Ask HN: What should I verify before releasing a P2P messenger?

#1

Post by Realman78 » Mon, Jul 06, 2026, 3:03 PM UTC

I’m releasing 1.0 of an open-source desktop P2P messenger tomorrow - Realman78/Kiyeovo on GitHub. In short, it's a feature rich messenger with clearnet “Fast mode” and an optional Tor-routed “Anonymous mode.” Before the "release" tomorrow, I want to catch anything I might have missed.

For people who have shipped tools from this domain (privacy/messaging/security): what would you verify now that you have less than 24 hours?

Re: Ask HN: What should I verify before releasing a P2P messenger?

#2

Post by fullstick » Mon, Jul 06, 2026, 5:03 PM UTC

What have you already verified?

Re: Ask HN: What should I verify before releasing a P2P messenger?

#3

Post by Realman78 » Mon, Jul 06, 2026, 5:12 PM UTC

fullstick wrote: post #2

What have you already verified?

I have verified that the app works without an issue on clean installations of Ubuntu, Debian and MacOS. I have spent the last 2 days testing the app by pretending to be a malicious user and patched those holes up. I ran the whole app through a detailed security scan using Fable. I went through the whole app and reduced metadata leakage to a bare minimum required by the app to work. I implemented all electron security recommendations. Currently, I'm just doing manual testing which mostly doesnt bring up any bugs, but rather some UI issues (like flickering or text going out of bounds) that I immediately patch

Re: Ask HN: What should I verify before releasing a P2P messenger?

#4

Post by firefax » Mon, Jul 06, 2026, 8:17 PM UTC

Verify you have a well established way to contact you about security vulnerabilities. (There will be vulnerabilities. Things like "anonymous mode" are harder than you'd think to make... trust me.)

Re: Ask HN: What should I verify before releasing a P2P messenger?

#5

Post by Realman78 » Mon, Jul 06, 2026, 9:13 PM UTC

firefax wrote: post #4

Verify you have a well established way to contact you about security vulnerabilities. (There will be vulnerabilities. Things like "anonymous mode" are harder than you'd think to make... trust me .)

The repo is open sourced so issues can be raised. I also included my email inside the app's info dialog

Re: Ask HN: What should I verify before releasing a P2P messenger?

#6

Post by jj2jj3 » Mon, Jul 06, 2026, 9:19 PM UTC

Realman78 wrote: post #5

firefax wrote: post #4

Verify you have a well established way to contact you about security vulnerabilities. (There will be vulnerabilities. Things like "anonymous mode" are harder than you'd think to make... trust me .)

The repo is open sourced so issues can be raised. I also included my email inside the app's info dialog

[dead]

Re: Ask HN: What should I verify before releasing a P2P messenger?

#7

Post by firefax » Tue, Jul 07, 2026, 7:56 PM UTC

Realman78 wrote: post #5

firefax wrote: post #4

Verify you have a well established way to contact you about security vulnerabilities. (There will be vulnerabilities. Things like "anonymous mode" are harder than you'd think to make... trust me .)

The repo is open sourced so issues can be raised. I also included my email inside the app's info dialog

Cool, for these things it's better to not have the only option be a PR. Good luck with your project!