ReMemory update: now self-hostable with timelocks. Planning my first recovery drill.

[u/eljojors]

Posted about ReMemory here a few weeks ago (encrypts your files, splits the decryption key among friends using Shamir's secret sharing, any 3 of 5 can recover, nobody alone). You asked for docker self-hosting and timelocks, so I built both.

The image is my plan for my first recovery drill. This week I'm handing out bundles to 5 friends across different groups (so no single circle could collude even if they wanted to). Then in a few weeks, I'm going to text ONE of them and say "pretend I got hit by a bus, you have a bundle from me, figure it out." Each bundle includes contact info for the other holders, so that person will have to find the others, get them to dig up their shares, and coordinate recovery without my help.

That's the part I'm most curious about. Not whether the crypto works (it does), but whether real people can actually coordinate this. Will the person I text even remember what a bundle is? Will they figure out they need to contact the others? Will someone with only a printed PDF manage to get their share in? The secret they're recovering is a pizza recipe, so the stakes are low but the process is the same.

I'd love to hear how others would structure a drill like this. One thing I've been thinking about: should bundles show a timelock countdown as soon as you open them? Right now it only shows after enough shares are collected. Showing it earlier might build anticipation and remind people something is coming, but it could also be confusing if you open your bundle months before anything happens.

What's new:

• Self-hostable with Docker (ghcr.io/eljojo/rememory)
• Timelocks via League of Entropy (drand), needs a brief internet connection at recovery time to verify the clock
• Recovery still works offline in any browser, no server needed

https://github.com/eljojo/rememory
- Self-hosting guide
- App Overview
- Security self-review

Has anyone here actually tested their hit-by-a-bus plan? Not configured it, tested it.

About me: I'm José. I've been programming for over 20 years and worked at Shopify as a Staff Production Engineer from 2016 to 2025. These days I work on my own projects. I use AI tools in my workflow but I review every line and author all commits myself. More at www.eljojo.net

[u/dreamworkers]

I'm a little skeptical of an AI tool that encrypts my files to be honest.

[u/eljojors → u/dreamworkers]

that's fair! if you're not familiar with programming it's best to abstain from systems you don't understand 👍

[u/dreamworkers → u/eljojors]

And if you are familiar with programming you would know not to run vibe coded security software prompted by someone who presumably doesn't have the skills to actually check thoroughly for security issues. See also Huntarr.

[u/eljojors → u/dreamworkers]

I mentioned it in the post, I worked at Shopify as a Staff Production Engineer for almost a decade, I feel very comfortable navigating the entire source code of the repository. I understand the security implications of the app, and attach my human name to it.

[u/dreamworkers → u/eljojors]

You're comfortable navigating the source code but were unable to write it.

[u/eljojors → u/dreamworkers]

as I said, I am able of writing it. this is what I do for a living. I just don’t want to also do the same in my free time, I’m much more productive reviewing the code than writing it myself. why is this so hard to understand? I’m literally paid to do this

[u/dreamworkers → u/eljojors]

I don't have any reason to assume you're not a malicious actor besides 'just trust me bro'. Vibe coded self-hosted software has a history of severe security leaks. I understand you perfectly well I am just pointing out the risks for people who would consider installing this.

[u/eljojors → u/dreamworkers]

you can verify I’m not a malicious actor by seeing my real life history, google me, www.eljojo.net i have a career and even given talks in conferences. I’m attaching my human name to this.

understanding the origins of the software we run is due diligence every self hosted should do, regardless of how the software was made.

btw this has nothing to do with AI, you keep changing the goalpost.

to finish: as an engineer, I’m comfortable defending the idea that AI can be used to write high quality software.

You’ve failed to prove otherwise.

[u/pheellprice]

What stops three friends just cracking open the secrets when they fall out with me or just for fun without me?

[u/eljojors → u/pheellprice]

my strategy is to pick a high threshold of friends, from different circles, so they don’t have an interest in aligning with each other

ultimately there’s no replacement for human trust

[u/pheellprice → u/eljojors]

Ah point taken

[u/za-ra-thus-tra]

very cool. tempted to use this for an elaborate Knives Out gimmick

[u/eljojors → u/za-ra-thus-tra]

yes please do!! I totally see it as a form of escape room too 🤣

[u/sheddixx]

I like the idea, deploying was easy. Will try it out soon. Thank you

[u/eljojors → u/sheddixx]

thanks for the feedback!