I Built a Windows 95-Style Developer Portfolio with Next.js 15

Adil Raxiq — Tue, 01 Sep 2026 11:00:43 +0000

Why a Windows 95 Portfolio?

Most developer portfolios look the same:

Hero section
About me
Projects grid
Contact form

I wanted something different. Something people actually remember.

So I built a portfolio that looks and feels like a classic Windows 95 desktop.

What It Looks Like

When you visit the site, you see:

A teal desktop background (just like Windows 95)
Clickable icons for Projects, Writing, Contact
A boot animation that says "System booting..."
Draggable, resizable windows

Tech Stack

Next.js 15 — App Router, Server Components
Tailwind CSS — All styling
Framer Motion — Animations and transitions
TypeScript — Type safety

Key Features

1. Boot Animation

When the page loads, it shows a retro boot screen before revealing the desktop. This sets the mood immediately.

2. Desktop Icons

Each icon (Projects, Writing, Contact) opens a window when clicked — just like real Windows 95.

3. Draggable Windows

Windows can be dragged around the screen using Framer Motion's drag constraints.

4. Blog Section

I added a writing section where I publish articles about Flutter, Django, and AI.

5. Contact Form

A working contact form so people can reach out directly.

What I Learned

Animations matter — The boot screen alone makes the site memorable
Constraints are creative — Sticking to a Windows 95 theme forced me to be creative with limited elements
Performance — Even with animations, the site scores 100 on Lighthouse SEO

Live Demo

👉 https://adilportfolio-tawny.vercel.app

Source Code

The project is built with Next.js 15 and is deployed on Vercel.

Thanks for reading! If you have any questions about the implementation, feel free to ask in the comments.

portfolio #nextjs #tailwindcss #webdev

The Trust Gap in Threat Intelligence: Why Your Feeds Are Lying to You

Adil Raxiq — Sat, 04 Jul 2026 12:58:05 +0000

The Trust Gap in Threat Intelligence: Why Your Feeds Are Lying to You

Every SOC has lived this scenario: an alert fires overnight, tied to an indicator pulled from a feed nobody on the team can fully account for. The analyst on call has two choices — chase it down at 3 AM, or gamble that it's noise. Neither option is good, and the reason isn't the alert. It's that the intelligence behind it was never trustworthy to begin with.

We Solved Format. We Didn't Solve Trust

The industry has spent a decade converging on how to move threat intelligence: STIX, TAXII, MISP, OpenCTI, and — inevitably — the vendor CSV that still lands in someone's inbox. That standardization work mattered. But it solved interoperability, not credibility. Somewhere between ingestion and action, the questions that actually determine whether an indicator deserves a response get lost:

Who originally reported this indicator?
Has it changed since it entered our pipeline?
Does this source have a track record worth trusting?
Has it been independently corroborated?
Is it even still relevant, or has it quietly expired?

Without answers, security teams are left making binary decisions — block or allow — on intelligence that was never scored, verified, or contextualized in the first place.

The Cost of Ungraded Intelligence

Treating every IOC as equally credible produces two failure modes, and both are expensive. Over-alerting burns analyst time on indicators that never should have triggered a response. Under-alerting lets real threats blend into the noise. In practice, most organizations get both at once: enough false positives to cause alert fatigue, and enough unverified low-quality intel to leave real risk unaddressed.

One security team estimated that over 40% of their automated alerts were ultimately dismissed as false positives — after already consuming analyst hours, triggering escalation workflows, and pulling people into response meetings that didn't need to happen. At scale, across tools and teams, ungraded intelligence isn't a minor inefficiency. It's a recurring cost that compounds every day the problem goes unaddressed.

Rethinking the Pipeline: Provenance and Trust as First-Class Data

The fix isn't another normalization layer. It's treating every indicator the way an investigator treats evidence — with a documented chain of custody and a defensible reason for acting on it.

1. Normalize without erasing origin

Every incoming feed still gets converted to a common schema (STIX 2.1), but the source metadata isn't discarded in the process. The pipeline retains:

The original format and provider identity
Schema validation results at ingestion
The specific mapping decisions made during transformation
That feed's historical accuracy and failure rate

An indicator isn't simply "added" to the system — it arrives with a record of how it got there.

2. Replace binary trust with a trust score

Rather than an allow/block decision, each indicator is scored using a model (in this case, XGBoost) trained on signals that actually predict reliability:

Signal	What it tells you
Source reputation	Has this feed been accurate historically?
Corroboration count	Has this indicator been independently reported elsewhere?
Sighting frequency	Is this indicator currently active or stale?
Timeliness decay	How much has confidence decayed since first sighting?
Pattern anomalies	Does this indicator resemble known synthetic or low-quality data?

The resulting score routes the indicator: high-confidence scores support automated action, mid-range scores route to analyst review, and low-confidence scores are suppressed until corroborated.

3. Make tampering provable, not just theoretically prevented

This is the one place a permissioned ledger earns its keep — not for decentralization as an ideology, but for a narrow, practical guarantee: proving that provenance metadata hasn't been silently altered after the fact. Each indicator's provenance record is hashed and committed to a permissioned ledger. No raw intelligence is exposed publicly, there's no token or coin involved, and the only goal is non-repudiation — an auditable answer to "has this record been changed since it was logged?"

Why This Matters Beyond One Pipeline

The underlying claim is simple: threat intelligence that can't explain itself isn't actionable, no matter how fast it moves or how well-formatted it is. A provenance-aware, trust-scored approach doesn't just reduce false positives — it gives every automated action a defensible audit trail, which matters as much to compliance and incident post-mortems as it does to the analyst on call.

What's Next

This is a project in progress, and it's being built in the open. Upcoming milestones include a live trust-score visualizer for IOCs, a demo of the metadata-preserving feed normalizer, trust-decay curves benchmarked across real sample feeds, and a walkthrough of the ledger-backed audit trail.

Code releases are planned within the year — the repo is open now for anyone who wants to follow the build or weigh in early: github.com/greykaizen/ThreatChain

Discussion

Two questions for anyone who's dealt with this problem directly:

What metadata do you most often lose during feed ingestion — and wish you hadn't?
Where would you set the line for auto-blocking on a 0–100 trust score?

If you work with threat intel pipelines, have signals you think should factor into a trust score, or can contribute anonymized feed telemetry, open an issue on the repo. This is the kind of problem that only gets solved with input from people actually running SOCs.

DEV Community: Adil Raxiq

I Built a Windows 95-Style Developer Portfolio with Next.js 15

Why a Windows 95 Portfolio?

What It Looks Like

Tech Stack

Key Features

1. Boot Animation

2. Desktop Icons

3. Draggable Windows

4. Blog Section

5. Contact Form

What I Learned

Live Demo

Source Code

portfolio #nextjs #tailwindcss #webdev

The Trust Gap in Threat Intelligence: Why Your Feeds Are Lying to You

The Trust Gap in Threat Intelligence: Why Your Feeds Are Lying to You

We Solved Format. We Didn't Solve Trust

The Cost of Ungraded Intelligence

Rethinking the Pipeline: Provenance and Trust as First-Class Data

Why This Matters Beyond One Pipeline

What's Next

Discussion