# 🙏 Looking for Feedback & Suggestions – PyPUtil (Early Stage)

[frosty zephyr]

is this project written with AI? if so, you should use the Created With AI tag

[noble vale]

<@&831776746206265384> pls check this project. Im highly confident that it was written by ai(atleast partially).

[plain lintel]

Yeah, I use this tag, check the tags (other and Created with AI)

[frosty zephyr]

i see, but it wasnt added when this post was uploaded which was why i commented that

[plain lintel]

Okay, sorry, but there might be a problem with the comment because I added it from the beginning

[plain lintel]

It is, bro

[brazen axle]

using AI is fine

if you have some sort of AI assistance involved, you should add the "created with AI" tag (which it seems like OP did)

that said, if the project wasn't written by you (e.g it's someone else's work, or if it was completely vibe-coded), that's a different issue

[plain lintel]

Some of the code was written by AI and some by me, but often the documentation in the code is done through the AI assistant

[brazen axle]

that's fine

[fervent dome]

sorry @still quartz your message got a bit nuked

I can retrieve the text if you need

[still quartz]

yeah, all good. Do you still have it by any chance?

yeah perfect

[fervent dome]

I messaged your message to you

[still quartz]

thank god, I was just trying to re-create it all in my mind

First of all: It's very telling that your Reddit account where you also posted this to got banned, even though you just posted this there 5 days ago: https://www.reddit.com/r/PythonLearning/comments/1ta9uxv/no_dependences_a_library_for_speeding_up_and/

And the giant response comment you made there is so obviously just LLM slop. You didn't even get the formatting right!
The fact that your chosen name on Reddit was "getfuckoff" also tells a story...

From your README:

Run C/C++ code inside Python without compiling separately
What? How? That does not make sense.

# 1. Run C code (1000x faster)
Never make such "Nx faster" claims without any proper proof. That will immediately discredit your entire repo.

Feature PypUtil cookiecutter ctypes pip poetry Project templates <TON OF EMOJIS> Run C in Python <TON OF EMOJIS> Run C++ in Python <TON OF EMOJIS> Auto-install packages <TON OF EMOJIS> Hot reload <TON OF EMOJIS> Freeze modules <TON OF EMOJIS> Load from URL <TON OF EMOJIS> Single library
Huh? Incredibly confusing, I have no clue what that's trying to tell me

In this part here:

build_structure_template(
...
create_github_actions=True,
create_changelog=True,
create_tests=True,
create_docs=True,
...
)
```aren't these kind of things that you would usually all like to do yourself, so you know exactly what's happening there, as these are sort of the most important parts of your code?

It also seems as if you uploaded all your `.pyc` files, i.e. the compiled Python bytecode. Is that intentional? Probably not. 

Also who wrote this code? There's like an essentially zero percent chance you wrote that code as the sole contributor. This thing is round about three-hundred-fifty-thousand (**350.000**) **lines of code**. And all of that in just two (**2**) **commits** (5 or 6 if you count the other branch you have, where you also have some absurd line of code changes that I didn't even account for here), even though you claim to have worked on this for two years.

Things I added after the timeout:
*I did overlook the "Created with AI" tag, too, but the tag is meant for when it was used as an assitance, but this seems like the entire project is just generated, isn't it?

Also while I did found the test folder, I didn't find any actual tests. Do you have any sort of tests for your code?

[still quartz]

**Regarding the "that doesn't make sense" comment:
From what I can tell from your code is that you are compiling it to then run it, so that statement "without compiling" is just wrong. You should rather call it something like "dynamic compilation" or something alike

[plain lintel]

Some of your criticism is fair, especially regarding the presentation and structure of the project.

I realize now that I over-marketed parts of the repository and tried to make the project look bigger and more impressive than it needed to be. That ended up hurting the credibility of the project instead of helping it.

At the same time, some assumptions being made about me personally are not accurate. I never claimed to be a large team, and I also never claimed that every line was written manually without any tooling or assistance. Modern development today includes generators, automation, templates, AI assistance, experiments, and archived code. The repository grew over a long period of testing and collecting utilities, but I understand why the current state looks confusing from the outside.

The criticism about the README, exaggerated wording, unclear feature descriptions, ".pyc" files, and overall structure is valid though, and I’m already planning to completely restructure the project into a much smaller, clearer, and properly documented form.

I want the project to be judged by clear code quality, documentation, and realistic functionality — not by marketing language or inflated claims. So the next versions will focus more on transparency, simplicity, benchmarks, examples, and maintainability.

[plain lintel]

That’s a fair concern.

I did use AI tools heavily during development for assistance, experimentation, refactoring, documentation drafts, and generating boilerplate. The repository in its current form is honestly a mix of manually written code, generated structures, experimental utilities, and unfinished ideas collected over time.

I understand why that gives the impression that the project is overly AI-generated or inconsistent structurally.

Regarding tests: right now the testing situation is incomplete. Some modules were tested manually during development, but I have not yet built a proper automated test suite with good coverage, which is something I’m currently restructuring the project around.

The current repository is closer to a large experimental/dev sandbox than a polished production-ready library, and I think part of the misunderstanding came from me presenting it too aggressively instead of communicating that more clearly.

That’s also why I’m now simplifying the project, improving documentation quality, removing exaggerated claims, organizing features into smaller maintainable parts, and adding proper tests and benchmarks over time.

[still quartz]

I never claimed to be a large team
Neither did I, I saw you were the sole contributor on GitHub. It just shocked me how many lines of code (besides a ton of other binary files) there were

The repository grew over a long period of testing and collecting utilities
The repository is 2 commits (5 or 6 if you include the other branch, but 3 commits are called "Deploy [some-commit-hash]" so that's kinda confusing, too). That did not "grow over a long period". In fact, your GitHub account is only a month old. Maybe you had the repo hosted elsewhere before? If yes, unclear. Also the fact that this is currently in version 0.1.0 speaks against your claim of it being a "long period"

I guess my main issue is that your project does not have any identity. I have absolutely no clue why I should pick your project. Yes, it seemingly does everything, but why? What problem does it solve?
Like, at first I was kinda hyped when I saw something to [compile and] run C & C++ from inside Python, but then you suddenly dove off to "auto-install packages" then to "generate complete project templates" then to "freeze modules in memory" then "Dynamic Module Loading" then an "[online] Package Search & Analysis" and a "Package Installation & Management", and some "Module Utilities".
Like, it does waaaaaay too much.
Each of these applications is kind of unique and niche. I can't ever imagine a scenario where you would want all of those features, at best you'd want like 2 of those. Also, in your project each of these features has essentially it's completely own API, so there is not even any better of a learning curve when using your project other a well established one.

My recommendation, I guess, would be to split this up into like 5-6 distinct projects, where each caters a unique purpose. That would also be much more sensible in terms of maintainability and probably also less scary initially.

Also your Discord responses sound like they're LLM-generated, too (they probably are :sigh:)

But overall you took the criticsm very well :proud:

[plain lintel]

Yeah, that’s actually fair criticism honestly.

You’re right that the project currently feels too broad and tries to cover too many unrelated areas at once. A lot of those utilities started as personal experiments/tools I kept extending over time, and eventually I bundled them together under one repository instead of separating them properly from the beginning.

And about the “long period” part — I meant the actual development/testing itself, not necessarily the public GitHub history. Most of the work existed locally before I pushed it publicly, which is also why the repository history currently looks messy and confusing.

I also agree with the identity problem. Right now PyPUtil doesn’t communicate a very clear “main purpose”, and that’s something I need to improve a lot.

Your point about splitting the project into smaller focused parts makes sense too, and that’s actually something I already started planning after reading the feedback here. The codebase will most likely be reorganized into more modular/separated components to make it feel more modern, maintainable, and less overwhelming overall.

And yeah 😭 some of my responses probably sounded too AI-polished. English isn’t my first language, so sometimes I over-correct my wording and it ends up sounding unnatural.

Still, I genuinely appreciate the detailed feedback. Comments like this are honestly more useful to me than blind praise.

[plain lintel]

Your honesty has benefited me, thanks bro 🙏

[frosty jetty]

@plain lintel explain in short how it works?

Running C code without compiling? how did u do it?

[plain lintel]

It still gets compiled internally 😭
I probably explained that part badly before.

What PyPUtil does is automate the whole process from Python:

• creating temporary source files
• invoking GCC/Clang in the background
• compiling the code
• then executing the produced binary automatically

So from the user perspective it feels like “run C directly from Python”, but under the hood it still uses a real compiler normally.

[frosty jetty]

🙃

"Run C/C++ code inside Python without compiling separately?"

• in ur github readme first point of "🧠 What is PypUtil?"

@plain lintel I see this line.
May i know how the sandbox functions?

"· Sandbox untrusted C code · Analyze package dependencies for vulnerabilities · Trace module imports and origins"

[plain lintel]

Yeah 😭 that wording in the README is my fault honestly.

What I actually meant is:
“without manually compiling it yourself”.

The compilation still happens normally in the background through GCC/Clang, PyPUtil just automates the process from Python so the user doesn’t have to handle the compile/run steps manually.

[plain lintel]

Absolutely!

But how can I send it to you?

[frosty jetty]

just tell me here

how exactly does the sandbox work?

you are just compiling and running

where is the sandbox here

[plain lintel]

Right now the sandbox uses OS-level process isolation mechanisms. On Unix systems it relies on setrlimit for resource limits (CPU, memory, processes, files), process groups for signal handling, and optional prctl/seccomp for syscall restrictions. On Windows it uses Job Objects, restricted tokens, and integrity levels.

Filesystem access is controlled through a path restriction engine with whitelist, blacklist, and read-only rules. Bind mounts, tmpfs, and overlayfs are available on supported platforms. Network blocking uses iptables, nftables, or Windows Filtering Platform. A temporary workspace is created and cleaned up automatically.

Chroot, overlayfs, and seccomp filtering require root/administrator privileges. Without those, the sandbox operates with standard user permissions.

[frosty jetty]

i dont think you have done these properly mate

everything looks vibe coded

did u run som tests? try some code which can break it and all that ? Before saying thta you can safely run untrusted C++ programs in it

[frosty zephyr]

why not use nsjail

much less error-prone

[frosty jetty]

i dont think he coded any part of this seriously man 😭

he just vibe coded it

[plain lintel]

That’s completely fair criticism honestly.

The sandboxing part is still experimental and nowhere near something I’d consider production-grade security. I definitely worded some parts too strongly in the README.

Right now it’s more of a restricted execution/helper layer with timeouts, subprocess isolation, temporary environments, and resource limits — not a hardened security sandbox for safely executing highly malicious code.

And yeah, I still need much more stress testing, adversarial testing, and real-world validation before making stronger claims around safety/security.

I also wrote tests just to show you that the documentation and the sandbox work as expected and as documented.

Unfortunately, I cannot send it in full here.

[plain lintel]

Mostly because I originally wanted the execution layer to stay cross-platform instead of depending on Linux-only tooling like nsjail.

But after the feedback here, I’m starting to separate the ideas of:

• “cross-platform execution management”
  vs
• “actual hardened sandbox security”

Right now the current implementation is much closer to the first one 😭
So I’ll probably rethink how I describe/document that part going forward.

Thank you for your suggestion 🙏