Project ideas from Hacker News discussions.

Why older tech is sometimes safer from hackers

📝 Discussion Summary (Click to expand)

Theme 1 – Security through obscurity/antiquity is unreliable
Many commenters pointed out that relying on old or obscure software (e.g., Eudora, MS‑DOS) for safety is just “security through obsolescence,” which fails once an attacker decides to target you.

“Security through 'obsolescence' is no different from security through obscurity - therefore, it doesn't work.” – postexitus
“The client … isn't secure because it has no security vulnerabilities - it is secure because nobody bothers to target Eudora users in general.” – badsectoracula

Theme 2 – AI makes targeted attacks cheap and easy
Several users noted that AI dramatically reduces the effort needed to find and exploit niche systems, undermining the “nobody will bother” argument.

“Hey AI go individually research and target county clerks for getting direct access to their {specific system} is much more practical today than it was 10 years ago.” – jerf
“The whole ‘they won’t hack me because they won’t bother to target Eudora running on AIX 3.1’ is flawed in an age when AI is both ubiquitous and cheap.” – rbanffy

Theme 3 – Critical infrastructure must be networked, but needs proper security
The discussion on water/power utilities highlighted that geographic distribution demands communication links (often the internet for cost and simplicity), yet the connection must be treated as untrusted and protected with strong security measures.

“The water and power utilities are themselves large distributed systems. They need communications between elements … You really need to treat it as untrusted and build your security on top with encryption, authentication, authorization, etc.” – saltcured
“Remote monitoring … central control over large systems clearly has benefits … but the benefits are obvious, and the security risks must be managed.” – delecti (paraphrased)


🚀 Project Ideas

LegacyFuzz AI

Summary

  • AI-guided fuzzing engine that automatically discovers vulnerabilities in legacy and obscure software binaries.
  • Delivers continuous testing reports and remediation guidance for organizations that rely on security through obscurity.
  • Core value: shifts from reactive obscurity to proactive vulnerability discovery, reducing the risk of AI‑enabled targeted attacks.

Details

Key Value
Target Audience Companies using legacy/industrial software (e.g., Eudora users, OT systems, embedded firmware)
Core Feature AI-driven fuzzing + automated exploit generation + patch recommendations
Tech Stack Python, Rust (fuzzing harness), LLMs (Anthropic Claude/GPT‑4), Docker, Kubernetes
Difficulty High
Monetization Revenue-ready: subscription per scanned binary or per month

Notes

  • HN user postexitus warned: “in the age of Claude - I am pretty sure I can destroy your legacy software in minutes” – LegacyFuzz AI gives defenders the same AI power to find those bugs first.
  • rbanffy noted AI makes targeting cheap: “it requires just a few seconds of a GPU server” – this service turns that advantage into a defensive tool.
  • Potential for discussion on responsible disclosure, continuous fuzzing cadence, and integrating with CI pipelines for legacy builds.

OTGuard Zero Trust Edge

Summary

  • Hardware/software appliance that enforces zero‑trust network segmentation for SCADA/utility environments.
  • Provides mutual TLS, device identity, microsegmentation, and anomaly detection without rip‑and‑replace of existing OT gear.
  • Core value: secure remote monitoring and control of water/power utilities while preventing lateral movement and internet‑based attacks.

Details

Key Value
Target Audience Operators of critical infrastructure (water, power, utilities) and OT security teams
Core Feature Zero‑trust gateway with policy engine, mTLS, IDS/IPS, and centralized management
Tech Stack Go, Envoy proxy, WireGuard, eBPF, Prometheus, Grafana
Difficulty Medium
Monetization Revenue-ready: appliance sale + annual support subscription

Notes

  • saltcured emphasized: “The water and power utilities are themselves large distributed systems… need communications between elements” – OTGuard secures that communications.
  • fishfasell noted remote monitoring as a key benefit; OTGuard provides it without exposing OT to the public internet.
  • HN community would appreciate a practical zero‑trust solution for OT, sparking debate on balancing legacy gear with modern security controls.

ObscurityLens

Summary

  • SaaS that measures an organization's reliance on security through obscurity by inventorying software versions, exposed services, and public footprint.
  • Returns an obscurity score and actionable recommendations: when obscurity is sufficient vs when hardening is needed.
  • Core value: helps decision‑makers quantify the risk of legacy/obscure security posture and allocate resources effectively.

Details

Key Value
Target Audience Security managers, CISOs, auditors of companies using legacy or niche software
Core Feature Automated asset discovery, version fingerprinting, obscurity scoring engine, remediation playbook
Tech Stack Node.js/React backend, Python scanners, Elasticsearch, AWS Lambda
Difficulty Medium
Monetization Revenue-ready: tiered SaaS pricing based on number of assets

Notes

  • rbanffy critiqued the “they won’t bother to target Eudora” mindset as flawed in an AI‑rich era – ObscurityLens makes that mindset measurable.
  • postexitus called security through obscurity ineffective; this tool gives a concrete metric to test that claim.
  • Would stimulate HN discussion on the usefulness of obscurity scoring, balancing risk acceptance vs hardening investments.

Read Later