Great find. This blog post - and specifically the background of the new management team - convinced me to start looking for a Bitwarden alternative. I’m watching the same “boil the frog” strategy unfold at Namecheap, and erode much of the brand trust they had built up over a decade, and it’s a shame.
> I’m watching the same “boil the frog” strategy unfold at Namecheap, and erode much of the brand trust they had built up over a decade, and it’s a shame.
What's happening with Namecheap? I've been a user for a long time and haven't noticed anything.. Maybe I'm one of the frogs being boiled!
Bought out by private equity. I've moved my domains to Hover when I found out from that Hacker news thread before any of the enshittification affects me.
Bought out by private equity. I've moved my domains to Hover when I found out from that Hacker news thread before any of the enshittification affects me.
Proton Pass. I stopped using Bitwarden for a different reason, the mobile app was too slow when not connected to internet. I can't accept such slowness, the company will definitely give justifications for this. But I don't care, let me see my passwords or notes for a website immediately. Proton Pass is better in this regard.
I am using Keepass XC + Keepass DX synchronized with Syncthing. There's really nothing to self-host, other than throwing Syncthing on a NAS so you can make sure you have at least one machine online at all times. But even that isn't critical, since both Keepass XC and Keepass DX have a "Merge" option if anything falls out of sync.
ive used keepassxc forever, switched to proton pass after the release, because i was managing my db in git and it was always a pain to keep in sync, but switched back a couple of weeks ago with exactly the same setup, syncthing and KeepassDx also works suprisingly well.
mostly i was missing power user features and especially ux for the browser plugin, namely you can't operate it fully with the keyboard, with keepassxc you can
As as self-hoster, I recommend vault warden. Supports 2fa, written in rust, works pretty well, is easy to backup, and you can use bitwarden's phone client.
I'm curious why other self hosters think it's a bad idea.
>The source code is available for personal use only.
Not sure how switching from a "FOSS with some proprietary source-available components" client, that can be forked mostly intact if need arises, to a full proprietary source-available client, that author can make closed source at any point with no forks being possible, is an improvement.
Because people don't trust themselves to do proper backups as if this is some kind of black magic or something.
I've been self hosting Vaultwarden for me and my wife for years without issue. People like to tell others what they should and shouldn't do because they want to feel superior to others, I suppose.
It's especially strange since self hosting is, aside from the 'fun' aspect of it, about personal control. So this tsk tsk'ing from others about self hosting a password manager is especially ridiculous.
I moved to the cloud for a simple reason: if I die tomorrow people who depend in the service are screwed. And this is an important service, like email or digital archives.
For me, vaultwarden's RSS is ~45 MB, with ~13MB of that being shared. I have it running as a secondary thing on a 512 MB machine and don't notice it's there. Is there a reason you presume it's a memory hog?
For me, RSS 35 MB, SHR 23 MB. The vaultwarden executable is 38 MB (typical Rust executable that links Rust code statically, and only dynamically links libssl.so and libc.so dynamically).
So probably its RSS usage is just mostly its own executable code?
I'm surprised, actually. I expected at least an order of magnitude more. In my humble opinion, this is still a lot of memory -- probably an order of magnitude (or even two) more than what is realistically required for the task. But this is just my own philosophy, and I do realize that the days of careful memory utilization are long gone.
I don't see much reason not to self-host a properly built password manager like Vaultwarden or something similar? The clients keep a local encrypted copy of the vault, so the server only needs to be up for syncing. If it went down for a week, you probably wouldn't even notice unless you were saving new logins. And even if the server got hacked, everything on it is encrypted. Why do you think it should not be selfhosted?
Thanks, on these topics I feel like I’m fucking crazy for not wanting to self host.
If you believe that the technology works, that encryption is happening and that the decryption is only happening on your local machine then why in the fuck would I host this myself?
You need to believe that it does not work when they do it, but does work when you do it.
It works just fine when they do it as long as they want, that is not the point. For me self hosting is a mostly a question of independence and digital sovereignty. We've seen all kinds of service providers turn into garbage over time, so I'd rather not rely on a company that needs to extract as much money from me as possible.
So what do you think the threat is? That they’re skimming data off with their extension? That they’re going to close up shop and take your encrypted vault with them? That they’re lying and storing your master and then peeking at your vault?
In order for snooping to be true, the extension would need to phone home what you’re viewing and I think that would be a pretty big no-go with everyone.
In order for them to close shop and take your vault… do you have any serious reason to assume that might happen? I’m sure it’s happened with X or Y obscure company before. Does it seem likely at bitwarden’s size? Is this threat not just as equally remedied with your own paper backup?
There are a lot of ways they can make the service worse without doing anything illegal. I would not be not worried about my secrets, I would be worried about all other things they can do when they sit at my browser.
The top comment in the post has a blog post which already shows that they are hiking prices without proper notifications, etc. To me it seems that Bitwarden is in a state where the software is pretty much complete, and majority of further development will go into capturing more value.
While "enshittification" might not happen here, its a typical pattern and there are many early signs here. When you selfhost things that just work, you need to worry far less about it.
Like, there are just so many things they can do. Their plugin already knows where you visit, they can sell your visitor data if they want. They can just increase prices. They can start making stupid limitations that force you to upgrade. They can remove possibility to export your data, claiming its a security feature, making leaving as hard as possible. They can start spamming you with all new obscure features and some NPS surveys and what not. Nothing bad, but increases cognitive load.
If you don't mind the risk, good for you. It is great that everyone can choose for themselves.
Keepass people always in these topics with ”offline rules!! … now let me tell you how I use it with a copy on my phone and sync it with Dropbox and a backup on a git repo”
It should be something like, well, git (but likely not directly git): something that replicates easily, so that you'd have a remote copy accessed via internet ("hosted"), and local copies where you see fit.
Not sure if still the case but normally you have to not only 'sign in' but also feed them information (e.x. salary at a position, write a review, etc.) in order to be able to view much of anything.
They also do not give a shit about obvious 'juicing' (i.e. when it is obvious that upper management and/or HR is adding reviews where the 'con' reads like one of those softball warning phrases in a job description.)
This is the fate of every online review site. Every single one. Including IMDB as I realised yesterday while trying to find something to watch.
The most egregious example I've found was that the Danish postal service had something like a 4,8/5,0 rating on Trustpilot. You'll be hard pressed to find a more inept, corrupt and universally hated company. So in an attempt to improve their public image, they decided to game the ratings, instead of actually delivering mail properly.
Yes they can. But then you see which account as took part of the DDOS scraping, and delete all accounts that match the pattern and site gets back under control.
Fundamentally it's all a game of whack-a-mole for admins unless some kind of microtransaction system is invented. Then a DDOS scraping event is just extra revenue.
In the specific case of Glassdoor, leaving a review about an organization sometime requires a proof that you work there, e.g. receiving a pass code sent to a work email. I'd say that this is reasonable, and makes gaming the reviews much harder.
Today, Bitwarden works as the FLOSS extension client/app. Next year, maybe Bitwarden won't be, but we will still have the source for today's code which can be forked and carried forward. I like to think there are enough users behind Bitwarden that a fork would likely work out if it came to that. For that reason I'm not jumping ship yet.
I don't like the changes, but if someone wants easy access to all the Android phones someone needs to take responsibility for what gets published. (and naturally since it's mostly a sham we need to have some shell corporation, just as malware publishers already have.)
Time and potentially some filing/service costs. You may be able to claim some of those as well (When I almost had to sue for a security deposit, in that Jurisdiction I could get some filing fees but not service costs for whatever reason...)
That said, if they don't show up, you'll get a default judgement. And if TM doesn't pay, they can have fun with it if there is an office nearby. A while back someone got a judgement against a bank, they didn't pay out. He came by with the sheriff and they started loading up chairs/etc when they hesitated to cut a check. :)
Or, whatever other 'collection' action you may have to motion for after the fact if they don't pay.
At least where I live (Texas, United States) from what I saw it's allowed to have legal counsel, although it may be uncommon. I'll have to look into the process more and see if there's anything I can pursue.
I vaguely recall in california you can opt-out of arbitration within 30 days of a contract. don't know if there are details or if that is still the case.
> Legal counsel isn't allowed in small claims courts.
That's only true in a handful of states. Most allow you to bring a lawyer.
Small claims courts will generally have simpler and friendlier procedures so that even if a lawyer is allowed you will be fine without one in most cases.
I’d say brain drain is the root problem. It’s hard to build a competitive ecosystem when the most ambitious and skilled people move away. From Europe, they move to the US. From within the US, they move to one of a few cities, most notably San Francisco.
There is a brain drain because there are little to no opportunities if you are skilled and less skilled people keep trying to push you down the ladder. If you stop people from moving, they will grow discontent and will probably not be working in tech anyway and prefer a more sane environment. I don't think most U.S. people realize how bad, inefficient and crooked the tech scene can be in some countries.
In my experience as a founder, excitement to work in a particular area is way more important than experience/skills. Ideally you have both. But lack of enthusiasm for a product, especially a niche product, kills a culture.
Yes startups are all about building great products that users will love. But that love should be organic and authentic, not blind belief.
I suspect that this expectation is likely because most startups are actually bullshit products. Look at all the dumbass crypto startups and now the AI startups. Its become an institution that churns out crap so you need to be able to delude yourself into believing the nonsense to keep doing it repeatedly.
I’m pretty sure the opioid epidemic is the leading cause of death in the US. Enormous numbers of Americans are dying from fentanyl and other poisons, but the media doesn’t like to cover it and the Government doesn’t like to talk about it.
I have no sense of its general coverage in the zeitgeist, but this month the White House announced Overdose Awareness Week "to focus the nation’s attention on the devastation caused by illicit fentanyl and other drugs" and also announced funding for a variety of things to attempt addressing it. Their recap links to media coverage in a variety of sources.
Of course, people and front pages quickly tire of 'boring' things like that and unfortunately get more excited about other events prone to popping up in a large country.
Among young people it is currently guns, until recently was cars, and drugs is about half of either, but rising. Drugs has recently risen to be about the same as cancer.
"Poisoning was the leading cause of preventable death for all ages, combined, for the ninth consecutive year and was the leading cause of preventable death for every age from 22 to 68. This is largely due to the opioid epidemic affecting millions of people in the United States."
The leading cause of death among young people is not guns. It's not even firearm-related injury, which is what your link talks about. The thing at the link (it's not a study) you point to has gotten a lot of press. It is deliberately deceptive.
It uses an age range of 1-19, excluding children 0-1 years old and including adults who are in their 18th and 19th years. So sure, when you do this bullshit maybe you can produce the answer your audience wants to see / which will play well in the press / which will lead to clicks. But it's not honest. The honest statistic for the U.S. is 0-18(exclusive) years old, and when you do the honest thing you see that death by firearm-related injury is not the leading cause of death for minors in the U.S.
The deliberately deceptive statistic is driven by including as many 15-35 year old males as possible. This is the age range when males in gangs are extra killy.
I'm unhappy with a doctor playing games with statistics by manipulating the data, under the guise of actual science, in order to advance a political agenda.
Everyone should be unhappy with that.
But interesting you didn't comment on the other statements in my reply.
The US has significantly higher rate of car fatalities than peer nations, which you're correct in this case shadows its (far more significantly higher than peer nations) rate of gun deaths.
Unity seems to be attempting this in the most deceptive and deceitful way possible, establishing the new Runtime Fee and then offering a temporary 100% "waiver" of the fee if you use their other (presumably inferior) products.
As soon as the pressure fades, the waiver will be reduced to 50% and then eventually dropped completely - but of course the new fees will remain.
They must think the average game developer has no business sense whatsoever.
Based on the backlash, my prediction is that Unity either quickly reverses course (damaging their brand a little and perhaps costing the CEO his job) or stubbornly doubles down (damaging their brand a lot and giving Godot and others an opening to eventually rival them).
> Unity seems to be attempting this in the most deceptive and deceitful way possible, establishing the new Runtime Fee and then offering a temporary 100% "waiver" of the fee if you use their other (presumably inferior) products.
The Personal and Plus tiers in particular now need to basically find additional 50 or so cents per install (factoring in platform fees and publisher fees), whereas for Pro and Enterprise tiers that figure is closer to under 10 cents).
In other words, once you start having to pay the Platform Fee on the Personal or Plus tier, it very quickly becomes cheaper to just get a Pro subscription and have the Platform Fee go away for 800'000 more installs on Pro (on top of the 200'000 you get without the platform fee on Personal/Plus).
For Personal tier you start paying after 200'000 installs (threshold), whereas with the Pro tier you start paying after 1'000'000 installs (threshold).
That gives us 1'400'000 installs that we need to pay for with the Personal tier and 600'000 installs that we need to pay for with the Pro tier, for which the runtime fee will be calculated and which are above the corresponding thresholds.
For the Personal tier, which has a fixed rate, the platform costs are then:
1'400'000 * 0.20 = 280'000 USD
For the Pro tier, with the volume discounts, the platform costs are then:
If we assume that a publisher might take around 50% (just an example value in the spreadsheet I used; though in practice can be as low as 20%), then that figure becomes:
On top of that, there are also the platform fees (like Steam might take 30% of your revenue straight off the bat, other platforms might take less), so the figure then becomes:
Personal full cost (overhead): 0.5 USD
Personal after 30% platform cut: 0.5 - (0.3 * 0.5) = 0.5 - 0.15 = 0.35 USD
Personal after 50% publisher cut: 0.35 - (0.5 * 0.35) = 0.35 - 0.175 = 0.175 USD
Pro full cost (overhead): 0.085 USD
Pro after 30% platform cut: 0.085 - (0.3 * 0.085) = 0.085 - 0.0255 = 0.0595 USD
Pro after 50% publisher cut: 0.0595 - (0.5 * 0.0595) = 0.0595 - 0.02975 = 0.02975 USD (close enough to 0.03 USD)
While the exact percentages might change, Unity asking for say 0.20 USD per copy (or effectively 0.175 USD in the example, because the first 200'000 don't have the runtime fee) means that you'll need to make more gross revenue per copy than that, because your publisher and the platform will both take some of that for themselves.
> As soon as the pressure fades, the waiver will be reduced to 50% and then eventually dropped completely - but of course the new fees will remain.
I think you've got this wrong. Unity is (multiple really, but for the purposes of this) two products - the engine and unity ads. Unity ads is the money maker, this is an attempt at bridging that gap. Ultimately unity don't care how they pay you, they just want to know that if you're building a successful game off their products, they're going to get paid. They can't do a revshare (because for some insane reason they talked themselves out of that a few years back), so they're left with something that quacks like a revshare, but won't negatively impact their most profitable customers and force them to reconsider.
Ultimately, I think that's as far as they got with the analysis and failed to consider well... everything else.
> They must think the average game developer has no business sense whatsoever.
Any game whose monetization strategy is "ads" is uniformly trash-quality shovelware. They're not here for the long haul, they're here to optimize short-term profit and dump as much garbage on the app store as they can.
> They must think the average game developer has no business sense whatsoever.
Well if the reports are to be believed, developers were signing agreements with Unity which allowed them to make unilateral changes to fees. If so, devs really do have no business sense.
IANAL. In US contract law, a contract that includes a clause allowing one party to unilaterally change the terms at any time may still be enforceable, but there are limitations. Such clauses are often subject to scrutiny and may be challenged if they are deemed unfair, unconscionable, or against public policy. Courts may consider factors like the balance of power between the parties, the clarity of the clause, and whether there was mutual assent to the changes.
I'm not familiar with the specifics of Unity's usual contracts, but this is the kind of thing that a court might not take Unity's side on.
Probably very little. Are you implying that they were right to have signed agreements with Unity which effectively gives them controlling rights to the developers’ companies?
The Unity CEO and management team seem actively hostile to game developers. They view them more as adversaries than allies. Their first principle may be something like "How can we extract more revenue from our developers?" rather than "How can we make developers more successful on our platform [such that we all enjoy more success]?". I think that cultural value is the root of a lot of these tactical problems and missteps.
A couple of years ago the CEO called game developers "big fucking idiots" effectively for not extracting the most possible revenue out of the industry. There was the classic "well I actually meant [more innocuous but still dirtbag thing]" walkbacks, but we all knew what he meant.
It now makes a lot more sense when you view it from the perspective of Unity wanting to rip much more revenue out of devs and games using their engine.
He was saying not thinking about monetization during the creative process is idiotic in context of developers wanting to to do monetization.
As in don't tack on monetization at the end of spending years building out your big creative dream. Which is bluntly true, you're going to be in a world for pain.
Most of the talent from IronSource has left or checked out, and they started to slip in competitiveness and lose clients as a result. This pricing model seems designed to slow those losses, but if it increases developer adoption of Godot or another rival platform (other than Unreal), it seems like Unity is playing with fire here.
For point #1, it's the exit price that matters. Whether the exit takes the form of an acquisition or an IPO, is incidental. I've done both multiple times. Acquisitions tend to be faster, cleaner, and easier exits. IPOs are tough, and once public, you're often locked up.
>The E(V) at larger companies is awesome by comparison.
It's not just comp that's variable, but experience too. Fast-growing startups offer career opportunities that you'd rarely see at FANG. Even if your goal is to simply minimize risk and maximize upside, the optimal path is probably something like bouncing back and forth between FANG for the cash comp and fast-growing startups for the career acceleration.
Not to mention the type of people who thrive at early stage startups typically can't stand FANG environments, and vice versa.
reply