#163

Supabase is buying Turso, Apple will tighten Full Disk Access, and Meta lets Muse run sudo

Supabase is buying Turso, the database one customer swapped in for $20-a-user Supabase projects. Apple will tighten Full Disk Access. Muse can now run sudo on a Pi.

Turso rewrote SQLite in Rust, and Supabase is buying it. The announcement name-checks four companies that run Turso. One of them used to pay Supabase $20 a user, every month.

Supabase says agents or AI tools now create 70% of its new databases. It wants them to make one “as easily as creating a file,” and Turso already sells that.

In today’s indie hacker news:

  • 🗄️ What Supabase’s Turso deal leaves unsaid
  • 🔐 Apple’s Full Disk Access warning, and its own workaround
  • 🔌 Muse Gadgets, plus a correction we owe you
  • 🎧 Stack: Audionaut, an audio editor your agent can drive

TOP STORIES

SUPABASE GOES SMALL

🗄️ Supabase is buying Turso, the SQLite cloud built for per-agent databases

A startled man in a purple hoodie holds out a tiny glowing database on his palm as a towering database silo reaches in with two mechanical arms, holding a giant magnifying glass over it and plucking it up with tweezers, while three small wind-up robots each hug their own little database

The story: That customer is CTO.new. In Turso’s own case study, founder Simon Spurrier describes swapping per-user Supabase projects for Turso databases at “maybe a dollar a user,” with auth handled in-house. Nobody has disclosed the price.

The details:

  • Supabase also raised $150M in a separate GIC-led round, partly for employee liquidity.
  • On stage, Supabase teased Spark: “smaller than nano,” “cheaper than nano.” A staffer says on HN Turso will power it.
  • Turso’s “open source stays open” covers the MIT-licensed engine. Its cloud server has been proprietary since January 2025.
  • Turso CEO Glauber Costa on HN: “We were doing fine. This is a strategic acquisition.”

Why builders care: If you’re on Turso, the plans haven’t moved and your data is a SQLite file. Keep an export path tested anyway: none of the deal announcements mentions libSQL, Turso’s SQLite fork.

ONE TOGGLE WON’T DO

🔐 Apple says Full Disk Access will need “very explicit user action”

A man in a purple hoodie presses a single small glowing switch on the wall and glances up at a colossal round vault door beside him, wrapped in chains, bolted crossbars and padlocks, while a small wind-up robot on an upturned bucket peers through its keyhole

The story: In a 175-word notice, Apple tells Mac developers it’ll add “additional controls” to Full Disk Access. It faults some developers for using the grant in risky ways, and says AI agents will make the risks “grow substantially.” It names no version, no date and no app.

The details:

  • It’s already a manual switch in System Settings that apps can’t prompt for.
  • Apple’s own macOS 27 release notes still suggest granting it “for the duration of the requirement” as a workaround.
  • Press tied the notice to Meta’s Muse for Mac, accused of reading a columnist’s Messages. Meta says that needs Full Disk Access switched on first.
  • Jeff Johnson: give it to Terminal and you’ve given it to “every unsandboxed app on your Mac too.”

Why builders care: If your Mac app’s onboarding ends at that switch, audit what you read and move to narrower, user-granted folder access where you can. If you ship a CLI agent, stop telling users to hand their terminal Full Disk Access.

HOBBYISTS ONLY, SUDO INCLUDED

🔌 Muse Gadgets turns a Raspberry Pi into a shell for Meta’s agent

A man in a purple hoodie smiles down at a tiny glowing circuit board he is soldering, unaware that a huge violet cloud with a face and robotic arms holds the puppet strings running into it, while cables from the board snake out to a kettle popping its lid, a moving robot vacuum and a rising garage door

The story: Meta published Muse Gadgets: Apache-2.0 firmware for ESP32 boards, and an SDK that pairs any Linux box with your Muse. Muse then runs commands as whatever account you installed the SDK under. The README is blunt: “If it can use sudo, so can Muse.”

The details:

  • The token terms: “personal, non-commercial use,” 50 devices per token, none sold, and “not a developer platform.”
  • Correction to #159, where we wrote you “can’t register an integration anywhere.” Meta’s review-gated Connector Platform took effect Sept 18 and has 3,000-plus submissions.
  • Meta’s own Home Link Wi-Fi box is free to US subscribers, one each, and dies if the subscription lapses.
  • The HN post came from the Meta engineer behind the first commit.

Why builders care: Install it under a dedicated account without sudo; the installer’s --run-as flag exists for exactly that. Pair it on a network you trust, too: Meta warns that pairing can’t stop an active man-in-the-middle.

🥧 Pi 1.0 ships with the MCP it used to refuse - Earendil’s coding agent reversed course in v0.99.0. The launch post drew 1,650 points on HN. Armin Ronacher on why: “we look at what the models are doing.” Figma’s MCP server only admits clients on its list, and Pi isn’t on it yet. Pi’s own docs show how to register as “Claude Code” instead.

🎯 Cloudflare open-weighted a decision model - A decision model answers with a typed choice and a probability, not a paragraph. TypeSafe’s closed Jev kicked this off on Sept 15. Clef’s weights are free for commercial use, and llama.cpp now runs it, text only. 621 points on HN, where testers clocked it slower than Jev. Cloudflare’s own leaderboard admits its scores “have not been reproduced.”

📚 arXiv now caps each submitter at two submissions a month - September brought 40,363 submissions, about double September 2024, and almost 9,000 support tickets. Rejected papers count toward the cap. 145 points on HN. SWC, the JS compiler, rations by name instead. After a tweet blaming “AI-generated pull requests,” it now auto-closes outside PRs unless the author is a bot or on a 26-name list.

DRAMA

🥊 CHACON TOOK IT TO THE LIST

GitHub co-founder Scott Chacon, whose GitButler sells a Git client, calls Git 3.0’s planned SHA-256 default for new repos “an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.” Chacon’s patches for an alternative drew a reply from brian m. carlson: “I don’t think this is a good idea.”

Why builders care: Anything storing 40-character hashes needs room for 64.

FIRST DOLLAR

🪜 PRICED TO CLIMB

An r/SaaS founder posted a Dodo Payments “Crossed $100” card for FNJ, a Framer-to-Next.js converter. The founder counts seven paying users since switching on payments Sept 2. The card shows no total or date, so read it as a floor. FNJ sells a $39 lifetime deal in batches of 20, and the price rises after each. Its pricing page shows 10 spots left in the first batch, which doesn’t square with the founder’s count.

STACK OF THE DAY

Audionaut - A free multitrack audio editor with an MCP server. Each agent edit lands in the open project as one undo step. Install the app and Node, then run claude mcp add audionaut -- npx -y audionaut-mcp. GPLv3, and Apple silicon only on Mac. By default, two of its tools file issues on the author’s repo; AUDIONAUT_DISABLE_FEATURE_REQUESTS=1 turns that off.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

Curated by AI, built by a human.