DEV Community: Waleed Shamhan

Cybersecurity Roadmap #2: Computer Basics Every Security Learner Needs

Waleed Shamhan — Fri, 16 Oct 2026 18:07:23 +0000

This is episode 2 of my Cybersecurity Roadmap series, where I learn cybersecurity in public. Last time: what cybersecurity is and the CIA triad. Today: the computer basics you need before any hacking or defending makes sense.

You cannot protect what you do not understand. So let us build the mental model.

1. Hardware: what actually runs your code

CPU — executes instructions. Every program, including malware, is ultimately instructions for the CPU.
RAM — fast, temporary memory. Turn the power off and it is gone. Passwords and keys sitting in RAM can be stolen while the machine runs.
Storage (SSD/HDD) — permanent memory. Deleted files are often recoverable, because "delete" usually just marks space as reusable.
Network card — connects the machine to other machines. Every attack from the internet arrives through it.

Security lesson: data in RAM is exposed while the machine runs, and "deleted" does not mean "gone".

2. Operating system: the boss of the machine

The OS (Windows, Linux, macOS) sits between programs and hardware. It decides:

Which program runs when (processes)
Who can read or change which file (permissions)
Which program may use the network (firewall rules)

Two security ideas live here:

Processes: every running program is a process. Malware is just a process you did not want. Task Manager (Windows) or ps (Linux) shows you what is running.
Users and permissions: files and programs have owners and permission levels. A normal user account cannot change system files; an administrator can. This is why you should not browse the web as administrator — any malware you run inherits your permissions.

3. Files, extensions, and why they matter

A file's extension hints at what it is — but it is only a hint:

.txt, .pdf, .jpg — usually data, not programs
.exe, .bat, .sh — programs that run when opened
.docx, .xlsx — documents that can contain macros (code!) — a classic malware carrier

Security lesson: "invoice.pdf.exe" is a program, not a PDF. Windows hides extensions by default — turn "show file extensions" on. It is a five-second change that stops a whole class of tricks.

4. The command line is not optional

A lot of security work happens in the terminal: checking processes, inspecting files, testing networks. You do not need to memorize everything — you need to be comfortable with:

Listing files and moving between folders (ls, cd, dir)
Reading a file (cat, type)
Seeing what is running (ps, Task Manager)
Checking network connections (netstat, ss)

If the command line scares you, practice ten minutes a day. It pays off in every later episode.

5. Updates: the most boring, most important defense

Most successful attacks do not use genius zero-days. They use known vulnerabilities in unpatched software — bugs the vendor already fixed. Updating your OS, browser, and apps closes those holes. Automatic updates exist for a reason: turn them on.

Quick checklist before the next episode

[ ] You can explain CPU, RAM, storage, and network card in one sentence each
[ ] You know what a process is and how to list running ones
[ ] You know why running as administrator is risky
[ ] File extensions are visible on your machine
[ ] Your OS and browser are up to date

Next episode: Networks — how data actually moves, and why that matters for attackers and defenders. Follow along, and tell me in the comments: Windows, Linux, or macOS — what do you learn on?

Cybersecurity Roadmap #1: What Is Cybersecurity, Really?

Waleed Shamhan — Fri, 16 Oct 2026 18:07:22 +0000

Welcome to my Cybersecurity Roadmap — a series where I learn cybersecurity in public, one topic at a time, and share everything I learn. No fluff, no assumed knowledge. If you are a student or a beginner wondering where to start, this series is for you.

In this first episode: what cybersecurity actually is, why it matters, and the three ideas everything else is built on.

What is cybersecurity?

Cybersecurity is the practice of protecting systems, networks, and data from digital attacks. Those attacks usually aim to do one of three things:

Steal information (passwords, personal data, business secrets)
Damage systems (delete data, shut down services, spread malware)
Trick people (phishing, scams, fake websites)

Every defense you will ever learn — firewalls, encryption, strong passwords, updates — exists to stop one of those three.

The foundation: the CIA triad

Almost everything in cybersecurity comes back to three goals, known as the CIA triad:

1. Confidentiality — only the right people see the data

Your messages, passwords, and files should be readable only by the people allowed to see them. Tools: passwords, encryption, access control.

2. Integrity — the data stays correct and unmodified

Nobody should be able to secretly change your data — not a bank balance, not a grade, not a medical record. Tools: hashing, digital signatures, backups.

3. Availability — the system works when you need it

Security means nothing if the service is down. Systems must stay up and reachable for legitimate users. Tools: redundancy, backups, protection against denial-of-service attacks.

A real attack usually breaks at least one of the three. A phishing email that steals your password? That breaks confidentiality. Ransomware that encrypts your files? That breaks availability (and often confidentiality too). A tampered download? That breaks integrity.

Why should you care?

Your accounts, photos, and messages are targets — attackers automate their work, so you do not need to be famous to be attacked.
Companies lose money and trust after breaches, so cybersecurity is one of the most in-demand skills in tech right now.
The basics stop most attacks. You do not need to be a hacker to be safer — you need the fundamentals, applied consistently.

What's next in this series

What is cybersecurity (this post)
Computer basics every security learner needs
Networks: how data actually moves
The CIA triad in depth: encryption and hashing
Common attacks: phishing, malware, and social engineering
And more — one topic at a time.

If you are learning too, follow along and tell me in the comments: what made you interested in cybersecurity?

AI Post Generator, Now Running on Local Open-Weight Models (Gemma 3 + Ollama)

Waleed Shamhan — Fri, 16 Oct 2026 18:02:00 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

AI-Post-Generator is a Python command-line tool that generates professional Arabic posts for WhatsApp and Telegram channels. I originally built it on a hosted API — and for this challenge I added a new mode that runs it on a local open-weight model (Gemma 3) through Ollama, with no hosted API involved.

Who would pay for it? Anyone who runs a channel and posts every day: channel owners, small businesses, media coordinators, and community managers. Writing fresh, consistent posts daily is the tedious task they all complain about — this tool turns a topic + a template into a ready post in seconds.

The problem it solves is threefold: the blank page (what do I post today?), consistency (same voice across every post), and cost/privacy (with the local mode, there is no per-post API bill and the channel's content never leaves the owner's machine).

Demo

Run it with the local open-weight model (default):

ollama pull gemma3
python main.py
# or explicitly:
python main.py --provider ollama --model gemma3

The original hosted mode still works:

python main.py --provider openai

Below is a real post generated by the tool running Gemma 3:1b locally via Ollama — topic "daily reading", template "morning motivation". The exact output is also saved in the repo as examples/gemma3_local_sample.txt:

صباح الخير يا أصدقائي! 📚

هل تبحث عن طريقة رائعة لتهدئة ذهنك، وتعزيز تركيزك، وفتح أبواب جديدة للمعرفة؟ القراءة اليومية هي الحل! ☀️

تذكروا، القراءة ليست مجرد قراءة، بل هي رحلة استكشافية، وتطوير الذات، وراحة البال. 🧘‍♀️

اكتشفوا قوة القراءة! 📖

شاركوا معنا أفكاركم حول القراءة اليومية. ما هي الكتب التي تحبون قراءتها؟ 🤔

دعونا نُشجع بعضكم البعض! 🤝

#صباح_الخير #تحفيز #إيجابية

Code

https://github.com/waleedshamhan2050-sys/AI-Post-Generator

The open-model mode is a --provider flag in main.py: get_client() points the same OpenAI-compatible client at the local Ollama server (http://localhost:11434/v1) instead of the hosted API, and the model defaults to gemma3 (configurable via OLLAMA_MODEL in .env or --model). The prompt, the JSON templates, and the saving logic are unchanged — only the provider changes.

How I Built It

Ollama for local inference — it exposes an OpenAI-compatible API, so the same client code works for both the hosted and the local path.
Gemma 3, an open-weight model, as the default local model.
JSON templates for each post type (announcement, quick tip, morning motivation, upcoming event, interactive question) with guiding examples.
python-dotenv for configuration (OLLAMA_MODEL, OLLAMA_BASE_URL, and the optional OPENAI_API_KEY for the hosted mode).

The key design decision: one codebase, two providers. The tool does not care where the model lives — the templates and the flow stay the same.

Why Does Open Innovation Matter?

This project is the reason I believe in open innovation:

Cost: a channel owner posting daily would pay per-post API fees forever. With a local open-weight model, the marginal cost of a post is zero — which is what makes the business actually work for small channels.
Privacy: channel content, business announcements, and audience ideas never leave the owner's machine. Nothing is sent to a third-party API.
No lock-in: no vendor can change the pricing, rate limits, or terms under you. If one model stops suiting you, you swap it — llama3.2, qwen2.5, mistral — without rewriting the tool.
Works offline: the tool runs on a laptop with no connection, which matters for users with unreliable internet.
Built for a niche: the templates are tuned for Arabic WhatsApp/Telegram channel style — a niche a general-purpose hosted API handles poorly out of the box.

Open weights made this possible. A closed API could never offer all five at once.

Prize Categories

Best Use of Gemma

Customer Purchase Prediction with Logistic Regression - A Beginner's End-to-End ML Project

Waleed Shamhan — Fri, 16 Oct 2026 16:38:45 +0000

When I finished my first machine learning lectures, I wanted a project that used everything I had learned: data loading, preprocessing, train-test split, scaling, training, and evaluation. So I built a small but complete project: predicting whether a customer will purchase a product, based on their age, salary, experience, and gender.

The dataset is tiny (8 customers), which makes it perfect for learning — you can follow every number by hand.

The data

Age	Salary	Experience	Gender	Approved
22	500	1	Male	No
25	600	2	Female	No
28	700	3	Male	No
31	800	4	Female	Yes
34	900	5	Male	Yes
37	1000	6	Female	Yes
40	1100	8	Male	Yes
43	1200	9	Female	Yes

Approved is the target: Yes means the customer bought, No means they didn't. The rest are the features.

Step 1: Load the data and encode the categories

Models work with numbers, so the Gender and Approved columns need encoding: Male = 0, Female = 1, No = 0, Yes = 1.

import pandas as pd
from sklearn.model_selection import train_test_split
from sklearn.preprocessing import StandardScaler
from sklearn.linear_model import LogisticRegression
from sklearn.metrics import accuracy_score

data = {
    'Age': [22, 25, 28, 31, 34, 37, 40, 43],
    'Salary': [500, 600, 700, 800, 900, 1000, 1100, 1200],
    'Experience': [1, 2, 3, 4, 5, 6, 8, 9],
    'Gender': ['Male', 'Female', 'Male', 'Female', 'Male', 'Female', 'Male', 'Female'],
    'Approved': ['No', 'No', 'No', 'Yes', 'Yes', 'Yes', 'Yes', 'Yes']
}
df = pd.DataFrame(data)
df['Gender'] = df['Gender'].map({'Male': 0, 'Female': 1})
df['Approved'] = df['Approved'].map({'No': 0, 'Yes': 1})

Step 2: Split features and target, then train/test

X = df[['Age', 'Salary', 'Experience', 'Gender']]
y = df['Approved']

X_train, X_test, y_train, y_test = train_test_split(
    X, y, test_size=0.2, random_state=42
)
# Train shape: (6, 4) — Test shape: (2, 4)

test_size=0.2 means 20% of the data goes to testing. random_state=42 makes the split reproducible.

Step 3: Scale the features

Age ranges up to 43, Salary up to 1200. Without scaling, the bigger numbers dominate the model. StandardScaler fixes that — and the key rule is: fit only on the training data, then transform both sets.

scaler = StandardScaler()
X_train = scaler.fit_transform(X_train)
X_test = scaler.transform(X_test)  # never fit_transform on test data!

Step 4: Train and evaluate

Since the target is yes/no, this is a classification problem, and logistic regression is the natural first model:

model = LogisticRegression()
model.fit(X_train, y_train)

y_pred = model.predict(X_test)
print("Actual:   ", list(y_test))   # [0, 1]
print("Predicted:", list(y_pred))   # [0, 1]
print("Accuracy: ", accuracy_score(y_test, y_pred))  # 1.0

The model predicted both test customers correctly: accuracy 1.0.

Step 5: Predict a new customer

Now the fun part — a brand-new customer: age 36, salary 950, 6 years of experience, female. The new data must go through the same scaler (transform, not fit):

new_customer = [[36, 950, 6, 1]]
new_customer_scaled = scaler.transform(new_customer)
prediction = model.predict(new_customer_scaled)
print("Approved" if prediction[0] == 1 else "Not Approved")  # Approved

Result: Approved (Yes) — the model predicts this customer will purchase.

What I learned

Preprocessing is half the project. Encoding categories and scaling features matter as much as the model itself.
Never fit on test data. Fitting the scaler on test data leaks information and gives fake results.
Small data teaches the pipeline. With 8 rows I could trace every step; the same pipeline scales to thousands of rows.
Accuracy on 2 test samples is not proof. A 1.0 here is encouraging, not conclusive — real evaluation needs more data and more metrics (precision, recall, confusion matrix).
If you are learning ML, build this project yourself and change one thing at a time: try a different random_state, add a feature, or compare logistic regression with a decision tree. That is where the real learning happens.

I Built an AI Post Generator for WhatsApp and Telegram - Here's What I Learned

Waleed Shamhan — Fri, 16 Oct 2026 16:21:37 +0000

I'm an IT student, and I also work as a media coordinator. That means I live in two worlds: writing code, and writing content. One day I got tired of staring at a blank screen every time I needed a post for a WhatsApp or Telegram channel, so I built a small tool to solve my own problem: AI-Post-Generator.

It's a Python command-line tool that generates professional posts for WhatsApp and Telegram channels using AI. You can find it here: https://github.com/waleedshamhan2050-sys/AI-Post-Generator

The problem

Running a channel means publishing constantly: announcements, tips, motivational posts, interactive questions. Writing all of that by hand is slow, and the tone drifts from post to post. I wanted something that could produce good drafts fast, in a consistent voice, and in Arabic.

How it works

The flow is deliberately simple:

You pick a topic and a template from the command line.
The tool loads a JSON template for that post type (announcement, tip, motivation, interactive question) with guiding examples.
It sends the prompt to the OpenAI API (using gpt-4.1-mini) and gets back a generated post.
The generated post is saved automatically in an examples/ folder, so you can reuse or review it later.

The tech stack is small: Python 3.x, the OpenAI API, python-dotenv for managing the API key safely in a .env file, and JSON for the templates.

Design decisions I am proud of

Templates instead of free-form prompts. Every post type has a JSON template with examples. This keeps the output consistent and lets me steer the AI toward a specific kind of post instead of hoping for a good result.

Arabic-first. The tool generates posts in Modern Standard Arabic with appropriate emojis, because that is the audience I write for. Most AI writing tools I tried defaulted to English, so this mattered to me.

Keep the secrets out of the code. The API key lives in a .env file, never in the source. It is a small thing, but it is the kind of habit I want to keep for every project.

What I learned

Building this taught me more than the tool itself:

Python CLI apps: structuring a command-line program and keeping the code clean and documented.
Working with AI APIs: how to call the OpenAI API, shape prompts through templates, and handle the response.
Structured data: using JSON to store and manage templates in an organized way.
Environment management: keeping sensitive data like API keys secure with .env files.
Prompt design: writing templates that guide the AI toward a specific post type is a skill of its own.
Content automation: how the whole loop of creating content for social channels can be automated.

What is next

I want to add direct publishing to channels, more template types, and support for scheduling posts. The goal is the same as when I started: less time staring at a blank screen, more time on the ideas that matter.

If you run a channel or create content regularly, I would love to hear how you handle the blank-page problem. And if you try the tool, feedback is welcome.