展示HN：拨号音监视器——我的笔记本电脑在做什么，我正常吗？
嗨，HN，我们是Andrew和Dex。我们开发了Dialtone Watcher，这是一个针对macOS和Linux的小型Go代理，目标非常明确：告诉我我的机器整天在做什么，并帮助我与其他机器进行比较。
目前它的功能包括：
- 监视正在运行的进程、CPU和内存使用情况，以及活跃的网络端点。
- 按进程、域和粗略协议（如HTTPS、DNS、QUIC和Postgres）将流量分组为易于理解的摘要。
- 存储本地摘要，并可以将有限的汇总数据发布到dialtoneapp.com API，以便足够的安装可以将整体视图变为现实。
我们一直在思考同一个问题：为什么没有一个简单的工具可以回答“这台机器实际上在花费时间做什么？”活动监视器显示了一个切片，而Little Snitch显示了另一个切片。虽然有一些整体工具，但通常是在企业防火墙后面。我们想要的是更诚实和可检查的工具。真正的动机问题不仅仅是“我的笔记本电脑在做什么？”而是“我正常吗？”
假设我有一台配备14个核心和36GB内存的MacBook Pro，并且整天运行Docker。为什么Docker在我的机器上消耗的CPU和内存比类似开发者的机器多得多？为什么我有一些奇怪的辅助进程一直在后台运行？为什么我的笔记本电脑在与我不认识的域进行通信？仅凭一台机器无法回答这些问题。你需要来自多台具有可比硬件和工作负载的机器的基线数据。
<a href="https://dialtoneapp.com/demo" rel="nofollow">https://dialtoneapp.com/demo</a>
开源MIT许可证：
<a href="https://github.com/andrewarrow/dialtone-watcher" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher</a>
Andrew和我记录了我们的对话历史：
<a href="https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts</a>
这个大想法是众包威胁情报。每个安装的代理都成为一个传感器。每个传感器报告进程与域的连接、DNS活动、连接频率、传输的字节数，以及基本的IP上下文信息，如ASN和国家。在一台机器上，这些数据可能只是微不足道的。但在成千上万台机器上，这些数据会迅速变得强大。
像CrowdStrike和SentinelOne这样的安全公司正是这样做的。但这些产品仅限企业使用，价格昂贵且不透明。
如果某个未知的辅助进程在一小时内突然开始与27台机器上的同一个奇怪域进行通信，那就是一种模式。如果一个所谓的PDF查看器正在向几乎没有人见过的域上传18MB的数据，那就开始看起来像是数据外泄。如果一个新的VSCode版本是唯一一个与某个随机域通信的构建，那就开始像是供应链问题。如果Slack或Docker的行为突然与类似开发者机器的基线完全不同，你也可以标记这一点。
我们认为有必要为普通开发者提供更开放、可检查和有用的工具。如果你尝试这个工具，反馈应集中在摘要的可读性、进程和域归属的正确性、上传负载是否合理，以及哪些比较实际上能帮助你判断“我正常吗？”如果足够多的人安装、运行并发送数据，演示就会变得真实，而真正的产品也会变得更智能。
我想留给你们一个问题：现代软件项目是否应该包含这样的提示目录？记录使用的提示几乎不需要什么努力，而这些提示就像git历史一样讲述了一个故事。
查看原文
Hi HN we are Andrew and Dex. We built dialtone watcher, a small Go agent for macOS and Linux with a very specific goal: tell me what my machine is doing all day and help me compare that with others.<p>What it does so far:<p>- Watches running processes, CPU and memory use, and active network endpoints.<p>- Groups traffic into human sized summaries by process, domain, and coarse protocol like HTTPS, DNS, QUIC, and Postgres.<p>- Stores a local summary and can post bounded rollups to the dialtoneapp.com api so enough installs can turn the fleet view into something real.<p>We kept circling the same question: why is there no simple tool that answers “what does this machine actually spend its day doing?” Activity Monitor shows one slice. Little Snitch shows another. Fleet tools exist, but usually behind a corporate wall. We wanted something more honest and inspectable. The real motivating question was not just "what is my laptop doing?" but "am I normal?"<p>Say I have a MacBook Pro with 14 cores and 36 GB of memory and I run Docker all day. Why is Docker chewing so much more CPU and RAM on my machine than on similar developer machines? Why do I have some weird helper process that keeps hanging around? Why is my laptop talking to domains I do not recognize? You cannot answer those questions from one machine alone. You need a baseline from many machines with comparable hardware and comparable work.<p><a href="https://dialtoneapp.com/demo" rel="nofollow">https://dialtoneapp.com/demo</a><p>Open source MIT License:
<a href="https://github.com/andrewarrow/dialtone-watcher" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher</a><p>Andrew and I kept a history of our conversations in:<p><a href="https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher/tree/main/pr...</a><p>The big idea is crowdsourced threat intelligence. Every installed agent becomes a sensor. Each one reports process to domain connections, DNS activity, connection frequency, bytes transferred, and basic IP context like ASN and country. On one machine that data is mildly interesting. Across thousands of machines it becomes powerful very fast.<p>Security companies like CrowdStrike and SentinelOne do exactly this. But those products are enterprise-only, expensive, and opaque.<p>If some unknown helper suddenly starts talking to the same odd domain on 27 machines in an hour, it's a pattern. If a so called PDF viewer is uploading 18 MB to a domain almost nobody has seen before, that starts to look like exfiltration. If a new VSCode release is the only build talking to some random domain, that starts to smell like a supply chain problem. If Slack or Docker suddenly behaves nothing like the baseline for similar developer machines, you can flag that too.<p>We think there is room for something more open, inspectable, and useful for normal developers. If you try this, feedback should focus on readability of the summary, correctness of process and domain attribution, whether the upload payload feels proportionate, and what comparisons would actually help you decide "am I normal?" If enough people install it, run it, and send data, the demo becomes real and the real product gets much smarter.<p>I'll leave you with the following question. Should modern software projects include a prompts directory like this? It takes so little effort to capture the prompts used and they tell a story like git history does.