TheProtector
Infrastructure
security monitoring for linux servers
SHOW HN2025
How HN took it
7 positive, 3 neutral or asking, 1 mixed, 11 critical, out of 22 comments about the project. Thread score -0.07.
Execution: 1 for, 5 againstDocs: 1 for, 3 againstIdea: 2 for, 2 againstDesign: 2 for, 0 againstPrivacy: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Single readable, auditable bash script
From 3 comments
Congratulations on your release! That packs a lot of functionality in a surprisingly small and readable (and thus auditable) shell script. Great work! One thing though: I can…
vanviegen on HNA self-contained Bash script and short enough to evaluate thoroughly in an hour or two. Bravo, OP.
ropable on HNI really like the simplicity. I have added it to a test server and will see how it goes. Congrats on releasing your project.
xalg on HN
Bash choice is practical and runs everywhere
From 2 comments
I love this implementation approach. At first glance I questioned your choice of bash over something like Python, but you're right - bash is everywhere and every competent Linux…
monch1962 on HNThis is great. I'm currently trying to use Linux more due to Recall but in terms of security I'm just not sure what I'm doing most of the time. I suppose I should go read a book…
globalnode on HN
Feature set impressive for a bash script
From 1 comment
As someone who runs production services but isn't a full-time sysadmin, I evaluated this script before thinking about deploying it. Here's what you should know: The Good: It's a…
panphora on HN
Objections
Contains a root privilege escalation via world-writable /tmp
From 1 comment
As someone who runs production services but isn't a full-time sysadmin, I evaluated this script before thinking about deploying it. Here's what you should know: The Good: It's a…
panphora on HN
Self-update mechanism is a trust risk
From 2 comments
I would probably delete the self_update function[0] if I were to use this, otherwise this is cool!…
FergusArgyll on HNWouldn't be a faithful replacement for enterprise tools if it didn't introduce a new "trust us" backdoor into your systems. :P
nullc on HN
Appears AI-generated with placeholder and LLM-style docs
From 4 comments
Was this made with LLMs?
_def on HNI believe so, a human programmer would feel ashamed for adding comments like these: ``` # Stop honeypots stop_honeypots # Stop eBPF monitoring stop_ebpf_monitoring # Stop API…
kirab on HNThe tech paper is LLM trash. Doesn’t bode well for the code, not just because it’s a gigantic bash script..
sevg on HNIt's LLM slop. I have done enough of these "projects" with every major model over the last six weeks to recognize it instantly. There are non-subtle patterns I would enumerate if…
kfrzcode on HN
Process name sanitization claim is wrong
From 1 comment
> However, process names from ps output are already sanitized by the kernel (limited to 15 chars, no shell metacharacters executed). I'm not sure what this is referring to. You…
thwarted on HN
Anonymous author and new accounts raise trust concerns
From 2 comments
Congratulations on your release! That packs a lot of functionality in a surprisingly small and readable (and thus auditable) shell script. Great work! One thing though: I can…
vanviegen on HN"I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K/year and don't understand Linux." You should have written it…
CodePoint on HN
Requests
Document the notification framework and give usage examples
From 1 comment
I love this implementation approach. At first glance I questioned your choice of bash over something like Python, but you're right - bash is everywhere and every competent Linux…
monch1962 on HN
Remove or disclose self-update
From 1 comment
I would probably delete the self_update function[0] if I were to use this, otherwise this is cool!…
FergusArgyll on HN
Clear experimental disclaimer and independent security review
From 1 comment
This cannot conscientiously be called a security tool, as it lacks: - author attribution (in fact, a mockery is made of it) - qualified independent security review and…
bugsMarathon88 on HN
Questions
Was this made with LLMs?
From 2 comments
Was this made with LLMs?
_def on HNWould love to see the prompts used. I can tell from the formatting etc this is AI built, nothing wrong with that.
webprofusion on HN
Who or what is the lotus author name?
From 1 comment
"Built by thelotus over a year of free time. Maintained by thelotus. Given away free because expensive security theater is stupid." Who / what is the lotus?
rfkjrjr on HN
Why is it named TheProtector but internally ghost sentinel?
From 1 comment
Neat, but isn't packing all this stuff into a bash script overkill? You can pretty easily install and configure some good tools (i.e. crowdsec, rkhunter, ssh tarpit or whatever)…
_QrE on HN
Alternatives named
CrowdSec
From 1 comment
Neat, but isn't packing all this stuff into a bash script overkill? You can pretty easily install and configure some good tools (i.e. crowdsec, rkhunter, ssh tarpit or whatever)…
_QrE on HN
rkhunter
From 1 comment
Neat, but isn't packing all this stuff into a bash script overkill? You can pretty easily install and configure some good tools (i.e. crowdsec, rkhunter, ssh tarpit or whatever)…
_QrE on HN