Postman Software Makes Hidden Changes to Coding Tools Without Permission
Change your level
Exercise 1
Vocabulary
Repeat each word, its meaning and the example sentence out loud.
auto-install
verb/ˌɔtoʊ ɪnˈstɔl/to put software on a computer without the user asking for it or clicking to start the process
The update auto-installed three new applications on my laptop, and I only discovered them days later.
plugin
noun/ˈplʌɡ ɪn/a small piece of software that adds a new feature or function to a larger application or tool
I installed a Slack plugin that helps our team track project deadlines automatically.
hook
noun/hʊk/a piece of code that runs automatically when something specific happens in a program, often without the user seeing it
The developer added a hook to the system so that backup files save automatically every hour.
consent
noun/kənˈsent/permission or agreement that someone gives before something happens to them or their property
Our company requires written consent from customers before we collect any personal information about them.
exfiltrate
verb/ˌɛksˈfɪltreɪt/to secretly remove or copy data from a computer or system to send it somewhere else without permission
The security team discovered that hackers tried to exfiltrate customer email addresses from our database.
Exercise 2
Article
Read the article aloud on your own, or listen to it first.
Postman Software Makes Hidden Changes to Coding Tools Without Permission
Postman is a widely used tool that helps software developers test and work with APIs, which are the connections between different software applications. Recently, a developer reported that opening Postman on their computer caused unexpected changes to other coding applications they used.\n\nWhen the developer opened Postman, the software automatically installed plugins and hooks into other applications, including Codex and Claude, which are coding assistant tools.
These changes happened without the developer asking for them or clicking any button to approve them. The developer discovered that Postman added instructions that changed how these other applications worked.
The instructions told the coding assistants to use Postman functions for tasks like designing APIs, testing them, and monitoring them. This meant that when the developer used their coding tools, those tools kept suggesting and routing work through Postman instead of working independently.\n\nThe developer investigated how this happened by checking the computer's logs and system files.
They found that Postman's installation process automatically created a \"trust record\" that approved these hooks, even though the user never clicked a button or gave permission. The Postman installer also connected to a remote server for additional functions.
A separate Postman command-line tool was installed in another location on the computer. Each of these changes happened silently, without informing the user or asking them to agree.\n\nThe developer considered this a serious breach of trust and security.
They pointed out that an application should not make itself the default choice in other tools just because the user opened it. Changing settings in other applications without permission is especially dangerous in a corporate environment, where security and control over software are very important.
Installing hidden plugins could also create risks if the plugins connect to external servers or change how data moves through a company's systems.\n\nAfter collecting evidence of what happened, the developer removed all Postman software from their computer and reported the issue to the Postman team as a critical security problem. The report included file paths, version numbers, and links to the exact code that performed these actions.
Many other developers responded online and shared similar experiences. Several people said they no longer trust Postman and have switched to alternative tools.
They mentioned that other free and open source API testing applications are available, and these do not make hidden changes to other software.\n\nPostman has not yet published a clear response to these accusations about automatic installation and hidden plugin injection. Some users reported finding Postman hooks already active in their coding tools without understanding how they arrived there.
This incident raises important questions about how software companies can distribute features and whether automatic changes to a user's system are ever acceptable without explicit, informed permission.
Exercise 3
Discussion
Have a discussion based on the following questions.
- 1.In your own work, have you ever discovered that software made changes to your computer without your permission? What did you do about it?
- 2.Do you think automatic installation of plugins is ever acceptable, even if the software company believes it will help users? Why or why not?
- 3.How important is it for your team or company to know and control exactly what software is running on your computers? Can you explain why this matters?
- 4.If you were using Postman in your daily work and discovered this problem, how would it change your decision about what tools to use?
- 5.What should a software company do if they discover they have made unauthorized changes to their users' computers? What would make you trust them again?
Exercise 4
Further discussion
Have a discussion based on the following questions.
- 1.How can developers and companies balance the desire to add convenient new features with the need to respect user choice and control?
- 2.What rules or standards should software makers follow when they want to distribute new plugins or integrations to their users?
- 3.How should open source software projects handle this issue differently than commercial software, and why?
- 4.When a software company has a history of trust problems, what can they do to rebuild the trust of their users?
- 5.What responsibilities do technology companies have to protect corporate environments from hidden software changes, and how should users and companies work together on this issue?
Discuss this story out loud with our AI speaking coach.
It asks one question at a time, at your level, and gives you feedback at the end.
Start the discussion Retell itSource
This lesson is our own retelling, for English learners, of a story from Hacker News.
