Live data from Hacker News

Show HN: Apfel – The free AI already on your Mac

apfel.franzai.com

11–20 of 180 posts

Re: Show HN: Apfel – The free AI already on your Mac

#15

It’s a very small model but I’ve been playing with it for some time now I’m impressed. Have we been sleeping on Apple’s models? Imagine they baked Qwen 3.5 level stuff into the OS. Wow that’d be cool.

The vision models and OCR are SUPER

Re: Show HN: Apfel – The free AI already on your Mac

#18
I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to make changes.

Some such projects use CORS to allow read back as well. I haven’t read Apfel’s code yet, but I’m registering the experiment before performing it.

Re: Show HN: Apfel – The free AI already on your Mac

#19
post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

Re: Show HN: Apfel – The free AI already on your Mac

#20
post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

They offer it as an option but default it to false! This is still a --footgun option but it’s the least unsafe version I’ve seen yet! Well done, Apfel authors.
Post reply on HN