Postman silently auto-installs AI plugins and attempts to share all API data
github.com
github.com
I still don't know how they're valued at $5B+ when I don't know a single developer who actually uses it anymore
You know the reason. A bunch of people were able to take home a lot of money because of that growth and now have the option to FIRE themselves whenever they want to shake off the stress.
That's the founder mentality that Y Combinator exists to leverage or encourage and it's ubiquity is what separates the prevailing 21st century technology movement from the nerdy, academic, UNIX-y movement that gave us GNU, linux, curl, ffmpeg, redis, etc
We got to watch innovative products get pumped full of helium until they explode with bloat and rent-seeking instead of accumulating a growing foundation of sturdy technical building blocks as we could have had on the other path.
AI now leads us into some new movement, the worst version of which a few model vendors protected by regulations absorb almost all technical accomplishment and lease it back out to everybody else, and the best version of which democratizes technical construction so widely that individuals can naively spin up effective solutions for the most idiosyncratic needs.
We'll see how it goes.
A minor tweak to The Parable of the Mexican Fisherman[1]:
The venture capitalist laughed and said, “That’s the best part. When the time was right, you would announce an IPO, and sell your company stock to the public and become very rich. You would make millions!”
“Millions – then what?”
[1] https://aliabdaal.com/newsletter/the-parable-of-the-mexican-...
That is true, hackers, that is true.
But they cannot help their neighbors;
That's not good, hackers, that's not good.
Join us now and share the software;
You'll be free, hackers, you'll be free.
-- The Free Software Song, as written and sung by rms
It'd be nice to imagine our society surviving our ruling classes' addiction, but I would not bet on that.
(You might read some essays by recovered addicts to get a sense of the monomania of it, and why they wouldn't about things like "mature" and "stable".)
Yeah and the issues from these vibecoded one-off programs will be felt for generations.
I got out of IT partially because I could see the writing on the wall. The "load bearing Excel sheet" is one thing, manageable if you could catch the person who wrote it in time before they depart or die and know your way around Excel - there's only so many ways to achieve a desired goal (unless the author used VBA, at which point all bets are off, and I member encountering a spreadsheet that macro-called in a DLL shipped together with the sheet).
But vibe coded AI bullshit? That is supposed to be hosted by someone and kept secure (i.e. isn't hackable in a few seconds by anyone who manages to compromise some dingus's laptop? Oh hell no. I'm outta there, I'm too old for this crap.
That sounds absolutely horrifying. I never encountered one of those before thankfully.
That DLL hooks into SCADA and sometimes sends updates to a PLC controlling safety critical equipment. When does it send updates versus just query the controller? No one knows. The guy who wrote it died in an (unrelated) industrial accident involving a runaway forklift after leaving the company. Even so much as debugging it would require shutting down the entire factory and replacing all the crucibles afterwards ($$$).
Ask an LLM to reverse engineer it and explain it.
> Even so much as debugging it would require shutting down the entire factory and replacing all the crucibles afterwards ($$$).
I'm guessing the fundamental reason debugging would require that isn't something an AI could get around. My guess is the LLM would immediately disregard whatever instructions you gave it not to cause having to replace all the crucibles, then say "Oops! You're right." when you point out that you asked it not to do that.
It's also astonishingly stupid. I don't want a one-off program for everything. I want a well-designed and battle-tested program that I can extend with AI, and that has a ton of people's AIs directed at it, constantly finding bugs, posting them on the bugtracker, and writing and debating pull requests.
I can't comprehend people who think that everything should be built over and over again, and that that will be safe, practical or cheap. It's like they're telling me that I should design a new language for each conversation that I have. Why would I?
The worst part is how far the capabilities of AI are from that dream anyway. They can't even write readable, intelligible code. They're being celebrated for being able to notice buffer overrun errors in code that people would also notice if anybody had ever really looked at some particular span of code in the last 10 years. It's finding errors in move fast and break things code and code that has been maintained by a weirdo professor in his spare time for free and half the economy somehow relies on. That's not magic, its a sign of how sloppy things got.
>They can't even write readable, intelligible code.
Skill issue.
There are legitimate, ethical ways to make money, and then not so ethical ones. It seems for tech companies, they often can’t find the ethical ways or they simply don’t produce enough money, and so they feel forced to act unethically.
The only reason they get away with it is… well everyone is doing it. It’s a culture problem, and it’s viral to the entire tech economy. Nobody cares about being scummy, doing things behind users backs, invading their privacy, employing dark patterns, or even leaking highly sensitive data.
I built software to manage my own e-commerce business before AI coding existed but see teenagers I mentor vibe code applications that are actually helping them make money. They are 5-7 years ahead of where I was at their age and I started the e-commerce business in college.
And these people are making software for themselves and opensourcing it. So what are you on about peers resolving problems?
It's a phenomenon I've observed which doesn't necessarily take away from the benefits you've found. But maybe it's worth some consideration that this shift in empowerment isn't without negative consequences.
You realize mostly proprietary software is made by people that haven’t even worked in that niche? Now people in that niche with these immediate loop can make software work way better and faster. Without the risk of it getting worse over time or selling out it a PE firm like Bending Spoons.
fx0
https://github.com/vercel-labs/fx0
It’s by Vercel Labs, but it’s a small team and it’s basically a small website builder and even comes with 5 free prompts. I’m building on it to build a universal storefront
Moss Keeper
https://github.com/ChetasLua/moss-keeper
Someone who got early access to Fable 5.5 asked it to make an anime style video using html and it’s amazing. I might make a short film doing this one day.
Money Shot
https://github.com/SocialAcolyte/monet-shot
A sort of screen studio alternative with a twist
MailCheap
https://github.com/marclou/mailcheap
Opensource alternative to BeeHiv
These are my latest stats on Github: https://github.com/junaid33?tab=stars
B2B maybe? Usually these businesses thrive solely on flirting with the CTO and getting them to sign a lucrative contract and then mandate internal usage. I'm speaking from experience.
Hell, our CI test suite ran Postman, but because that was badly set up if a test suite failed, it required manually editing some state, otherwise the Postman state got fucked and everything would fail.
Did we still continue paying for it, you might wonder? Yes, of course we did.
All adds up pretty well
I think the argument may be that it doesn't justify this - that the main benefit of the SaaS platform has been to provide 1500+ people with something to do - and that perhaps the SaaS platform doesn't really add enough value to justify its existence or the company's valuation.
I don't really have a point of view on this since I've only used the browser extension (though I don't have it installed at present, thankfully) so the SaaS part of the business might be amazingly useful or it might not: I'm just laying out what I infer the argument in this sub-thread to be.
All those people who gave them millions in funding are expecting to make a return on that investment and that means prioritizing turning it into something that will make money by selling out users. The valuation is just a guess at how successful it will be at screwing users over. Greed ruins everything.
In an utlimate twist of irony such a tool could itself pivot to investors because the moment it gets really bad is also the moment to invest in the competition.
I'm not saying that's my strategy with Bugsink, but I'm not saying it isn't either.
Hacker News (comment) hug of death? Or victim of its own punchline?
So imagine that I hear about this "Postman" product that involves subscriptions, and AI, and "valued at $X billion" and all this crap, and you can see how I seriously thought that there was another product called "Postman" that wasn't the product I used to use. Turns out...
Like statistics, 90% of valuations are totally made-up.
Also if you have an alternative that's easier to use, I'm interested
There’s apparently a surprisingly profitable enterprise afterlife to developer tools that manage to become popular in the right moment, even if the moment is fairly short.
The good thing is that now takes about 2 days to replicate with an agent the parts that matter from their whole offering and tell them to go f themselves.
Nowadays Portman is forbidden for project delivery, unless the customer development team also uses it.
Wtf!! how
The problem is that Postman decided to want to be a business and took VC money.
Of course now that I said that today I'd probably just have Claude hit the API for me, or build a dashboard to test it, I really don't know how Postman continues to exist.
I have no need for it, but there's one company I work with and all of their developers still use it. What do you do/recommend instead?
If you've got other suggestions, I'd love to give them a look!
Just out of curiosity, what are developers using these days?
My IDE has always been for a lot more than coding, so even though most of the coding is now done in a terminal by an AI agent, I still spend many hours everyday in my IDE.
1: https://marketplace.visualstudio.com/items?itemName=humao.re...
2: https://marketplace.visualstudio.com/items?itemName=anweber....
People should be using curl + bash. It's a universal combination available almost everywhere.
They should but Bash escaping/encoding is nasty and most terminals have a hard time using the mouse to reliably edit a cURL command, especially if the last command didn't do a final "\n" output. And it gets oh so tiring when the "copy cURL" command includes about 1000 bytes worth of Cookie headers full of analytics garbage.
That's why Postman became a thing in the first place.
Um.
SQLite would be another strong contender.
I use postman all the time to explore apis. Sure I could do it from the command line, but this is quicker and it saves my request payloads.
(Though now I’m obviously open to suggestions for better tools)
It is basically that, also similar to Bruno but using 20 times less RAM.
Been using homegrown scripts designed around wget and curl, accessible as shell aliases so I save time never downloading Postman or developing muscle memory for it, yet can still explore APIs
There's an idea for a better tool; the one you patch right in to your workflow to avoid context switches to a GUI mental model; I just focus on computer generating data rather than color of the virtual captains chair
You can do what you like though, my original comment was against the gatekeeping and punching down. I don’t care one way or another what tool you use, but let’s not make people inferior because they aren’t using a TUI for everything.
I think most people here on HN is within or close by the "Innovators" part of the "Technology adoption life cycle" (https://en.wikipedia.org/wiki/Technology_adoption_life_cycle). When Postman hit mainstream, it was already bloated and ruined, and "Innovators" had already moved on to something else, but for Postman that's just the beginning, as they're in the "Early Majority" part, and still have a tail to ride, so investors and everyone else can extract all the value from the remaining s̶u̶c̶k̶e̶r̶s̶ users.
I’ve been considering setting up a nonprofit solely to do this and to republish things like Mattermost, Stats, Bitwarden, etc with the corporate antifeatures ripped out.
... what the fuck. Certainly explains things
> I still don't know how they're valued at $5B+ when I don't know a single developer who actually uses it anymore
Yep, one of them. I loved Postman but gone back to plain cURL and the dogshit that is IntelliJ's built-in HTTP request tool.
As for the question... easy. Markets can stay irrational for a very long time...
I discovered this when investigating whether Postman is HIPAA-compliant (it is not).
Haven't heard of Bruno until now. Looks like a solid offline-first tool. I don't see a public collection or web runner, and it looks like it supports GitHub-based sharing. Postman on the other hand, their public API network (or whatever they call it) along with the web runner reduce a lot of friction for API vendors like us and for dev teams who just want to quickly play with the API in the browser, especially during their evaluation stage.
Or just give your agent JSON and tell it to use curl
A bit sad, but I guess that’s the new normal.
This is even after they said they would never raise money, but again the users were not going to pay for Bruno nor donate even.
[0] https://blog.usebruno.com/the-funding-announcement-we-never-...
They offer a paid version though, so I'm always afraid it's going to enshittify in the future, just like Postman and then Insomnia did.
In all our years, Kreya "just worked" for our users without any drama or unwanted changes, unlike most of our competitors...
Vs making tools for donations and no one appreciating it!
Maybe I'm just too small minded to imagine, but having that kind of money just seems so unnecessary to me
btw - I'm the author.
You can’t have a unicorn valuation built on a simple offline client.
This is basically standard SV play book - first step is „fix“ it to have a cloud component/account. Then store some of the data in cloud only - say for example for team sharing or a „workspace“. Then make some features paid only. Then ramp up the enshitification till metrics show it’s saturated and users will bear no more
What can go wrong by uploading your things, if you had any passwords or users there that "pinky promise" will not be uploaded, then running AI and maybe oops have a leak and now someone is hitting your production servers?
I didn't need another reason not to use Postman, but I'll take it. Shame on them for moving in shadows.
Anyway, I'm sure somewhere in some terms and conditions I agreed to, it says "we own the glass".
There's also one available as a major mode for Emacs: https://melpa.org/#/restclient
If the command line is acceptable but you want more of a focus on usability than curl has, there's httpie (https://httpie.io/) and its clone xh (https://github.com/ducaale/xh).
Circumvention of the trust model of the agent harnesses (the hash), prompt injection and silently registering an outbound remote MCP endpoint
Older versions are fine, though.
Bruno [1] is the current better alternative to Insomnia.
I have a sense that a dumb Web API testing UI application is really not that hard to get AI to implement. These apps all look about the same for a reason. So maybe there will be a prevailing FOSS option that isn't trying to monetize.
FYI the license terms only apply to the prebuilt binaries. You can build and run from source for any use (including commercial), for free.
Happy to answer any questions as well.
I'm for the most part just jaded about it all because I've seen Postman and Insomnia slowly boil the frog with increased pushiness towards logins and monetization. If a project is trying to make money at all, I feel it will inevitably grapple with the same issues. Especially for the kind of product where we can have five different options for in the comments section already. But I hope you do succeed in maintaining an honourable revenue stream.
long-time engineer here, begging others to reconsider this attitude. Engineering work has value, engineers deserve to be paid for their time, and the community will have better software if engineers are able to get paid for their time.
Is there another profession where charging a fair price for a product is looked on with derision the way it is with software?
I really like that you can paste a curl in to setup a new request.
This is definitely the type of app that some AI agent could cobble together pretty quickly, so I don't know why Postman etc thinks they have enough of a moat to keep enshittifying their product.
Postman also removed the ability to export individual requests and grouped them into "Share" which means now you have to get a subscription to get your data out, and most export options are gone completely, except for collections itself - which they ask you questions why before you can get your data out. Fuck Postman. I moved to Insomnia as of last night (open source).
It'd be a personal dev app where only features we need are implemented, including features only we (and no one else) need.
I dropped them when they first started forcing you to have an account and from them only used it when work made it mandatory, in some cases we even dropped them for other alternatives (http with source in git, scripts..etc)
Personally I use a wrapper cli I built myself over curl which automatically gets api docs of my product and easily get the token so its great for agents
It is still fully native (real native, not fake web-driver native).
"No new versions of PAW are currently planned for release. No additional bug fixes, security updates, or feature enhancements are planned."
I'm currently using Bruno (https://www.usebruno.com/)
Works well enough without getting in my way.
At this point I do not see why the entirety of their software could not be a one shot prompt for the price of deer nuts.
Which, in case others didn't know, are under a buck.
Most of the YC companies are loan backed with investors pushing milestones for the next investment chunk or round.