Ghost in the BISO: A Local AI Tool for Surfacing Forgotten Security Risks

·2 views

A developer submitted a Halloween-themed AI project called The Ghost in the BISO to a Hacktoberfest open-source challenge. The tool is a local-first companion that analyzes a fictional security risk register to flag aging findings, missing owners, and evidence gaps. It offers four features: a risk radar dashboard, an evidence checklist generator, natural-language questioning of the register, and a leadership briefing draft. The builder used Python, Streamlit, Pandas, and Ollama with the open-weight Qwen3 model, keeping calculations deterministic and AI limited to explanations. The project runs on synthetic data so sensitive enterprise records never leave the user's machine.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tutorial Shows How to Export We Work Remotely Job Listings to CSV or Google Sheets

A DEV Community post explains that We Work Remotely's public RSS feeds show only the newest listings and lack clean fields for company, region, or job type. It describes a hosted Apify actor, pennydata/wwr-remote-jobs-feed, that reads these feeds and returns structured rows. The article includes Python code that calls the actor with category, keyword, region, and posting-age filters and writes the results to a CSV file for import into Google Sheets. It also recommends scheduling the actor daily and filtering for previously unseen URLs to maintain a de-duplicated list. The author discloses that they built the actor and earn from its runs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Strong Resume Without Work Experience: A Canadian Student's Guide

The guide addresses students applying for co-op, internship, or part-time roles who feel trapped by postings that demand prior experience. It recommends opening with a short summary that states the applicant's program, skills, and availability for the role. Education should be prioritized, listing the program, school, graduation date, and relevant coursework or academic achievements. Volunteering, campus jobs, freelance work, and similar activities can be presented in job-style bullet points with measurable results. For tech students, a dedicated projects section with tools used, outcomes, and linked code is presented as especially valuable, and the resume should stay within one page.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codename One Restores Installable Offline Web App Support for Java Browser Apps

Codename One has restored progressive web app support after it was lost in the move from TeaVM to ParparVM, letting users install browser apps on supporting browsers. The ParparVM JavaScript build now automatically generates a manifest, home-screen icons and a service worker, with no separate enablement step, and the bundle should be deployed over HTTPS including subdirectories. A service worker caches generated application files so the app can launch offline, but it does not cache API responses, proxied requests or external resources. The framework notes that data synchronization and offline behavior, such as blocking actions that require a server, remain the developer's responsibility. Developers can customize the app's identity through build settings, and the article advises testing installation, offline behavior and update activation before deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Using Samba discovery and SMB signing tests to verify file-server enforcement

The article explains how exposed Samba servers identified through ZoomEye can serve as candidates for an SMB signing review, though a product match alone does not show whether a share enforces signing. It reports that a ZoomEye query returned 74,610 matching records at one point in time, noting this counts observations rather than verified shares or unsigned servers. The author recommends building a client-to-server matrix covering dialects, signing settings, authentication, and dependent clients for each owned server. Verification should involve controlled tests with unsigned and intended clients, plus checking event logs on both sides to confirm the negotiated signing state. Unrecognized owned matches should be investigated for ownership, and any production signing exceptions should be isolated with a named remediation owner.

0 comments Read more at DEV Community