Hacker News

> How come this is trying to install its own vendored dependencies

"Why does this new software do X?" is probably answered by "the vibe worked on my system"

> instead of checking for what's already installed

Plenty of software come with their own Python runtime. Even Blender uses its own Python runtime. I can name so many apps with embedded Python runtime: Blender, Houdini, Bitwig, Substance Painter, Krita, etc. Checking for what's already installed isn't the norm. In Krita's case, it uses installed Python to build it... and in the building process it builds another Python runtime for its own!

This app should have probably bundled the runtime instead of downloading a new one though.

> install its own vendored dependencies

> lead to both security and performance issues

npm install and pip -r theoretically have the same kind of security issue. How many projects on github run this kind of command during build process? My guess is in the order of millions.

This is unfortunately becoming more common.

Just yesterday, I went to try out some cool new AI thing that was here on the front page of HN. It's written in Python. Great, I thought, that means I can put it into a virtualenv and just rm the whole tree when I'm done and my system will be exactly in the same state it was previously.

But sadly... no... the first time I ran it, this Python program started downloading and installing Node/NPM, and all kinds of other stuff to my machine WITHOUT even asking for permission. Sorry app developers, but my machine and my home directory are my workplace. They are curated property, you are NOT allowed to just install whatever you wish.

I expect this kind of behavior from programs whose only supported installation method is a curlpipe. (And I do avoid those.) I do not expect it from programs that claim to be installable by pip, or ship their own binaries. These NEED to be called out as vulnerable to supply-chain attacks at worst and extremely disrepectful to users at best.

> How come this is trying to install its own vendored dependencies, including executable binaries, instead of checking for what's already installed? That approach can lead to both security and performance issues.

I've been sympathetic to your viewpoint, and I can see why this kind of thing is becoming more common.

The idea that users can reliably supply their own vendor libs/execs for applications is a bit of a fantasy. Devs working on fixing issues caused by the user having a strange issue due to the version of Python or whatever that they have installed is largely a waste of time when the application can "simply" ship with the exact dependencies it expects. This is especially true when it comes to open source work. Dealing with weird edge cases because the user has a version of FFMPEG installed that, for whatever reason, is missing h264, is work that nobody asked for. Given that the audience of this kind of app is a general one (not specific at all to devs) then it doesn't make sense to require other system packages to be present; if things like Python and FFMPEG are not required and will be downloaded anyway as part of the app install process, then there's no point in not always doing that. If you think about it, it's hardly different from any other sort of software dependency. The dependencies are just relatively bigger.

Personally, I have no desire for my applications to use other executables on my system unless I request that they do so explicitly. I'm sympathetic to the idea from a mere efficiency perspective, especially when it comes to developer tooling. But a karaoke app? No offense, but why care? A Python interpreter will be anywhere between 50 and 200 megabytes. FFMPEG is even smaller, especially if you don't enable every single feature and codec. Compared to how ridiculously bloated your average basic mobile app is (without anything like a built in JIT), bundling a desktop application with something like Python provides a lot of power relative to the number of bytes added.

>How come this is trying to install its own vendored dependencies, including executable binaries, instead of checking for what's already installed? That approach can lead to both security and performance issues.

Because the person who vibecoded this had no idea they should have been doing that.

I'm just using cross https://github.com/cross-rs/cross to build cross-arch. you can still use `cargo build`, it will just work.

welcome to the millenial way of doing things

always assumes internet is connected

always assumes everything is trusted

Just tried it with B.E.D - Walk Away[0], unfortunately it lost track of the lyrics after 30 secs (Model is "large-v3"). Will play around a bit more, as it would be great to have a working karaoke generator.

Some quick feedback:

  - Needs a way to skip for-/backwards during playback to validate the result
  - Sentences seem to be recognized (first letter has uppercasing), but periods aren't added
  - Needs an option to edit results from the track analysis

[0]: https://www.youtube.com/watch?v=_MFT4H3VoNE

Amazing work! I am thrilled someone was motivated to approach this problem and develop a creative solution like this. There are very limited options for Karaoke, especially in the FOSS space. Most Karaoke apps are super limited and that's driven many Karaoke enjoyers I know to YouTube in search of the songs they want to sing. This solution would give them the power to do even more songs, even better than what's out there now!

Questions for you:

1. What CUDA capability level is necessary for Nvidia GPU accelleration to work?

3. Are there any plans to support iGPU/NPU accelleration on AMD and Intel? Asking because those chips are most common in the mini computers sold at low cost these days.

My family members who love Karaoke and will be happy to try this. Looking forward to it!

I just want to say how much I love that you used Dean Blunt in the example video

Excited to try this out. How well does WhisperX deal with lyrics in say Mandarin or Cantonese? Does it output Hanzi?

Struggled somewhat with Tjamuku Ngurra by the Tjintu Desert Band, absolutely nailed Mariah Carey's Ken Lee.

This looks like awesome awesome fun! Will let you know how it runs. What a wonderful idea <3

Just tried No_4mat's 1992... unfortunately it didn't work :(

Was that a songbird followup?

hi there! pitch scoring is now pretty simplistic and the feature you're describing is not implemented. it's a great feature request tho!

hi! answered here https://github.com/rzru/nightingale/issues/7

hey!

you can use + / - buttons on the keyboard to change the level of guidance according to your preference, generally there is a controls legend in the top right corner

https://nightingale.cafe/docs/controls

Yeah I think this is quite tricky. Even spotify screws up the sync halfway through the song somewhat frequently

I don’t want to take away from OPs project (which seems really nice) but have you tried Ultrastar Deluxe ( https://usdx.eu/ ) in combination with USDB ( https://usdb.animux.de/ )?

There’s also a program for automatically downloading the songs: https://github.com/bohning/usdb_syncer

What would you consider the best "Singstar-like" alternative atm?

please try it out and share your feedback afterwards!

both transcript/alignment might not work perfectly, but it really depends on the song

Processed Kenny Rogers' The Gambler perfectly - took out the lead vocal but left the backing vocals.

hey, thanks for the feedback, both noted!

Unfortunately karafun, like so many other systems, has egregious holes in its catalog. I hate playing the “this song? No… this song? No… this song? No…” game.

Karafun is a paid service? I've seen their karaoke songs on Youtube for over a decade, I thought that was their business model.

No joke, feel free to try it! The beauty of the approach is that you don't have any limitations. Just be prepared to degraded experience, sometimes models struggle even with the simplest pop tracks :D

oof, since it uses quite heavy models locally I would expect it to struggle on such hardware. M1+ macs & nvidia gpus work the best and fastest.

it's a false positive, however feel free to build from the source while I'm figuring out what the virus trigger is about

so, as answered in one of the other threads - for me the transcript model performed poorly back in the days, however since then I've added lyrics lookup and tweaked a bunch of parameters, so it is worth trying!

I'm not sure whether the analysis would work swiftly enough on steam deck, it might be better to analyze on a desktop device and transfer ~/.nightingale/songs to the steam deck. just saying!

stay tuned for more features!

hey, thanks! would be happy if you open it as issue on gh

thanks, share your feedback afterwards!

not yet, but it's a great feature request!

It's problematic even client side since you don't have a sync license to show words timed to the song. A bunch of other licenses are needed too for the lyrics themselves and to process the original file into the instrumental.

it's a false positive, however feel free to build from the source while I'm figuring out what the virus trigger is about

it is as good as the models are. it is not perfect, especially for non-major languages, but it works.