Alternatives
Products that do what Shibuya – A High-Performance WAF in Rust with eBPF and ML Engine does
Hi HN, I’ve been working on Shibuya, a next-generation Web Application Firewall (WAF) built from the ground up in Rust. I wanted to build a WAF that didn't just rely on legacy regex signatures but could understand intent and perform at line-rate using modern kernel features. What makes Shibuya different: Multi-Layer Pipeline: It integrates a high-performance proxy (built on Pingora) with rate limiting, bot detection, and threat intelligence. eBPF Kernel Filtering: For volumetric attacks, Shibuya can drop malicious packets at the kernel level using XDP before they consume userspace resources.…
- 1BT
2025 · docs.bunkerweb.io
- 2ZR
Ditch Burp Suite’s bloat for zxc, a Rust-built, terminal-based proxy that uses tmux and Vim to intercept HTTP/S and WebSocket traffic. It captures requests for debugging, security testing, or tweaking—fast and lean. # Key Features - Disk Wizardry: Stashes massive datasets on disk-100k+ entries without breaking a sweat. - Addons: Boost your workflow with default support for ffuf and sqlmap, or craft your own addons for extra fun. - Buffer Tweaks: Edit variables in a popup (e.g., b:host, b:scheme) in Interceptor/Repeater to twist requests. - Config Control: TOML files for global…
2025 · github.com
- 3HH
2021 · github.com
- 4PA
Sep 2025 · github.com
- 5AF
Serialization framework with some interesting numbers: 10-20x faster on nested objects than json/protobuf. Technical approach: compile-time codegen (no reflection), compact binary protocol with meta-packing, little-endian layout optimized for modern CPUs. Unique features that other fast serializers don't have: - Cross-language without IDL files (Rust ↔ Python/Java/Go) - Trait object serialization (Box) - Automatic circular reference handling - Schema evolution without coordination Happy to discuss design trade-offs. Benchmarks:…
Oct 2025 · fory.apache.org
- 6
- 7AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 8
An ultra-fast, single-binary MCP server written in Rust as a lightweight alternative to Node.js/Python. - StamManif/mcp-stama
24d ago · github.com
- 9PD
PicoMQ is a Rust server for Durable Streams, built on Object Store. Cheap, URL-addressable, granular streams (create/append/read/long-poll/SSE), with Pico Protocol or Durable Streams Protocol as the facade. S3Stream is the stream storage primitive, used in AutoMQ, shipped as a Rust library. Coordination is a command log in Postgres.
13d ago · picomq.com
- 10NL
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com
- 11KA
Jun 2026 · kyushu.dev
- 12FA
I've just released an early version off my project I've been working on for a few months now and would love some feedback. https://github.com/fourlexboehm/faasta I was surprised there isn't yet an open/source and standards compliant way to host wasi-http functions in a way that takes advantages of WASM, a multi tenanted application. If you're not familiar with wasi, Compared to something like AWS Lambda, this approach is much more efficient as a single process can serve 1000s of function invocations concurrently and asynchronously, instead requiring an entire VM.…
2025 · github.com
- 13
- 14WA
2016 · github.com
- 15WP
Mar 2026 · wolfscale.org
- 16
- 17HT
Hey everyone! I've been working on hsrs, a type-safe Haskell Bindings Generator for Rust. I couldn't really find any bindings generator that would create type-safe, rich bindings for Haskell from Rust. Naturally, both languages have rich type systems, so I was amazed that no awesome bindings generator already existed, hence I decided to write my own. hsrs feels very similar to pyo3 and napi-rs, and if you've used those, hsrs will feel right at home. What's unique about hsrs as opposed to hs-bindgen is that it has type-safe bindings for rich types, like Result, Maybe, etc. while also…
May 2026 · github.com
- 18BW
Nov 2025 · iggy.apache.org
- 19S5
2025 · github.com
- 20CN
Last week Cloudflare released Cap'n Web [1], a schema-free capability-based RPC protocol. I built capn-rs this week - a Rust implementation with full wire protocol compatibility. Links: GitHub: https://github.com/currentspace/capn-rs Crates: https://crates.io/crates/capnweb-server API docs: https://docs.rs/capnweb-server What's working: Wire compatibility verified via integration tests against TypeScript reference Multi-transport: HTTP batch, WebSocket, WebTransport (HTTP/3) Complete IL (intermediate language) expression evaluator…
Sep 2025 · github.com
- 21CE
We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions. We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too. It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the…
Mar 2026 · github.com
- 22AM
2025 · github.com
- 23IG
Hey HN, For years, my local development setup has been a fragile mess of tools that never quite played nicely together. On my mac, it was a constant battle with Homebrew services starting (or not starting) on boot, conflicting PHP and Node versions managed by `asdf` or `nvm`, and a collection of `docker-compose.yml` files that I'd copy-paste and tweak for every single project. The cognitive load was just too high. Setting up SSL was another chore involving `mkcert`. Sharing a quick demo with a colleague meant firing up ngrok. And if I wanted to run two projects that needed different versions…
Oct 2025 · servbay.com
- 24RR
runNburn is an Apache-2.0 Rust inference engine for quantized GGUF models that are too big for your fast memory. The core idea: weights stay file-backed (mmap), host residency stays under an explicit byte budget (--ram-budget), and GPU caches are sized from detected free/total VRAM — never from device-name presets. There is no conversion step, no sidecar cache files, no silent requantization. The GGUF on disk is the single source of truth. The result that made me want to post this: Tencent's Hy3 (295B total / 21B active sparse MoE, a single 97.8 GiB Q2_K GGUF) runs on my desktop…
Jul 2026 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →