Apple just patched the iOS bug the FBI used to read deleted Signal messages. In a federal terrorism trial, FBI agent Clark Wiethorn testified that cached notification previews survived on a defendant’s iPhone for weeks after she deleted Signal entirely. Cellebrite pulled the messages straight from the device’s internal notification database.
Apple didn’t find this internally. It learned about its own bug from the court transcript, not a bug bounty. The patch shipped 13 days later.
In today’s indie hacker news:
- Apple patches the iOS bug FBI used to read deleted Signal messages
- Qwen’s 27B coding model beats 397B, ties Claude Opus
- Google splits TPU, inference 80% cheaper per dollar
- OpenAI kills Custom GPTs, ships Workspace Agents free until May 6
- 20-year SaaS veteran asks if AI killed the industry
- Leadverse hits $11K revenue on $0 ad spend
TOP STORIES
THE NOTIFICATION DIDN’T DELETE
🔒 Apple patches iOS bug FBI used to extract deleted Signal messages
The story: Apple’s internal notification database cached message previews even after users deleted messages or the app itself. In the Prairieland federal terrorism case, FBI Special Agent Clark Wiethorn testified that Cellebrite extracted deleted Signal conversations from defendant Lynette Sharp’s iPhone. Sharp had already deleted Signal. The previews persisted for weeks.
404 Media first reported the extraction on April 9 from court testimony. Apple shipped iOS 26.4.2 thirteen days later.
The details:
- 4 iOS versions patched: iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, iPadOS 18.7.8
- Root cause: “Notifications marked for deletion could be unexpectedly retained on the device”
- Apple learned from court testimony, not an internal audit or external bug report
- Signal’s “No Name or Content” notification setting would have blocked it, but it’s off by default
Why builders care: If your app shows message previews in push notifications, those previews may survive app deletion on-device. Signal president Meredith Whittaker: “Notifications for deleted messages shouldn’t remain in any OS notification database.”
Work from any WiFi like it's your home network. NordVPN's Meshnet runs a free private mesh between your laptop, dev box, and home server. SSH from a café without exposing a port, the way you'd use Tailscale. The paid VPN on top lets you test geo-fenced Stripe checkouts or feature flags from any country.
We get a cut if you sign up. Only added for tools we use ourselves.
SMALL MODEL, BIG SWING
🤖 Alibaba’s 27B model beats its own 397B on coding, ties Claude Opus
The story: Qwen3.6-27B is a dense 27B model that outperforms Qwen3.5-397B-A17B, a model 15x its size, on every major coding benchmark. SWE-bench Verified: 77.2 vs 76.2. Terminal-Bench 2.0: 59.3, matching Claude 4.5 Opus exactly. Apache 2.0, no commercial restrictions.
The 397B weighs 807GB. The 27B sits at 55.6GB in BF16, or 16.8GB quantized. That’s a 4090, an M3 Max, or an AMD Strix Halo box.
The details:
- SWE-bench Verified: 77.2 (vs 76.2 for 397B, 80.9 for Claude Opus)
- 82 quantized variants shipped at launch for llama.cpp, Ollama, LM Studio
- 262K native context, extensible to 1M tokens via YaRN scaling
- 50 tokens/sec on RTX 5090 (Q6_K), 13 tokens/sec on M3 Max 36GB
Why builders care: Zero API costs, no rate limits, no data leaving your machine. A 16.8GB model that matches Opus on Terminal-Bench changes the economics for anyone building coding agents or local dev tools.
ONE CHIP BECOMES TWO
🧮 Google splits TPU into separate training and inference chips, inference 80% cheaper
The story: Google announced its 8th-generation TPU as two purpose-built chips. TPU 8t (Sunfish, designed by Broadcom) handles training. TPU 8i (Zebrafish, designed by MediaTek) handles inference. Both target TSMC 2nm for late 2027.
The inference chip delivers 80% better performance-per-dollar than last gen for LLM serving.
The details:
- TPU 8t: 12.6 petaFLOPS FP4, scales to 121 ExaFLOPS across 9,600 chips
- TPU 8i: 384 MB on-chip SRAM (3x prior gen), 5x faster collective latency
- Boardfly topology cuts network diameter by 56% (7 hops vs 16)
- Both chips switch from x86 to Arm Axion CPUs
- Supports JAX, PyTorch (preview), vLLM, and SGLang
Why builders care: If you’re paying for Gemini or any Google Cloud inference, the 80% price-performance gain will eventually compress your API costs. The dedicated inference chip is built for agentic workloads where multi-step reasoning is the bottleneck.
GPTS ARE DEAD, LONG LIVE AGENTS
⚡ OpenAI retires Custom GPTs for Workspace Agents, free until May 6
The story: OpenAI launched Workspace Agents as cloud-based persistent agents powered by Codex. They run scheduled workflows offline, connecting to Slack, Google Drive, SharePoint, GitHub, HubSpot, and Asana. Custom GPTs are being phased out as a “transitional technology.”
Available now for ChatGPT Business, Enterprise, and Edu plans. Free until May 6, then credit-based pricing.
The details:
- Integrations: Slack, Google Drive, SharePoint, GitHub, HubSpot, Asana, custom MCP servers
- 4 internal use cases: Software Reviewer, Product Feedback Router, Metrics Reporter, Lead Outreach Agent
- Human approval gates on sensitive actions (emails, calendar entries)
- 9 million paying business users (4x since September 2025)
- Up to $500 in credits for eligible workspaces during transition
Why builders care: Lightweight Slack bots and Notion automation wrappers now compete with a natively integrated platform enterprises already pay for. The MCP server connector is the opportunity: you can sell custom integrations as first-class plugins into ChatGPT Enterprise.
TRENDING TODAY
📈 Qwen 3.6 takes over r/LocalLLaMA - 1,556 upvotes on the release thread. A follow-up asking “How is a 27B model better than 397B?” pulled 354 ups and 134 comments. Short answer: dense models skip MoE routing overhead and quantize cleaner.
🎨 GPT Image 2: brilliant and broken - A “White Smoke Attack” exploit broke safety filters hours after launch by feeding visual noise into the vision encoder. Meanwhile, r/ChatGPT is posting incredible 3D renders alongside visible training data artifacts. Two narratives, same model.
⚔️ Claude Code vs Codex - Post-Anthropic’s Claude Code Pro removal (#21), multiple r/SaaS threads asking the same question. Builder consensus: Claude Code wins on multi-file reasoning and frontend. Codex wins on token efficiency (4x fewer) and sandboxing.
DRAMA
THE AI ATE MY SAAS
🔥 “Is it me or has AI really f’d up SaaS?”
A 2-decade SaaS veteran posted on r/SaaS asking if AI destroyed the industry. 105 comments. Two camps: those saying AI killed their clients’ willingness to pay, and those saying it just exposed mediocre products that should have died anyway.
Why builders care: If your SaaS competes on features an LLM can replicate in a prompt, the moat was never real. The survivors are products where the value lives in data, integrations, or workflows.
FIRST DOLLAR
ORGANIC ONLY
💰 Leadverse hits $11K revenue on $0 ad spend
Leadverse.ai scans Reddit, X, and LinkedIn for high-intent leads. Jakub Muzik built it solo, 8 months in, all organic. TrustMRR-verified: $11,134 all-time, $4,003 current MRR, 152 subscriptions. The r/microsaas and r/SaaS cross-posts pulled 134 upvotes and 22 comments combined.
Also shipping: ClickCast turns any URL into a promo video. $379 revenue, 8 subscriptions, TrustMRR-verified. 122 upvotes on r/SaaS.
STACK OF THE DAY
🛠️ Preflight - Test your MCP server before submitting to Claude or OpenAI directories. Show HN launch. If you’re shipping MCP integrations (and after today’s Workspace Agents news, you probably should be), this catches compatibility issues before review. Free.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
📝 Over-editing: when AI models modify code beyond what’s necessary - Research on AI code models introducing unnecessary changes. Every Cursor and Claude Code user has felt this. 316 HN points.
🔍 Firefox/Tor IndexedDB privacy vulnerability - A stable browser identifier links separate Tor identities across sessions. 508 HN points. Pairs nicely with the Apple story: even “private” tools have forensic gaps.
📚 Technical, cognitive, and intent debt - Martin Fowler on three flavors of tech debt. 221 HN points. A useful framework for the AI-generated code pile the vibe-coding wave is building.
Curated by AI, built by a human.