Elixir Mentor

Mike Hostetler, creator of Jido and ReqLLM, is back for round three. Jido 2.0 hit the top of Hacker News and took his docs server down with it, and Jido v3 betas are already on Hex. We get into agentic back pressure, why models write better declarative Elixir, why most actors don't need an LLM at all, durable workflows with Jido Flow, and the multiplayer harness he's building on OTP.

Plus Grok Bots and personal agents, reverse engineering bad IoT apps, and live questions from chat.

00:00 - Introduction

02:56 - The Jido 2.0 launch and a Hacker News hug of death

06:27 - Lessons from Ralph Wiggum loops

08:51 - Why models write better Elixir

11:44 - Agentic back pressure

14:22 - Jido v3's Spark DSL

20:48 - When do you need 10,000 agents?

26:28 - Q&A: A public actor mesh?

27:59 - Actors vs agents: Jido without an LLM

30:38 - Halo 2 NPCs and classical AI

33:36 - What's new in Jido v3

35:03 - Durable workflows with Runic and Jido Flow

39:34 - Property and fuzz testing with agents

42:27 - Who's building on Jido

44:27 - Q&A: TermUI and the Jido harness

48:28 - DASP, the Durable Actor Session Protocol

50:39 - Q&A: Pods, topologies, and the signal bus

55:01 - Grok Bots, Dots, and personal agents

57:20 - Reverse engineering IoT apps with an LLM

1:06:24 - LLMDB and LLM Catalog

1:07:51 - 600 PRs a month and vibe coded PRs

1:12:12 - The Founder Playbook skills repo

1:14:37 - Teaching and community after LLMs

1:17:31 - Will AI replace engineers?

1:22:57 - A hard lesson migrating Killswitch data

1:25:01 - What's next for Jido and the harness

Resources Mentioned:

- Jido: https://jido.run/?utm_source=elixir-mentor

- Runic: https://github.com/zblanco/runic?utm_source=elixir-mentor

- LLM Catalog: https://llmcatalog.dev/?utm_source=elixir-mentor

- Founder Playbook: https://github.com/getagentseal/founder-playbook?utm_source=elixir-mentor

- Killswitch: https://killswitch.app/?utm_source=elixir-mentor

Connect with Mike:

- X: https://x.com/mikehostetler?utm_source=elixir-mentor

- LinkedIn: https://www.linkedin.com/in/mikehostetler?utm_source=elixir-mentor

Sponsors:

- BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor

- Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor

- Jido: https://agentjido.xyz/discord?utm_source=elixir-mentor

SUPPORT ELIXIR MENTOR

- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

#ElixirLang #MyElixirStatus #ElixirMentor

Michael Lubas, CEO of Paraxial.io and the first guest ever on this podcast, is back to check in on the state of security. We get into Microsoft's record Patch Tuesday, why AI keeps lowering the bar for attackers, the OpenAI sandbox escape story, and whether the AI labs are overstating the risk.

Michael shares why cheap foundational checks still beat a frontier model, why small companies should skip bug bounties, and why Elixir gets no credit for its security. Plus live questions from chat.

00:00 - Introduction

02:34 - ElixirConf US and the Hex pentest talk

06:20 - Microsoft's record Patch Tuesday

13:50 - Engineers who stopped reading their code

14:54 - LLMs as offensive security engineers

17:40 - Sandbox escapes and the OpenAI incident

23:00 - Are the AI labs overstating the risk?

26:09 - The open weights debate

29:32 - Developer anxiety and the Rails World keynote

35:00 - Why it's getting worse for defenders

38:30 - Run grep before a frontier model

41:11 - Why Elixir has an edge right now

45:21 - Patch windows in the AI era

47:11 - Can a startup stop a nation state?

50:06 - Securing your Elixir app with AI

57:17 - Letting AI patch production live

1:01:38 - Learning security as a developer

1:03:42 - Why small companies should skip bug bounties

1:04:54 - Insecure MCPs and AI assistants

1:10:14 - Verifying beneficiaries in Killswitch

1:12:36 - Q&A: Simulating catastrophic events

1:13:25 - Q&A: Learning ethical hacking with AI

1:16:22 - Kids, social media, and regulation

1:23:17 - Q&A: Are garbage collected languages safer?

1:27:26 - Where to find Michael

Resources Mentioned:

- Securing Hex: https://paraxial.io/blog/hex-pentest?utm_source=elixir-mentor

- PortSwigger Web Security Academy: https://portswigger.net/web-security?utm_source=elixir-mentor

- The Web Application Hacker's Handbook (2nd ed.)

- Killswitch: https://killswitch.app/?utm_source=elixir-mentor

Connect with Michael:

- LinkedIn: https://www.linkedin.com/in/michaellubas?utm_source=elixir-mentor

- Paraxial.io on X: https://x.com/paraxialio?utm_source=elixir-mentor

Sponsors:

- BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor

- Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor

- Jido: https://agentjido.xyz/discord?utm_source=elixir-mentor

SUPPORT ELIXIR MENTOR

- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

#ElixirLang #MyElixirStatus #ElixirMentor

Adam Gusky, solo founder of Blawgy, on how businesses get recommended by ChatGPT and other AI tools, and what technical founders get wrong about marketing. Adam went from a college wrestling meme page and 30 side projects to quitting his job, selling Blawgy as a hand-built service, watching it churn, and rebuilding it into a product agencies now run for their clients.

We get into SEO vs AEO, whether a post every day still works, and why most people will buy software instead of vibe coding it. I share how customers are finding Killswitch through AI answers, the Grok Bot team behind its marketing, and the partner program I'm building with attorneys and financial advisors.

00:00 - Introduction

02:19 - A college meme page and 30 side projects

04:05 - What Blawgy does

04:51 - Is SEO dead? SEO vs AEO and GEO

07:18 - How long before it works

10:34 - FoodBuddy and the menu item calorie play

12:21 - Agent readiness and llms.txt

15:23 - Customers finding Killswitch through AI

18:35 - Quitting the job to build Blawgy

22:12 - From hand-built service to real product

24:26 - Guardrails and multi-pass quality checks

26:17 - The Blawgy pixel and refreshing old posts

33:30 - Why people buy software instead of vibe coding it

38:37 - Handoff plans for solo founders

45:23 - Blawgy's stack, AI coding tools, and Tmux

54:06 - Marketing Killswitch with Grok Bots

56:31 - CAPTCHAs, bots, and AI slop on social

58:48 - A partner program for attorneys and advisors

1:01:09 - Local cold outreach that gets replies

1:03:02 - Why Blawgy sells to agencies

1:09:50 - Tiered pricing and finding agencies with Apollo

1:13:23 - SEO agencies, backlinks, and a cold email experiment

1:16:34 - Is a post every day overkill?

1:19:08 - Building an AI podcast producer

1:27:42 - Where to find Adam

Resources Mentioned:

- Blawgy: https://blawgy.com/?utm_source=elixir-mentor

- MyFoodBuddy: https://apps.apple.com/us/app/myfoodbuddy/id6505124191?utm_source=elixir-mentor

- Is It Agent Ready: https://isitagentready.com/?utm_source=elixir-mentor

- Killswitch: https://killswitch.app/?utm_source=elixir-mentor

Connect with Adam:

- X/Twitter: https://x.com/adamc0dez?utm_source=elixir-mentor

- Blawgy on X: https://x.com/blawgyseo?utm_source=elixir-mentor

Sponsors:

- BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor

- Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor

- Jido: https://agentjido.xyz/discord?utm_source=elixir-mentor

SUPPORT ELIXIR MENTOR

- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

#ElixirLang #MyElixirStatus #ElixirMentor

Brice Ayres, founder of Axio Intelligence, on fractional engineering and what changes when one senior engineer can run a team of AI agents. Brice went from the Army and a 3.7 million follower Facebook cause to finding Elixir at Topgolf, leading engineering orgs, and going out on his own.

We get into managing agents like an engineering org, whether you still need to read every line, and why Ash keeps LLMs on the rails. I share how a team of Grok Bots handles marketing, support, and QA for Killswitch, and we close with Brice's playbook for cutting cloud costs.

00:00 - Introduction

02:51 - Web dev class, the Army, and a viral nonprofit

08:38 - Finding Elixir at Topgolf

13:00 - What is fractional engineering?

16:10 - Vibe coding and why engineers still matter

24:03 - Think like an engineering manager

26:32 - Reviewing AI code, Ash, and established patterns

29:55 - Offmic, a live AI podcast producer

35:18 - Running agents like an engineering org

40:51 - Read-only agents in prod and self-healing infra

42:05 - A Polymarket bot with agent consensus

47:06 - Marketing Killswitch with Grok Bots

52:06 - Lighthouse scores and agentic browsing

56:13 - Getting found by LLMs

59:27 - Order with Surf: agentic food ordering

1:02:48 - Agent QA and local testing with K3s and Floci

1:05:40 - Data labeling, synthetic data, and edge AI

1:08:55 - Nerves, Peridio, and Avocado OS

1:11:47 - Bot traffic, analytics, and self-hosting

1:16:00 - Hardware stories and real-world edge cases

1:26:24 - When engineers ship faster than you can plan

1:29:10 - Monoliths, Postgres scaling, and ETS

1:36:40 - Where to find Brice

1:37:44 - Cutting cloud costs: logging and AZ traffic

Resources Mentioned:

- Axio Intelligence: https://axiointelligence.com/?utm_source=elixir-mentor

- Grok Bot: https://x.ai/news/introducing-grok-bot?utm_source=elixir-mentor

- Killswitch: https://killswitch.app/?utm_source=elixir-mentor

Connect with Brice:

- X/Twitter: https://x.com/briceayres?utm_source=elixir-mentor

- LinkedIn: https://www.linkedin.com/in/briceayres/?utm_source=elixir-mentor

Sponsors:

- BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor

- Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor

- Jido: https://agentjido.xyz/discord?utm_source=elixir-mentor

SUPPORT ELIXIR MENTOR

- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

#ElixirLang #MyElixirStatus #ElixirMentor

In this episode of the Elixir Mentor Podcast, I step a little outside the BEAM to talk with Francesco Ciulla, Head of DevRel at Zerops. Francesco came up as a Rust developer and content creator with a 300,000-subscriber YouTube channel, and we get into the problem every builder runs into: getting developers to actually adopt what you ship.

Francesco shares how he went from a corporate developer role at the European Space Agency to going independent, building an audience, and publishing his own Rust book. We talk about why distribution matters as much as the work itself, how public speaking changed him, and what being a developer looks like in 2026 with AI in the mix.

From there we get into developer relations directly. Francesco explains what the job actually is, why you can't advocate for a product you don't believe in, and how he builds credibility for something he didn't write. He breaks down what Zerops does as a platform, how it compares to running things on GCP, and where developers fall off between signing up and getting real value.

We also cover building a brand by declaring it and not stopping, why negative comments are a sign your audience is growing, language tribalism in tech, the risks of shipping vibe-coded projects without thinking about security, and what it takes to run Elixir on Zerops. A useful conversation for anyone trying to get a tool, a project, or themselves in front of developers.

Resources Mentioned:
- Zerops:https://zerops.io

Connect with Francesco:
- X/Twitter:https://x.com/FrancescoCiull4
- Website:https://francescociulla.com

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com

Jason Allum returns to the Elixir Mentor Podcast to talk about Beadwork, his filesystem-native, git-synced issue tracker built for AI coding agents. With 40 years of building software and cleaning up other people's messes, Jason has a sharp read on where agentic coding falls apart.

The conversation starts with Beads, the ticketing tool that inspired Beadwork, and why it eventually devolved into slop as it grew. Jason explains how coding agents lose the thread on long tasks through compaction and drift, and how a clean queue of tickets keeps an agent moving toward the right outcome instead of stitching back together the very thing it was told to tear out.

From there we get into how Beadwork is built: a git-synced design backed by an orphan branch that sidesteps the merge conflicts that made earlier tools painful for teams and work trees. Jason walks through breaking large changes into epics and issues, pausing the agent to catch drift, and the parts of the job an agent still can't do, like architecture decisions, taste, and judgment.

We also cover raising the quality bar on agent output, the efficiency argument around tokens, multi-project and team workflows, and the prompts Jason reaches for to get better plans. If you write code alongside an agent every day, this one is full of practical, common-sense workflow advice you can put to use right away.

Resources Mentioned:
- Beadwork:https://github.com/jallum/beadwork
- Bedrock (from last time):https://github.com/bedrock-kv/bedrock

Connect with Jason:
- X/Twitter:https://x.com/mullaj
- GitHub:https://github.com/jallum

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com

In this episode of the Elixir Mentor Podcast, I talk with Tjaco Oostdijk, a drummer turned Elixir developer now working at DPG Media, one of the largest media companies in the Netherlands. Tjaco played drums professionally from the age of seven and has taught for 22 years, before landing in software through a music distribution company writing Ruby and eventually moving to Elixir nearly a decade ago.

We get into what it takes to keep Elixir running inside a large enterprise. DPG adopted Elixir after a high-traffic Ruby service fell over at scale, and Tjaco describes the reality of working in a locked-down environment standardized on Kotlin, using Copilot with Anthropic models while waiting for Claude Code to be approved. He also talks about the colleagues who stay skeptical of AI tooling and why that skepticism can be healthy.

The heart of the conversation is muziekles.app, the application Tjaco built for Dutch music teachers to run their entire teaching practice, from year-long scheduling and student accounts to homework and assignments. He explains why he deliberately keeps payments out of the product, how he thinks about onboarding teachers, and the build process using Phoenix, Ash, Claude Code, and Tidewave. We also compare notes on shipping side projects fast, multi-tenancy in Ash, and the differences between hardware and software work.

If you are building with Elixir inside a company that hasn't standardized on it, or shipping a side project with AI tooling, this conversation is full of practical, hard-won lessons from someone doing both at once.

Connect with Tjaco:
- Website:https://drumusician.com
- X / Twitter:https://x.com/drumusician
- GitHub:https://github.com/drumusician
- LinkedIn:https://www.linkedin.com/in/tjaco-oostdijk

Resources Mentioned:
- muziekles.app:https://muziekles.app
- Tidewave:https://tidewave.ai
- Vocablo:https://vocabloapp.com
- Kabisa:https://kabisa.nl

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com

Peter Ullrich returns to talk about a CVE hunt across the most-downloaded Hex packages, run with Claude Code on Opus 4.7. After ElixirConf EU pulled him into AI security, he started pointing Opus at popular libraries day and night, and within half an hour of his first serious attempt he found the Decimal vulnerability, where raising 10 to a huge power can blow up an application's memory.

We get into what separates a real CVE from noise, how CVSS scoring works, and why reachability matters so much, since a flaw in Phoenix's default config matters far more than a crash in a function nobody can call. Peter also walks through the process he runs with the EEF: verifying each issue, getting a second pair of eyes, coordinating a fix, and getting a number issued through a CNA, without sending slop reports to maintainers. We also touch on regulation and breach reporting.

We also cover how Opus compares to Mythos, why Peter keeps coming back to Claude, his first impressions of Opus 4.8, and the economics, with a simple scan costing about $10 in API tokens. He also shares his Session Watcher plugin, an update on Killswitch and its browser-side encryption, thoughts on AEO, and how he uses dev containers to sandbox coding agents.

Resources Mentioned:

• Peter's blog post: peterullrich.com/what-the-cve
• Peter's prompts: gist
• Scrutineer: github.com/alpha-omega-security/scrutineer
• Decimal advisory: GHSA-rhv4-8758-jx7v
• EEF CNA published CVEs: cna.erlef.org/cves
• EEF CNA security policy: cna.erlef.org/security-policy
• Responsible disclosure guidelines: security.erlef.org
• Anthropic article: red.anthropic.com

Connect with Peter:

• Website: peterullrich.com
• GitHub: github.com/pjullrich
• LinkedIn: linkedin.com/in/pjullrich
• Bluesky: @peterullrich.com

Sponsors:

• BEAMOps: beamops.co.uk
• Paraxial.io: paraxial.io

SUPPORT ELIXIR MENTOR

• Elixir Mentor: elixirmentor.com

In this episode of the Elixir Mentor Podcast, I sit down with Jason Allum, creator of Bedrock and Beadwork and a 40-year veteran of computing, to talk about Bedrock: an embedded, distributed key-value store for Elixir with guarantees that go beyond ACID.

Jason walks through the problem Bedrock solves, keeping distributed state consistent when the same data is read and written across many nodes. We get into why the BEAM's decades-old ideas map cleanly onto today's AI and agent workloads, how Bedrock borrows its architecture from FoundationDB, and what serializable transactions actually buy you over plain ACID.

From there we dig into the machinery: log servers versus storage servers, the five-second version window and MVCC, letting it crash with supervision-tree thinking across a cluster, and how rows can live as values while indexes become keys. Jason also covers running distributed jobs with leases and what it takes to swap Postgres out for Bedrock.

Along the way Jason makes the case that none of this is magic, that the real wins come from understanding your machine and the shape of your data. We finish on Beadwork, his lightweight system for managing agent tickets directly in git. If you build with Elixir or care about distributed databases, there's a lot here to chew on.

Connect with Jason:
- X/Twitter:https://x.com/mullaj
- GitHub:https://github.com/jallum

Projects:
- Bedrock:https://github.com/bedrock-kv/bedrock
- Beadwork:https://github.com/jallum/beadwork

Resources Mentioned:
- Notes on the FoundationDB paper:https://uvdn7.github.io/notes-on-the-foundationdb-paper/
- FoundationDB architecture:https://apple.github.io/foundationdb/architecture.html
- Raft consensus algorithm (GeeksforGeeks):https://www.geeksforgeeks.org/system-design/raft-consensus-algorithm/
- The Raft Consensus Algorithm:https://raft.github.io/

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io
- Jido (Elixir AI Collective Discord):https://agentjido.xyz/discord

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com

Michael Lubas, CEO of Paraxial.io and my first-ever guest, returns to talk about AI's dual role in cybersecurity: finding vulnerabilities and writing the code that creates them.

We open with the Hex package manager penetration test Paraxial ran under the Erlang Ecosystem Foundation's Aegis initiative, funded through Alpha Omega. Michael caught a remote code execution bug before it shipped. From there we cover GitHub Actions supply chain attacks, why every maintainer should run zizmor, and campaigns that target release pipelines instead of application source.

Then the AI inflection point. The EEF's CNA issued nine CVEs in all of 2025 and is on track for well over a hundred in 2026, driven by researchers like Peter Ullrich using AI to find bugs already sitting in source code. Firefox went from about 20 valid bug reports a month to over 400 in April 2026. Michael argues defenders without state-of-the-art models are at a structural disadvantage, and we get into why bug bounty programs are collapsing under AI-generated noise, something I saw firsthand with Killswitch.

We close with the practical side: what a real pentest costs, when Claude Code helps solo developers, and the common Elixir gotchas, including binary term deserialization, SSRF, dynamic atom creation, and staying inside Ecto's default query syntax. Plus Paraxial vs. Sobelow and what SOC 2 actually covers.

Resources Mentioned:

- Securing Hex (Paraxial blog): https://paraxial.io/blog/hex-pentest?utm_source=elixir-mentor

- Hex security audit report: https://hex.pm/reports/2026/paraxial.pdf?utm_source=elixir-mentor

- EEF CNA: https://cna.erlef.org/?utm_source=elixir-mentor

- Hardening Firefox with Claude: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/?utm_source=elixir-mentor

- What the CVE? (Peter Ullrich): https://peterullrich.com/what-the-cve?utm_source=elixir-mentor

Connect with Michael:

- Website: https://paraxial.io/?utm_source=elixir-mentor

- X/Twitter: https://x.com/paraxialio

Sponsors:

- BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor

- Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor

- Jido, Elixir AI Collective Discord: https://agentjido.xyz/discord?utm_source=elixir-mentor

Support Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor