December 27, 2022

131: Start Securing Elixir and Phoenix

38 minutes

Securing our apps is our responsibility as developers. We are the custodians and the guardians of our user's data. We met up again with Michael Lubas to discuss some lesser known community security resources and helpful tips to get us started with securing our Elixir and Phoenix applications!

Show Notes online - http://podcast.thinkingelixir.com/131

Elixir Community News

https://erlangforums.com/t/otp-25-2-released/2166 – Erlang/OTP 25.2 is the second maintenance patch package for OTP 25, with mostly bug fixes as well as improvements.

https://twitter.com/livebookdev/status/1603787699458113539 – HuggingFace announced “spaces”, a feature that lets people run Docker images on HuggingFace.

https://huggingface.co/spaces/livebook-dev/single_file_phx_bumblebee_ml – Elixir Phoenix was specifically shown as a Docker example on HuggingFace

https://twitter.com/sean_moriarity/status/1602817446875992066 – Sean Moriarity added “negative prompts” feature to Nx's Stable Diffusion support.

https://github.com/elixir-nx/bumblebee/pull/109 – PR adding "negative prompt" support

https://twitter.com/miruoss/status/1604849993130676225 – Michael Ruoss has a new Kino plugin for working with kubernetes pods

https://github.com/mruoss/kino_k8s_term – KinoK8sTerm

https://twitter.com/livebookdev/status/1603391808209391617 – Livebook added two new neural network tasks to Bumblebee integration.

https://twitter.com/hanrelan/status/1603470678081929216 – Customized Livebook Stable Diffusion shows intermediate steps when generating images.

https://blog.ftes.de/elixir-dijkstras-algorithm-with-priority-queue-f6022d710877 – Fredrik Teschke wrote a blogpost using Livebook to visualize Dijkstra's algorithm for finding the shortest path between nodes in a graph.

https://notes.club/ – Notesclub is a website by Hec Perez that makes it easy to share and discover Livebook notebooks online.

https://twitter.com/louispilfold/status/1602740866602631170 – Louis Pilfold announced his last full day at Nomio. He is now working full time on Gleam.

https://twitter.com/louispilfold/status/1600960290455113728 – Louis Pilfold shared that Bumblebee, Nx and Axon work in Gleam thanks to Gleam's new Elixir support.

https://twitter.com/kipcole9/status/1604929772253229057 – Kip Cole has a library called Image. He added Image.Classification.classify(image) using Bumblebee.

https://sessionize.com/code-beam-lite-stockholm-2023 – Code BEAM Lite Stockholm 2023, 12 May 2023, Stockholm, Sweden. Call for speakers is open until Feb 5th 2023.

Do you have some Elixir news to share? Tell us at @ThinkingElixir or email at [email protected]

Discussion Resources

https://paraxial.io

https://paraxial.io/blog/securing-elixir – Securing Elixir/Phoenix Applications - 5 Tips to Get Started

https://paraxial.io/blog/xss-phoenix – Cross Site Scripting (XSS) Patterns in Phoenix

https://podcast.thinkingelixir.com/93 – Previous interview with Michael

https://www.youtube.com/watch?v=w3lKmFsmlvQ – ElixirConf 2017 - Plugging the Security Holes in Your Phoenix Application - Griffin Byatt

https://felt.com/blog/rate-limiting – Rate Limiting Algorithms for Client-Facing Web Apps by Tyler Young

https://github.com/podium/elixir-secure-coding – Elixir Secure Coding Training (ESCT) that runs in Livebook

https://github.com/rrrene/html_sanitize_ex

https://fly.io/phoenix-files/github-actions-for-elixir-ci/ – Blog post about Elixir CI/CD checks

https://github.com/mirego/mix_audit – mix_audit

https://hexdocs.pm/mix/Mix.Tasks.Deps.Unlock.html – mix hex.audit

https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/ – Erlang Ecosystem Foundation resource - Secure Coding and Deployment Hardening Guidelines

https://github.com/slab/safeurl-elixir – SafeURL hex package by Slab

https://slab.com/

Guest Information

https://twitter.com/paraxialio – on Twitter

https://github.com/paraxialio/ – on Github

https://paraxial.io/ – Blog

[email protected]

https://genserver.social/paraxial – on Mastadon

Find us online

Message the show - @ThinkingElixir

Message the show on Mastadon - @[email protected]

Email the show - [email protected]

Mark Ericksen - @brainlid

Mark Ericksen on Mastadon - @[email protected]

David Bernheisel - @bernheisel

David Bernheisel on Mastadon - @[email protected]

Cade Ward - @cadebward

Cade Ward on Mastadon - @[email protected]