is allowed under the GPLv3, before locking the issue, stating this:

This is disappointing. Bitwarden has been giving me the shits lately so seeing them pull this is even more aggravating. Back in April they had a bug with the browser extension on Firefox where it'd kick you out randomly (usually once or twice a day) and force you to log back in again. They refused to do a hotfix, instead forcing everyone to deal with it for a month until they reached the milestone for their next monthly release.

Then they deployed the highly anticipated May update aaand... the bug was still present (great testing). Fucking unbelievable. They found the issue quickly but made everyone suffer another fucking month. https://github.com/bitwarden/clients/issues/8873

They did the usual promise of "We'll learn from this" then fucked up again recently, this time the extension would just ignore the form autofill preference and offer to autofill no matter what. Some people probably think autofill is wonderful but I find it a huge pain in the ass and this was killing me. This shit was broken for all browsers and took a month to fix. Mozilla trannies didn't help by dragging their ass on approving it https://github.com/bitwarden/clients/issues/11173

I've tried out Psono a couple of times and it sucks, though the 2nd attempt went better than the last (about 2 years apart) so it's slowly improving. It's seriously unpolished, lacks a desktop client and is very tedious for a regular user as it's geared more for enterprise. The browser extension was especially bad, it's basically a self-contained version of the web UI and lacks a lot of features.

I'm going to try Passbolt next as it looks pretty slick. The cloud option is enterprise-only but it looks easy to self-host.

 

[h2_jGX]

I feel so defeated and sad about how open-source software has become recently. I was going to write more about the subject, but no point... The internet, software, and games will never be the same as they once were. RIP.

 

[Radiaux]

Great, so what now?

 

[Kola]

Boo hoo the sky is falling because the free and open source software is not freetard enough. You still see everything that's in the code, you can still self-host, you can do whatever you want. Tempest in a teapot. Literally nothing's changed.

 

[Battlefield42]

Lol, lmao.
Apparently Godot assrapes your pc when importing assets.

 

[Weapons of Mass Tardation]

Lol, lmao.
Apparently Godot assrapes your pc when importing assets.

That one is interesting. I thought initially when I read it maybe it was just code written by people used to abusing memory overcommit (you'll see Linux/Unix apps occassionally malloc for way the fuck more memory than they actually need), which if you just ported to Windows would cause problems, since AFAIK Windows doesn't do overcommit, but it looks like it's actually using the memory.

I'm not a games programmer, but have done some scientific and industrial visualization software. I have no idea what that object format is (I'm only really familiar with wavefront), but one thing I've seen is that a lot of people just don't export normals on their objects (maybe for good reason?), and I could imagine if you're the sort of retard that doesn't think about memory at all (which is a huge percentage of modern developers), when it comes time to do shit like calculate your Gouraud normals (or whatever the kids do these days) and convert the object to a VBO (or dating myself, a display list), it would be easy for your object loader to rape the shit out the system, especially if your object format is retarded and you're not careful with allocations. I'm sure if it includes animations or trying to generate mipmaps, that only further complicates shit. Good 3D programming is kind of a dark art, and if you're a webshit developer or do street shitting GoF OO, it generally makes shit run like pure ass. Just a guess on my part, though.