witr
Ranked 14 of 86 privilege escalation tools by recommenders
Explains why a Linux process is running by showing its parent chain, a handier take than shell aliases. Main caveat: curl-based install and parent-only checks.
Explains why a Linux process is running by showing its parent chain, a handier take than shell aliases. Main caveat: curl-based install and parent-only checks.
28 people gave an opinion
- recommend it
- 24
- criticize it
- 4
- approval share
- 86%
Recommended in 3 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 24 people recommend itNeeds 10 or more, met.
- 6 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Handy, useful everyday terminal tool
“Very cool utility! Simple tools like these keep me glued to the terminal.”
Comment from 26 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “This is extremely useful, will be added to the toolbox.”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “This is amazing. Thank you for sharing this.”
Comment from 26 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” - Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
- Comment from 26 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
- Comment from 26 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
- Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
Better than ad hoc shell aliases
“Cool idea. Reminds me of my alias "whodis" which just lsofs a port to find out the pid who's got it open, but way more functional.”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “Great tool! I was looking to convert my decades-old shell script into something a bit more modern and user-friendly”
Comment from 1 Jan 2026 in “Show HN: Witr – Explain why a process is running on your Linux system” “I really like this. Something like this should already exist, stock.”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” Simple, minimal, no package manager
“I like that it is simple, and doesn't (thank god) need npm or some other package manager.”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “Very cool utility! Simple tools like these keep me glued to the terminal.”
Comment from 26 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
What people warn about
Each mark is one comment
Parent-process reporting appears incomplete
“mostly the ppid is outputted as the reason for starting”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “it seems like it only checks for the parent processes?”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system” “Yes, this is a bug. Planning to fix it soon.”
Comment from 27 Dec 2025 in “Show HN: Witr – Explain why a process is running on your Linux system”
Other privilege escalation tools people recommend
The four most recommended other privilege escalation tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 86 privilege escalation tools, rankedWhat people said
23 of the 31 comments that mention it, newest first. Each links to the original comment.
“Loved what they were doing, but at that time the station definitely bought into the hipster attitude”
“Great tool! I was looking to convert my decades-old shell script into something a bit more modern and user-friendly”
“and has a useful breakdown”
“I like that it is simple, and doesn't (thank god) need npm or some other package manager.”
“I'd not trust any app that parses /proc to obtain process information”
“`witr` is trying to be a bit different.”
“Yes, this is a bug. Planning to fix it soon.”
“Thanks, glad you liked it! As @darrenf mentioned, `whatis` can help with that use case.”
“mostly the ppid is outputted as the reason for starting”
“it seems like it only checks for the parent processes?”
“This is amazing and really useful to me.”
“Cool idea. Reminds me of my alias "whodis" which just lsofs a port to find out the pid who's got it open, but way more functional.”
“the LLM probably has a much better idea of what's happening than any human”
“As long as you’re auditing the LLM’s outputs and doing a decent code review I think it’s reasonable to trust this tool during incidents.”
“I really like this. Something like this should already exist, stock.”
“installing a binary via `curl` doesn't sit right with me”
“This is extremely useful, will be added to the toolbox.”
“Very cool utility! Simple tools like these keep me glued to the terminal.”
“I would love for an AUR made for this”
“This is amazing. Thank you for sharing this.”
“Nice and installed then starred.”
“i definitely see the use for it”
“This looks very handy to have around!”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.