[{"data":1,"prerenderedAt":350},["ShallowReactive",2],{"project-44662497":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":44,"post_text":45,"what":46,"said":85,"maker_in_thread":218,"shape":229,"grid":233,"attempts":313,"same_week":314,"maker_shows":33,"maker_hidden":342,"reader_version":343,"card":344},"44662497","TheProtector","Linux Bash script for the paranoid admin on a budget","title","Show HN: TheProtector – Linux Bash script for the paranoid admin on a budget","https:\u002F\u002Fgithub.com\u002FIHATEGIVINGAUSERNAME\u002FtheProtector","github.com","lotussmellsbad",1753295868,2025,167,35,419,3837,11,"notable","infrastructure","security monitoring for linux servers","cli",[24,25,26,27],"linux security monitoring","bash security script","yara malware detection","intrusion detection linux","roasted",-0.067,{"positive":31,"neutral":32,"mixed":33,"critical":18},7,3,1,22,{"docs":36,"execution":37,"privacy":39,"idea":41,"design":43},{"positive":33,"critical":32},{"positive":33,"critical":38},5,{"positive":40,"critical":33},0,{"positive":42,"critical":42},2,{"positive":42,"critical":40},[38,33,32,40,33,40,33,33,40,33,33,38,40,33,32,40,32,40,38,32,33,40,40,38,40,33,33,40,38,38,40,38,40,33,40],"Hi HN,\n\nI spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K\u002Fyear and don't understand Linux.\n\nTheProtector is a comprehensive security monitoring tool that actually runs on the systems we use (Linux) instead of being a Windows-first afterthought. Built it entirely on a $500 laptop because I believe good security shouldn't require unlimited budgets.\n\nFeatures: - Real-time process, network, and file monitoring - YARA malware detection with custom rules - eBPF kernel monitoring (when available) - Behavioral baseline establishment an",{"problem":47,"audience":53,"pricing":57,"motivation":61,"time_to_build":65,"stack":69,"openness":82,"stage":83,"team_size":84},{"value":48,"source":49,"evidence":50},"Security monitoring for Linux systems without enterprise tool costs","maker",[51],{"id":52},"post",{"value":54,"source":49,"evidence":55},"Linux admins and paranoid self-hosters on small budgets",[56],{"id":52},{"value":58,"source":49,"evidence":59},"Free",[60],{"id":52},{"value":62,"source":49,"evidence":63},"Tired of expensive enterprise security tools that don't support Linux well",[64],{"id":52},{"value":66,"source":49,"evidence":67},"Past year in spare time",[68],{"id":52},[70,74,78],{"value":71,"source":49,"evidence":72},"Bash",[73],{"id":52},{"value":75,"source":49,"evidence":76},"YARA",[77],{"id":52},{"value":79,"source":49,"evidence":80},"eBPF",[81],{"id":52},"open_source","beta","solo",{"praise":86,"objections":121,"requests":171,"questions":187,"alternatives":209},[87,103,114],{"value":88,"source":89,"evidence":90},"Single readable, auditable bash script","commenter",[91,95,99],{"id":92,"by":93,"text":94},"44664474","vanviegen","Congratulations on your release! That packs a lot of functionality in a surprisingly small and readable (and thus auditable) shell script. Great work! One thing though: I can…",{"id":96,"by":97,"text":98},"44666918","ropable","A self-contained Bash script and short enough to evaluate thoroughly in an hour or two. Bravo, OP.",{"id":100,"by":101,"text":102},"44664986","xalg","I really like the simplicity. I have added it to a test server and will see how it goes. Congrats on releasing your project.",{"value":104,"source":89,"evidence":105},"Bash choice is practical and runs everywhere",[106,110],{"id":107,"by":108,"text":109},"44664785","monch1962","I love this implementation approach. At first glance I questioned your choice of bash over something like Python, but you're right - bash is everywhere and every competent Linux…",{"id":111,"by":112,"text":113},"44665578","globalnode","This is great. I'm currently trying to use Linux more due to Recall but in terms of security I'm just not sure what I'm doing most of the time. I suppose I should go read a book…",{"value":115,"source":89,"evidence":116},"Feature set impressive for a bash script",[117],{"id":118,"by":119,"text":120},"44666057","panphora","As someone who runs production services but isn't a full-time sysadmin, I evaluated this script before thinking about deploying it. Here's what you should know: The Good: It's a…",[122,126,137,156,163],{"value":123,"source":89,"evidence":124},"Contains a root privilege escalation via world-writable \u002Ftmp",[125],{"id":118,"by":119,"text":120},{"value":127,"source":89,"evidence":128},"Self-update mechanism is a trust risk",[129,133],{"id":130,"by":131,"text":132},"44664751","FergusArgyll","I would probably delete the self_update function[0] if I were to use this, otherwise this is cool!…",{"id":134,"by":135,"text":136},"44667138","nullc","Wouldn't be a faithful replacement for enterprise tools if it didn't introduce a new \"trust us\" backdoor into your systems. :P",{"value":138,"source":89,"evidence":139},"Appears AI-generated with placeholder and LLM-style docs",[140,144,148,152],{"id":141,"by":142,"text":143},"44665605","_def","Was this made with LLMs?",{"id":145,"by":146,"text":147},"44668648","kirab","I believe so, a human programmer would feel ashamed for adding comments like these: ``` # Stop honeypots stop_honeypots # Stop eBPF monitoring stop_ebpf_monitoring # Stop API…",{"id":149,"by":150,"text":151},"44666813","sevg","The tech paper is LLM trash. Doesn’t bode well for the code, not just because it’s a gigantic bash script..",{"id":153,"by":154,"text":155},"44666630","kfrzcode","It's LLM slop. I have done enough of these \"projects\" with every major model over the last six weeks to recognize it instantly. There are non-subtle patterns I would enumerate if…",{"value":157,"source":89,"evidence":158},"Process name sanitization claim is wrong",[159],{"id":160,"by":161,"text":162},"44666500","thwarted","> However, process names from ps output are already sanitized by the kernel (limited to 15 chars, no shell metacharacters executed). I'm not sure what this is referring to. You…",{"value":164,"source":89,"evidence":165},"Anonymous author and new accounts raise trust concerns",[166,167],{"id":92,"by":93,"text":94},{"id":168,"by":169,"text":170},"44677665","CodePoint","\"I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K\u002Fyear and don't understand Linux.\" You should have written it…",[172,176,180],{"value":173,"source":89,"evidence":174},"Document the notification framework and give usage examples",[175],{"id":107,"by":108,"text":109},{"value":177,"source":89,"evidence":178},"Remove or disclose self-update",[179],{"id":130,"by":131,"text":132},{"value":181,"source":89,"evidence":182},"Clear experimental disclaimer and independent security review",[183],{"id":184,"by":185,"text":186},"44666295","bugsMarathon88","This cannot conscientiously be called a security tool, as it lacks: - author attribution (in fact, a mockery is made of it) - qualified independent security review and…",[188,195,202],{"value":143,"source":89,"evidence":189},[190,191],{"id":141,"by":142,"text":143},{"id":192,"by":193,"text":194},"44665802","webprofusion","Would love to see the prompts used. I can tell from the formatting etc this is AI built, nothing wrong with that.",{"value":196,"source":89,"evidence":197},"Who or what is the lotus author name?",[198],{"id":199,"by":200,"text":201},"44664823","rfkjrjr","\"Built by thelotus over a year of free time. Maintained by thelotus. Given away free because expensive security theater is stupid.\" Who \u002F what is the lotus?",{"value":203,"source":89,"evidence":204},"Why is it named TheProtector but internally ghost sentinel?",[205],{"id":206,"by":207,"text":208},"44664569","_QrE","Neat, but isn't packing all this stuff into a bash script overkill? You can pretty easily install and configure some good tools (i.e. crowdsec, rkhunter, ssh tarpit or whatever)…",[210,214],{"value":211,"source":89,"evidence":212},"CrowdSec",[213],{"id":206,"by":207,"text":208},{"value":215,"source":89,"evidence":216},"rkhunter",[217],{"id":206,"by":207,"text":208},{"comments":18,"answered":42,"key":219},[220,223,226],{"id":221,"text":222},"44668786","This is why I released it - I am one person and know I need this community to make it something more",{"id":224,"text":225},"44668791","ha and good catch",{"id":227,"text":228},"44670575","organically?? thanks though!!",{"commenters":230,"max_depth":32,"maker_replies":18,"first_comment_mins":231,"lifespan_hours":232},25,199,29,[234,236,240,242,246,247,249,250,252,253,255,257,259,262,265,266,267,269,271,274,277,278,280,282,285,287,291,292,294,296,301,303,307,309,311],[107,40,38,235,108,40],"project\u002Fpositive\u002Fdocs",[237,40,33,238,239,40],"44677524","project\u002Fcritical\u002Fexecution","justaj",[118,33,32,241,119,40],"project\u002Fmixed\u002Fexecution",[243,33,40,244,245,40],"44666256","commenter\u002Fneutral\u002Fnone","bravesoul2",[160,33,33,238,161,40],[221,33,40,248,11,33],"maker\u002Fneutral\u002Fnone",[130,42,33,238,131,40],[134,42,33,251,135,40],"project\u002Fcritical\u002Fprivacy",[224,42,40,248,11,33],[168,32,33,254,169,40],"project\u002Fcritical\u002Fidea",[206,256,33,254,207,40],4,[92,38,38,258,93,40],"project\u002Fpositive\u002Fexecution",[260,38,40,244,261,40],"44667716","subscribed",[149,263,33,264,150,40],6,"project\u002Fcritical\u002Fdocs",[192,31,32,248,193,40],[227,31,40,248,11,33],[199,268,32,248,200,40],8,[270,268,40,248,11,33],"44665527",[111,272,38,273,112,40],9,"project\u002Fpositive\u002Fidea",[141,275,32,276,142,40],10,"project\u002Fneutral\u002Fnone",[145,275,33,238,146,40],[279,275,40,248,11,33],"44668860",[281,18,40,248,11,33],"44665035",[100,283,38,284,101,40],12,"project\u002Fpositive\u002Fdesign",[286,283,40,248,11,33],"44669722",[288,289,33,264,290,40],"44666484",13,"somehnguy",[153,289,33,264,154,40],[293,289,40,248,11,33],"44669075",[96,295,38,284,97,40],14,[297,298,38,299,300,40],"44665834",15,"project\u002Fpositive\u002Fnone","indigodaddy",[302,298,40,248,11,33],"44669112",[304,305,38,273,306,40],"44664453",16,"BLKNSLVR",[308,305,40,248,11,33],"44669738",[184,310,33,238,185,40],17,[312,310,40,248,11,33],"44668748",[],[315,320,325,329,332,337],{"id":316,"name":317,"points":318,"category":319},"44664873","Tender",1030,"consumer_social",{"id":321,"name":322,"points":323,"category":324},"44594584","Conductor",228,"dev_tools",{"id":326,"name":327,"points":328,"category":20},"44630648","connmap",205,{"id":330,"name":331,"points":231,"category":20},"44661673","Apple Health MCP",{"id":333,"name":334,"points":335,"category":336},"44613438","Compass CNC",176,"hardware",{"id":338,"name":339,"points":340,"category":341},"44622374","blender-mcp",151,"creative",false,"v2",{"id":345,"name":5,"line":6,"ai":342,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":346,"top":18,"kw":347,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":348,"url":9,"mix":349,"praise":88,"objection":123,"sub":21},44662497,-0.07,[24,25,26,27],"51301011011501303053100501105505010",[31,32,33,18],1794036679010]