Developer Openly Admits His Security App Once Used Weak XOR Obfuscation Instead of Real Encryption

·1 views

Akhouri Anmol Kumar, developer of Windows security suite ATLOCK, has published a candid post-mortem revealing that earlier versions of the app's Password Vault used XOR obfuscation — not genuine encryption — to store user credentials. Kumar acknowledged the flaw was present in a released version and could have been cracked within minutes by a determined attacker. Version 4 of ATLOCK replaced XOR with Fernet (AES-128-CBC with HMAC), while the master password is now hardened using PBKDF2-HMAC-SHA256 with 200,000 iterations and a unique random salt per installation. The update also introduced failed-attempt masking before any data touches disk, NTFS ACL-based file locking, and safe PowerShell notification handling to eliminate shell-injection risks. Kumar urged users evaluating any security tool to ask vendors about past vulnerabilities, arguing that honest post-mortems build more trust than vague claims of "military-grade" protection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developers Build Zero-Dependency Java JSON Parser in 72-Hour Hackathon

A team participating in the ZeroDepsHack 2026 hackathon built JValue, a fully functional JSON parser and serializer in Java, using no third-party libraries whatsoever. The project relied solely on the Java standard library, including hand-written recursive-descent parsing, a custom test runner, and a 15-command CLI built without any external frameworks. Developers also implemented a JDK-only file fetcher to download test corpora, replacing common tools like curl and JUnit. The team documented 12 specific substitutions where third-party libraries were replaced by standard library equivalents, honestly noting the tradeoffs involved. The exercise was intended to test whether modern Java development could function without the dependency ecosystem most projects take for granted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Code Review Test Reveals Which Tools Actually Read Your Rules Files

A developer designed a controlled experiment to determine whether AI code review tools genuinely read project-specific rule files like CLAUDE.md and AGENTS.md, or simply rely on general best practices. Two tools, CodeRabbit and Qodo, were tested against a small Cloudflare Worker API that deliberately violated two rules: one widely-known security bad practice and one obscure internal naming convention. Both tools flagged the security violation, but that test proved little since any standard scanner would catch it regardless of file access. Only Qodo successfully identified the camelCase route naming violation — a purely internal convention with no external reference — and traced its functional impact on real requests. The experiment highlights a meaningful gap in AI code review reliability when enforcing custom, repo-specific conventions at scale.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Common Myths That Blur the Line Between AI Models and Actual Servers

A technical FAQ published on DEV Community identifies five widespread misconceptions that cause developers to conflate AI language model outputs with real server-side execution. The piece clarifies that a free model provides token prediction only, with no bundled compute or server infrastructure attached. It also explains that environment variables set inside a chat or markdown code block do not affect any running process on an actual machine. The author recommends a set of shell checklists — including hostname, pwd, and export verification commands — to confirm whether a task was genuinely executed on a server rather than merely described by the model. The article was prepared as part of outreach for MonkeyCode, a platform the author uses for free model access and server resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ex-cameraman builds AI photo caption tool solo after spending 20 minutes per post

Marco, a 25-year TV cameraman turned photographer based in Dublin, built CAPTD to solve a personal pain point: writing captions, hashtags, and alt text for photos was taking him 20 minutes per post. Using AI-assisted development despite no prior coding experience, he created the tool over roughly six months using TanStack Start, Supabase, Google Gemini, and Vercel. CAPTD generates platform-specific content packs for nine social networks, supports ten languages, and includes features like a Creator Voice tone system and a free 28-lesson photography academy. The platform requires no signup to use its core generator, a deliberate decision by Marco to lower the barrier for new users. A major post-redesign bug silently broke multi-language output and mobile generation without triggering any errors, marking a critical challenge in the tool's development.

0 comments Read more at DEV Community