Solo Developer Builds Windows Security Suite in Python, Documents Its Own Weaknesses

·1 views

Developer Akhouri Anmol Kumar has built ATLOCK v4, a roughly 3,000-line single-file Python security suite for Windows that ships as a standalone executable requiring no installation. The tool bundles four subsystems — OS-level lockdown, NTFS file locking, an encrypted password vault, and webcam-based intruder detection — behind a single desktop interface. The password vault uses PBKDF2-HMAC-SHA256 with 200,000 iterations and per-vault random salts, with each entry individually encrypted using Fernet, and no decrypted data stored at rest. A noted trade-off is that settings-level secrets rely on a weaker machine-bound key derived from Windows system identifiers and a hardcoded salt, which the developer openly acknowledges would not resist a determined attacker with local access. The project is open-source and notable for its in-code transparency about the security model's limitations, an uncommon practice in hobbyist security tooling.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Matplotlib Session 2: Bar Charts, Histograms, Scatter Plots and Subplots Explained

A DEV Community tutorial builds on basic Matplotlib line-plotting skills by introducing four core chart types used in data analysis. Bar charts and horizontal bar charts are covered for comparing discrete categories, while histograms are explained for visualising the distribution of continuous numeric data. Scatter plots are demonstrated to reveal relationships between two variables, with an extension into bubble charts that encode a third variable through marker size and colour. The guide also introduces subplots, enabling analysts to display multiple views of data within a single figure. Practical Python code examples accompany each chart type, with tips on when to use each and common beginner mistakes to avoid.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a COEP header silently killed a browser-based WASM image compressor in production

A development team shipping a privacy-focused, browser-side image compressor built with Rust, WASM, and WebGPU encountered a critical production failure after enabling cross-origin isolation headers. Activating Cross-Origin-Embedder-Policy with 'require-corp' caused all compression formats — JPG, PNG, WebP, and AVIF — to crash simultaneously, as nested rayon workers spawned by the multi-threaded WASM build were blocked by COEP. The bug was invisible in local and staging environments because it only surfaced under real cross-origin isolation, making it difficult to detect before reaching production traffic. The root cause was a flawed logic gate that automatically loaded the multi-threaded package whenever crossOriginIsolated was true, meaning the same header enabling shared memory also triggered the code path that COEP then blocked. The fix involved three loader-level changes: decoupling thread usage from COI detection behind an explicit user opt-in, defaulting to a single-threaded WASM build, and adding a self-healing fallback that retries on the safe path if a worker crashes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Travel Planners Still Struggle to Understand Your Personal Trade-Offs

Current AI travel tools can generate itineraries within seconds, but they largely rely on surface-level preferences like budget, destination, and travel dates rather than understanding how individuals actually make decisions. Two travelers with identical parameters can want entirely different trips based on personal priorities — such as preferring a quiet neighborhood over a central location, or valuing one expensive meal over multiple tourist attractions. The gap lies in trade-offs: what a traveler is willing to sacrifice for what they truly value. Great human travel agents learn these nuances by asking probing questions and sometimes pushing back on a client's own stated plans. The next generation of agentic AI must move beyond recommendation engines and develop the ability to make judgment calls on a user's behalf — a significantly harder challenge than simply generating text.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rails Config Module Rebuilt With Lazy Loading and Three-Source Key Resolution

A Rails developer has released a redesigned configuration module that replaces manual YAML wiring with automatic resolution across environment variables, encrypted credentials, and YAML files. The updated module uses Ruby's const_missing to load namespaces lazily, meaning only referenced configurations are instantiated at runtime. A Mutex guard prevents duplicate namespace creation in multi-threaded servers like Puma. Key lookups follow a predictable ENV naming convention, and bang methods such as Config::Bot.api_key! raise an error immediately if a value is missing, aiding fast failure in initializers. The full code is available on GitHub, and the author notes the approach shares conceptual overlap with the layered credentials API being introduced in Rails 8.2.

0 comments Read more at DEV Community