Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Apfel – The free AI already on your Mac

apfel.franzai.com

Post reply on HN
Print view View original

21–30 of 180 posts

Re: Show HN: Apfel – The free AI already on your Mac

#21

Post by brians »

stingraycharles wrote: post #19
brians wrote: post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

I think any browser will allow it but not allow data read back.

Re: Show HN: Apfel – The free AI already on your Mac

#22

Post by mememememememo »

brians wrote: post #21
stingraycharles wrote: post #19

Earlier quoted context omitted.

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

I think any browser will allow it but not allow data read back.

Isn't there a CORS preflight check for this? In most cases. I guess you could fashion an OG form to post form fields. But openai is probably a JSON body only.

The default scenario should be secure. If the local site sends permissive CORS headers bets may be off. I would need to check but https->http may be a blocker too even in that case. Unless the attack site is http.

Re: Show HN: Apfel – The free AI already on your Mac

#23

Post by bombcar »

gigatexal wrote: post #14

It’s a very small model but I’ve been playing with it for some time now I’m impressed. Have we been sleeping on Apple’s models? Imagine they baked Qwen 3.5 level stuff into the OS. Wow that’d be cool.

Apparently the Overcast guy build a beowulf cluster of Mac minis to use the Apple transcription service.

https://www.linkedin.com/posts/nathangathright_marco-arment-...

Re: Show HN: Apfel – The free AI already on your Mac

#25

Post by airza »

brians wrote: post #21
stingraycharles wrote: post #19

Earlier quoted context omitted.

I don’t think many browsers will allow posting to 127.0.0.1 from a random website. What’s the threat model here?

I think any browser will allow it but not allow data read back.

There is a CORS preflight check for POST requests that don't use form-encoding. It would be somewhat surprising if these weren't using JSON (though it wouldn't be that surprising if they were parsing submitted JSON instead of actually checking the MIME-type which would probably be bad anwyay)

Re: Show HN: Apfel – The free AI already on your Mac

#27

Post by khalic »

swiftcoder wrote: post #9

Anyone tried using this as a sub-agent for a more capable model like Claude/Codex?

If you’re looking into small models for tiny local tasks, you should try Qwen coder 0,5B. It’s more of an experiment, but it can output decent functions given the right context instructions.

Re: Show HN: Apfel – The free AI already on your Mac

#28

Post by robotswantdata »

brians wrote: post #18

I’ve seen several projects like this that offer a network server with access to these Apple models. The danger is when they expose that, even on a loop port, to every other application on your system, including the browser. Random webpages are now shipping with JavaScript that will post to that port. Same-origin restrictions will stop data flow back to the webpage, but that doesn’t stop them from issuing commands to…

Keep seeing similar mistakes with vibe coded AI & MCP projects. Even experienced engineers seem oblivious to this attack vector

Re: Show HN: Apfel – The free AI already on your Mac

#29

Post by convexly »

I like the approach of running everything locally. I'm strongly of the opinion that the privacy angle for local models is going to keep getting stronger and more relevant. The amount of articles that come out about accidents happening because of people handing too much context to cloud models the more self reinforcing this will become.

Re: Show HN: Apfel – The free AI already on your Mac

#30

Post by FinnKuhn »

gigatexal wrote: post #14

It’s a very small model but I’ve been playing with it for some time now I’m impressed. Have we been sleeping on Apple’s models? Imagine they baked Qwen 3.5 level stuff into the OS. Wow that’d be cool.

For small tasks this seems perfect. However it being limited to English from what I can tell is quite a downsite for me.
Post reply on HN