DEV Community

Cover image for Are You a Python Developer or a Python Expert? 7 Tests I Failed Building 3 Desktop Apps
Akhouri Anmol Kumar
Akhouri Anmol Kumar

Posted on

Are You a Python Developer or a Python Expert? 7 Tests I Failed Building 3 Desktop Apps

#tutorial #python #security #programming

Description: Python security, screen capture, spring physics, HiDPI and PyInstaller .exe gotchas. 7 tests from shipping 3 no-telemetry Python apps for Windows (ATLOCK, ASNIPP, APIC).

Most Python developers can write a for loop, a Flask route and a pandas one-liner.

Python experts know what happens before line 1 runs, what Python can't do, and what breaks the moment your script leaves your laptop.

I found out which one I was while building three Windows desktop apps in pure Python: ATLOCK (a security suite), ASNIPP (a screenshot and screen recorder) and APIC (an image toolkit). No ads, no analytics SDKs, no bloat. Every test below is a real bug or design decision from one of them.

Score yourself honestly. 👇

Test 1: Do you know that import order can be a security decision? (ATLOCK)

Quick: what does import ctypes have to do with security?

On Windows, a DLL imported later can be loaded from the current directory. That is how DLL planting attacks work. The fix has to run before the other imports:

import sys, ctypes

if sys.platform == "win32":
    k32 = ctypes.WinDLL("kernel32", use_last_error=True)
    k32.SetDllDirectoryW.argtypes = [ctypes.c_wchar_p]
    k32.SetDllDirectoryW("")                      # drop the CWD from the DLL search path
    k32.SetDefaultDllDirectories.argtypes = [ctypes.c_uint32]
    k32.SetDefaultDllDirectories(0x1000)          # LOAD_LIBRARY_SEARCH_DEFAULT_DIRS

# only NOW import the heavy stuff
import cryptography, argon2
Enter fullscreen mode Exit fullscreen mode

Developer: puts imports in alphabetical order.
Expert: knows import order is a runtime security boundary.

This is the very first thing that runs in ATLOCK, my pure-Python security suite.

Test 2: Can your screen recorder avoid recording itself? (ASNIPP)

I built a screen recorder with a floating control bar. First recording: the bar showed up in the video. 🤦

You don't need to hide and show windows. One Win32 call, straight from Python, does it:

import ctypes

def exclude_from_capture(widget):
    hwnd = int(widget.winId())
    # 0x11 = WDA_EXCLUDEFROMCAPTURE (Windows 10 2004+)
    ctypes.windll.user32.SetWindowDisplayAffinity(hwnd, 0x11)
Enter fullscreen mode Exit fullscreen mode

The window stays visible to you and is invisible to every screen capture. That is how ASNIPP keeps its own toolbars, drawing overlay and recording border out of your videos.

Developer: crops the bar out in post.
Expert: knows ctypes gives Python the whole Windows API.

Test 3: Can your app decide what you meant, without asking? (APIC)

Good desktop software removes clicks. In APIC, my image toolkit, the rule is simple:

  • Drop one image → open it in the editor.
  • Drop many → open the batch converter. 
def on_files(self, paths: list[str]):
    if not paths:
        paths, _ = QFileDialog.getOpenFileNames(
            self, "Open Image(s)", "",
            "Images (*.png *.jpg *.jpeg *.webp *.bmp *.tiff *.gif *.ico *.heic *.avif)")
    if len(paths) == 1:
        self.open_in_edit(paths[0])
    elif paths:
        self.open_in_convert(paths)

def dropEvent(self, event):
    self.on_files([u.toLocalFile() for u in event.mimeData().urls()])
Enter fullscreen mode Exit fullscreen mode

The home screen, the file dialog and drag-and-drop all go through one function. Add a new entry point and you add zero logic.

Developer: writes three code paths.
Expert: writes one funnel and lets every input flow into it. The UI is split into one module per mode (edit, convert, compress, search), and main.py only wires them together.

Test 4: Do you know the difference between "encrypted" and "encrypted correctly"? (ATLOCK)

Developer: AES.new(key, AES.MODE_ECB) and done.

Expert checklist:

  • AEAD, not just encryption: AES-256-GCM authenticates every chunk.
  • Slow KDF for passwords: Argon2id, not a bare SHA-256.
  • Never reuse a nonce with the same key.
  • Bind the header with AAD so metadata can't be swapped. 
import os
from argon2.low_level import hash_secret_raw, Type
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def seal(password: bytes, data: bytes) -> bytes:
    salt = os.urandom(16)
    key = hash_secret_raw(password, salt, time_cost=3, memory_cost=64 * 1024,
                          parallelism=4, hash_len=32, type=Type.ID)
    nonce = os.urandom(12)
    ct = AESGCM(key).encrypt(nonce, data, associated_data=b"v1")
    return salt + nonce + ct
Enter fullscreen mode Exit fullscreen mode

(Simplified. ATLOCK's real container format also does chunking, key commitment and versioning.)

Test 5: Can you make a Qt animation feel alive with 6 lines of math? (ASNIPP)

ASNIPP's capture bar is a "Dynamic Island" that bounces open. Qt's built-in easing curves felt stiff, so I wrote a damped spring and plugged it into QEasingCurve:

import math
from PyQt6.QtCore import QEasingCurve

def spring(zeta, omega):
    wd = omega * math.sqrt(max(1e-6, 1 - zeta * zeta)) if zeta < 1 else 0.0
    def f(t):
        if t <= 0: return 0.0
        if t >= 1: return 1.0
        if zeta < 1:    # under-damped: overshoots, then settles (the bounce)
            return 1 - math.exp(-zeta * omega * t) * (math.cos(wd * t) + (zeta * omega / wd) * math.sin(wd * t))
        return 1 - math.exp(-omega * t) * (1 + omega * t)   # critically damped: no overshoot
    return f

BOUNCY = spring(0.66, 11.0)   # keep it at MODULE level (see below)

curve = QEasingCurve(QEasingCurve.Type.Linear)
curve.setCustomType(BOUNCY)
Enter fullscreen mode Exit fullscreen mode

The trap: if the function is a temporary object, Python garbage-collects it while Qt still holds a pointer, and you get random crashes. Keep custom callables alive at module level. Only people who've been bitten know this one.

Test 6: Does your app look sharp on a 4K laptop with 150% scaling? (APIC)

Most Python GUI apps look blurry or oddly sized on modern displays. In Qt 6 the fix is one policy before you create the app:

from PyQt6.QtWidgets import QApplication
from PyQt6.QtCore import Qt

QApplication.setHighDpiScaleFactorRoundingPolicy(
    Qt.HighDpiScaleFactorRoundingPolicy.PassThrough)   # no rounding: 125%/150% stay crisp

app = QApplication(sys.argv)
app.setApplicationName("APIC")
app.setOrganizationName("Akhouri Systems")
Enter fullscreen mode Exit fullscreen mode

PassThrough keeps fractional scales like 125% and 150% exact instead of snapping to 100% or 200%. Add one try/except AttributeError for older Qt builds, and your app looks native everywhere.

Developer: tests on their own monitor.
Expert: tests at 100%, 125%, 150% and 200%.

Test 7: Can you explain why Python can't truly erase a password from memory? (ATLOCK) 

password = "hunter2"
password = None   # is it gone? 🙂
Enter fullscreen mode Exit fullscreen mode

No. Python str and bytes are immutable, and the interpreter is free to copy them. The best you can do is keep secrets in a mutable bytearray and wipe it explicitly:

buf = bytearray(b"hunter2")
# ... use it ...
for i in range(len(buf)):
    buf[i] = 0
Enter fullscreen mode Exit fullscreen mode

An honest Python security tool says this out loud instead of promising magic. ATLOCK's source header lists what it can't do: memory wiping is best-effort, SSD shredding can't be guaranteed, and a same-user attacker can modify the script. Python experts document their limits.

Bonus: "Why does it work in VS Code and silently do nothing as a .exe?"

All three of my apps ship as Python compiled with PyInstaller (--onefile --windowed). It cost me an evening before I learned this: in a windowed build, sys.stdout and sys.stderr are None. Any print(), logging call or library traceback can fail silently, and your app "just doesn't open."

import sys, os

for name in ("stdout", "stderr"):
    if getattr(sys, name, None) is None:
        setattr(sys, name, open(os.devnull, "w", encoding="utf-8"))

# and show errors somewhere a human can see them:
import ctypes
ctypes.windll.user32.MessageBoxW(None, "Startup failed: ...", "App error", 0x10)
Enter fullscreen mode Exit fullscreen mode

Try the code yourself

I'm the developer behind all of this, and the three apps are the proof that it works outside tutorials. They're built by Akhouri Systems, each is pure Python packaged as an .exe in a zip, with no ads and no analytics. The only network features are the ones you trigger yourself (for example ATLOCK's optional breach check, which sends only a 5-character hash prefix).

App Python lesson it proves What it is Get it
🔐 ATLOCK v5 Tests 1, 4, 7 Security suite: AES-256-GCM + Argon2id file guard, password vault, TOTP/FIDO2, anti-tamper Direct download (zip) · Microsoft Store
📸 ASNIPP v1 Tests 2, 5 Dynamic-Island-style screenshot, screen recorder, live drawing and editor Direct download (zip)
🖼️ APIC v1 Tests 3, 6 Image edit, convert, compress and search toolkit Direct download (zip)

If you're learning how Python behaves outside a notebook, run them and then ask what's going on under the hood. That's the fastest way I know to level up.

Your score

  • 0–2 tests known: You're a Python developer. Great start, now go break things.
  • 3–5: Solid. You've shipped something real.
  • 6–7: You're a Python expert. Come argue with me in the comments.

Which test did you fail first? Mine was the windowed-.exe one, and I lost an entire evening to it. Tell me yours below 👇

Top comments (9)

Collapse
 
akhourianmolkumar profile image
Akhouri Anmol Kumar •

@technogamerz @puneetkumar2010
see this:
youtube.com/shorts/_R6_KfHEdm4?si=...

Collapse
 
puneetkumar2010 profile image
Puneet Kumar Mishra •

😎🤣🤣

Collapse
 
akhourianmolkumar profile image
Akhouri Anmol Kumar •

bro I've seen a shorts a really funning shorts of titled what IITian do in there free time but because it is not family friendly So I didn't shared it here 😂

Thread Thread
 
puneetkumar2010 profile image
Puneet Kumar Mishra •

☠☠ WHAT!!! WHAT DO THEY DO!!
NO WORDS??

Thread Thread
 
akhourianmolkumar profile image
Akhouri Anmol Kumar •

no words left
☠️

Collapse
 
effessdev profile image
EffessDev •

@akhourianmolkumar bro since you are a Python developer can you inspect this example repository? It looks quite complicated to me just wanted to know whether you think the same...

Collapse
 
akhourianmolkumar profile image
Akhouri Anmol Kumar •

it can be short too.

Collapse
 
effessdev profile image
EffessDev •

means?

Thread Thread
 
akhourianmolkumar profile image
Akhouri Anmol Kumar •

.github
.gitlab
components
docs
examples
bluetooth
ble_get_started
bluedroid
nimble
NimBLE_Beacon
NimBLE_Connection
NimBLE_GATT_Server
main
include
src
CMakeLists.txt
Kconfig.projbuild
idf_component.yml
main.c
CMakeLists.txt
README.md
sdkconfig.defaults
sdkconfig.defaults.esp32
sdkconfig.defaults.esp32c3
sdkconfig.defaults.esp32c5
sdkconfig.defaults.esp32c6
sdkconfig.defaults.esp32c61
sdkconfig.defaults.esp32h2
sdkconfig.defaults.esp32s3
NimBLE_Security
ble_uart_service
bluedroid
blufi
common
esp_ble_audio
esp_ble_iso
esp_ble_mesh
esp_hid_device
esp_hid_host
hci
nimble
.build-test-rules.yml
build_system
common_components
custom_bootloader
cxx
ethernet
get-started
ieee802154
lowpower
mesh
network
openthread
peripherals
phy
protocols
security
storage
system
wifi
zigbee
README.md
tools
.codespellrc
.editorconfig
.gitignore
.gitlab-ci.yml
.gitmodules
.idf_build_apps.toml
.idf_ci.toml
.mypy.ini
.pre-commit-config.yaml
.shellcheckrc
.vale.ini
CMakeLists.txt
COMPATIBILITY.md
COMPATIBILITY_CN.md
CONTRIBUTING.md
Kconfig
LICENSE
README.md
README_CN.md
ROADMAP.md
ROADMAP_CN.md
SECURITY.md
SUPPORT_POLICY.md
SUPPORT_POLICY_CN.md
add_path.sh
conftest.py
export.bat
export.fish
export.ps1
export.sh
install.bat
install.fish
install.ps1
install.sh
pytest.ini
ruff.toml
reason.... 💀
bro do you have any APIC v2 idea please