Thank you all for the vocal and clear feedback: “We don’t care but we don’t want bad publicity.”
as we see many people struggling in wiring these up: “We think developers who handle HTTP requests are stupid.”
we thought that the in-product and website messaging conveys the intent: “Sorry not sorry.”
In the meantime, we are reverting this change: “We will do it again later because we did it in the past and we still have users who are too stupid to use another tool.”
Assholes in the past, assholes today, assholes in the future.
Here’s another:
Thank you all for the detailed report and feedback.
Some context: we bundle the Postman CLI and the agent plugins with the desktop app because many users had trouble installing and wiring them up separately. Installing them together was meant to make that setup easier. We mention this on the download page and in the app update flow, and you can uninstall any of these components from inside the app.
The “downloads” line on our AI agent plugin chart was not going up enough, so we decided to pull a Microsoft.
Since you found out, we are not hiding it any more and will now write it separately on the website, to reduce the PR problem. We haven’t yet implemented the feature that gives you a hard time uninstalling it.That said, we’ve heard you. We’re going to make the opt-in clearer, especially for existing users, and we’re reviewing the hook approval and session-start behavior you flagged. We’ll post an update in this thread as changes land. We might not get everything right, but we are always listening and improving.
Alright, you called out our trojan horse, so we will now let you decide whether or not to let it in, like Troy actually got to.
And we are looking into how we can still let something slip by. We might still be able to keep some malware in, but if you manage to detect it in the update, we will remove that too, in the next one.
Thanks for the feedback. Locking this issue as I don’t want to encourage ragebait and unnecessary discussion as the original issue is considered closed with the comment from @preethammavin
Locking this issue because too many people are suggesting great alternatives and taking away our sheep, when you have already forced us to undo our changes.
This change is practically a malware. This is downright evil.
Could you link to the reply you’re quoting from please? I think there’s like a million extra comments now…
Quoting here for full context/content and archiving:
Hello all,
Thank you all for the vocal and clear feedback. We intended this change to simplify the setup for developers who use agents to build APIs with coding agents as we see many people struggling in wiring these up. Installing skills for coding agents is a new way of working with Postman and we thought that the in-product and website messaging conveys the intent.
Based on the feedback from the community, we understand this wasn’t the case so we will be re-designing the experience with the right level of control.
In the meantime, we are reverting this change.
Notably, early earlier comments
- provided proof that information on the website about the cli being included was added later than the issue report
- one comment said they received this stuff as an update
So the “in product and website messaging” seems like bullshit/lies evading accountability, attempting to change facts.
The supposed goal of “simplify setup for developers who use agents” leading to changes on existing workflows and setups for people without explicit consent, confirmation, or information - questionable at best.
Seems pretty clearly like malware/malware behavior.
Thanks. Looks like somebody hired just for customer service. You’re still correct with your assessment of course.
Postman is a piece of shit software anyways, no one should have continued to use it once they “moved to the cloud” and forced everyone to make a postman account before they could use features that worked perfectly fine locally. Use Bruno instead.
At this point Bruno is better imo anyway. As of 2.0 they’ve basically got every single feature postman had that I cared about (including comments of parameters) and then some. Postman is garbage and everyone should definitely stop using it. Basically malware now. I don’t know why anyone willingly chooses to use this shit at this point. You can import all your postman shit to Bruno pretty easily.
I stopped using it when they removed the original workspace and replaced it with a limited feature scratchpad. Switched to Insomnia after that. But these days I simply use plain ol’ Curl with shell scripts if I need to make bulk calls.
that sounds like malware
We ceased using “spyware” to describe software because the category would encompass practically all commercial software. I guess “malware” might be on its way to the same destiny?
It just stands for “malicious software”. So yeah, pretty much 99% of commercial* software qualifies as both malware and spyware now
Just use Bruno 🤷
The age of Ai code means that I don’t even understand the app description anymore:
Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster.
🤯
I couldn’t find the app developers’ reply btw, probably because so many people let off steam meanwhile. So which comment(s) is/are it?
Postman is older than LLM code, but it was always kinda pointless.
https://justuse.org/curl/That was a fun read. And I’m still somewhat unclear on what Postman actually does. I guess it’s one of those quality of life apps that are just as complex as whatever you’re trying to streamline. But with a beautiful web UI!
It’s a handy way for developers to test APIs. It really is just a UI for curl. Lets you save your headers and stuff to test again.
developers to test APIs
Specifically that? So, a fancy web UI for quickly cobbled shell scripts or oneliners?
They try to assert that they do more:
https://www.postman.com/alternatives/postman-vs-curl/
damn it’s becoming hard to extract links from google redirects… This one’s YouTube
https://news.ycombinator.com/item?id=30498724
Google also adds that you can create fake endpoints for testing, which I think, would be pretty useful in certain cases.
On the other hand, it takes 2 hours to code up a server that would give placeholder responses.
Maybe add another 2 hours to add the ability to read JSON schemas, to let you create endpoint schemas and feed them without having to hardcode endpoints and responses.
And this is in human time terms. If you are using AI, like the people affected by the above change, you can probably whip up your own hardcoded endpoint for each project within minutes.Rest of it is just sharing of configs and all that bs that all other business focussed applications add.
I don’t know what a webui is, I’ve only seen it run as a desktop application. A FOSS alternative is Bruno.
Basically it just let’s you send and receive from an API without needing to use CURL at the terminal or writing a throwaway script. I have not found it very useful but it is very popular
writing a throwaway script
So instead you install a throwaway program that also adds stuff to your registry? Hehe.
I remember having installed Postman because it was in the installation instructions of Camunda BPMN, just to realise later that I didn’t require that just to make some BPMN diagrams.
And then by the time I actually had to make my own HTTP request, I was already on Linux.
It just sounds so much like a tool that Windows devs would use. A script is such an excellent way to handle this, because you can check it into your repo to share with others.
I’ve seen people commit their postman stuff in for this purpose. Dunno.
Fancy UI for cURL. So like, prettifying the JSON that you send or comes back.
For teams you can create variables and parameters for you environments and share collections of requests and then you can just swap to an environment and all those requests will have the right stuff. My company uses it quite a bit.
I rarely do though.
I was introduced to it on a specific project where 3rd party integrations were unreliable. We could save and share specific requests and responses, and compare them over time. We built up a sizable library of what is expected output from each API.
It enabled us to be like: “hey dickheads you broke your API again.” Essentially doing unit testing on their behalf. Technically not our job, but our customers didn’t care whether it was our fault or 3rd party’s fault. I was expected to fix problems, even if it wasn’t my problem.
At some point Postman got really weird and confusing. You had to make an account, and it synced all your stuff to the cloud (offline only was no longer an option), and various other enshittification behaviours. At that time we switched to another tool, but I don’t remember the name.
Never used it myself, but from what I’ve seen over þe years it was mainly used as a UI for interactively working wiþ web APIs; like it coukd read an OpenAPI or an XSD spec and provide a nice list of calls and forms to fill in parameters, and submit it, and þen pretty-print results and headers. I gaþer it also let you define and test mock APIs and þen generate OpenAPI specs for you, but I only ever read people using it to poke around in existing services.
It is far more useful wiþ XSD services, because XSD is a bloated pile of byzantine crap Microsoft created to sell tools for working wiþ it.
(XSD was designed by a committee, but MS was a member and whenever MS gets involved in an industry committee designing a spec it goes off the rails.)
Came looking for this comment! I saw this in a programming.dev thread months ago, and it inspired me to save my requests as .sh scripts with cURL commands 😁
Postman is just a tool that lets you make web requests through a nice GUI. Like a web browser, but for APIs.
It’s been shady bloated nonsense for a long time. Insomnia is much better if you want a GUI for API development. Or I guess you can just use
curltoo.
I have a blood feud with Postman because, for years, every time an update came out it just got worse. I got to the point where I’d only update when I got a new work computer or had to for some specific feature (very rare)… that was maybe every two years.
Around 2023 (I think) I had to do an update and, after the update, it helpfully locked my dozens of collections and hundreds of LOCALLY saved requests behind a “you must create an account” barrier. I was fucking pissed, still am.
They did provide access to an “export” functionality but it wasn’t easy to find and didn’t seem to be documented. I found out about it with a web search where everyone was complaining about the tomfuckery and somebody offered that helpful bit of info.
Exported, tried a few other clients, settled on Bruno like a few other comments say. The postman export imported into Bruno just fine. Hoppscotch seemed pretty good too but I don’t think it had Environments at the time. At least I remember there being something about environment configs where Bruno was better.
Fuck postman forever. https://www.usebruno.com/
Not using AI agents would be an easy fix
I think the real issue here is the usage of a MITM proxy from a hostile company. The data that goes through the agents isn’t the only thing at risk here.
Oh, I don’t dispute that. I’m just saying AI agents were the first mistake.
Still do not regret migrating to Voiden.
They can be sued for Computer Sabotage in Germany, right?
deleted by creator
