Hacker News Reader

> The plan is however to open source when Orion is self-sufficient (business model of Orion is you are the customer and can pay for it - like we used to pay for browsers 20 years ago before advertisers started paying for our browsing), meaning it can sustain its own development independent of Kagi Search.

Orion will never reach "self-sufficiency" as long as you don't actually charge for Orion. Orion is completely free to use. I can donate to Orion+, but Orion+ offers no paid features; it's basically a Patreon. https://help.kagi.com/orion/orion-plus/orion-plus.html

(No major browser has ever sustained its own development independent of a search engine's funding, not even Netscape, which charged $40/seat in the 1990s, with a free "shareware" tier so generous that hardly anyone paid. Netscape was funded by advertising, especially from Yahoo search. Funding browser development entirely on donations to a commercial business would be completely unprecedented.)

What if, instead, you made Orion "source available" to paying customers, but not open source? You could merge PRs only from users who sign a CLA. (Users would file PRs out of charity, for the same reason they sign up for Orion+ today.)

I'm a kagi user, and as many have said, I will not use Orion until it is open sourced.

I understand your position, but a web browser is so important a software that it must be open.

I also think that you can still sell it even if it is open source.

Also, you might be able to secure funding from governments that want to move away from closed source solutions.

Anyway, still congratulation for v 1.0, and I hope it will go well.

> Also, you might be able to secure funding from governments that want to move away from closed source solutions.

people with no skin in the game trying to sell bridges.

I would ignore the haters, keeping Orion proprietary makes the most sense for being able to successfully charge for it as a commercial product. You can't sell an OSS product, only supporting services, as many many startups have realized and been forced to relicense to much anger within their respective communities.

And when the market is going to be primarily technical people I don't think you can trust them/us with source-available either as hackers with a strong aversion to paying for software thinking themselves clever will make and distribute bootleg builds with the license checks removed. Then you'll have to spend your time finding and DMCAing them which will only make people mad. Best to avoid it entirely.

I appreciate you/Kagi actually thinking about building a sustainable business in contrast to companies that open source their core competency and then fail to make money later.

Source: happy paying customer and user of Orion.

> managing an open source codebase of this size would add real strain to our small team

Can you please elaborate what do you mean when you say this? This is something I do not understand. How licensing terms affect your codebase management beyond setting things up so the code is available to users?

Publishing something under a FLOSS license doesn’t mean anything except that you grant end-users certain rights (the four essential freedoms). The rest (like accepting patches or supporting external developers) is customary but by no means obligatory. You don’t have a capacity for it - don’t do it, easy. There are thousands of developers who do that - they just dump whatever they have under a nice license and that’s it.

Unless you’re saying your legal department doesn’t have capacity to handle licensing concerns, especially if you’re using or potentially using non-FLOSS third party components. That I can totally understand, it could be pretty gnarly.

Please don’t be mistaken: Free Software is a purely legal matter of what you allow users to do with your work - not some operating principles or way of organizing processes.

Note: All this said, I can understand that you may not want to grant some freedoms to the end users, particularly the freedom to redistribute copies, because this could affect your plans of selling the licenses. But that’d be a whole different story than codebase management concerns.

> you’re saying your legal department doesn’t have capacity to handle licensing concerns

My read is their legal department isn’t fleshed out enough to defend the work when e.g. a tech giant steals it.

What’s the threat scenario and “defense” here?

As I wrote, If the concern is that they cannot figure out a way to distribute it as paid software as others may redistribute it for free, that’d be a valid point of concern (and there are plenty of options). But that’s not what they’re saying.

> What’s the threat scenario and “defense” here

Someone steals their work. Violates the license. To defend their rights Kagi has to sue or lay down. Not giving away the keys to the kingdom until that ability to defend is established just underlines that they're doing valuable work.

Pardon my skepticism but I don’t believe that’s a realistic threat model. Yea, purely hypothetically that could happen. But realistically, why would someone do that - what’s the point? Especially so it’s severe enough to warrant a serious legal battle that takes more than a few sternly worded DMCA-like emails to hosting providers?

Mind you, if we’re talking about hypotheticals, someone can ship a differently branded or malware-ridden (or idk what else, my imagination runs dry pretty fast here) version of their binary distribution without any source code access just fine, violating licensing all the same. Patching unprotected binaries is pretty easy, frequently much less demanding than building from source. And with all due respect to the good work they’re doing, I highly doubt Orion team needs to buy a Denuvo license, haha.

(And, as I said, it’s not even remotely what they wrote.)

For example:

If it is open source, it will end for in LLMs and will be used in other browser variants (bigger and smaller). Any USP of the code itself will be gone.

What’s this “it” are you talking about, exactly?

If LLMs hoover up removal of auto-shipped telemetry (currently the main selling point) then I’d say that’d be a reason to publish and submit this to every indexer imaginable ASAP ;-) Shame it’s a bit of absence of code so it’s nor really possible to submit anywhere.

And other features are worthy because they’re implemented ideas, not because of their actual implementations. Like programmable buttons or overflow menus - I’m pretty sure there’s no secret sauce there, and it’s extremely unlikely one can just grab some parts of that and move it to a different product - adapting the code from Orion’s codebase would likely take more effort than just implementing the feature anew.

Most code is just some complicated plumbing, not some valuable algorithmic novelty. And this plumbing is all about context it lives in.

The value is usually not in the code, but in the product itself. Some exceptions apply, of course.

> What’s this “it” are you talking about, exactly?

Orion's code.

LLMs facilitate the attribution-free pillaging of open-source code. This creates a prisoner's dilemma for anyone in a competitive context. Anything you build will be used by others at your cost. This was technically true in the past. But humans tried to honor open-source licenses, and open-source projects maintained license credibiilty by occasionally suing to enforce their terms. LLMs make no such attempt. And the AI companies have not been given an incentive to prevent vibe coders from violating licenses.

It's a dilemma I'm glad Kagi is taking seriously, and one the open-source community needs to start litigating around before it gets fully normalised. (It may already be too late. I could see this Congress legislating in favour of the AI companies over open source organisations.)

> Most code is just some complicated plumbing, not some valuable algorithmic novelty. And this plumbing is all about context it lives in

Sure. In this case, it's a WebKit browser running on Linux. Kagi is eating the cost to build that. It makes no sense for them to do that if, as soon as they have a stable build, (a) some rando uses Claude to copy their code and sell it as a competitor or (b) Perplexity straight up steals it and repackages it as their own.

You don’t need a LLM to just copy their code as a whole thing. Copying and rebranding (plus some vendor adaptations) is a valid concern that I have already agreed about, but for the third time: it’s not what they wrote. Has nothing to do with codebase management.

And taking some individual pieces may sound problematic as an abstract concern but have you ever tried to adopt code from one FLOSS codebase into another different one? Especially UI code, if it’s not some isolated purportedly reusable component? Maybe Orion developers are wizards who wrote exceptionally portable and reusable code, but usually in my experience it’s a very painful process, where you’re constantly fighting all the conceptual mismatches from different design choices. And I’ve yet to see a LLM that can do architectural refactoring without messing things up badly. So I’m generally skeptical of such statements. And that’s why I’m suggesting we pick a concrete example we can try to analyze, for doing this on highly abstract “the whole code” level is not going to succeed.

It's the strain of dealing with FLOSS freaks, who are by far the most annoying and persistent people to have ever walked the earth.

Thanks for responding. Orion on iOS with extensions has been outstanding.. looking forward to linux version.

Which extensions do you use? I was never able to get them to work. d reddit redirect, for example, never once redirected a reddit link to old reddit.

The big one being ublock origin

My experience is that one doesn't actually work, though the built-in ad-blocking does work quite well.

Doesn't actually work: https://news.ycombinator.com/item?id=46555554

I've found a few that work but many can be buggy or non-functional, just depends on the extension. The only one I use currently is called "Control Panel for Twitter", which seems to work pretty well.

earlier in the thread I read nhe plan was to release the source "when it has merit" But that instantly left me with the feeling that the authors of the browser, and I have very different opinions on what the word merit means. Such that they would be incompatible, and I'd never want to use it. This is a decision that has lowered my opinion about exactly how much I can trust Kagi.

> Kagi founder here. Orion isn't open source yet primarily because we're a 5-person team that spent 6+ years building this and created significant IP doing so,

But it's possible I haven't considered some detail where I might agree it's reasonable. Can you describe or offer any insight into the "significant IP" that you need to protect and defend? What threats from a larger company are you primarily concerned about?

I'm not the founder nor Kagi employee, just a customer, but

> Can you describe or offer any insight into the "significant IP" that you need to protect and defend?

The novel IP is having implemented and still implementing the browser APIs necessary for both Firefox and Chromium extensions to work in a Safari (Webkit)-based browser. See [1] for the significant progress.

> What threats from a larger company are you primarily concerned about?

Integrating said functionality themselves to offer another viable iOS browser, which Kagi is currently the only [2] offerer of (or another viable macOS/future Linux/Windows browser, although more than one exist there already).

[1] https://docs.google.com/spreadsheets/d/14IgSRVop4psUTgtLZlvY... (via: https://help.kagi.com/orion/misc/technical.html)

[2] Unless the EU steps up, all iOS browsers will continue to have to be Webkit-based with minimal, lackluster extension support. Not viable for anything beyond the most basic of use cases.

Thanks for being so transparent about this. As a Kagi search user since the beta, I appreciate what you are doing. Good luck!

Having access to the source is just one part of open source.

The state of webkitgtk is a bit rough, as I’m sure you and your engineers have noticed. The other part of what open source means to people is that you contribute back to the open source code you used to build your business, lifting all boats in the process.

What people certainly do not want to see is Kagi pull an Apple: utilize FOSS to the extent it helps you but return nothing but “thanks everyone but we got ours”.

Are you looking for people who worked on WebKit in the past?

I really hope you refactored WebKit's Bridge, because it allowed a lot of exploits in the past, and was neglected upstream by Apple.

When I started my RetroKit fork I was aiming to reduce that attack surface while offering farbled apis based on other browser behaviors and their profiles. [1]

My fork has been neglected a bit due to lack of time, as I'm currently still busy with other APT related things before I can get back to it.

Would love to chat whether your plan is to open source your WebKit fork, maybe there's some overlap and we can work together on it?

(I currently hope that ladybird will be getting into a more forkable and modular state, because servo passed by that goal a long time ago).

[1] https://github.com/cookiengineer/retrokit

The GPL has pretty good legal precedent, and so does the MPL in the browser space (though, Firefox has mozilla behind it so it gets the enforcement benefit). If the SFC wins its vizio case, would you look into freeing orion?

We support Kagi across products. We believe alternate browser engines keep the web standard. We give more weight to that than to whether a particular browser's value add (on top of a double digit* but non-hegemonic engine) is open.

We believe software and hardware creators have a right to choose their business model and let that model compete, as Kagi's is competing right here in this thread.

* Having worked at mega banks etc., they do look at these numbers to decide whether to invest in standards support or slap on a "Requires IE" button.

I am generally ok with things being proprietary if they want, and I'm mostly ok with Orion being proprietary, but I do understand peoples' issues here.

For a lot of people (even relatively geeky people), their computers end up being "an interface to use a browser". People use their browser to file their taxes, to write their documents, to manage their websites, to create websites, to look at porn, to pirate movies, to chat with their friends, to send/receive money to their bank, and a whole bunch of other things.

It would be hard to imagine a piece of software that is capable of knowing me more intimately than my primary web browser, and as Google has proven, this intimate knowledge is valuable. Companies pay boatloads of money for large quantities of personal information to target ads (and probably a bunch of other more disturbing things).

I genuinely don't think freediver is lying; I believe him when he says there's no telemetry data being sent and that it's not tracking me, but there's the sticking word: "believe". I have to trust him, which wouldn't necessarily be the case if it were FOSS.

Now, granted, I could always run Wireshark or something to ensure that there's no telemetry data being sent regularly, but that only protects you so much; for all I know, they could be taking steps to actively make it look like they're not sending data, or they could be batching up N days of data and sending it in batches so it is not as obvious that telemetry is sent.

Again, I genuinely don't think they're doing that, I believe them, but I do see peoples' points.

> I genuinely don't think freediver is lying; I believe him when he says there's no telemetry data being sent and that it's not tracking me, but there's the sticking word: "believe". I have to trust him, which wouldn't necessarily be the case if it were FOSS.

Proving this is actually the easy part - all you have to do is install a network proxy and monitor connections. It is something literally anyone can do which is why the zero telemetry statement carries a lot of weight.

Other people have ran their own independent tests eg https://www.reddit.com/r/browsers/comments/1k382gi/browser_t...

> For a lot of people (even relatively geeky people), their computers end up being "an interface to use a browser". People use their browser to file their taxes, to write their documents, to manage their websites, to create websites, to look at porn, to pirate movies, to chat with their friends, to send/receive money to their bank, and a whole bunch of other things.

I agree! Which is why it is so terrifying for me that Orion is the only browser on the market you can pay for. For the most intimate piece of software we have on our computers, you would expect that more people would want a clean transaction and 'being the customer' relationship. Yet for vast majority of users, their browsing has been paid for by advertisers and third parties (true for 100% of most popular browsers out there).

> We also see limited upside from community contributions - the number of people who can meaningfully work on a WebKit browser is small

But the number of people who can contribute to the app UI is bigger, and that's also an area seriously lacking

I can live with that compromise for now. Thanks for the lengthy response!

Enjoying Orion with uBlock on the iPhone, thanks for making it work!

uBO is not technically working on Orion for iOS. We do not have permissions to run certain web extension APIs on iOS needed for uBO feature set. The adblocking you witness is thanks to built in native adblocker in Orion.

When you do release it, do you know yet if you plan on releasing the full change history? Or would you start with a snapshot at the ~release date?

Thank you for building orion. Thanks for the explanation and it all seems perfectly reasonable to me and your choices are solid.

What is the UI SDK used for Windows version?

we used to pay for browsers 20 years ago

I've been online for about 30 years, I have never heard of paying for a browser.

As an example, Opera was payware for the first ten years of its existence. I remember trying out a demo of it included on a CD decades ago!

You're absolutely right ! I had forgotten that.

The paid browser market essentially collapsed after Microsoft bundled IE with Windows for free. For example Netscape was $49. Microsoft famously attacked this with "Why waste $50 for Netscape?! IE is free!"

This doesn't make browsers today really 'free' (same like search engines aren't really 'free'). Browsers are incredibly complex to make and maintain. And the customers paying all these cost are the advertisers/third parties, not the users using them (entire reason for Kagi's existance is to create an option where user is also the customer).

Being able to pay for the most intimate piece of software you have on your computer makes a lot of sense.