Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Apfel – The free AI already on your Mac

apfel.franzai.com

Post reply on HN
Print view View original

31–40 of 180 posts

Re: Show HN: Apfel – The free AI already on your Mac

#31

Post by btown »

brians wrote: post #21
stingraycharles wrote: post #19

Earlier quoted context omitted.

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

I think any browser will allow it but not allow data read back.

FWIW this was the status quo (webpage could ping arbitrary ports but not read data, even with CORS protections) - but it is changing.

This is partially in response to https://localmess.github.io/ where Meta and Yandex pixel JS in websites would ping a localhost server run by their Android apps as a workaround to third-party cookie limits.

Chrome 142 launched a permission dialog: https://developer.chrome.com/blog/local-network-access

Edge 140 followed suit: https://support.microsoft.com/en-us/topic/control-a-website-...

And Firefox is in progress as well, though I couldn't find a clear announcement about rollout status: https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-...

So things are getting better! But there was a scarily long time where a rogue JS script could try to blindly poke at localhost servers with crafty payloads, hoping to find a common vulnerability and gain RCE or trigger exfiltration of data via other channels. I wouldn't be surprised if this had been used in the wild.

Re: Show HN: Apfel – The free AI already on your Mac

#32

Post by layer8 »

stingraycharles wrote: post #19
brians wrote: post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

Restricting such access it is still a work in progress: https://wicg.github.io/local-network-access/

Re: Show HN: Apfel – The free AI already on your Mac

#34

Post by franze »

brians wrote: post #20
brians wrote: post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

They offer it as an option but default it to false! This is still a --footgun option but it’s the least unsafe version I’ve seen yet! Well done, Apfel authors.

thx for the report - a totally valid attack vector i was not aware of before, should be fixed https://github.com/Arthur-Ficial/apfel/releases/tag/v0.6.23 - see also new https://github.com/Arthur-Ficial/apfel/blob/main/docs/server...

Re: Show HN: Apfel – The free AI already on your Mac

#36

Post by gherkinnn »

arendtio wrote: post #33

For those who don't know, 'Apfel' is the German word for Apple.

And for those who did know that and want to know more, the shift from apple - apfel and water -> wasser happened during the High German consonant shift.

https://en.wikipedia.org/wiki/High_German_consonant_shift

Re: Show HN: Apfel – The free AI already on your Mac

#37

Post by aswanson »

convexly wrote: post #29

I like the approach of running everything locally. I'm strongly of the opinion that the privacy angle for local models is going to keep getting stronger and more relevant. The amount of articles that come out about accidents happening because of people handing too much context to cloud models the more self reinforcing this will become.

That's the way things have to go. Business risk is too high having everything ran over exposed networks.

Re: Show HN: Apfel – The free AI already on your Mac

#39

Post by xenophonf »

khalic wrote: post #27
swiftcoder wrote: post #9

Anyone tried using this as a sub-agent for a more capable model like Claude/Codex?

If you’re looking into small models for tiny local tasks, you should try Qwen coder 0,5B. It’s more of an experiment, but it can output decent functions given the right context instructions.

> [Qwen coder 0,5B] can output decent functions given the right context instructions

Can you share a working example?

Re: Show HN: Apfel – The free AI already on your Mac

#40

Post by gherkinnn »

Now this is a development I like.

With the Claude bug, or so it is known, burning through tokens at record speed, I gave alternative models a try and they're mostly ... interchangeable. I don't know how easy switching and low brand loyalty and fast markets will play out. I hope that local LLMs will become very viable very soon.

Post reply on HN