65
PeerBox, the first fully P2P secure email system
(novafuture.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 17 Apr 2026
65 points (88.2% liked)
Privacy
9692 readers
816 users here now
A community for Lemmy users interested in privacy
Rules:
- Be civil
- No spam posting
- Keep posts on-topic
- No trolling
founded 2 years ago
MODERATORS
Is this vibecoded or is there thinking behind why it will silently reuse existing user SSH keys by default? For an app like this I would expect it to exclusively use its own keys. Same for PGP.
I also find the ways dependencies are handled a bit unorthodox and surprising (possibly system-breaking even). For a python project it would make more sense with a lockfile and using a package manager for dependencies installed remotely via pip.
https://codeberg.org/NovaFuture/Peerbox/src/commit/60ed3b638d6dc6c82322f73a9ce1c3e44ecec5d2/conf/config.py#L148-L197
https://codeberg.org/NovaFuture/Peerbox/src/commit/60ed3b638d6dc6c82322f73a9ce1c3e44ecec5d2/system/mount/src/onion_client.py#L345
I also wonder why it bundles minified js for Quill editor v1.3.7 (from 2019) when unminified version would be easier to audit and maintain, and v2.0.3 was released in 2024?
Thanks for the detailed review, really appreciate it — this is exactly the kind of feedback the project needed before a public release.
You were right on two of the three points, and I've just pushed fixes to Codeberg (commit 93b8985):
GPG: you nailed it.
config.pywas silently reusing the user's personal~/.gnupgkeyring if a key was present, which is obviously wrong for an identity-isolated app. Fixed: PeerBox now uses a dedicated keyring atsystem/gpg/with--homedirenforced on every gpg call. Existing users get their key auto-migrated on nextconfig.pyrun so contacts don't break.Dependencies:
install_pysocks()was callingpip install --break-system-packagesat runtime, which is indefensible. Removed entirely — it was actually dead code (never called) but still a trap. DocumentedPySocksin the README as a required pip dep alongside cryptography and pywebview. The broader venv/lockfile refactor is a bigger chantier, planned for phase 6.SSH keys: here I have to push back a bit —
ssh_setup.pydoes generate a dedicatedid_rsa_peerboxkey, never reusesid_rsaorid_ed25519. BUT you indirectly uncovered a real bug:request_creator.pyhad a silent fallback readingid_rsa.pub/id_ed25519.pubifid_rsa_peerbox.pubwas missing. That's gone now too.Quill 1.3.7 → 2.0.3: fair point, on the roadmap for this weekend. Non-minified too for auditability.
Seriously, thanks for taking the time to read the code and call out what needed calling out. This is what keeps small projects honest.
Obvious LLM reply is obvious.
I wouldn't call that detailed. It was what glared at me from skimming for a couple of minutes.
"You" still have three instances left of runtime
pip install --break-system-packageswithout user interaction, one of which dead code.I think the follow-up beautifully clarified the "is this vibecoded?" question too.
Labeling it
1.0.0seems premature to say the least.I needed an open beta over the weekend to finalize a solid version. I've been working on this project since November, and at some point you can't look at your own code with fresh eyes anymore. Anyone who codes will know exactly what I mean. A new version is now online. Everything you mentioned isn't relevant anymore. On the "is this vibecoded?" question, honestly, I find it disrespectful. I've put in hundreds of hours since November, plus another 15+ hours this past weekend, and the implicit suggestion that GPT wrote the thing isn't a fair take. Disagree with design choices, sure, that's a real conversation. But that framing isn't it. Also, on an open source project, opening an issue on Codeberg is way more constructive than chatting on a forum. That's where actual fixes happen.
Aaaand there goes your credibility.
Oh, the irony!
Yeah this response is not reassuring. Death to AI slop.
Are you alright? Just chilling? Doing your own thing in your corner? You're speaking without any basis. That's unacceptable.