Show HN: Firefighter.sh – an insane solution to the current CVE apocalypse

Firefighter.sh launched as an experimental harness that runs with root access and zero confirmations to continuously patch servers against published vulnerabilities, pulling official disclosure feeds into a shared hub and broadcasting notices to clients whose LLMs check versions, exposures and logs, apply package or code fixes, test changes, invoke key-rotation hooks, verify service health and roll back when supplied. The project's own site warns "You have to be insane to run this" and calls the approach "experimental, unproven," betting that an LLM with root access is less of a risk than a slow human, and advises keeping tested, independent backups. Installation is a single command, curl -fsSL https://firefighter.sh | sudo bash, which runs as a root service and gives an LLM root access.

Listen The hub pulls official vulnerability sources centrally, then broadcasts notices to every client. Firefighter is a harness that constantly and continuously patches your server, running with root access and zero confirmations You have to be insane to run this. Read the risks before installing ↗ https://firefighter.sh/faq/ Each client’s LLM checks its own versions, exposures, logs, and evidence. The client’s LLM applies package or code fixes, tests changes, contains exposures, and invokes the configured key rotation hooks. Checks the fix and service health, uses rollback when supplied, and sends a report to an agent of your choice. This is an experimental, unproven approach. The bet is that a LLM with root access is less of a risk than a slow human. Keep tested, independent backups and read the FAQ https://firefighter.sh/faq/ . curl -fsSL https://firefighter.sh | sudo bash Notice: this runs as a root service and gives an LLM root access. Public disclosures from one shared intake. Every client evaluates them locally. Checking source status… Connecting to the shared notice feed… Only actual published notices appear here.