Selfhosted

59923 readers

551 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

133

Vaultwarden update (security!) (github.com)

submitted 2 months ago by megaman@discuss.tchncs.de to c/selfhosted@lemmy.world

8 comments fedilink hide all child comments

Vaultwarden update out as of ~15 minutes ago, includes security updates.

It says "unconfirmed owner can purge entire organization vault". That seems probably not great, so updating is probably a good idea.

you are viewing a single comment's thread
view the rest of the comments

[–] TVA@thebrainbin.org 17 points 2 months ago (3 children)

Updated mine, but, realistically, I don't think most of us are directly exposing our VaultWarden instances to the internet ... I can't imagine I'm all that weird by only exposing it over VPN for remote use.

[–] TrumpetX@programming.dev 12 points 2 months ago (1 children)

Isn't that there point though? Remote synchronizing?

[–] mpramann@discuss.tchncs.de 8 points 2 months ago (1 children)

That's why most use a VPN.

[–] TrumpetX@programming.dev 10 points 2 months ago (1 children)

I understand why some would do this. It's definitely a more secure setup, but I highly doubt "most". I like having passwords on my work laptop. I couldn't sync there with a VPN, for example. My wife, kids and parents aren't going to run VPNs on their phones, etc.

[–] mpramann@discuss.tchncs.de -1 points 2 months ago

Vaultwarden is specifically used for self hosting. Setting up a Wireguard VPN on your server at home can be tricky in specific instances. Most of the time it's dead simple though. Installing a Wireguard Client on your mobile devices is as simple as scanning a QR code. And to be fair: If you're going to expose the Vaultwarden instance to the internet why not just use the official Bitwarden service then? I'm sure they can handle security better than someone who has trouble setting up an VPN server.

[–] MCHEVA4EVA@lemmy.world 11 points 2 months ago

I have it exposed with a 2FA it seems fairly safe.

[–] oyzmo@lemmy.world 3 points 2 months ago

True! Good and relative safe on my Tailscale network. The only thing I`m brave enough to expose to the big and scary internet/botnet is my little Pi running Headscale, and I've put that on a separate network.