Google dropped Gemma 4 12B yesterday, and the 4-bit build squeezes into 7-8GB of RAM. That means an M2 MacBook Air can run a real multimodal model, vision and audio and text together, fully offline under Apache 2.0, with no API key and no per-token bill.
That footprint is the unlock. Privacy-bound work that could never touch a cloud API, medical notes, legal docs, internal comms, now has a multimodal option that lives entirely on your own hardware.
In today’s indie hacker news:
- 🤖 Google fit a multimodal model into one 8GB file
- 🧪 Elixir 1.20 type-checks your code with zero annotations
- 💸 Uber caps engineers’ AI spend at $1,500, per tool
- 🔐 Let’s Encrypt’s post-quantum plan: do one thing now
- 🛠️ A desktop gauge for your Claude and Codex limits
TOP STORIES
A WHOLE STUDIO IN YOUR RAM
🤖 Google shipped Gemma 4 12B, an encoder-free model that runs image, audio, and text on a laptop
The story: Google introduced Gemma 4 12B as a model “designed to bring agentic multimodal intelligence directly to laptops,” and the architecture is the headline. There’s no separate vision transformer or audio conformer. Image patches and raw 16kHz audio project straight into the language model’s embedding space through a tiny linear module, so one decoder handles every modality in a single pass. That collapses the usual multi-encoder pipeline into one weight set you can fine-tune with a single LoRA adapter. It landed top of Hacker News and swept the top seven slots on r/LocalLLaMA the same day.
The details:
- The whole vision-embedding module is about 35M parameters, standing in for a full vision tower that would normally carry hundreds of millions.
- Memory footprint scales with quantization: 7-8GB at 4-bit, ~14GB at int8, 25GB at BF16. The 4-bit variant fits a 16GB M-series Mac with room to spare.
- It does text, variable-aspect images, 30 seconds of audio, and 60 seconds of video at 1fps, all native, with a 256K context window. It’s the first mid-sized Gemma with native audio in.
- Day-one support shipped across llama.cpp, MLX, Ollama, vLLM, and Unsloth, with 4-bit quants and fine-tuning guides out the same afternoon.
- The “near-26B-class” framing is Google’s own benchmark claim with no third-party numbers yet. On Google’s chart it scores 72% on LiveCodeBench v6, well above Gemma 3 27B’s 29% but below the new Gemma 4 31B’s 80%.
Why builders care: This is the first time on-prem multimodal is a one-file drop-in, which opens use cases that were legally off-limits the moment they hit someone else’s GPU. Just temper the laptop fantasy before you wire it into a live loop: community benchmarks put it around 5 tokens/sec at 4-bit on a 12GB GPU, which HN users called sluggish for interactive coding. Treat it as a local inference engine for image and audio jobs first, a chat partner second.
Turn one English video into 30 languages, in your own voice. ElevenLabs' dubbing studio transcribes your video, translates it, then voices each language in your cloned voice. Built for creators who want a Spanish or Portuguese channel without hiring a VO artist per region. Free tier covers your first few minutes.
We get a cut if you sign up. Only added for tools we use ourselves.
TYPES THAT SHOW UP UNINVITED
The story: Elixir 1.20 finishes the first of three planned milestones for the language’s set-theoretic type system, which means the compiler now infers types across every construct, guards, receive, try, with, and for included, without you writing a single annotation. When it finds a typing violation that’s certain to blow up at runtime, it flags a “verified bug” rather than a soft maybe. José Valim engaged the release thread directly, explaining the escape hatch that keeps the dynamism intact: the dynamic() type “effectively works as a range, which can be refined as it is used throughout the program.” The arc from his 2022 announcement to here took roughly four years.
The details:
- The system is set-theoretic, so types compose through unions, intersections, and negations, which is how it models multi-clause functions and pattern matching cleanly.
- “Strong arrows” give soundness without runtime coercions. Writing
x + 1lets the compiler infer backward thatxis a number, no signature required. - Inference now reaches arbitrary-key maps, covering
Map.putandMap.delete, not just atom-keyed structs. - On the IfT type-narrowing benchmark it passes 12 of 13 categories, a strong showing for a gradual system.
- Explicit type signatures, typed structs, and recursive types are not here. Those are milestone two and three, targeting v1.21 and v1.22.
Why builders care: If you run Phoenix or LiveView, you upgrade and get type checking on your existing codebase with no migration and no annotations. Valim’s own framing of the first payoff is dead code, not new bugs: on a mature codebase with decent coverage, most warnings will be paths that never execute. Active development gets the sharper win, catching an atom() passed where integer() belongs at the call site instead of in production. The thing you don’t get yet is annotated public APIs, so typed Ecto changesets stay on the roadmap.
THE PRICE TAG ON HEAVY AI USE
The story: Uber blew through its entire 2026 AI-tools budget by around April, so it set a hard ceiling, and the detail everyone’s misreading is that the cap is per tool. Claude Code and Cursor get separate $1,500 limits, which means a single engineer can still run up to $3,000 a month across both. Simon Willison read the number as a useful market signal, calling it “a rational policy response to over-spending, and much more sensible than those tokenmaxxing leaderboards,” a jab at the internal usage leaderboard Uber had been running that pushed engineers to spend more to climb the rankings. The cap comes with a permission process to exceed it. TechCrunch and Bloomberg confirmed the figures.
The details:
- Before the cap, individual engineers were spending $500 to $2,000 a month on a single tool as adoption climbed, so the $1,500 line clips only the heaviest users.
- Per CEO Dara Khosrowshahi, 95% of Uber engineers touch AI tools monthly, about 70% of committed code originates from AI, and roughly 10% comes from autonomous agents.
- The leaderboard ranking teams by total Claude Code usage drove “tokenmaxxing,” where engineers spawned extra subagents purely to run up numbers.
- That $3,000 combined ceiling times twelve is $36,000 a year per seat, which Willison pegs at roughly 11% of a median Uber engineer’s total comp.
- Uber’s COO supplied the skeptic’s line, noting that tying token throughput to shipped features is hard: “that link is not there yet.”
Why builders care: A company near $200B with near-universal AI adoption just published its idea of a defensible per-seat ceiling, and two signals fall out. If you’re solo on Claude Code Max at $200 a month, you’re an order of magnitude under it, so the ROI math is wildly in your favor and you can stop feeling guilty about the bill. If you build a dev tool, the market clearly absorbs four figures a month per seat for heavy agentic use, not $20 SaaS pricing. Just price on output, because Uber’s own COO is the cautionary note: usage is not the same as shipped value.
NOTHING TO DO TODAY, EXCEPT ONE THING
🔐 Let’s Encrypt laid out its post-quantum roadmap, and the urgent move isn’t the certs
The story: Let’s Encrypt published a post-quantum roadmap, and the first thing it wants you to know is that nothing changes yet. Andrew Gabbitas put it plainly: “Your current Let’s Encrypt certificates will continue to be issued and renewed exactly as they always have been.” PQ certs aren’t shipping, with staging penciled for late 2026 and production in 2027. The interesting bet is the path: instead of stuffing bulky post-quantum signatures into today’s certificates, LE is going with Merkle Tree Certificates, which batch many certs under one signature so the handshake stays small. The genuinely urgent ask is separate, and it’s about key exchange, not signatures.
The details:
- Signatures are the less urgent half: forging one needs a live quantum computer at attack time, whereas recorded traffic can be decrypted later, which is why key exchange jumps the queue.
- Raw post-quantum certs are huge. An ML-DSA chain adds 13,000 to 17,000 bytes to a handshake versus about 448 for Ed25519, enough to trigger extra round trips on slow links.
- Merkle Tree Certs compress that quantum-resistant authentication down toward 736 bytes, smaller than today’s Web PKI, and bake certificate transparency in by design.
- Chrome named MTCs its preferred path and is running live tests with Cloudflare, with its quantum-resistant root store targeting Q3 2027.
- Go 1.27 is expected to ship ML-DSA in its standard library, which cuts friction for ACME clients down the line.
Why builders care: For most of us on certbot or Caddy auto-renew, there is genuinely nothing to do, and PQ certs are promised “free, automated, and available” when they land. The one move worth making now is enabling hybrid key exchange (X25519MLKEM768) if your stack supports it (nginx 1.27+, OpenSSL 3.5+), because adversaries are recording encrypted traffic today to decrypt once quantum hardware exists. If you maintain an ACME client or a custom cert pipeline, start tracking the IETF PLANTS group, and watch your non-browser clients: curl-based backends and IoT have no clear way to receive MTC data yet.
TRENDING TODAY
🛡️ Builders are sandboxing and pen-testing their AI agents - The “how do I safely run an autonomous agent” question went mainstream on two fronts. Anthropic detailed its containment layers: Claude.ai runs code in ephemeral gVisor containers, Claude Code uses OS sandboxing where writes need approval, and Cowork runs agents in a full VM with credentials locked to the host. On the offense side, a researcher spent $1,500 pitting models against a deliberately vulnerable app. GPT-5.5 topped it at 7 of 10 solves, DeepSeek V4 Pro was cheapest by far at $0.62 a solve, and Gemini mostly refused to play.
🪤 Companies are seeding Reddit to steer ChatGPT and Google AI answers - 404 Media reports peptide and HRT companies covertly spamming r/biohackers to shape what AI engines say about their products. It has a name now, AEO, or AI Engine Optimization, SEO aimed at the source text LLMs scrape. The mods banned new peptide content and called it out directly. One named firm advertises “an army of agents publishing Reddit posts” for exactly this. The answer layer is the new SEO battleground, and it’s already gamed.
📉 “6 months. 4,400 users. €2,100 total.” - Counter-programming to the 10k-in-30-days flex. A married dev with a day job and a kid posted brutally honest numbers on his personal-growth app Loggd: €244 MRR, about half of all revenue from selling 10 lifetime deals, and €1,400 torched on ads with nothing to show. The top comment captured the mood: “€244 MRR with a full-time job and a kid in 6 months is actually solid.” Realism is the genre winning the room right now.
FIRST DOLLAR
SEVEN PRODUCTS, ONE YES
🎁 A builder shipped seven products in six months, then woke up to a first sale on the seventh
After six months and six misses, this builder landed a first paying customer on product number seven, a gift-message app called giftfeels.in that had been quietly pulling 200-300 visitors a month. The mechanics are the lesson: he added a payment gateway around 4am, went to sleep, and woke at 6am to a sale notification. The number is small and self-reported, no MRR attached, but the pattern is the point. Shipping is a numbers game, and the gateway has to actually be live before anyone can pay you.
STACK OF THE DAY
🛠️ AI Gauge
An open-source desktop monitor that shows your usage and spend across Claude, Codex, Copilot, and OpenRouter in one place. It’s a floating always-on-top widget on Windows and Linux, and a menu-bar item on macOS, with session usage, weekly totals, and reset times at a glance. Built in Python and PyQt6, no Electron, with credentials stored in your platform’s native keychain. MIT licensed, free, and very fresh at v0.5.9. If you live in these tools and keep getting surprised by limits, this is the dashboard you’ve been meaning to build.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
🧠 “Artificial intelligence is not conscious” - Ted Chiang’s Atlantic essay is sharp pushback on the consciousness hype, and it lit up HN at 297 points and 537 comments. Worth reading before your next argument about what these models actually are.
⚖️ “They’re made out of weights” - A short, clever essay reframing what an LLM fundamentally is. Pairs nicely with the Chiang piece if you want the technical-poetic angle on the same question.
📦 “Self-hosted dev sandboxes with preview URLs” - This project gives you ephemeral preview environments with their own URLs, built on Docker and Go with no Kubernetes in sight. On theme with today’s agent-sandboxing thread if you want isolated environments without the cluster tax.
Stop trusting random coffee-shop WiFi with your auth tokens. Public WiFi is a free packet sniffer for anyone in earshot of your laptop. NordVPN encrypts the tunnel so a logged-in Vercel session, a GitHub PAT, or a Stripe dashboard tab stays yours. Works on the same 6,400+ exit nodes you'd use for geo-testing.
We get a cut if you sign up. Only added for tools we use ourselves.
Curated by AI, built by a human.