Developer builds real Windows file lock using OS-level ACLs, not app tricks

·1 views

A developer building a tool called File Guard for ATLOCK found that most Windows file-locking apps rely on hiding or renaming files rather than enforcing true access restrictions. To create genuine protection, they used Windows NTFS Access Control Lists (ACLs), which strip read and write permissions at the operating system level so no application can bypass them. The approach means Windows itself blocks unauthorized access, independent of the locking app's own process. The tool also captures intruder photos or video on failed password attempts using a background thread, keeping the UI responsive and inconspicuous. The developer argues that meaningful file security must be enforced at the OS or filesystem layer, not through app-level password prompts alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Agents Often Run on Human Credentials, Creating Enterprise Security Blind Spots

Many AI agents deployed in enterprises lack their own distinct identities and instead operate using API keys, tokens, and credentials originally issued to humans or workloads. Because no enterprise identity provider typically mediates these exchanges, agent activity can fall outside standard governance and access reviews. Security experts warn that the problem is fundamentally about unmanaged secrets before it becomes an identity issue. Organizations are advised to first locate where agent credentials reside and who owns them, while simultaneously blocking new credential exposure. The recommended end state is replacing reusable, standing credentials with agent-specific or delegated identities backed by scoped, short-lived tokens that limit the damage if compromised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds tool to make git diff understand JSON and YAML structure

A developer created a custom tool to give git diff semantic awareness of structured data formats like JSON and YAML, after a Kubernetes manifest formatter reordered keys and produced noisy, misleading diffs. Git offers two extension points for this: an external diff driver that fully replaces the diff output, and a textconv filter that normalises file content before comparison. A key discovery was that these two hooks behave differently across git commands — the external driver only activates for git diff, while history commands like git log -p and git show fall back to textconv. Several edge cases required careful handling, including invalid mid-edit files that could abort an entire diff run, temp files without reliable extensions, and encoding issues that could silently erase content. The author recommends starting with a simple shell shim for existing tools, but notes a dedicated subcommand offers better error messaging, cross-platform support, and more reliable file-type detection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Duplicate Consent Records: Why a Stable Event ID Is Essential for Compliance

When a customer withdraws marketing consent, that single action can trigger multiple system deliveries due to network failures, webhook timeouts, or queue replays in distributed architectures. Without a mechanism to distinguish a redelivered message from a new customer decision, consent history logs may incorrectly record the same withdrawal twice. This creates serious risks for Privacy, Compliance, and Legal teams who rely on accurate consent histories to understand user intent. A stable, unique event ID — assigned once per consent action and retained across retries — allows receiving systems to recognize and discard duplicates without creating false records. Industry standards such as the CloudEvents specification from the Cloud Native Computing Foundation already recommend this approach for exactly this reason.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Custodial Services Can Issue Deposit Addresses Without Holding Private Keys

A software developer has published a Python package called chain-addresses that allows custodial services to generate cryptocurrency deposit addresses using only an extended public key, eliminating the need to expose private keys on internet-facing servers. The approach derives deposit addresses from an account-level extended public key, separating address issuance from spending authority entirely. Traditional methods that ask a node for a fresh address bundle key custody, address gap tracking, and wallet recovery into a single component reachable via HTTP, creating a broad attack surface. The package explicitly refuses hardened derivation paths and private key inputs, making the security boundary a verifiable code property rather than a configuration assumption. It supports multiple address encodings including Bitcoin P2WPKH, P2TR, and EVM formats, mapping a single derived public key to several address types.

0 comments Read more at DEV Community