Alternatives
Products that do what LTH Shield does
Linux hardening & IPS for VPS — without the enterprise bill
- 1
- 2
- 3AP
2020 · github.com
- 4TL
Hi HN, I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K/year and don't understand Linux. TheProtector is a comprehensive security monitoring tool that actually runs on the systems we use (Linux) instead of being a Windows-first afterthought. Built it entirely on a $500 laptop because I believe good security shouldn't require unlimited budgets. Features: - Real-time process, network, and file monitoring - YARA malware detection with custom rules - eBPF kernel monitoring (when available) - Behavioral baseline…
2025 · github.com
- 5
- 6
- 7NA
I'm the founder at Netrinos. I built a WireGuard-based mesh VPN because remote access has always been a pain. After years of SSH tunnels, IPsec headaches, and the ssh log horror movie, I wanted something simpler: install, sign in, get work done. Netrinos creates a LAN-like overlay network across your devices. Connections are direct P2P via WireGuard, with no central server routing traffic. Each device gets a stable IP and DNS name (pc.you.netrinos.com). When direct connections fail, they fall back to a relay server that's still encrypted end-to-end. We can't see your traffic. The most…
Dec 2025 · netrinos.com
- 8AE
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me. The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's…
Dec 2025 · github.com
- 9DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 10TY
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh
- 11
- 12BI
Jun 2026 · bastion.computer
- 13BA
I found hping3 and nmap's nping to be far too slow in terms of sending individual, bare-minimum (40-byte) TCP SYN packets; other than inefficient socket I/O, they were also attempting to do far too much unnecessary processing in what should have otherwise been a tight execution loop. Furthermore, none of them were able to handle CIDR notations (i.e., a range of IP addresses) as their source IP parameter. Being intended for embedded devices (e.g., low-power MIPS/Arm-based routers), Blitzping only depends on standard POSIX headers and C11's libc (whether musl or gnu). To that end,…
2024 · github.com
- 14SA
2015 · github.com
- 15
- 16IB
The only way to go fast is full YOLO mode in your coding agent. I've got the local sandbox figured out (pro tip: Incus VMs work great) but I wanted to keep my agents from doing things like inadvertently blowing up my cloud services or chasing a prompt to POST to some random website. I struggle most with this on my side projects where my permission model isn't quite as robust as it is at the office. I started with a firewall on the Incus container but every time the agent needed access to something new, I was poking more holes in it - and it didn't differentiate between HTTP verbs. I've been…
Jul 2026 · trollbridge.dev
- 17I2
2017 · github.com
- 18
- 19IR
I do fullstack dev for work and side projects and recently moved everything to a couple VPSs on hetzner. Great setup, low cost, but one thing kept bugging me, how do I know if something is down without manually sshing in all the time? I tried the grafana + prometheus stack but the configuration time and seeing it use more resources than my actual apps was rough. Tried some smaller solutions too but nothing felt right. So I said screw it and built exactly what I wanted. tori is a single go binary that runs on your server, reads host metrics from /proc and /sys, monitors containers…
Feb 2026 · github.com
- 20
Axiom▲11Local desktop sandbox engine against Client-Side Scanning
Jul 2026 · gabrielgigitashvili044-pixel.github.io
- 21VT
Hi HN, I spent the last few months reading the RISC‑V specification to build the lightest possible sandboxes. The idea behind a vpod is to quickly spin up a Linux sandbox from snapshots (Alpine by default) without any setup or subsystem required. The trade-off for portability and security is raw CPU speed. So we don't expect it to match native workloads with Python or pip, for example. More info is in the README https://github.com/capsulerun/vpod Happy to answer any questions!
Jun 2026 · github.com
- 22
- 23
- 24HR
2022 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →