Show HN: Dialtone 观察器——我的笔记本在干什么？我正常吗？
1 分•作者: fcpguru•5 个月前
大家好，我们是 Andrew 和 Dex。我们开发了 dialtone watcher，一个基于 Go 语言的小型代理程序，适用于 macOS 和 Linux 系统，其目标非常明确：告诉我我的机器一整天都在做什么，并帮助我将其与其他人的机器进行比较。
目前的功能包括：
* 监控正在运行的进程、CPU 和内存使用情况以及活跃的网络端点。
* 按进程、域名和粗略的协议（如 HTTPS、DNS、QUIC 和 Postgres）将流量分组，形成人类可读的摘要。
* 存储本地摘要，并可以将受限的汇总数据发布到 dialtoneapp.com 的 API，这样，当有足够多的安装量时，就可以将整个集群的视图变成现实。
我们一直在思考同一个问题：为什么没有一个简单的工具可以回答“这台机器实际上每天都在做什么？” 活动监视器显示了一个方面。Little Snitch 显示了另一个方面。虽然存在一些集群工具，但通常都位于企业防火墙之后。我们希望得到一些更诚实、更可检查的东西。真正促使我们开发这个工具的问题不仅仅是“我的笔记本电脑在做什么？”，而是“我正常吗？”
假设我有一台配备 14 核和 36 GB 内存的 MacBook Pro，并且我一整天都在运行 Docker。为什么 Docker 在我的机器上消耗的 CPU 和 RAM 比在类似的开发人员机器上多得多？为什么我有一些奇怪的辅助进程一直存在？为什么我的笔记本电脑会与我不认识的域名通信？你无法仅从一台机器上回答这些问题。你需要从许多具有可比硬件和可比工作量的机器上获得一个基线。
[https://dialtoneapp.com/demo](https://dialtoneapp.com/demo)
开源 MIT 许可证：
[https://github.com/andrewarrow/dialtone-watcher](https://github.com/andrewarrow/dialtone-watcher)
Andrew 和我将我们的对话记录保存在：
[https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts](https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts)
我们的核心理念是众包威胁情报。每个已安装的代理程序都成为一个传感器。每个传感器都会报告进程到域的连接、DNS 活动、连接频率、传输的字节数以及基本的 IP 上下文，如 ASN 和国家/地区。在一台机器上，这些数据略有意思。但在数千台机器上，它会迅速变得强大。
像 CrowdStrike 和 SentinelOne 这样的安全公司也在做同样的事情。但这些产品仅限于企业使用，价格昂贵且不透明。
如果某个未知的辅助程序突然在一小时内开始与 27 台机器上的同一个奇怪域名通信，这就是一种模式。如果一个所谓的 PDF 查看器正在向一个几乎没有人见过的域名上传 18 MB 的数据，这看起来就像是数据泄露。如果一个新发布的 VSCode 版本是唯一与某个随机域名通信的构建版本，这开始闻起来像供应链问题。如果 Slack 或 Docker 的行为突然与类似开发人员机器的基线完全不同，你也可以标记出来。
我们认为，对于普通开发人员来说，存在一个更开放、更可检查、更有用的工具的空间。如果你尝试使用它，反馈应该侧重于摘要的可读性、进程和域名归属的正确性、上传负载是否合理，以及哪些比较实际上可以帮助你判断“我正常吗？” 如果有足够多的人安装、运行并发送数据，演示就会变成现实，而真正的产品也会变得更加智能。
最后，我想问大家一个问题。现代软件项目是否应该包含像这样的 prompts 目录？捕获所使用的 prompts 只需要很少的努力，它们就像 git 历史记录一样讲述一个故事。
查看原文
Hi HN we are Andrew and Dex. We built dialtone watcher, a small Go agent for macOS and Linux with a very specific goal: tell me what my machine is doing all day and help me compare that with others.<p>What it does so far:<p>- Watches running processes, CPU and memory use, and active network endpoints.<p>- Groups traffic into human sized summaries by process, domain, and coarse protocol like HTTPS, DNS, QUIC, and Postgres.<p>- Stores a local summary and can post bounded rollups to the dialtoneapp.com api so enough installs can turn the fleet view into something real.<p>We kept circling the same question: why is there no simple tool that answers “what does this machine actually spend its day doing?” Activity Monitor shows one slice. Little Snitch shows another. Fleet tools exist, but usually behind a corporate wall. We wanted something more honest and inspectable. The real motivating question was not just "what is my laptop doing?" but "am I normal?"<p>Say I have a MacBook Pro with 14 cores and 36 GB of memory and I run Docker all day. Why is Docker chewing so much more CPU and RAM on my machine than on similar developer machines? Why do I have some weird helper process that keeps hanging around? Why is my laptop talking to domains I do not recognize? You cannot answer those questions from one machine alone. You need a baseline from many machines with comparable hardware and comparable work.<p><a href="https://dialtoneapp.com/demo" rel="nofollow">https://dialtoneapp.com/demo</a><p>Open source MIT License:
<a href="https://github.com/andrewarrow/dialtone-watcher" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher</a><p>Andrew and I kept a history of our conversations in:<p><a href="https://github.com/andrewarrow/dialtone-watcher/tree/main/prompts" rel="nofollow">https://github.com/andrewarrow/dialtone-watcher/tree/main/pr...</a><p>The big idea is crowdsourced threat intelligence. Every installed agent becomes a sensor. Each one reports process to domain connections, DNS activity, connection frequency, bytes transferred, and basic IP context like ASN and country. On one machine that data is mildly interesting. Across thousands of machines it becomes powerful very fast.<p>Security companies like CrowdStrike and SentinelOne do exactly this. But those products are enterprise-only, expensive, and opaque.<p>If some unknown helper suddenly starts talking to the same odd domain on 27 machines in an hour, it's a pattern. If a so called PDF viewer is uploading 18 MB to a domain almost nobody has seen before, that starts to look like exfiltration. If a new VSCode release is the only build talking to some random domain, that starts to smell like a supply chain problem. If Slack or Docker suddenly behaves nothing like the baseline for similar developer machines, you can flag that too.<p>We think there is room for something more open, inspectable, and useful for normal developers. If you try this, feedback should focus on readability of the summary, correctness of process and domain attribution, whether the upload payload feels proportionate, and what comparisons would actually help you decide "am I normal?" If enough people install it, run it, and send data, the demo becomes real and the real product gets much smarter.<p>I'll leave you with the following question. Should modern software projects include a prompts directory like this? It takes so little effort to capture the prompts used and they tell a story like git history does.