thehardwarestore.ai

Win11Debloat is a PowerShell-based Windows 10/11 debloating and configuration utility. It provides both a WPF graphical interface and a command-line interface, allowing users to remove pre-installed bloatware, disable telemetry and AI features, customize the taskbar, Start menu, File Explorer, and apply numerous registry tweaks. The tool is data-driven: feature definitions, app catalogs, and localization strings are stored in JSON files, while registry modifications are applied via `.reg` files. It supports undo operations, registry backup/restore, system restore points, and multi-user or Sysprep deployment scenarios. The architecture is modular, with dot-sourced PowerShell scripts organized into functional directories (Features, Helpers, GUI, AppRemoval, FileIO, Threading) and a comprehensive Pester test suite. External dependencies include PowerShell 5.1, winget, and standard Windows command-line tools. The codebase demonstrates high craftsmanship with reusable patterns for registry file parsing, non-blocking execution, user profile resolution, and localization.

This repository provides a collection of shell scripts to automate the setup and management of an IPsec VPN server on Linux. It supports multiple VPN protocols (IPsec/L2TP, IPsec/XAuth, IKEv2) and a wide range of Linux distributions including Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Alpine Linux. The main entry point is `vpnsetup.sh`, which detects the OS and runs the appropriate installer. The project also includes helper scripts for user management, IKEv2 certificate handling, upgrades, and uninstallation. Additionally, it offers an Azure ARM template for cloud deployment. The code is well-structured with OS-specific installers, common bash utility functions, and extensive documentation in multiple languages. It is a mature, widely-used DevOps tool for system administrators.

Technitium DNS Server is a full-featured, cross-platform DNS server written in C# (.NET). It serves both authoritative and recursive DNS with support for DNSSEC, DNS-over-TLS/HTTPS/QUIC, EDNS Client Subnet, caching, blocking, and a built-in DHCP server. The server includes a web-based management console with REST API, a Windows system tray app, and a plugin system that allows extending functionality via DNS apps (e.g., geo-location, failover, query logging to SQL databases, block pages). The architecture uses a custom domain tree data structure for efficient lookups, a zone management hierarchy (primary, secondary, stub, forwarder, catalog), and a channel-based producer-consumer pattern for logging and statistics. The codebase is actively maintained with frequent releases and security fixes. While the overall design is solid and modular, some files are large and there is reliance on binary serialization with versioning that adds complexity.

PrivateBin is a self-hosted, zero-knowledge pastebin web application. The PHP backend (Controller, Model, Data) handles paste/comment lifecycle, expiration, deletion, traffic limiting, and storage backend selection; the JavaScript frontend performs all encryption/decryption in the browser using AES-256-GCM (WebCrypto) with PBKDF2 key derivation and optional zlib/WASM compression. The server only ever stores ciphertext and metadata, never plaintext. Data flows from browser encryption into a pluggable persistence layer (filesystem, PDO database, Google Cloud Storage, S3), then back to the browser for decryption; JSON API endpoints accept and return encrypted bodies. Architecturally it is a classic server-rendered MVC app with a frontend state layer: index.php bootstraps a Controller, which delegates to Paste/Comment models over an AbstractData storage interface. Views are rendered via PHP templates with Bootstrap 3/5 themes, and the frontend is a vanilla-JS module namespace (PrivateBin) with submodules for encryption, editor, viewer, discussion, attachments, and i18n. The feature set includes expiration times, burn-after-reading, password-protected pastes, discussion threads, file attachments, URL shortening proxies (YOURLS/Shlink), QR codes, dark mode, and multi-language support. Engineering practices are strong for a mature open-source project: PHPUnit tests cover backend behavior, fast-check property tests cover frontend utilities, CI includes CodeQL/Snyk scans, and security hardening (DOMPurify, CSP, SRI hashes, HTTPS guidance) is explicit. Maintenance is active with recent commits and issue triage. Technical drift is moderate: the project retains legacy browser support and old Bootstrap 3/darkstrap assets, still supports PHP 7.4, and ships a monolithic JS file without a build step, but pinned frontend libraries (Bootstrap 5.3.8, Showdown 2.1.0, DOMPurify 3.4.17) are current.

PureMac is a free, open-source macOS system cleaner and app uninstaller built as a native SwiftUI application (targeting macOS 13.0+). It provides a graphical interface and a companion CLI tool for scanning and removing junk files, uninstalling applications with full leftover cleanup, finding orphaned files, and performing scheduled maintenance. The system is architected with an MVVM-like pattern: a central `AppState` ObservableObject drives all UI state, while modular actors (`ScanEngine`, `CleaningEngine`, `BinaryThinner`) handle async scanning and cleaning operations with safety checks (path allowlists, symlink resolution, trash-only deletion). The app uses a 10-level heuristic to match app files, scans 12+ categories (system junk, user cache, Xcode, Homebrew, Docker, AI apps, etc.), and integrates with macOS services like Full Disk Access, Finder Services, Menu Bar, and Sparkle auto-updates. The CLI is a separate Swift package with its own set of commands (clean, purge, analyze, optimize, ignore, config) that reuses similar logic, ensuring consistency between GUI and terminal workflows. The codebase is well-structured, fully internationalized (10+ languages), and distributed via Homebrew and GitHub releases with a full CI/CD pipeline for signing and notarization.

This is a production-grade Customer Data Platform (CDP) backend written in Go. It ingests events via HTTP (gateway), transforms and enriches them (processor), and routes them to over 90 destinations including streaming services (e.g., Kafka, Kinesis) and data warehouses (e.g., Snowflake, BigQuery, ClickHouse). The core of the system is a PostgreSQL-backed job queue (JobsDB) that provides partitioned, multi-consumer, durable processing. The architecture is a monolith with multiple internal services that can be deployed in different modes (gateway-only, processor-only, embedded). It includes enterprise features like OAuth token management, user suppression, regulatory deletion (GDPR), and reporting with HyperLogLog aggregation. The codebase is well-structured with clear separation of concerns, extensive unit and integration tests, and many reusable patterns (worker pool, circuit breaker, transaction listeners, config reloading). It is actively maintained with regular commits and security patching.

The Winapp2ool repository is a VB.NET-based console application designed to manage and customize the winapp2.ini database of cleaning rules for tools like CCleaner, BleachBit, and System Ninja. It provides a modular suite of tools for downloading, trimming, debugging, and transforming the INI file, allowing users to tailor the cleaning rules to their specific system and preferences. The application features a consistent menu-driven interface across its modules and supports command-line operation for automation. At its core, the repository maintains a comprehensive set of application-specific cleaning rules (organized in the Assembler/Entries directory) that can be assembled into a final winapp2.ini file. The tool includes specialized modules for tasks such as generating browser-specific entries (BrowserBuilder), removing irrelevant entries based on system compatibility (Trim), and validating the INI file syntax (WinappDebug). The architecture emphasizes separation of concerns, with each module handling a distinct function while sharing common utilities for logging, INI file parsing, settings management, and user interface. The codebase demonstrates strong engineering practices through its reusable components, including a robust INI file parser, a flexible console menu system, and a centralized logging mechanism. These components are designed with low coupling and high cohesion, making them suitable for extraction and reuse in other projects. The project is actively maintained, targets the .NET Framework 4.6.1, and shows minimal technical debt, ensuring compatibility with modern Windows systems while maintaining access to a vast, community-driven database of Windows cleaning rules.

Offen Fair Web Analytics is a privacy-focused, self-hosted web analytics platform that emphasizes user consent and data ownership. The system employs a multi-service architecture consisting of a Go-based backend server for API and data persistence, a Node.js vault service for client-side encryption and key management, a Node.js tracking script for event collection, and a Node.js auditorium interface for users to view their analytics data. All services are orchestrated via Docker Compose, with Nginx acting as a reverse proxy. The platform ensures privacy through end-to-end encryption of analytics data in the browser before transmission to the server, preventing even the server operator from accessing raw data without the user's key. It implements granular consent management, data retention policies (default 6 months), and allows users to review, export, or delete their data via the auditorium. The system supports multiple databases (SQLite, MySQL, PostgreSQL) and provides internationalization for over six languages.

Ente is a multi-product, end-to-end encrypted cloud platform providing photo storage (Ente Photos), two-factor authentication (Ente Auth), secure document vault (Ente Locker), social photo sharing (Ente Space), AI chat assistant (Ente Ensu), ephemeral pastebin (Ente Paste), and media casting (Ente Cast). The system is built as a monorepo with a Go server backend, Rust core libraries for cryptography, machine learning, and media processing, and client applications across web (React/Next.js), mobile (Flutter, native Android/iOS), desktop (Electron), and CLI (Go and Rust). Architecture follows a zero-knowledge design: all encryption (XChaCha20-Poly1305, Argon2, X25519) happens client-side, with keys never exposed to the server. The server handles user accounts, file storage (S3-compatible), billing (Stripe), ML indexing, and sharing. Key entry points include the Go server at `server/cmd/museum`, Rust WASM bindings for web crypto, and Flutter apps with native plugins. Data flows involve client-side encryption before upload, server-side metadata storage in PostgreSQL, and decryption on download. External dependencies include PostgreSQL, S3-compatible object storage, Stripe, ONNX Runtime for ML, and various cloud infrastructure (Cloudflare Workers, Grafana, Prometheus).

Neo-Store is a modern, feature-rich Android client for F-Droid and compatible open-source app repositories. Built with Kotlin and Jetpack Compose, it provides a full-featured app store experience: browsing apps by category, search, filtering, and sorting; managing multiple repositories with incremental index synchronization; downloading and installing APKs via multiple backends (root, Shizuku, session, legacy); tracking app updates; displaying detailed privacy information (permissions, trackers, anti-features) via integration with Exodus Privacy and VirusTotal; and visualizing download statistics. The architecture follows MVVM with Room for persistence, Koin for dependency injection, and WorkManager for background sync and download tasks. The codebase is well-structured with a clean separation of data, domain, and UI layers, though it contains some experimental API usage and extensive auto-generated icon files.

AnonAddy (addy.io) is a self-hosted anonymous email forwarding service built with Laravel, Inertia.js, and Vue 3. In production, it allows users to create email aliases that forward to real inboxes, with support for custom domains, PGP/MIME encryption, user-defined rules (sender/subject/header conditions with actions like block, quarantine, label), and a blocklist. The system receives inbound email via a Postfix pipe, applies rules, and either forwards, replies, or sends-from aliases with rewritten headers, List-Unsubscribe banners, and optional DKIM signing. Outbound sending handles VERP bounce tracking and stores failed deliveries with deduplication. The architecture is a monolith Laravel application with a REST JSON API (used by mobile/extension clients) and a server-driven SPA frontend. Key entry points include the ReceiveEmail console command, the CustomMailer driver, and numerous API controllers under /api/v1/. The frontend uses reusable Vue components and Inertia form handling across pages for alias, recipient, domain, rule, blocklist, and settings management.

This repository is a toolchain for generating Apple Configuration Profiles (.mobileconfig) that configure DNS over HTTPS (DoH) and DNS over TLS (DoT) on iOS, iPadOS, and macOS devices. It maintains a curated registry of public encrypted DNS providers (e.g., AdGuard, Cloudflare, Quad9, CleanBrowsing) with metadata such as server addresses, filtering capabilities, and region. The build pipeline reads provider definitions from JSON files under src/, generates unsigned profiles in profiles/, optionally signs them with CMS digital signatures using a user-provided ECC certificate, and places signed versions in signed/. It also produces multi-language README files (English, Simplified Chinese, Traditional Chinese) with provider tables and installation links. The architecture is a set of TypeScript scripts executed via npm commands (build, sign, new, test). There is no runtime server or daemon; the output is static files intended for manual installation by end users. The interactive CLI (npm run new) guides users through creating new provider profiles with validation and optional signing. The codebase demonstrates solid engineering practices: deterministic UUIDs (v5) for stable profile identifiers, CMS signing with both Node.js crypto and OpenSSL parity tests, and a modular design that separates provider data, language templates, and build logic. While the repository is primarily a build tool, it also serves as a reference for encrypted DNS provider capabilities and a practical solution for deploying encrypted DNS on Apple devices. The signed profiles provide authenticity verification, and the multi-language support broadens accessibility. The code is well-structured and maintainable, though it relies on external certificates for signing and manual updates to provider data when server endpoints change.

This repository contains the ReviOS Playbook, a collection of configuration files and executable scripts designed for the AME Wizard tool to customize Windows 10 and 11 installations. Its primary function is to debloat the operating system by removing pre-installed bloatware (Microsoft Edge, OneDrive, Teams, UWP apps like Xbox, Photos, etc.), disabling telemetry, privacy-invasive features, and unnecessary services, and applying a set of registry tweaks for performance and privacy. The playbook also offers optional software installation (Brave or Firefox), wallpaper and theme configuration, and integration with the Revision Tool for further customization. The architecture is a declarative task pipeline defined in YAML files, orchestrated by AME Wizard, with supporting PowerShell and CMD scripts for specific actions like app removal, registry modifications, and service changes. It is not a standalone application but a payload for AME Wizard.

picosnitch is a Linux daemon for per-executable network bandwidth monitoring using eBPF (CO-RE) and fanotify. It tracks which executables make network connections, records bytes sent/received, timestamps, and metadata (SHA256 hashes, optional VirusTotal and GeoIP lookups). The system provides real-time and historical views via multiple interfaces: a curses TUI (both live top and historical browser), a web UI, and a UNIX socket live feed. The daemon uses a multiprocess architecture with privilege-separated subprocesses for monitoring, event processing, database writes, notifications, and external API queries. It supports local SQLite storage and optional remote SQL (MariaDB/MySQL/PostgreSQL) for tamper-evident logging. The repository also includes a comprehensive comparative benchmark suite (bench/) that tests picosnitch against nine other network monitors across 24 scenarios, with a reusable ToolAdapter framework for running controlled experiments.

This repository contains the official IVPN desktop client, a multi-platform VPN application supporting Windows, macOS, and Linux. It is composed of three main components: a privileged Go daemon that manages VPN connections (OpenVPN, WireGuard, V2Ray), firewall (kill switch), DNS (including DNSCrypt-proxy for DoH), split tunneling, and WiFi trusted networks; a Go CLI for command-line control; and an Electron/Vue.js UI for graphical interaction. The daemon and clients communicate over a local TCP JSON protocol with authentication and event push. The codebase demonstrates strong engineering practices: platform abstraction via build tags, a custom ICMP ping library, a reusable logger, a type-safe IPC client library documented for third-party integration, and Windows WFP wrappers for firewall and split tunneling. Build scripts and native projects (Windows kernel driver, macOS helpers) handle cross-platform packaging and signing.

Anytype for iOS is a full-featured, offline-first knowledge management and collaboration application. It provides a block-based editor for notes, documents, and databases (sets/collections), along with chat, spaces, widgets, and membership management. The architecture follows MVVM with a coordinator pattern, heavily leveraging SwiftUI for modern UI and UIKit for legacy editor components. Communication with the backend (middleware) is via protobuf-defined commands and events, with real-time subscription-based data synchronization. Dependency injection is handled through the Factory library, and the codebase is modular with separate packages for services, design system, core utilities, and generated protobuf models. The app supports iOS 17+ and uses Swift 6 concurrency features extensively.

Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.

imsgcrawl is a local-first CLI tool for reading, archiving, and searching Apple iMessage data. It operates by taking a read-only snapshot of the macOS Messages SQLite database (`chat.db`), extracting handles, chats, messages, and deletion events, then merging them into a local SQLite archive. The tool provides bounded commands for metadata, status, sync, chats, messages, full-text search, and phone-only contact export. It outputs both human-readable text (with terminal control escape protection) and stable JSON for automation. The architecture is cleanly separated into packages for archive management, message extraction (including attributed body decoding and edit/unsend reconstruction), and portable SQLite snapshotting with macOS copy-on-write support. The codebase demonstrates strong engineering practices: thorough test coverage including fuzzing, explicit privacy boundaries, identity validation for source databases, and careful handling of edge cases like malformed UTF‑16, hardlinked sidecars, and concurrent sync locking.

This repository provides a cross-platform desktop application (GUI and CLI) for debloating Android devices by uninstalling or disabling unwanted system packages. It is built in Rust using the Iced GUI framework for the interface and a shared core library (`uad-core`) that abstracts ADB communication, package list management, backup/restore, and self-update logic. The tool leverages a community-maintained package classification database (embedded JSON) that categorizes packages by vendor (AOSP, Google, OEM, etc.) and removal safety (Recommended, Advanced, Expert, Unsafe). The architecture is modular: `uad-core` handles all ADB operations and data logic, `uad-cli` provides a command-line interface with subcommands for device management, package list filtering, and actions, and `uad-gui` offers a modern graphical interface with search, filter, bulk selection, and settings for cross-user and fallback modes. The codebase is well-organized with clear separation of concerns, custom theming, and a generic modal overlay widget. It demonstrates solid engineering practices for a desktop tool, though some components (like the embedded large JSON and complex fallback logic) introduce maintenance complexity.