Skip to main content

Hacker News Front Page

Show HN: OnKey – I'm a bad singer, so I built an app to show where I'm off-key

Hacker News Front Page
1 day 7 hours ago

Hi all

I was pretty terrible at singing, now I’d say I’m bad but not terrible. This is because I’ve been using a singing app (won’t name it here) that scores me on my pitch and timing throughout the song so that I can improve.

Lately however, the app I’ve been using has flooded their song list with songs that aren’t originals. I didn’t like this at all as for me, it’s easier to try to improve when you’re singing along to the original.

So, I asked an agent (Claude Code) if it could write some code to listen to Spotify and also listen to me and see if it could detect both pitches and score me. It impressed me by writing some Python and showing me my pitch in the terminal!

It couldn’t go all the way though and detect the singer’s pitch in real time.

So I found the next best setup and built OnKey, a Mac app that needs to listen to the song once (it doesn’t save it) and then when it’s learnt the song (takes a couple of minutes), you can sing along to the pitch track that it’s learnt. OnKey is free to use and open source under the MIT license.

It can listen to Spotify, Apple Music, and YouTube playing in your browser with the right permissions.

During the build I found that someone had done something similar in Nightingale, but this requires a library of songs exported to disk and who has this in 2026 (maybe some of you ;) - but we need to help the normies too).

You can check out a demo video on the site of me singing (warning given) here: https://singonkey.app

The app sends out to find the song info (short Shazam fingerprint, and looks up song details), lyrics (from LRCLIB), and checks for updates.

The app never sends the music (it doesn’t save this to disk) and your voice. Everything you’d expect to stay private does.

It’s still weak in a few places:

- when the song’s backing is noisy it’s hard to pick the pitch track out

- sometimes it gets a note an octave off

- it’s limited to Apple Silicon Macs, M1 or later, and only macOS 14.2 up because extra drivers aren’t required past this point

- the scoring is built for beginners like me so it’s fairly easy on you

Would love for people to try it out and let me know what works and what doesn’t for them!

Comments URL: https://news.ycombinator.com/item?id=50195488

Points: 23

# Comments: 12

Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress

Hacker News Front Page
1 day 8 hours ago

When I founded my business a whistle-blowing-service for enterprises, I’ve seeked for a working solution to block spam bots on that home page. The solution was intended to comply with EU data privacy law, no cookies, no sniffing, light-weight-size, on my webserver only, beeing invisible for my site visitors and no running costs at all.

I came across Hashcash, a proof-of-work approach, to block spam. When I implemented it, it worked immediately and blocked 100 percent without blocking any incoming real posts.

I was astonished, that no solution existed in the ecosystem allready that covered all forms and was for free. Therefore I‘ve turned it into a free wordpress-plugin.

It is not only a technical solution, but starts with the business model of spam (mass spamming at low cost), by producing a calculation effort for every single post, that unavoidable. And therefore is not exactly unbreakable but becomes very expensive for the spammer and therefore alows only for targeted high quality approaches that need other treatment. Up to now my own page remains spam free and users report the same.

Now, running since 2022 on 4000+ active installations, it is working with almost every webform and plugin combination that is running on any wordpress instance, using pattern recognition on http-post-level instead of specific proprietary integration for single specific form builders. It ships with 80+ starting patterns for the most relevant form builders and themes, but can be enhanced with any pattern by the user.

The plugin can be previewed directly and immediately on wordpress.org. It ships with14 KB compressed under a GPL-2.0 license.

I’m looking forward to discuss about the proof-of-work approach, form detection, privacy implications, and tradeoffs.

Comments URL: https://news.ycombinator.com/item?id=50194762

Points: 8

# Comments: 7

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

Hacker News Front Page
1 day 11 hours ago

I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

Comments URL: https://news.ycombinator.com/item?id=50193416

Points: 471

# Comments: 192

Checked
12 minutes 27 seconds ago
Hacker News RSS
URL
https://news.ycombinator.com/
Subscribe to Hacker News Front Page feed
#channel
All
Technology
TechTrends
HackerNews