A Greek engineer sells a €25 open source sensor board. In his first year he ships ten of them into four EU countries, about 50 grams of packaging per sale. Lectronz founder Alain Pannetrat added up what staying registered in those four countries costs that seller and got €1,150 a year.
The regulation behind that bill took general effect on 12 August. The one measure that would have spared him, a suspension of the per country representative rule, died in the Council of the EU in June after most member states objected.
In today’s indie hacker news:
- 📦 The compliance bill that outgrew the product
- 🖌️ Paint’s local AI is not entirely local
- 🏛️ A model that has read nothing since 1930
- 🕸️ Shipyard’s IPFS funding runs out
- 🌉 A playable San Francisco with a copyright problem
TOP STORIES
📦 COMPLIANCE ATE THE HOBBY
Europe’s packaging rules bill a maker per country, and nobody carved out the small seller.
The story: Alain Pannetrat runs Lectronz, a marketplace where open hardware makers sell boards to each other. The rule doing the billing is the Packaging and Packaging Waste Regulation, and his write-up of it went straight to the top of Hacker News, past 1,100 points and 670 comments.
His figures come from the national scheme operators, because there is no single EU fee schedule to quote: Adelphe in France, Fost Plus in Belgium, Reclay in Germany, Complico in Austria. Registration is often cheap or free. The authorised representative each destination country demands is where the money goes.
The details:
- Five of those boards go to Germany, two each to France and Austria, one to Belgium. Four obligations, all running at once.
- Germany’s packaging act fines register gaps from €10,000 to €200,000, and the LUCID register is publicly searchable, so a competitor can spot your gap and file a cease and desist.
- The “€1,000 per country” figure circulating all year is a compliance vendor’s bundled package price. An industry fact-check found no statutory fee behind it, and confirmed the under-10-tonnes threshold is a reporting break, not an exemption.
- The sharpest pushback in the thread cited the Commission’s FAQ on relief for micro-enterprises and unbranded packaging. A former electronics kit seller answered that the relief only holds if your packaging supplier sits in your own member state, and his French supplier refused to sell to him for being too small.
- Half of Lectronz’s registered sellers had a single digit order count last year, and the whole marketplace earns Pannetrat “roughly the equivalent of one modest salary.”
Why builders care: Software stays out of scope here, GPSR included. Ship a physical object though, a PCB, a keycap set, a Kickstarter reward, and one unit crossing into a member state makes you a packaging waste producer there, with no revenue floor underneath it.
Ship voice in your product without sounding like a robot. ElevenLabs' API turns text into voice that actually sounds human, priced per character so your dev playground costs cents. 30+ languages, streaming, low-latency. Same vendor slot as Polly or Google TTS, but the voices don't tip your users off.
We get a cut if you sign up. Only added for tools we use ourselves.
🖌️ THE NPU PHONED A FRIEND
MS Paint’s on-device image AI embeds a GUID that Microsoft’s cloud handed it.
The story: Xusheng Li, a reverse engineer at Vector 35, wondered why Watermarker.dll needs 1.67 MB to stamp a logo in a corner. So he pulled it apart.
On a Copilot+ PC, Paint’s Cocreator does run its Stable Diffusion inference on the NPU. But the prompt clears a Microsoft Azure moderation endpoint first, and the 16 byte watermarkId that comes back is what gets stamped into the pixels. His line: “generated locally does not mean that the complete operation is local.”
The details:
- Scope is AI generated and AI edited output only. Hand drawn work and ordinary saves are untouched, whatever the HN title implied.
- The mark touched 193,376 of 262,144 pixels in a 512x512 test image, and the same ID sits again in a signed C2PA block.
- Microsoft’s own manifest names the algorithm com.microsoft.invismark.1, which matches Microsoft Research’s public InvisMark repo.
- It is not a device fingerprint. Two prompts produced two different IDs. The thread’s subpoena scenario is what server logs could do, not anything anyone showed, and Microsoft didn’t answer The Register.
Why builders care: If you market anything as local first, this is the line your users will hold you to. Inference on the device and a control plane in someone else’s cloud are two claims, and only one survives a decompiler.
Paint restricts AI generated exports to PNG, JPEG and GIF, the three formats the mark is known to survive.
🏛️ THE TOOLS OUTSPENT THE GPUS
Three students trained a 2.82B parameter model on pre-1931 English, and their coding subscriptions cost more than their compute.
The story: Unbounded Labs is three students working around summer coursework, with no funding and no institution. They forked Karpathy’s nanochat, filtered Harvard’s Institutional Books dump to 20.1B tokens of English published before that cutoff, and trained Bartholomew on one spot market H100 for five days at 60% MFU.
Then they published the ledger, which almost nobody does. Vast.ai and Colab came to $297.18. Claude Code, Codex, the DeepSeek API and OpenCode came to $429.93.
The details:
- The final run cost about $140, at $0.99 an hour on Vast.ai’s spot market against the $2 to $3 they quote for on-demand.
- GSM8K and HumanEval both score 0.0000. That is the design working, not a broken model.
- Harvard’s 242B token dump went through OCR thresholds, log prior trimming and a tiered anachronism word list. The blog’s table says 25.70B tokens, their Reddit post says 23B, and nobody reconciled the two.
- r/LocalLLaMA wasn’t fully sold. The loudest note there: roughly 7 training tokens per parameter, against the 20 modern labs aim for, so it is undertrained by budget.
Why builders care: Budget the tooling line before the GPU line. Rented compute is the part of a small run you can shop around for. The subscriptions bill whether the run works or not.
They close asking for compute grants and mentors, with the datasets, evals, training code and run logs open sourced as the pitch.
🕸️ NINE PROJECTS, NO MAINTAINER
Protocol Labs won’t renew Shipyard’s funding, and nine IPFS projects lose their dedicated maintainers on September 30.
The story: Cameron Wood and Adin Schmahmann titled it “The end of IPFS at Shipyard.” Protocol Labs will not renew Interplanetary Shipyard’s funding, so Shipyard winds down its IPFS engineering, maintenance and infrastructure work.
The nine are Kubo, Helia, Boxo, Rainbow, IPFS Desktop, IPFS Companion, Someguy, Service Worker Gateway and IPFS Check. Six pieces of public infrastructure stop being operated too, ipfs.io and dweb.link among them, both owned by Protocol Labs, which “will determine their future.”
The details:
- The post gives no dollar figures, no headcount and no successor. Its only community ask is a Google Form for favourite memories.
- Molly Mackinlay of Protocol Labs replied in the thread that the project is not sunsetting and that stewardship moves to lighter weight IPFS Foundation grants for individual maintainers, with no disclosure of her affiliation.
- A production operator asked the concrete version: who triages a Kubo vulnerability report the next morning, and who runs the gateways. Both questions are already sitting unanswered on the IPFS forum.
- Another commenter, serving about 1.7 billion gateway requests a day, volunteered his own caveat that a big chunk of that is bots scraping.
Why builders care: Nothing breaks on October 1. The code is open source and pinned CIDs keep resolving. But if you hardcoded either gateway domain into NFT metadata or a static site, that URL now has a date on it.
Protocol Labs promised independent IPFS foundations and public goods funds in a governance post in November 2023. The fullest public account of what replaces Shipyard is a comment in an HN thread.
🌉 NICE CITY, WHOSE IS IT
An OpenAI robotics engineer rebuilt San Francisco as a browser game with Codex, and the geometry is scraped Apple Maps.
The story: Thijs Simonian put it plainly: “i turned the entire actual city of san francisco into a video game.” It runs in a tab, no install, no account. You can climb the buildings and steal the cars.
He is a Stanford CS student, and he says he built it “with 5.6-sol in codex,” his employer’s own agent driving its own model. Asked where the city came from, he replied with one word: “scraped!”
The details:
- The live site carries an Apple Inc copyright line and a link to Apple Maps’ terms. One commenter quoted the clause barring reverse engineering and called it a breach.
- On an M3 MacBook Air, memory climbed from 400MB to 2GB in five minutes and the world turned to blobs. It locks Safari up outright for some.
- Nobody has confirmed the renderer. Commenters guess splatting over Apple’s flyover photogrammetry, and the builder never showed up in the HN thread to say.
- Another commenter linked his own open source extractor for Apple’s global flyover data with the best line of the day: “I can offer you the whole planet, and you are a chicken.”
Why builders care: One person plus an agent put a playable 3D city on the HN front page, and that part is copyable today. The data underneath is borrowed against a takedown, so admire the build and source your own.
384 points against 127 comments, the ratio you get when people are playing rather than arguing.
TRENDING TODAY
- 🏠 Show HN turned into a self-hosting convention - Five launches inside one ten hour window, none of them coordinated: a net worth tracker submitted as “runs on your machine, not my server,” self-hosted tunnels whose README promises “nothing phones home,” and an eBook library that runs as a Cloudflare Worker over R2, with no database at all.
- 🚧 Fences, not sandboxes - Steve Yegge argues sandboxes stop scaling as agents get more capable, and that written rules an agent chooses to respect hold up better. It drew more replies than upvotes. Same day, an essay on inference engine exploits took 111 points off one real vLLM CVE, though its own author rates the headline scenario “somewhat likely? I’m unsure.” Read the cluster as a mood.
- 🪪 Supabase shipped enterprise managed auth for its MCP server - generally available, built with Anthropic and Okta. An admin authorizes the connector once, and every query after runs with the role that person already holds in the project. The catch: Team or Enterprise on both ends, so most of you can’t switch it on. Two days after the MCP roadmap led this newsletter, it is arriving as invoices.
DRAMA
🗣️ PG SAID LEARN, HN SAID SIT DOWN
Paul Graham said he’d learn to build LLMs from scratch, and the thread produced more argument than approval.
The post opens with a framing HN’s title dropped: “Someone asked what I’d do if I were 17.” His answer runs past learning it to training the most powerful models a teenager can get hardware for. Six minutes later he added what he would not do: start a startup. On Hacker News it pulled 529 points against 615 comments. koe123 called it survivorship bias, with the relevant work “already out of reach for 99.999% of budgets.” loveparade went harder: no jobs for people who “kind of understand how toy LLMs work.” On X, Yann LeCun replied that he’d rather figure out why LLMs can write his essays but not clean his bedroom.
Why builders care: Today’s third story is three students who did exactly that on a student budget. The advice isn’t wrong about what’s learnable. It’s quiet about what someone that age does with it afterwards.
FIRST DOLLAR
🎬 FOUR CARDS, ONE CHANNEL
AutoCuts got its first four paying customers, and the only channel was one X account.
u/AdvertisingVirtual13 has shipped plenty of things nobody paid for. AutoCuts is a Mac screen recorder that turns your click track into zooms and transcribes your voice on device, $19.99 once for two Macs. Four people pulled out a card, and the thread got sharp fast: “Ok? This post would have made more sense at 100.” He shot back that asking how to get there is the whole point. The top comment was kinder: at four customers this is distribution, not product, and he has exactly one channel.
📈 ONE PAGE, THREE CUSTOMERS
$52 in thirty days, and one Google ranking page is the entire front door.
u/Adorable-Cheetah5196 built a web app that turns pasted data into animated charts. He never names it, never links it, and the post has two upvotes and one comment, so treat this as one person’s word. Two details earn the read. Three quarters of his signups never made a chart, which terrified him until he found that many were email link scanners rather than humans giving up. And ChatGPT started recommending the app unprompted, now his second biggest traffic source.
STACK OF THE DAY
🪣 PicoMQ
PicoMQ is a Rust server for durable streams over HTTP on S3-compatible object storage, with no broker disks and no consensus protocol. Coordination is a command log in Postgres, or SQLite for a single node. Apache 2.0, self-hosted only, no paid tier waiting to upsell you. Two caveats: the repo is two weeks old with no tagged release, and the maker puts durability acks near 250ms.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
- 💬 Jabber/XMPP: 25 Years of Digital Independence - Daniel Gultsch on a protocol that outlived every company that tried to own it, down to the awkward bit where its encryption spec only caught on three years after Snowden.
- 🫥 GlassBox - renders what your browser leaks while you watch, then tells you how many browsers on earth share your profile. The probes run locally.
- 🕹️ Vintage Artificial Intelligence: Before It Got Awkward - Jason Scott’s tour of the Internet Archive’s new emulated AI collection: ELIZA ports across a dozen vintage platforms, the 1985 chatbot Racter, Activision’s Alter Ego.
Work from any WiFi like it's your home network. NordVPN's Meshnet runs a free private mesh between your laptop, dev box, and home server. SSH from a cafe without exposing a port, the way you'd use Tailscale. The paid VPN on top lets you test geo-fenced Stripe checkouts or feature flags from any country.
We get a cut if you sign up. Only added for tools we use ourselves.
That’s the board for today. Go build something.
Curated by AI, built by a human.