Alternatives
Products that do what Code in Response to “The Trouble with Symlinks.” does
See: https://news.ycombinator.com/item?id=32190032 This was written in about the past hour or so; it has no documentation or test cases yet. Think twice before relying on it in production. The idea is that we can perform a detailed validation of the trustworthiness of an absolute or relative path, as a simple function that can be reused anywhere: I call this function safepath_check. A trustworthy path is one whose meaning cannot be changed by a third party: another user who isn't root. The path is therefore immune, for instance, to TOCtoTOU security problems, like the…
- 1
- 2
- 3
- 4
- 5
- 6IB
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com
- 7DA
Github Link: https://github.com/prahladyeri/distroverify Folks, I'm a distro hopper who mainly hops between ubuntu distros such as ubuntu, xubuntu, ubuntu-mate, etc. One thing I've found is the frequent need to verify the SHA1 hashes of the local and original version found on cdimage.ubuntu.com. Sometimes, you forget to verify the hash immediately and later, you have to again scavenge for that download URL in your browser history and then find the hash files URL, isn't it? For this, I've created a tool called distroverify that automatically pulls the corresponding…
2019
- 8BG
We originally set out to solve complex debugging headaches and useless alerts caused by traditional security scanners in our own projects. Static Analysis (SAST) flagged too much noise because it couldn't verify runtime context, while Dynamic Analysis (DAST) missed internal logic bugs because it treated the app like a black box. We built a CLI tool to bridge this gap using grey box testing from a red team approach. We use internal knowledge of the codebase to guide parallel execution, allowing us to find complex or hidden logic errors and attack paths standard linters/scanners miss. The…
Dec 2025 · bloodhoundsecurity.ca
- 9IM
Hello! I just made my first web app with Sinatra. It is a REST API that helps people add two-step verification to their websites or apps. I am a complete noob in web development so please criticize me and let me know how shitty this whole thing is. :) http://two-step.herokuapp.com/
2014
- 10IC
There aren't any reliable free broken link checkers out there, so I decided to create one. Right now, it is a Python script that can be run on any platform. It is multi-threaded and has a lot of room for improvement. Feel free to check out the code and point out the mistakes or leave suggestions. I am newbie programmer :)
2022 · github.com
- 11LO
Hi HN, Martin, Nils, and Jannes here. We are building Legit, an open source version control and collaboration layer for AI agents and AI native applications. You can find the repo here https://github.com/Legit-Control/monorepo and the website here https://legitcontrol.com Over the last years, we worked on multiple developer tools and AI driven products. As soon as we started letting agents modify real files and business critical data, one problem kept showing up. We could not reliably answer what changed, why it changed, or how to safely undo it. Today, most AI…
Jan 2026
- 12YV
Hi HN, I made a tiny tool called YAML Validator that checks your YAML files with one Docker command — no installs, no setup, no excuses. It does: - Syntax checks - yamllint linting - checkov security scanning - All in one lightweight, zero-config container --------------------------------------------------------- How to use: docker run -v "$(pwd):/data" pooyanazad/yaml-checker Optional alias (for .bashrc / .zshrc): alias ytest='docker run -v "$(pwd):/data" pooyanazad/yaml-checker' Then simply call: ytest sample.yaml YAML powers CI/CD, configs, infra ,and…
Nov 2025
- 13OS
Hey Everyone! Avi and I (in the current YC S25 Batch) noticed how fragmented crypto compliance is with rules changing constantly, vary by region, and force developers and legal teams into a scramble. So we hacked together a prototype framework that generates a “guardrail” smart contract which: - Hooks into your KYC provider - Enforces rules defined a simple compliance.yaml file - Automatically blocks users you can't legally serve When regulations shift (new blocked country, updated KYC threshold, etc.), just update your YAML and redeploy with no smart contract rewrites. Audit prep also…
2025 · github.com
- 14YC
I made a website to make able to open suspicious links safely, You can open the "suspicious link" by putting it on the website, and behind the scenes on the server, there is a VM (Virtual Machine) that contains Chromium, and an API that will receive your "suspicious link" and open it in a thread using Chromium. What result will I receive ?: You get the downloaded files that are downloaded when you open the link. Also, it takes a screenshot of the page behind that link to be able to see what it looks like, and it will give you the requests made by that link when it was opened.…
Sep 2025 · linksray.com
- 15LF
Hi HN, I just wanted to share what I have been working on for the past few months: A firmware analyzer for embedded Linux systems that helps uncovering security issues running entirely in the browser. This is a very early Alpha. It is going to be rough around the edges. But I think it provides quite a lot of value already. So please go ahead and drop a firmware (only .tar rootfs archives for now) and try to break it :)
Mar 2026 · xray.boldwark.com
- 16PI
`pathlib.Path` is Python's object-oriented interface to local filesystem paths, but it was invented too late to be used in modules like `tarfile` and `zipfile`. It also does a lot of magic that makes it hard to extend. I wrote this package to help others write their own subclasses of `pathlib.Path` for any sort of embedded/remote filesystem. I've included built-in support for `zip`, `tar` and `iso` files (inc. SUSP+RR but exc. Joliet+UDF) and JFrog Artifactory. Hopefully it's helpful to someone. Source: https://github.com/barneygale/pathlab Docs:…
2020
- 17FB
I've published an open specification for a detection method I'm calling RQ4 (Request Context Fingerprinting). It analyzes whether HTTP request headers are logically consistent with real browser behavior - not just what headers are present, but whether they make sense together given the request context.
Mar 2026 · github.com
- 18FV
We open-sourced the TLA+ and Fizzbee verified spec behind Ursa's storage engine. Verification across ~200K states caught a design bug that years of production missed. We then handed the spec to Claude Code — it produced a working Rust implementation (concurrent producers, compaction, fencing) without back-and-forth. We think verified specs are the best harness for coding agents: open-source the spec, let anyone implement it.
Apr 2026 · github.com
- 19
Every model with a unified interface. Privacy with proof. Discussion | Link
6d ago · producthunt.com
- 20IB
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com
- 21IM
Hey HN! I made a completely open sourced alternative to Weights and Biases with (insert cringe) blazingly fast performance (yes we use rust and clickhouse) Weights and Biases is super unperformant, their logger blocks user code... logging should not be blocking, yet they got away with it. We do the right thing by being non blocking. Would love any thoughts / feedbacks / roasts etc
2025 · github.com
- 22IM
I've just launched a new site that creates Trusted Timestamps. Anyone can use it to make any data immutable going forward in time. By "verifying" a Trusted Timestamp against a file, you certify that file has not been altered since the time the Trusted Timestamp was created at. Trusted Timestamps are not a new idea, there is a standard defined in RFC3161 and some other prior work as well. My design though is different as it is based on plain-text, human readable files. I believe this makes this form of Trusted Timestamp more accessible for a wider set of applications. I found the RFC3161…
2024 · timestampit.com
- 23SS
2017 · semver-sentry.com
- 24
Check is extension safe and don't collect your data
29d ago · is-extension-safe.online
Ranked by how close each launch is in meaning, then by votes. Refine with a description →