[z64]

(I work at Kagi, but do not work on Orion)

There's a lot of different reasons that people ask for open sourcing of Orion / software in general; could I ask you to expand a bit more as to which issues being open source would address for you?

I can assume of course, but I'd rather listen to you articulate it, even if it's usual reasons.

[luma]

Single word answer: trust.

Y’all seem like nice people but trust isn’t automatic these days.

[z64]

Trust with regards to...? Orion doesn't have any telemetry, doesn't force any updates on you, doesn't require any account. You can audit the application's behavior with standard tools to verify that it isn't "phoning home", etc., it doesn't need to be open source to do that, nor would making it open source obviate auditig the final executable anyways.

What do you perceive as the risk to "trusting" Orion in this case?

edit: Sandboxing the app also further reduces the surface area for "trust", though I'm unfamiliar with MacOS as a platform when it comes to that.

[drdaeman]

Personally, I have some software engineering skills. For me it’s about trust in your development team and product direction.

To be at least somewhat certain of the future, I want to own critical pieces of software, not rent it from someone no matter how benevolent-looking.

While things are well, I want to be able to contribute. There are myriads of minor things that your development teams would never get time to look into. If something is a wart, I might have skills to do it myself and - hopefully - ask you to incorporate my patches. I did that to a few pieces of software I trust and use, and I consider the ability to do this as fairly important, even though I do this very rarely.

And if things go sour, it could be impossible to keep up with long-term maintenance of this complex machinery but I still want that option open too. I want to know that if you folks decide to do something unpleasant to the browser, I’ll be able to begrudgingly take over and still fully own the software at least while I’m investigating the replacement options. Not be at someone’s else’s mercy.

To be persuaded otherwise, I need to be aware about your reasons for not providing users software freedoms and agree they’re serving our mutual interests.

(Needless to say, Orion is a very different product from Kagi Search, which is why I apply different set of requirements. I can switch search engines much more easily than user agent software.)

[makemethrowaway]

It may not phone home now, but it can do it tomorrow, or it can in be enabled and immediately disabled in some minor releases. Even if people didn't catch those shenanigans immediately it will be evident from the commit history. I'd say opensource forces certain discipline.

Also there is point of rugpull, or the product is getting cancelled. Few people will step up to maintain it; atleast until most users migrate to a different product.

[hedora]

As a paying kagi customer that uses orion, I’ll just point out that there’s a reason “enshittification” was the word of the year recently.

Much of it had to do with testimony during the Google antitrust trial. It’s hard to understand how Kagi wouldn’t be ultra-sensitive to guaranteeing there will be escape hatches if it enshittifies. (Your funding model is a great first step!)

[yjftsjthsd-h]

> it doesn't need to be open source to do that, nor would making it open source obviate auditig the final executable anyways

It doesn't need to be open source to do that, but it really helps. Ideally you'd publish source and have reproducible builds, so that users could look at the code to see that it's not doing anything objectionable and a handful of people could make sure that that code matched the official binaries.

> You can audit the application's behavior with standard tools to verify that it isn't "phoning home", etc.

Can you? Practically? Lots of programs are easy: You put them in a sandbox with zero network access, or very carefully restricted access, and that eliminates 90% of likely problems. But this is a web browser; it's purpose is to connect over the network, all day every day, to arbitrary, dynamic domains in large numbers, such that I would seriously question whether it is in fact practical to audit in a black-box approach.

[jfindper]

>Orion doesn't have any telemetry, doesn't force any updates on you, doesn't require any account.

Source: "Trust me".

As another person mentioned, telemetry could be sent out Sundays @ 2:00am, so my use of standard tools to verify that it isn't phoning home on a Tuesday afternoon is useless. This is just one isolated example.

>it doesn't need to be open source to do that, nor would making it open source obviate auditig the final executable anyways.

Trust is not a single bit that is flipped from "Fully trust" to "Fully distrust". Things become more trustworthy when the source can be reviewed, and less trustworthy when an employee says "We don't do this, trust us, but we're keeping the box closed because ~reasons~".

In my eyes, Kagi has a lot of trust-building to do, despite being the darling child that can do no wrong in many HNers eyes (for whatever reason).

[cosmosgenius]

Browser handling is way more personal than any other piece of software. It need not be open source licensed but being able to compile and install it from source the exact binary (minus signing) is a huge plus is today's world. Otherwise is "not" doing much from chrome, brave, firefox etc of today. Open source would be cherry on top.

Trust of Kagi search is already there w.r.t both the tool and the company but it is not transferable to Trust to the Orion Browser.

[zamadatix]

It's relatively hard to audit a binary. You can audit the behavior of single runs, you can't nearly as easily audit the behavior of the program itself though. What if it pings only on Tuesdays, what if it does some sort of dns reach out that's a false positive for something else you didn't realize the browser was doing, what if there are platform specific differences in behavior.

The same goes for auditing the final executable. Open source gives two options on that: build it, trust it. The latter may seem 0 gain but, again, it is actually a big difference trying to audit a blackbox for every possible behavior vs seeing what the baseline behavior is supposed to be and looking if any differences occur in the premade binaries. There is a 3rd option: reproducible builds... but I doubt that's a reasonable goal in this case.

I'm not saying Kagi/Orion should necessarily care about providing that level of audibility, just that the response a pre-made binary is as trustable as a binary with its source code falls quite flat.

[inesranzo]

I think Kagi / Orion should go down the independent auditor route like TrailOfBits, Cure53 and others.

That way the software would be audited and it doesn't have to be open source.

[e12e]

Also trust that it won't be abandoned like Opera was.

[inesranzo]

Would you pay for Orion not to be abandoned?

There is Orion+ that can be paid for that keeps development going.

[e12e]

I paid for opera too :)

But, sure, I could imagine paying for a browser again - although I don't immediately see what features would be worth paying for.

For opera it was the custom, fast rendering engine and the email client.

Now with basically two equivalent rendering engines, I don't imagine performance in that area will be enough to pay for.

Maybe a smalltalk like developer mode with better debugger and repl support?

[tiltowait]

If it gets abandoned—so what? Switching browsers is trivial.

[klardotsh]

It really isn’t, and especially not when one of the browser’s unique selling points is its multi-browser extension compatibility that no other browser offers.

Also some of us simply don’t want to learn new UIs and/or risk dealing with an “AI” infused alternative if we have a tool that already Just Works. Switching away from Just Works sucks.

[carlosjobim]

It is completely trivial to switch browser. Anybody who doubts it can try it in this very moment.

[e12e]

The worst part about opera dying was the email client imnho - and it wasn't trivial to find a replacement.

I'm not sure what I'd seek in a browser I'd pay for - but it would be features not present or great in foss browsers.

Maybe email, podcast, rss client, a modal vi like browsing (like vimperator, but first class), a good reader mode/style override, proper editor for text input (like "it's all text"), automatic force support for select text, save as... for images)...

But whatever would be useful enough to pay for, would likely be a pain to lose.

[inopinatus]

By pushing back on someone over trust, you’ve eliminated the interest I briefly held in evaluating Orion. It would’ve been far better to acknowledge the concern than nitpick it.

[cipehr]

What? Since when was asking questions to clarify someones position considered "pushing back?"

Can you help me understand what about the questions make you uncomfortable?

I am completely unaffiliated with Kagi. I find it concerning that we've come to a world were we can't ask questions without it being taken as something hostile to the person/people/idea being questioned. Is that not what science is?

[inopinatus]

If you don’t think “you can just audit the binary with tools” is pushing back, then I don’t know what is, and especially so when you’ve framed the invitation with “I'd rather listen”.

I’m reminded of the number of times I’ve had vendors sit across the table from me and argue that our fixed requirements for <whatever> are just a preference or a nice-to-have. This generally doesn’t bode well for their prospects.

[cipehr]

Fair enough. I personally did not read push back in the questions/statements asked/made.

> Trust with regards to...?

I took this to be a good faith ask for clarification

> Orion doesn't have any telemetry... You can audit the application's behavior with standard tools to verify that it isn't "phoning home", etc...

I took this as a statement if what I could do, not specifically what I should do instead of getting it open sourced.

Maybe I read it with more good faith intention and curiosity than I should have. I see your point on how that could be perceived as push back, but I landed somewhere different from where you might have.

[rplnt]

> you can just audit the binary with tools”

That statement also said you have to audit binary even if the code is open source. Which isn't entirely true as other comments pointed out - reproducible builds - but the idea doesn't seem like pushing back to me. It was to point out that open source doesn't automatically imply any level of trust when it comes to security/privacy.

[inesranzo]

I'm assuming the people who are asking for Orion to be open source are not paying for it.

I think a blog post on Orion's transparency is enough. The fact that there is Orion+ is enough to warrant no need to have tracking or 'enshittification'.

If you like Kagi and Orion, supporting development by paying for it makes sense.

Open sourcing everything of Orion means that Orion+ will be open source which defeats the point of supporting development of Orion directly.

I've seen projects start open source, change to closed source and then add in the enshittification later. It doesn't matter if the code is 'open' the source code would eventually be unmaintained and have security holes which there is no time in the world for anyone else to maintain.

[0_gravitas]

> I'm assuming the people who are asking for Orion to be open source are not paying for it.

I think this is an odd/slightly-disingenuous statement.

I mean, I'm on linux, so I'm not, I'm happily paying for kagi though, and would pay for Orion+ if it was available to me :)

I would also very much like it if Orion was open source, it would make me feel a lot better committing to and recommending a browser if I had actual assurances it's behaving appropriately, beyond a company saying "trust me", no matter how nice/cool they seem at the time.

Honestly, I kinda wish Orion+ was the only option, I think having a free option (and the incentives that can create) is kind of antithetical to Kagi's whole raison detre.

[inesranzo]

> I would also very much like it if Orion was open source, it would make me feel a lot better committing to and recommending a browser if I had actual assurances it's behaving appropriately, beyond a company saying "trust me", no matter how nice/cool they seem at the time.

Kagi isn't 100% open source but you still use it and recommend it?

How do you know they aren't spying on the backend?

[zamadatix]

There's not really a reasonable local alternative to running something like Kagi, so one kind of just have to hope for the best with the least shady looking option or not use web search at all. It would be nice if they at least had a 3rd party audit validate their privacy claims... but Kagi is at least a step in a better direction than any common search option, even if they might still actually be spying on you for all you know (and keep that in mind if you choose to use it).

The same is not true of browsers, to the extent you can even build/use privacy conscious versions of Google's browser project because Chromium is open source! To trade that away for closed source on the promise of another company who was only able to build a browser because of an open source engine is an unnecessary step backwards and should be bothering people, as much as Kagi appears like the nice company for now.

[zamadatix]

> I'm assuming the people who are asking for Orion to be open source are not paying for it.

I don't know about the others, but I'm an Orion+ lifetime purchaser just because I like what they are trying to do and it's a good phone browser for my work phone. I'm not sure I follow why specifically people who pay are supposed to be uninterested in it being open sourced?

> If you like Kagi and Orion, supporting development by paying for it makes sense.

> Open sourcing everything of Orion means that Orion+ will be open source which defeats the point of supporting development of Orion directly.

Sure, one should support the development costs. Can you elaborate why you feel that relates to Orion being freeware vs open source or why it defeats the point of Orion+? The two aren't differentiated by functionality, Orion+ is a token of development support.

> I've seen projects start open source, change to closed source and then add in the enshittification later. It doesn't matter if the code is 'open' the source code would eventually be unmaintained and have security holes which there is no time in the world for anyone else to maintain.

Open source isn't a promise that the code will be maintained forever, nothing can guarantee that, it's a promise if the company decides to go closed source the community can decide what to do. Or, even if you don't care about that, a promise of easy/public auditing and hacking. Just look how many Chromium/Firefox build customization, UI tweaks, and forks people have made despite the possibility Google stop contributing to Chromium in the future.

[sedatk]

In return, could we ask Kagi to expand on which problems they find in open sourcing it?

[nicce]

Business model from Orion+ would likely take a hit in the long run.

[tucnak]

Only my 2c, but being able to modify commodity software (including, but not limited to browsers, text editors, etc.) I am running on my computer is table stakes.

[kachapopopow]

I think the bigger question is: why not open-source it? At bare minimum provide the debug symbols for it (even chrome provides them!).

[dartharva]

Linux distro portability without having to rely on third-party package management like Flatpak. I'd prefer there'd be independent maintainers and packagers for Debian and Arch and all others.

[crossroadsguy]

I expect a lot of people saying trust. My reason is simpler - a browser is not like an email service, it's not like an IM, it's not like a social network, not that these as FOSS wouldn't be better, but a browser is literally the most fundamental end-user software to access the Internet and I don't want to bother spending even 10 mins to support another browser that is not FOSS. This sounds harsh but I am not shitting on Kagi or Orion. While I have not much positive views on Kagi Search either, I understand that and accept that and hence I acknowledge that, but the closed-source browser - nope! In some twisted way it feels like paying public taxes to build a private road. It's not a great analogy, I know, but that's the closest I could come to in terms of a connotation.

[TingPing]

I would contribute to it if it was FOSS.

[warkdarrior]

Can't speak for OP, but open source allows the community to check for spyware inserted to exfil data to the company and its partners.

[redserk]

As much as I'd appreciate more open source for the sake of transparency, binaries provided on websites aren't guaranteed to match the source code provided and I'd assume most users are pulling binaries versus building themselves.

[goku12]

Practically every platform has multiple software stores these days and many FOSS stores make their build logs available. Some take it a step further and provide reproducible builds, which is more or less there as far as source to binary traceability and binary trustworthiness is concerned. These are good enough reasons to open up the source, ignoring the other advantages just this once.

[array_key_first]

This is true, and this is where trusted repositories come in.

I don't necessarily have to trust each individual app on fdroid or in the Debian repos. I have trust the maintainers are building them properly, and those people are not the same people developing the core app.

[stonogo]

The ability to do so provides some protection. If someone pulls and builds and cannot reproduce the binaries, they can at least try to get the word out. Closed-source prevents even the opportunity. Even source-available is better than closed.

[inesranzo]

Why would and what incentive does Kagi have to put 'spyware' in a browser?

[0_gravitas]

??? why does any company do it? Money?

[inesranzo]

Any company?

Don't you think if Kagi introduced spyware it would ruin their reputation quickly, why would Kagi want to quickly ruin that brand reputation?

The answer is that there is no incentive for 'spyware' on Orion as you can pay for Orion+ to support development.

https://kagi.com/onboarding?p=orion_plan

[zamadatix]

My concern is Kagi isn't/doesn't make as much as they need/hope to with their brand model. If they are ever disappointed in the results of building their brand, it's quite easy to see why they would be fine selling out.

Hell, WhatsApp started out as a privacy focused messaging app before selling out to Facebook/Meta. Now it's getting ads, nobody believes a privacy focus anymore, it's had a commercial message channel push, and so on. They are far from the first example of a tech company/product trading the mission/brand value for more money.

Bless the VLC developer for refusing offers for millions of dollars to put crap in VLC even though he knows the project could just be forked after and bless Gorhill for the same on uBO but the real trust in these things comes from the code being open source rather than faith the developers would never sell out.

[barnabee]

Sure :)

tl;dr: I'm a tinkerer, an idealist, and someone who wants to retain control over my digital life and deny influence over it to the likes of Google, Apple, Meta, et al. at pretty much all costs, and there are absolutely good enough open source options that I couldn't bring myself to use a proprietary browser unless I absolutely have to.

To elaborate…

First off, there are a few reasons I always prefer to use open source software:

- I like being able to open things up, see how they work, chops bits off them, attach other things too them, use them in unexpected ways and general use (and abuse) them however I see fit. After all, I can do that with all the physical stuff I own, so why not the digital stuff too…?

- Code costs nothing to copy and is trivial to copy perfectly. This means that the potential compounding benefits of everyone sharing not only their complete software products but individual libraries, algorithms, and solutions to common (and not-so-common) problems are huge. When we use and contribute to open source software we help build those benefits for everyone.

- Closed source code is always open to being abandoned or moving in a direction we don't care for with nothing we can do about it. When it's open source, the question is "will I submit a PR", or "will I maintain a fork" (even if just for me). When it's closed, the question is "will I build a replacement". These are not the same category of thing! I can start running a fork any time[0]. Building a replacement may take months or years, if it's even feasible. But there are individuals who run their own fork of my favourite text editor (Helix).

- I'm a big believer in the value of communities and efforts made primarily for the benefit of one's community rather than financial gain. Open source can act as a kind of insurance against the latter.

Secondly, I think this is all uniquely important for browsers because the web is so dominant and it's therefore so important to me (and I think to Kagi's mission) to protect that platform for everyone, for all time. Even though Chromium and Webkit are open source, Google and Apple exert huge influence and control through their ownership of Chrome and Safari. Firefox is better but even that project is not free of Google's influence, which is steadily making the web worse for everyone.

Kagi probably won't be the next Google, in that respect. As a long time payed user of Kagi[1], I really do believe they want to build a good browser that does not abuse an exploit it's users. But Google's motto used to be "Don't be evil", and many of us believed that for a while too. My point is not that Kagi will or is likely to become evil, it's that when Firefox/Zen, ungoogled Chromium, and maybe one day Ladybird and others exist, *I can't invest time, effort, and attention into something that could in theory go down such a path without the community even retaining the option to fork it[2]. This is especially true when using a closed source browser would also simultaneously weaken those more open efforts, however slightly, by subtracting from their community.

So there you have it. I hope that's helpful.

[0] Case in point: I've used Firefox for years. Sometime last year I start using Zen (a fork/derivative of Firefox) alongside it with no drama or fanfare. Now I rarely open Firefox.

[1] Honestly, I couldn't imagine going back. It's a genuinely excellent product and I believe the company is generally doing, and certainly trying to do the right thing.

[2] Just look at the cautionary tale/disaster that is Arc/Dia. For a while I was worried I was missing out on something special. Then Zen came a long and I worried less. Then the whole Dia thing… boy am I glad I didn't invest my time in that.

[z64]

Thank you!

[barnabee]

You’re welcome. Keep up the great work!