Tell HN: Don't use Postman, they proxy your info without your permission

Posted by neya 2 days ago

When you send a POST request to your server, you think you're sending the information to YOUR server, right? That was the default behaviour - as it should be. After updating the Postman client, I noticed Postman also sends the request to their internal servers, which then sends your server the actual request (proxying). I thought I was paranoid until another commenter confirmed the same (https://news.ycombinator.com/item?id=50358055). It's fucking annoying that something called POSTman does anything but that. Please don't use Postman for anything sensitive. It's borderline spyware, especially when you didn't consent to this behavior.

Comments

Comment by thorin 1 day ago

First I've seen of this, thanks HN. Almost every SAAS I've worked with this year has used Postman or offered a Postman collection, so a bit surprised this isn't more widely appreciated.

Is Bruno the general replacement now, for general purpose / enterprise users?

Is this only an issue with the web version, rather than the desktop client?

Comment by vunderba 20 hours ago

I've been pretty happy with Yaak [1] for a couple of years at this point. It's got some opt-out notifications, but they can be easily switched off.

It was also pretty easy to export my Postman stuff and import it directly into Yaak.

I've heard about issues with telemetry in Bruno, which apparently still phones home regardless of user preferences. [2]

Obviously both being open-source you can just fork and rip out the telemetry though.

[1] - https://github.com/mountain-loop/yaak

[2] - https://github.com/usebruno/bruno/issues/337

Comment by nikolasdimi 1 day ago

[flagged]

Comment by vocatan 2 days ago

Absolutely abysmal situation. Postman has lost my trust.

Comment by ironmagma 1 day ago

Hurl was always my preferred tool. Very dumb, very Unixy. Then there is Insomnia, and HTTPie. Really no reason to use Postman.

Comment by Adil_Ali 20 hours ago

hell no, just did some digging after reading this, unfortunately you are right. Goodbyes to Postman

Comment by gnabgib 2 days ago

Gigantic discussion (1084 points, 10 hours ago, 359 comments) https://news.ycombinator.com/item?id=50354960

Includes suggested replacements, lots of bots, accounts saying enshittification. The whole nine yards