FreeRave

16 Mar

Hello Bluesky! 👋 "Hello World" from a Dev-Tools & Mobile Engineer. I’m the creator of 7 VS Code extensions and the DotSuite ecosystem (DotScramble, DotEnvy, etc.). I write about Python, Kotlin, Flutter, and building AI tools.

I built DotScramble: a Linux app that hides faces, license plates and text in photos, and strips the GPS and camera data hidden in the file, before you share. Everything stays on your computer. Open source.

On save it keeps, strips or fakes the EXIF (GPS, camera, timestamps), with a report of each field first. AI Evasion adds a noise pattern that hides a face from a detector. Tested against MediaPipe, not every system.

github.comGitHub - kareem2099/DotScramble: 🔐 A powerful, modular image privacy protection tool. Redact faces, text, and EXIF metadata from images with AI and batch processing. Supports LTR/RTL (Arabic) interfac...🔐 A powerful, modular image privacy protection tool. Redact faces, text, and EXIF metadata from images with AI and batch processing. Supports LTR/RTL (Arabic) interface. - kareem2099/DotScramble

AppImage / .deb / Arch / tarball, all GPG-signed. 7 languages incl. Arabic RTL. github.com/kareem2099/DotScramble Write-up: dev.to/freerave/i-b...

Detect outlines every region before anything changes, and you click to skip the ones you want to keep. Compare drags a divider across before / after. Seven effects, from blur to oil paint.

1/ I built a file converter for Linux that lives in a radial menu: right-click a file, a wheel blooms, pick a format, done. 440+ conversions (images, PDF, SVG, video, audio, Office), all local, open source.

3/ Opens from the file manager, a global hotkey, watched folders, or the terminal. A daemon makes it appear in ~0.1 s. Drag it to the screen edge and it docks as a tab with a half wheel on hover.

github.comGitHub - kareem2099/DotMorph: Radial-menu file converter for Linux: 440+ conversions for images, PDF, SVG, video, audio, Office and Markdown. Edge dock, global hotkey, file-manager menus. Part of DotS...Radial-menu file converter for Linux: 440+ conversions for images, PDF, SVG, video, audio, Office and Markdown. Edge dock, global hotkey, file-manager menus. Part of DotSuite. - kareem2099/DotMorph

4/ pipx install 'dotmorph[gui]' or the AppImage / .deb / Arch package, all signed. Also on AppImageHub and OpenDesktop. github.com/kareem2099/DotMorph Write-up: dev.to/freerave/i-b...

2/ Under the hood it drives Pillow, librsvg, poppler, Ghostscript, ImageMagick, ffmpeg, LibreOffice and pandoc, and only offers the conversions your machine can actually do.

1/6 Most password managers have a backup dilemma: Export to unencrypted CSV and you dump plaintext secrets on disk. Use proprietary cloud sync and you give keys to a 3rd party. Part 2 of our DotGhostBoard 2.1 "Leviathan" deep dive is live! #Linux #Security

5/6 Coordinated Plaintext History Sweep When you copy a key, it enters clipboard history before the Vault. We closed this gap: Saving/deleting a secret sweeps matching unencrypted entries from SQLite history. Plus 3-version encrypted history with 1-click revert!

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

6/6 Read the full Part 2 Deep Dive on Dev.to: dev.to/freerave/dot... ⭐ GitHub (523 tests passing • Apache-2.0): github.com/kareem2099/D... Try it on Linux! 🐧

3/6 Built-in CSPRNG Password Generator No switching windows to generate credentials. Built on Python's secrets module (/dev/urandom). Features live keyspace entropy: H = L × log₂(N). Visual meter up to 131 bits (Fort Knox) + UUIDv4, Base64, Hex presets! #DevOps

4/6 Secret Expiry Tracking & Badges API keys and production tokens shouldn't live forever. DotGhostBoard 2.1 introduces calendar-based expiry with dynamic visual badges: • ⛔ EXPIRED • ⚠️ 3d left • ⏳ Active countdown Never let stale credentials linger unnoticed.

2/6 Standalone .vault Binary Backups We engineered a tamper-proof package format: DGBV header + version + 16B salt + 12B nonce + ciphertext + 16B GCM tag. Authenticated with AES-256-GCM + AAD. Modifying 1 bit triggers instant cipher rejection. 100k PBKDF2 rounds.

1/6 Most clipboard managers treat every copied item the same: inert text in a database. With DotGhostBoard 2.1 "Leviathan", your clipboard understands what it's holding and surfaces actions immediately. Part 1 of our technical deep dive is live! #Linux #OpenSource

5/6 Coming Next in Part 2 Next up, our cryptographic security stack: • Standalone .vault backup packages (AES-256-GCM + AAD) • CSPRNG Password Generator with 131-bit entropy meter • Secret expiry tracking & status badges • Plaintext clipboard history sweeps

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

6/6 📖 Read Part 1 on Dev.to: dev.to/freerave/dot... ⭐ GitHub (523 tests passing • Apache-2.0): github.com/kareem2099/D... Try it on Linux today! 🐧

3/6 Instant Smart Auto-Tagging Copied text is classified and tagged on the fly: • #link — Web URLs • #json — Minified/raw JSON • #secret — API keys, JWTs, AWS tokens • #code — Python, JS, Bash snippets • #ip, #email, #path, #hash Seamlessly searchable and filterable.

4/6 Contextual Inline Smart Actions No more window switching: • ⚙️ { } Format JSON: 1-click 2-space indentation • 🔗 Open Link: Direct launch in browser • 🛡️ Send to Vault: Envelope encryption for secrets • 📡 Copy Clean IP: Strips log noise instantly Productivity in 1 click.

2/6 Zero AI. Zero Cloud. Under 1ms. Using an LLM for clipboard text is a privacy & latency nightmare. Instead, we built a deterministic engine using pre-compiled regex, Shannon entropy & fast heuristics. Typical payloads (< 5KB) classify in 8–82 µs! #Python #DevOps

1/6 Maintaining 7 VS Code extensions across 2 marketplaces (19,500+ downloads) is great—until you have to sync versions & metrics by hand. Instead of spinning up a backend, I built a zero-dependency dual-path synchronizer. Here’s how it works

5/6 The best part? No backend required: ❌ No server ❌ No database ❌ No auth layers Because both store APIs support CORS, vanilla JS in the browser + scheduled GitHub Actions handles the entire pipeline cleanly and for free.

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

6/6 Read the full engineering deep dive: 📖 Dev.to: dev.to/freerave/bui... 🌐 Live: universe.dotsuite.dev ⭐ GitHub: github.com/kareem2099/d...

3/6 The Architecture: Dual-Path Sync Runtime Path: Browser fetches store APIs directly via CORS and caches in localStorage for 24 hours. Build/CI Path: A Node script runs daily via GitHub Actions to keep the static README and HTML fallback fresh.

4/6 Two key engineering decisions: 1️⃣ 24h Cache TTL: Extensions update over days/weeks, not minutes. 24h is a practical default that stops redundant API calls. 2️⃣ Clean Git History: CI checks `git diff --staged --quiet` so it only commits when numbers actually change!

2/6 The problem: VS Marketplace and Open VSX expose completely different APIs. Every new release meant: • Checking 2 dashboards • Calculating total installs • Editing HTML cards & README badges I needed one source of truth for both live visitors and the static repo.

A .vsix file is not a compiled binary. It is literally just a ZIP archive containing plain JavaScript. If your build pipeline injects a secret before packaging, anyone can extract it in seconds with unzip and grep. Here is how we eliminated embedded client secrets in DotEnvy

The Scanner Paradox: Marketplace scanners then flagged DotEnvy for leaking AWS and Stripe keys — because our regex patterns DETECTED them! We resolved false positives via runtime pattern construction: new RegExp(['A', 'KIA', '[0-9A-Z]{16}'].join('')) + pre-publish CI/CD gates.

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

Lesson: Never ship static credentials in client bundles. Read the full engineering post-mortem on Dev.to: dev.to/freerave/the... #FreeRave #VSCode #AppSec #DevSecOps

The Trap: We needed DotEnvy to authenticate requests to our backend using HMAC. Our build script injected an EXTENSION_SHARED_SECRET before packaging. Security bots (Trufflehog, GitHub) caught it immediately. If 1 user extracts it, your entire backend trust model collapses.

The Architecture: Zero Embedded Secrets 1. Extension registers anonymously on first launch via /extension/register (10/hr IP limit). 2. Backend returns a per-device secret stored in OS SecretStorage (Keychain). 3. Requests signed with HMAC-SHA256 + 5-minute replay defense.

Calling an AI model for every single secret scan in a VS Code extension was a terrible idea. Every keystroke added 400ms latency, and high-entropy noise easily fooled the model. Here is how we decoupled detection into a 4-layer pipeline in DotEnvy

🔹 L3: Shannon Entropy Gate Pure math filter. Candidates with H(X) < 3.5 are dropped immediately, eliminating ~80% of candidate noise. 🔹 L4: Neural Classifier Only the ~20% ambiguous tokens reach our Python backend, where a 35-feature model analyzes surrounding code semantics.

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

Key results: ~80% fewer cloud API calls Native OS SecretStorage Risk signals, not a security oracle Read the full engineering deep dive on Dev.to: dev.to/freerave/dot... #FreeRave #VSCode

🔹 L1: In-Process Regex Known tokens (AWS, Stripe, GitHub) resolve in sub-milliseconds without touching the network. 🔹 L2: Truncated Composite Hashing Cross-references hashes against an anti-poisoning community blacklist via an O(1) in-memory Set. The full secret is never sent.

1/7 A 2,353-line UI file is a symptom that storage, crypto, sync, and UI have collapsed into one boundary. That was DotGhostBoard v1.5 (our Linux clipboard manager). Here is how we refactored the monolith with 0 regressions #FreeRave #Python

6/7 The Results (By The Numbers): 📉 -35% LOC in the main Dashboard window 📈 +39% tests (220 ➔ 306 passing tests) ⚡ 3.7x faster CI test suite (14.2s ➔ 3.8s) 🛡️ 0 detected user-facing regressions Architecture over rewrites. #Linux #OpenSource

dev.toDEV CommunityA space to discuss and keep up software development and manage your software career

7/7 Full deep-dive case study on Dev.to: dev.to/freerave/fro... Star & download on GitHub: github.com/kareem2099/D... OpenDesktop / Pling Store: www.opendesktop.org/p/2353623/ #FreeRave #Python #Linux

4/7 Phase 3: Cryptographic Rigor 2-tier key derivation chain: Password ➔ PBKDF2 (600k iter) ➔ Base Key ➔ HKDF-SHA256 ➔ Vault KEK. Password rotation now takes ~2ms via constant-time DEK re-wrapping instead of re-encrypting the whole database.

5/7 Phase 4: Slicing the Monolithic UI Extracted 4 behavioral QObject controllers: • HistoryController (cards & search) • CollectionController (folders) • SecurityController (vault & lock) • SyncController (LAN P2P) Dashboard shrank by -35% LOC (-818 lines).

2/7 Instead of a risky Big Bang rewrite, we established one golden rule: "Controllers coordinate UI behavior. Services own business rules. Repositories own persistence. Backends own platform integration." Everything has a strict boundary.