Kushan

To be fair, not to defend the CEO at all but when this story first broke it was so wild that you knew someone had to be making up some serious bullshit but it was just so out there, it could have been either side.

Why anyone decided to pick sides is beyond me, this is why courts exist.

It was a couple of weeks ago for me but I managed to get my docker compose script for all my infrastructure cleaned up and all versions of containers are now pinned.

I have renovate set up to open PR’s when a new version is available so I can handle updates by just accepting the PR and it’s automatically deployed to my server.

Nice and easy to keep apps up to date without them randomly breaking because I didn’t know if a breaking change when blindly pulling from latest.

Absolutely! Here’s my CI pipeline, it’s actually super basic: https://gist.github.com/neoKushan/bd92031bb9c8db3320e8c19d5dae3194

Happy to answer questions if you like.

I just added my compose files to the repo, that CI file and set up renovate https://github.com/renovatebot/renovate to create my PR’s for me.

I generally agree with the sentiment but don’t pull by latest, or at the very least don’t expect every new version to work without issue.

Most projects are very well behaved as you say but they still need to upgrade major versions now and again that contains breaking charges.

I spebt an afternoon putting my compose files into git, setting up a simple CI pipeline and use renovate to automatically create PR’s when things update. Now all my services are pinned to specific versions and when there’s an update, I get a PR to make the change along with a nice change log telling me what’s actually changed.

It’s a little more effort but things don’t suddenly break any more. Highly recommend this approach.

From the paper itself:

We had a video-conference and numerous email exchanges with Bitwarden. At the time of writing, they are well advanced in deploying mitigations for our attacks: BW01, BW03, BW11, BW12 were addressed, the minimum KDF iteration count for BW07 is now 5000, and their roadmap includes completely removing CBC-only encryption, enforcing per-item keys and changing the vault format for integrity. On 22.12.25 they shared with us a draft for a signed organisation membership scheme, which would resolve BW08 and BW09. At our request, to maintain anonymity, they have not yet credited us publicly for the disclosure, but plan to do so.

I didn’t look at the response to other Password managers, but the gist here is that the article is overblowing the paper by quite a bit and the majority of the “issues” discovered are either already fixed, or active design decisions.