Secure your Elixir apps with paraxial IO.
From code analysis and bot defense to dependency checks,
they've got you covered. Elixir first design with GitHub
integration. Elevate your security at
paraxial dot IO. This episode is brought to you
by Beam OPS. If your Elixir deployments are
painful, or your infrastructure is a mess, or you just need
experience hands to help you scale, these are your people.
Beam OPS specializes in scalable Elixir development, automated
deployment pipelines, and infrastructure migrations.
They will help you work smarter and ship faster.
As authors of the Pragprog book Engineering Elixir Applications,
they know their stuff. Check them out at beamops.co.uk
testing. What's up?
I'm Jacob Blitzo, your Elixir mentor and welcome to another
exciting episode of the Elixir Mentor Podcast.
This is where we discuss everything related to Elixir,
from interviews with enthusiasts, pioneers in the
community to innovative projects and libraries shaping Elixir's
future. Today I'm joined by returning
guest Michael Lubas, CEO of Perexial IO here to talk about a
is kind of two sided role in security, finding bugs and
writing them. Welcome back Michael.
I'm excited to to to chat. I feel like I always learn a lot
when you come on. Thank you, Jacob.
I've been looking forward to coming back on the show as well.
There's certainly been a lot of things that have happened since
we last spoke and I've just been looking forward to it.
Yeah, we had a lot of like, I, I don't know, do you like you, we
were projecting a lot of like the AI slop and what, what, what
is that going to look like for development?
And I think when were you back? When were you on?
Was it September? I don't remember.
Six months. A year ago it was.
A while ago it was not. It was not recent at all.
Yeah, I feel like we we get you back every year now I'd like to
have you back on more. Yeah.
So I'm, I'm trying to think we kind of talked about let's see
you you were launching a new version of Paraxial or in the
midst of kind of building a new version when you're on.
And then we were also talking about just AI slop in general
and what we thought was going to happen.
And then in the recent days, we've been seeing a lot of
articles like Peter Ulrich and all of that, and all these
vulnerabilities being discovered by AI and yeah, what are you
kind? Of seeing there right now,
there's definitely been this inflection point where the
models have gotten a lot better. And it's really not an
exaggeration to say that AI has become the most important and
influential factor in cybersecurity, arguably since
the Internet, maybe even more than the Internet, depending on
how things go. I don't want to get ahead too
much because the the big news that I think is relevant for
your audience, like I couldn't talk about at the time, but was
that paraxial? I was involved with a
penetration test of the HEX package manager, which most
listeners are probably familiar with.
So that project was actually run by the Erlang Ecosystem
Foundation and the Aegis Initiative.
So that initiative was started by Jonathan, who's the Sizzo of
the foundation, which is a nonprofit that actually handles
the CV ES, which is basically a a vulnerability for a piece of
software, which we'll get into in this show because that's
where all of this news is coming from.
The EEF. Essentially, if there's a
vulnerability in an Elixir package, Jonathan is the person
that's involved in the classification and coordination
of that. So he started this program with
the leadership of Alistair, who I should mention as the EEF
board President. And Alistair has been extremely
productive in raising money for this because as you can imagine,
having Jonathan work on this full time hiring actually 2
firms, Praxial was one of the ones selected that cost money.
And this work was actually funded through an initiative
called Alpha Omega, which is under the Linux Foundation.
And some of the sponsors included Anthropic, AWS, Citi,
GitHub, Google, Google DeepMind, Microsoft Open AI.
So I'd like to say thank you to all of those organizations if
anyone from them is listening. The work was extremely
beneficial to the Elixir community.
So not only can the Elixir community now go to the wider
programming world and say, you know, what's our package manager
story? Not it's not.
And it's not always, you know, roses and everything's great.
There are controversies and problems with package managers,
but I think the Elixir community has an extremely strong
narrative now based on facts, which is, you know, we hired
these two firms. Praxeal, I was actually honored
because I was able to stop our MO code execution vulnerability
that I found during the test. I prevented it from being
released. So there's actually no CVE in
the sense of a vulnerability that you have to.
Patch 1 was issued by Jonathan very prudently, but it never
showed up in your scanner because it was actually fixed
before the release. So I think that work was really
important because now as cybersecurity gets probably more
important than ever, the Elixir community has this very strong
evidence that can point to you saying, you know, thank you so
much to everyone who funded this.
Elixir has an extremely secure base.
We're taking security very seriously.
And the stewardship of Hex, you know, I should, I should mention
Eric as well. He's fantastic.
And the whole Elixir core team, they take this work extremely
seriously. So you have this secure,
actively maintained ecosystem, which really is what companies
should be looking for if you're going to be building your
company, your government software, your nonprofit or
hospital systems on top of an open source ecosystem.
I think Elixir is probably one of the best, if not the best
right now. So yeah.
What do you think about that though, from your perspective?
I mean, from my perspective that just sounds awesome, right?
Like it gives me Peace of Mind because I've built a lot of
products and Elixir is pretty much always my stack now.
So it's just everything is on the beam.
And yeah, I use Paraxial myself with, with my own products and
it yeah, I think it's really cool to see initiatives like
this and it's really cool to watch Paraxial find, you know,
compromising code and security flaws in things.
Like, it's got to be cool for you to see as you're doing an
audit to actually catch things before anything hits production.
Yeah, that was a really important moment during that
test. I remember talking to Jonathan
and then Eric and mentioning, hey, you know, I found this a
problem. This could be extremely bad.
But fortunately, I, I was checking the git, you know,
branches and everything, and it hadn't been released yet, which
was really great to see. So I, I do want to say thank you
as well to the, you know, the Hex core team and you know,
everyone involved because it's not just Hex.
There's all of these packages across the ecosystem that take
security so seriously. As one example, which I think is
really worth calling out. Have you heard of these recent
campaigns with GitHub Actions where packages have been
backdoored by GitHub Actions? So what happens is let's say you
have a package that a lot of people install.
There were there were a few, but essentially most people use
GitHub Actions now to take code from pull requests and you know,
probably do something based on that code usually run like a
CICD check. When GitHub was first first
became popular, this this didn't exist.
This kind of grew as GitHub became more and more important
to open source and what the bad guys have noticed and in some
cases they were using AI for this.
I think it was called clawed. You know that the lobster I I
can never keep up with the name. So it was like the mole bot.
Open claw or whatever. Yeah, But there was a version
that hacked GitHub repositories. And the way it worked, it wasn't
actually targeting the application code.
So it'd be like a Python project.
It was actually targeting GitHub Actions, meaning the attacker
would submit some malicious code, the attacker controlled
code would be executed in the context of a GitHub action,
which could steal API credentials.
And then people often have releases tied to GitHub actions.
So now the bad guy has the ability to push a backdoor, you
know, Trojan release, which is basically malware.
And the big problem with that is it spreads.
So once the package is infected, it's in the pipeline.
A lot of developers just have auto update on why for security.
Well, in this case people are saying don't do that anymore.
There's like a cool down period because it just spreads
instantly as soon as well. Cause yeah, now you're reading
like with MPM packages. Wait your seven days so
vulnerabilities are discovered and patched.
And that's exactly why, because what happened is the malware we
get downloaded to the machine then propagate across the
developer's GitHub credentials. So this is a huge problem.
They're they're active campaigns ongoing right now.
I think you can find some literally within the last week
where this. I'm sure it's kind of
terrifying, honestly. And this was going on during the
pen test, which was a few weeks ago.
So as a result of this penetration test, the
Praxillaire report, which is public Elixir, the actual Elixir
repo itself, Hex, I believe Gleam and some Erlang
repositories, they're all using Zsmore right now, which is this
open source tool to detect if your GitHub actions are
vulnerable. I suppose I should I should
mention this for your audience. If you are watching this stream
and you are a maintainer of a package or maybe you're just
involved in a package, I think a lot of people in Elixir are.
I would check to see if the package is using GitHub Actions
for building releases, and if it is, I'd highly highly highly
recommend I. I like Ziz more because it's
very fast, it's written in Rust, and installing that and taking
the findings very seriously. That will prevent the package
from potentially being backdoored.
Fortunately, during the Elixir pen test, there were some
findings, but none of them were actually exploitable by a bad
guy. It it's sort of this weird state
where a lot of GitHub repos have been exploited.
So you think, oh, if I was vulnerable, I probably would
have been exploited by now. But on the other hand, new
packages keep getting exploited every day.
So it's not that simple. So I, I highly recommend
checking for that. If you only get one thing from
this podcast that I know it, it can all kind of blend together.
I if you maintain an elixir package or any open source
package and you use open source. This isn't even a praxial app,
by the way. I'm not like affiliated with
this more. It's it's one guy.
Praxial has no financial stake in that at all.
So I'm not even, I'm not even promoting.
I, I that's it's totally free. It's open source.
I recommend that go do that. I'm curious, like obviously this
isn't just going to affect open source packages, right?
It could affect SAS any like anything where you're using
GitHub Actions to build a product or have API keys
available, right? Or yeah, power plants, you know,
electricity delivery, water, basic infrastructure, things
like that, you know, open source packages used everywhere and,
and you know, do the train shop today.
That's sort of, but people don't expect that.
You kind of think in terms of your own work usually.
Yeah, it's, I feel like like when you hear things like this,
you're just like, is this like something we can recover from?
It seems like a huge just domino effect of kind of a shit show.
Well, I'd say I'm an optimist. I think you kind of have to be
to start a cybersecurity company.
You have to be a little bit optimistic because we've been
through this before. Are are you familiar with the
Morris Worm? Maybe a little bit, but might as
well, you know? Yeah, very early self
propagating piece of malware. And this is like very early
Internet before my time, certainly.
But essentially info like cybersecurity used to be a lot
worse. It used to be where if you put a
web server on the Internet, there was a pretty good
probability that somebody could find a flaw in it and hack it.
And that happened very frequently.
Microsoft got a lot of Flack for this way back in like the early
2000s. So that's kind of the kind of
period I'm thinking, I think like 1990s, early 2000s
Internet. And then security did genuinely
get better over time. It did actually become a lot
harder to hack a web server or hack an iPhone.
It cost a lot of money to, for example, like an exploit against
the modern iPhone. That is something that well,
maybe this is again the I debate right now, but let's say prior
to LLMS, I'm getting very good. That was something that really
only organization with kind of a nation state level budget could
do. You know, a teenage hacker crew.
Those are very common. When you hear about them, you
know, Scattered Spider is a good example.
When you hear Scattered Spider hacked a company, they probably
fished credentials that that's their TTPS are pretty public.
When you hear about a journalist whose iPhone was hacked, that
wasn't teenagers in Discord, that was a government or
somebody with access to government level budgets.
That type of capability is not cheap, of course.
Now what people are very much concerned about is how AI is
changing that that calculation. But I would say I'm I'm actually
not too pessimistic about things.
I think if you're a developer right now, it's a great time to
learn about security because it's inevitable that you will no
matter what happens. But what do you think?
Where does your pessimism come from?
I I mean, I think it's like the fear of thinking cybersecurity
and security is like, you know, this thing that I'm not able to
grasp completely. Like I understand, you know what
I mean? Yeah, the unknown.
But then like also just hearing you talk like not only do the
bad guys have these tools, so do the good guys, like we all have
the same toolbox that we're we're using to, I don't know, I
guess fight threats as they appear, But like you always have
to be kind of a step behind to know what you're defending
against, right? I I would say with AI, we
haven't yet seen entirely new types of threats, sort of.
For example, when AI discovers a remote code execution
vulnerability or a Linux privilege escalation, it is
genuinely impressive that an AI computer program can do that
they they couldn't before. And the, the other big part that
I think often gets lost in these discussions is AI is not really
a bug finding machine like a scanner where it's like you put
the program in and the exploits or the exploit code comes out.
The, the big capability that is often under appreciated is kind
of the agentic, which I think people don't like.
It's kind of a buzzword now, but essentially a, a malware
campaign or a ransomware campaign that is not, you know,
1 issue TP request. That is somebody who's an
operator, you know, launching malware, sending phishing emails
to a company. The ransomware will land or it
won't. It'll the payload will work.
The files are then encrypted and then the victim has to
communicate with an operator, you know, pay the Bitcoin or
whatever there. There are bottlenecks.
There are crews that do that, but AI has changed that
calculation significantly. So maybe that's the pessimistic
side, but I, I would say the optimistic side is that the
major labs, and I will actually give Anthropic some credit here,
I think they have been very prudent in their safety research
and in their caution. Anthropic particularly has been
getting some criticism that I think they don't deserve around
Mythos, where I'll give an example.
So the creator of Carl, Daniel, I highly respect him as a
software developer too. I think he's actually one of the
best open source developers in the world and the Carl project
is one of the most secure open source projects.
And I think that's actually why it it is a bad example to use
because he recently published A blog post which was actually
very fair. I think he did a great job in
the blog post, but when you read the press coverage of the blog
post, it gives people the wrong impression.
I'll actually read a headline from I think it was a registered
brand. This headline Anthropic's bug
hunting Mythos was greatest marketing stunt ever, says Curl
creator. The AI scanner found one low
severity curl flow flaw. That's the framing that the
register gives you. And I think what it misses, and
this is the big point, is that curl is probably in the top 99th
percentile. It is the top tier of an open
source project. The capabilities that the models
have are dramatically shifting things.
For example, Firefox, which is a much larger project.
The number of, you know, bugs reported in Firefox that were
valid went from an average of about 20 in 2025 to 400 to over
400 in April 2026. And we see this actually in
Elixir too, because I mentioned that earlier.
Now does that is that is that one month that Mozilla.
One month, Dang. And this is not unique, by the
way, I will give an example from the Erling Ecosystem Foundation.
So I'm in the security working group.
I know Jon Tan very well. He's handling this work.
If you go on the website, we'll, we'll put it in the show notes.
But cna.erlef.org, it's like the Erling Ecosystem Foundation,
the, the CNA, which is what issues the CV ES.
In 2025, they issued 9 CV ES total in 2026, The current
trend, I've talked to Jonathan about this.
It's well over 100, maybe over 200.
And that's public data right now.
You can go on the website and see that and it, it ties back
into exactly what you were talking about with Peter where
he is but enormously productive in.
By the way, these were bugs that already existed.
AI did not create these bugs. All of these vulnerabilities
existed in source code. The bottleneck was security
professional or programmer finding them, and AI has just
blown that bottleneck out of the water.
And I you can't deny that right now.
That is a huge. Shift I feel like every single
day now there what there at least like for me this week
we've had a hex package security vulnerability get flagged by
SOBLO like it's crazy. Everywhere.
Yeah, it's happening everywhere. So I will do something that
maybe people will find controversial, but I will defend
Open AI here because back in 2019 there was this article.
I, this might have actually been the anthropic people within Open
AI. It's, it's hard to say, but I, I
believe it was Open AIA press release saying that GPT 2, which
was 2019, they said it was too dangerous to release.
And then Chachi BT was released in 2022 and everyone kind of
mocks that he's like, oh, they thought like GVT 2 was too
dangerous. Like that's stupid because like
the models we have now are so much stronger and everyone's
happy with them. Everyone loves AI and there's no
negative extra talities at all. That's what I find so odd about
the debate because I would argue AI is probably the most
important technology debate right now.
Everyone has an opinion. I get texts on my phone from
local politicians about if we're going to build data centers or
not, and that is directly tied to Chachi PT being released.
You know, talk to educators, talk to people in school about
people using LLLMS to cheat. It's a bended education.
I mean, just look online. Even within Elixir, people hate
AI there. There's a very strong negative
sentiment. In a lot of ways, a lot of
people are unhappy. You're either on board or the
opposite. I feel like it's this very
polarized. And I and I, I don't want to,
you know, say all, all of the negative AI is wrong.
I think actually the labs have been very forthright about the
potential harms. But what I find bizarre is
people will imply that it was not important because, you know,
you can be on either side of the polarizing debate.
But to say, oh, you know, it wasn't too dangerous.
I'm like, well, no, it, it turned out to be this enormously
important and transformation like technology.
How can you deny that there was a risk there?
It it did cause a lot of problems.
Well, the data center drama, though, is like, I'm in Utah, so
the Kevin O'Leary data center in Utah has been very controversial
here. Exactly.
And but but to say that it's not important or that oh, like, you
know, the GPT 2 was fine, there was no safety risk at all.
And like therefore Mythos, the new model that's very good at
cybersecurity, I, I think Anthropic is doing the right
thing with not really seeing it publicly.
I think that's a very prudent decision.
All of those vulnerabilities that Peter found just in our, in
our corner, in our, in our Elixir ecosystem, he put in his
blog post, he didn't use Mythos and you know, explosion of
completely valid security bugs. I think a lot of the bugs that
have been reported that people are talking about were not even
found by Mythos. Yeah, every time I have to
update and patch a dependency in one of my projects, I just kind
of curse Peter for finding that. But that's The thing is the
vulnerability already existed in.
Your. And the bad guy might have
already been using it in a bad way.
But the, the point I'll argue that I feel very strongly about
is that security concerns and safety concerns around AI
related to cybersecurity. How can you argue that they're
not there? Like they're clearly there.
We're, we're having this debate. It's, it's having this massive
impact on industry defensive, defensive cybersecurity people.
You know, bug bounty programs are shutting down.
People are saying we just don't have the resources to handle
this volume. So speaking from experience, I
just, I launched Killswitch what at the beginning of the year and
I had AI, had a bounty program because I was like, look, I'm a
zero knowledge encrypted storage.
Essentially. I was like, people need to trust
me. So I had a bounty program.
I was getting so much like just clearly AI generated reports.
I couldn't keep up. So I shut it down and like had
to make like very specific like privacy statements in terms of
service. Like if you're a paying
customer, there are bounties available.
But like if you're just like some random pen tester, I can't
accept it. Like I will read that.
I will fix the problem if it exists, but I can't just like
pay it out 'cause I was just like I couldn't keep up.
It was just like my inbox was stuffed.
Exactly. And the Internet bug bounty
program actually shut down, I think no JS shut down their
program. You know, how can you argue that
there's no impact? Like the impact is just, it's
clearly there. And a lot of times though, like
it's a like the, the problem was it wasn't necessarily finding
like critical or vulnerabilities.
A lot of it was like BS, like they're fake.
But it still takes a lot of time to sort through it, to verify
that they are. And that took a lot of my time.
So I did talk at Elixir Conf EU back in 2024.
You know, I was watching it recently.
It almost seems kind of quaint, like, you know, like the calm
before the storm where I, I, I said bug bounty programs are not
that helpful. And this was pretty LLM because
I, I did bug bounty work professionally.
I, I would get the reports come in, I'd be like, a lot of these
are spam. I don't like them very much, but
it's interesting that AI has kind of been an amplifier in
that regard. Well, it's like, here's the
thing, like you have like low level pen testers trying to make
an extra buck and of course you're gonna just spam out
reports and hope for a few bucks here and there.
Like I get it. I would do the same thing if
that was my line of work. Yeah, I should mention bug
bounty hunters, which is what we're talking about.
It's a very distinct operation compared to a a penetration
test. Fair, fair.
So the bug bounty hunter, their whole incentive is, you know,
get paid maximum money. I do penetration tests for a lot
of elixir companies. I've gotten, I'm very grateful.
I've gotten very good feedback from the customers about them.
And the the key difference is that when you write a pen test
report and you're doing the work, you have to frame it in a
way that is useful for the business saying, you know,
here's what your business operations are.
Here are the risks that realistically affect you.
Here is the current state of your application.
Like maybe there is a remote code execution or a very severe
bug, but if the complexity is so high and the probability is so
close to 0, you know the customer should know that to be
able to make an intelligent decision.
Compared with actually some of the worst bugs I've ever found
on pen tests have been so simple that I you could anyone could
appreciate them just for example, an, an API endpoint
with no authentication. It's not complicated.
You don't need to be a pone to own, which is a cybersecurity
competition. A like a master hacker.
Anyone on the call, anyone on this call could have found that
bug if they just knew to look for it, But that that was the
most severe because an attacker or now an AI agent frankly could
find that and cause a security incident.
That would be, you know, front page of Hacker news.
Do you remember that T app that happened a while back?
It was like a it was a insecure, it wasn't an S3 bucket, it was
like a Firebase bucket. But that's one of the first
things I always check for on Pentas because the complexity is
so low. Just open S3 bucket and probably
hundreds. I like it.
It depends on the reporting, but probably hundreds of companies
have been breached just by a storage bucket that didn't have
proper that's. Wild.
I was going to say like like a major problem with my day job
are we have an open endpoint obviously for like login, like
authentication. You have to, yeah.
Right, and that's one of the the biggest things that like we have
to work on like we have to do like client side puzzles and
work just to slow down how many times like yeah, bots and things
and it's always the open endpoints that and obviously
they'll like login has to be open.
But yeah, that's interesting. S3 buckets though not being
secured is wild. Very common.
Extremely common. And then like I bet like rate
limiting is important, which by the way paraxial just to plug
you a little super easy to add rate.
I haven't deployed myself really on this show, maybe I should.
Well, I plug you for you, you know, but yeah, it's, it's funny
and but it's, you also have to take it with like a grain of
salt because another problem is I, I shouldn't call them pen
testers. I'm going to call them bounty
hunters 'cause I think. It's and there are very good bug
bounty hunters. I'm sure there are there.
Are people that are very good at this.
The majority of them, like a lot of them, a lot of reports that I
get is like, well, you're hacking your own account.
Like why would you do detrimental things to your own
account? You.
Know what's actually interesting?
I've noticed this because I I use Claude code on pen test and
found this. Really interesting bug in Hex.
Actually I was I was using it during the hex pentas where it
was this logic flaw. But what I had a recent client I
had the app was actually very secure and there weren't that
many vulnerabilities. So I noticed Claude would kind
of do exactly what you're describing where it would invent
a vulnerability. And I'd be like, oh, that sounds
very bad. It it sounded very bad in the
output. And I'd verify be like, hi,
Claude, the bad guy when he when he hacks it, you said he already
has database access and it's. Oh, you're absolutely right.
OK. So it's actually not a
vulnerability? Yeah, it's just like, OK, you're
getting your users data or you're manipulating your data
which you already have access to.
Well, and, and this is actually a great point to talk about
because people often ask me, are you worried about paraxial with
the, with the rise of AI and everything is, is that going to
put your company in a, in a bad spot?
And then the point that I like to tell people about is that
when you do a full analysis of your code base with an AI system
that costs a lot of tokens essentially.
So, you know, smaller code base where people use for demos, it's
a small amount of tokens, an actual production database doing
a full AI analysis of that in some cases actually cost more
per hour. Well, once you kind of parcel,
it actually cost more than hiring a security engineer.
There's a there's a very open secret in Silicon Valley right
now, which every major tech company they are.
Playing off devs and replacing them with AI are spending more
until. But but even this is the open
secret is that how do they do the stack ranking and the
productivity measurements? How many tokens you use?
So people just have these things running all day.
So yeah, an engineer at Fang makes a lot of money.
They're not cheap to employ out in out in San Francisco, but
they'll often be using double or triple their salary in tokens.
And then of course, you know, Jensen will go on and and say,
of course they should be doing that.
I am the CEO of NVIDIA. And I actually don't think he's
wrong necessarily. But the phenomenon at the moment
is very funny because, you know, it's sort of like the big tech
companies went from over hiring to have the illusion of
productivity to too much uses of AI for the illusion of
productivity. Because it turns out
productivity is actually very hard to measure, and there's not
an easy metric. In in any.
Business. Like where you're not like a
line worker, It's really hard to do that at all 'cause like
programming and engineering is like very artistic, you know,
form, right? Like you're not gonna just be
writing code 24/7. You have to architect.
You have to solve the solution and figure out how you're going
to solve the problem right. You know, if you're if you're
building an aircraft that the usual metric is not wait for how
close is it to being finished. It usually has to fly at some
point, but I that is often lost on some people in these debates.
Yeah, project managers mostly. I'm sure there's some very good
product. No offense, project managers,
I'm just joking. All right.
I'm going to just take a quick break here and we'll run some
ads and then we'll be right back.
Hey, I'm Kimberly with Elixir mentor Jacob recently added
recruitment services to help companies hire pre vetted Elixir
devs. I help with company outreach, so
if you're hiring, I may be reaching out, or you can connect
with us anytime at elixirmentor.com.
Coding Elixir with AI or building AI into your Elixir
apps? The Elixir AI Collective Discord
is your community for both. Link in the description below.
All right, and we're back. Yeah, sorry for the be right
back screen, now I forgot where we were.
No, I think we're in, I think we're in a great path.
Something I want to mention that I think you also mentioned is
that defenders now need access to AI to do their job correctly.
And I think that's an under appreciated point because I know
there is a debate about AI growth and AI adoption.
But I want to submit my opinion from the corner of a
cybersecurity practitioner, which is that if you work in
cybersecurity, especially defending systems or you're a
software developer that also handles security, having access
the state-of-the-art models is non negotiable.
Now you can't have worse models than say an adversarial country.
It's, it's just not tenable at all to do effective
cybersecurity work right now. I would argue that, you know, in
the United States we have anthropic and open AI that is
extraordinarily useful a, a situation where, you know, I'm
in the United States, you're in the United States too.
But I think we also have listeners in Europe and things a
situation where let let's just use America as an example, where
America falls behind significantly in the AI race
because the other world powers are very interested in this
topic. It's we're getting a bit away
from elixir into politics here. I know.
But I promise it's, I promise it's related because, you know,
I'm someone that helps people secure their elixir applications
for a living. And I'll, I'll say this on air,
without state-of-the-art AI models, it's not really going to
be possible for me to do my job. And it, it will be a
disadvantage advantage because you know, if the
state-of-the-art models are controlled by, let's say,
another country that your country sees as an adversary and
you're relying on those for defense, it just doesn't make
any sense. In the United States, for
example, Kopersky products, which is the Russian antivirus
firm, They're not only banned by the government, but I think like
state governments and municipalities.
And it, it goes both ways. You can't really use American
antivirus products in, in Russian government systems.
They might I, I don't know how accurate this point is, but I
think they're switching to Linux or open source tooling.
Actually, a lot of countries want to get off Windows.
So this is, this is well tridden kind of geopolitical ground
already. But the point being, you know,
antivirus people can kind of get their head around, you know,
there's a virus on your computer, you have an antivirus
program running to block it. You probably want to want to run
one that's at least your own country or an ally of your
country, not an adversary. Everyone kind of understands
that intuitively. For an AI system that is going
to be defending or responsible for code security, it's kind of
the same principle. There is a well known meme right
now on Infosec Twitter that if you are worried about your
computer being hacked or having malware on it, put the Russian
language pack on. Have that in your system because
there's a very common check in malware where we'll say, oh,
Russian language pack don't run. There we go.
Now we know how to secure everything.
Not, not quite for, but there's actually kind of a rich history
about this where like cybersecurity and geopolitics
kind of kind of come together. I would say the good news, yeah,
for for Elixir developers, though, the good news is that
the ecosystem itself is handling the situation very well.
We've got Jonathan, we've got the EEF.
I'm grateful to Alistair for all of the fundraising work he's
doing. And I should give credit to the
Open AI Labs themselves. Anthropic and Open AI are both
funders of Alpha Omega, the initiative that put the money up
so that we could secure Hex. When Mythos and Glass Wing was
announced that mentioned Alpha Omega that like famous post that
like, you know, every mainstream media in the United States was
picking that up. They mentioned Alpha Omega Open
AI has been very proactive in granting their models access
for, you know, defensive capability.
So I know there's a lot of controversy right now in AI
generally, but I want to state, but the labs have been very good
on security and I think that they often do the right thing
and it kind of gets lost in the noise of the headlines.
And you know what? What gets clicks is kind of the
controversy. The the good work often kind of
flies under the radar, but it's extremely important.
Yeah. I mean, I always, I always what
I think about the most with like using clod code everyday and all
these other things. And I mean, I've kind of just
ignored it, but I've always had this like paranoia of just like
dishing all my information and data to some third party.
And I mean, obviously these large LM models have all of our
data now and all of our coding projects, like everything,
right? I don't know if there's any
avoiding that. But like, I'm not like really,
it's not concern of like the what code I have in my
repository. It's, it's more just like, you
know, API keys, sensitive information, whatever
accidentally leaks because, you know, like if you have a dot env
file in your project, sure, Anthropic will pretend they
ignore it, but they're scanning those files and they're seeing
your like, I don't keep production keys on my desktop,
you know? I, I would say the, the good
news on that one is anthropic is another.
I don't want to sound like I'm, you know, not not being totally
critical, but there was a recent blog post I saw where it was a
CTF that was run by a university.
I think it might have been RIT clawed like an like an AI agent
entered it to like test the cyber capabilities.
And the organizer said, you know, hey, we, we don't like
this. This shouldn't have happened.
And an employee from Anthropic responded on Twitter, I believe,
saying, you know, we apologize for this.
We've actually updated our policies and we're deleting all
this data. And I believe them 100% because
the entire, you know, brand of Anthropic is the safety and
privacy and the lack of ads right now.
But to, to your point about the private keys, there's no real
benefit for them having your private keys.
They don't want them. You know, if you upload like an
AWS key or like your passwords to a, to an open to like a large
language model provider, that is something they don't want.
You know, regulators in the United States, well, European
regulators especially really don't like that.
And of course, those businesses want to operate in Europe.
And the, the other trend that you've probably noticed is a lot
of these models can be run in kind of a private cloud
situation. Like I believe Amazon bedrock is
very big right now. And, you know, as models get
better and, you know, I have tasks like, I, I use OMS
constantly. I, I, I'm in cloud every day
constantly. But there are, there are tasks
where I'll have a task, I'll be like I I don't need to use, you
know, Opus. Or like a top tier model for
this. I know I could probably use
something locally. And, and as that gets better, I
think there's tremendous privacy prudential there where a lot of
people do have, you know, they want privacy, They maybe don't
want to be using the frontier model that, you know, just by
design. It has to have a kind of a
cloud, have kind of a cloud set up.
I, I haven't seen any locally hosted coding models.
They really get close to the cloud ones.
I think there are a few projects.
PewDiePie is probably the most famous public figure.
I think he built his own like kind of GPU cluster.
Any any post about it on his YouTube channel now.
Nice. I am so bad at keeping up on
like everything going on. I feel like the ecosystem is
moving so fast with just a genic coding and different solutions
and context management like it's kind of crazy.
I, I think it's a huge opportunity for Elixir.
You know, open Hive famously used Elixir for that recent
product that, that I've saw a lot of people in Elixir talking
about. And it's sort of like the idea.
It's like, oh, well, what's an agent?
You know, every Elixir programmer kind of knows what a
Gen. server is in a process and sending messages and what, and
what's the big problem right now for like these agentic coding
swords like, oh, they can't really communicate well.
And it's like, oh, if only there was like a programming language
and model that had that, only there was.
Message passing, you know. It's almost like the whole field
is moving in the direction that that Elixir Elixir developers
are a bit of ahead of the curve in some ways.
Yeah, that is funny. I forgot where I was going.
Anyways, Yeah, I think it like you, you were watching all these
like LLMS and like larger companies try to like reinvent
the wheel when the beams existed since like 1986.
But yeah, it's it's an interesting pattern.
It's sort of like everyone uses Python And they hit the gill and
then they kind of tried to hack around it and not so great.
I was like, I wish there was like some way to do concurrent
programming easily. If, if only somebody designed a
programming language for this, for this problem.
Yeah, exactly. I'm curious like for small,
small products like people like me with like Kill Switch and my
other products, if I were it is like quad code, something I can
leverage to do internal pen testing and like how would you
kind of like go about doing your own internal audits with it?
I, I would say that the big problem at the moment, and you
know, we're May 2026, if you're watching this from the future, I
see a very plausible future where the AI systems actually
get better than human pet testers.
That is extremely likely today. They're not quite there yet.
So the big problem is that, you know, I'm a professional
software security person. That is my full time job.
I started a company to do it. I love it.
I also really find it interesting and I, I do find it
sometime kind of frustrating with Claude because it'll, it'll
send you a report, you know, get kind of exciting.
I'm like, oh, I found something big and that's a false positive
and I know enough. It's funny because the mistakes
Claude makes are very similar to the mistakes I see like bug
bounty researchers make and I make when I'm doing research.
It's very human in that way. But the big problem is almost
like doesn't know what to, I don't want to say, doesn't know
what to look for because there's prompts you can do, but you kind
of already need a mental model of what is your application
like, what's the threat model, what are the risks?
And you can do this with Claude, actually, but it's just not
quite there yet. But like, for example, a lot of
people now are, are saying, you know, AI is fantastic because,
you know, it enables all of these things very cheaply.
I think medical diagnosis is a big one.
And that's very controversial with doctors, of course, because
they want to, you know, kind of protect, well, I think
altruistically protect patients #1 because there's always a risk
of a mistake. At the same time, I think AI
legitimately does represent a very good advancement in medical
technology for patients, but there is a very real risk there
that I think doctors are aware of.
So, you know, I'm, I'm sitting here as a professional saying
like, oh, should you just use Claude for your pen test?
And you know, you won't, you won't need Michael anymore.
And I, and I, I don't say this cynically.
I'm not trying to kind of like defend my own job.
I think it that if the models actually were that good, I would
be out here saying that because a lot of people, a lot of people
in Infosec just defensively hate AI and they don't really engage
with the truth of, of what's happening at all.
And I see that. So that's not the argument I'm
trying to make here. Rather, it's that, you know,
right now, at the moment, if you have a, let's say, a very
important web application, like a software as a service or your,
your business relies on a publicly facing Elixir app or
really web application in general.
Maybe the AI is good enough that it could perform a pen test
right now in the hands of like someone competent.
Like like if I had to use Claude personally right now and I like
couldn't touch the keyboard. I could only like prompt it.
I could actually get you a pretty good pen test.
Like I could tell you, I, I'd get frustrated, but I could tell
you I, I really wouldn't trust somebody with no security
background to have a good picture because because you just
don't have experience. The AI, you, you need to know
what to tell it. That's a big problem.
And you know, there are probably systems where you could kind of
like feed it everything, like feed it the whole code base, but
it, it's just not quite there yet.
They're, they're like these very common mistakes that I see made
constantly. I see it miss things, I see it
hallucinate things. That is, that is a little bit of
a problem. I think the field is changing
very quickly and there is a potential future where you know,
an AI is better than most human pen testers.
But but I also actually want to qualify that statement a bit
because there is a very good talk that I recommend everyone
watch if you have time. If you're interested in this.
Nicholas Carlini, who's an anthropic researcher, gave a
talk called Black Hat LLMS at unprompted 2026.
This is back in March 2026 where he says that AI is now a better
vulnerability researcher than he is.
And he and he's one of the best researchers, you know, eminent
sighted, probably top, you know, one of the top research
cybersecurity researchers in the world.
And the AI example he gives in the talk, and this was a few
months ago, this before Mythos, it was in Ghost, I believe,
which is a Ruby on Rails application and then the Linux
kernel. And his argument in the talk is
that AI is better at him than, you know, finding bugs in the
Linux kernel. And for people outside
cybersecurity, I should actually explain this is an important
part. When somebody is a professional
vulnerability researcher, they tend to specialize a bit like
the iOS scene that's kind of like its own own, like if you're
a jailbreak dev, that's its own scene.
That's very distinct from, say, the work I do, which is securing
Elixir web applications. You go to Defcon, nobody's going
to know what Elixir is. There's people that specialize
in Windows. There's people that specialize
in like SCADA. It's, you know, I actually
falsely had this view at one point.
I thought if someone was like a master hacker at Defcon, they
could hack anything and they probably had the capability to
learn it. But people specialize.
That's the point I want. That makes sense.
So somebody that does Elixir, somebody that does kernel like
Linux kernel security for a living, they might not know any
Windows at all and they won't really be able to tell you.
So it's like an AI is like a better, you know, vulnerability
researcher than most people. Yeah, Well, true.
So it was like a stack and like a basic, there's a joke, they
called it GREP, where a lot of like really hardcore security
research, like, oh, well, how did you find the bug?
Oh, like I grepped for a function and they were using it.
So that's not as glamorous. But, but the point I want to
make is that finding bugs, it is very different from like the act
of finding a vulnerability is very different from hacking a
company. And even the act of a hacking a
company can be very different. Like we talked about the
Scattered Spider, which is like the teenagers in a, in a group
chat on Discord, you know, social engineering.
That's a very different type of hacking than say, what North
Korea does with cybersecurity, sorry, with cryptocurrency,
where you're a hacker that specializes in, you know,
stealing money from cryptocurrency projects, that's
very different from a hacker that does iOS and iPhone for a
living. So they're very different.
The point I want to get at is that if you're a business using
Elixir, you know, I, I, that's my customer base, I would say
I'm very good at that. I don't mean to brag or plug or
anything, but it's because I, I know what a business in that
situation needs. I know what they need from a pen
test and how to kind of guide the work almost as a product
manager, I'll, I'll defend product managers a bit.
I feel like we still need them a little bit.
Because when, when you get a pen test report, it is in a sense, a
list of work that needs to be done.
And the reason I tell people like, I'm sorry, a good pen
test, the test is very expensive.
You can, you can cheap out on it, but you're kind of shooting
yourself in the foot because now you have a report where the
person doesn't understand your business context, They don't
understand the technology stack you used.
They just gave you a bunch of findings, which might be wrong.
They're probably AI generated now if you went with the cheap
provider and now you have to fix them.
And what if they're not real bugs?
What if they miss something important?
Now you're doing work that is nonsense.
You're wasting developer time. And you might tell them, hi,
yeah, we looked at this. We don't think it's a bug.
And they might say, no, it is a bug.
Like we're 100%, you know, and you're just ridiculous.
And I've seen this happen, by the way, in my career.
You've experienced this. Myself.
OK. So, you know, and maybe people
on this call have experienced this.
So you're not people don't hire, you know, Parac Clio to do a pen
test necessarily, just as code in, you know, findings out.
That is a very important piece of a much larger picture, which
is, you know, what does your business need to know to
maximally reduce the risk of a cybersecurity incident?
And this is subtle and it gets, it's very easy to get lost in
this because, you know, it's headlines and click bait and
outrage, but the the finer points are are genuinely subtle.
And I think this is actually a great forum to discuss it
because we can kind of go into detail and and get into the
because as you said, you've dealt with this yourself.
Well, yeah, and I think you make a good point.
And I think anyone that is using LMS or, you know, AI on a daily
basis, like I produce really good code, but I also know when
it's not producing good code. So I feel like that's my skill,
right? I'm a developer.
I know when it's good. But if I were to randomly say,
all right, hey, I want a pen test kill switch, Sure, I know
some like trigger words from the industry, but is that actually
going to am I gonna know what it's spitting out at me?
Probably not very well. And it'd probably take me a very
long time to sift through the reporting and whatever Claude
discovers in my, in my codebase. And it's not, sorry, it's not
just codebase, right? It's your how your, your DevOps,
how you've deployed things like is your, are your droplets
secure, etcetera. You know?
A really good example that I think is related to that is
let's say you feed Claude your codebase and you spend 1000 or
$10,000. People spend that much.
People spend more than that. Let's say you say Claude, I'm
giving you a budget of $10,000. I want you to do the best audit
possible. I want you to use 50 agents and
it comes back and you know, it's got 100 false positives, but it
finds two really good bugs and you go, OK, that's very good.
And then a week later you got hacked and back doored.
And what was the problem? It was your GitHub actions,
which were, you know, technically not in scope.
You didn't even think about it. That that was what got you.
You know, it's, it's that kind of context that, and I see it
happen constantly in industry where people they kind of focus
on the wrong things. They, they think that, you know,
number of hours spent on a pen test is like the ultimate metric
or number of tokens burn. As we were talking about like
lines of code tokens burned, weight of an air.
It's, it's the wrong metric. You have to kind of be able to
look past it a bit and kind of find the truth of the matter,
which is very difficult. It gets philosophical and it's
not easy, and there's a lot of debate in that area.
Yeah, and like, it's always funny because I always go back
to when I was on the, you know, the top of the Dunning Kruger
curve when I first started programming, you know, Mount
Stupid. And I didn't even know what like
a man in the Middle attack was. And then I experienced one with
just a REST API that I was building.
And then that became like my priority and security concern
right when like, you know, there's thousands of other ones.
But now that I know about this one and it actually affected my
day-to-day. Now it's like this new thing I
learned and I'm like sole focus was man in the middle attacks.
But like, yeah, it was a good like, learning opportunity,
right? But like, you can't just narrow
your focus to worrying about man in the middle when there's like
so many, so many other things that can happen.
Absolutely. Is there a chat?
Like do people ask questions during the stream or?
Yeah, we do. We have some chatter going on.
Let's see. Cipher asked.
He just wanted to say hi to Michael and thank.
Thank you for all your Elixir security work.
Thank you for your message, I appreciate that.
And he's listening intently because he's trying to convince
his regional ISP to use the Beam.
Hey man, this is the podcast. We'll talk you into it.
Build everything on. That's a great, that's a great
way, Sir. I, I hope they do.
I mean, it's telecom. They should, they should want to
it's but it's hard. It's hard for.
Real. It's like the perfect fit.
They've already solved the problems you are working on.
OK, I don't we have someone with just some Chinese characters as
their name. If I have a limited budget for
an Elixir based projects project and I want some basic
penetration testing, what should I do?
Yeah, the limited budget is a tricky part.
I would actually recommend using the open source tools SOBLO.
There's a mix audit which checks for vulnerable dependencies.
That's a big one. Paraxial.
Paraxial has a free tier as well.
If it's non commercial you know it's it's because I do actually
want to recommend clawed code. I would say like clawed code is
actually fairly useful in your situation.
It might sound like I'm contradicting our previous
conversation, but the but the difference there is limited
budget. If you only have, you know,
let's say under $100 for your budget, the the mainstream
cybersecurity industry really isn't set up to help you.
You're going to be on the free tiers for like, for like a
proper customer of any cybersecurity software.
You're it's, it's going to be much higher than that.
What is like, I don't even know what is like the average like I
come to you, Michael, I want you to pen test Killswitch.
What's like an average budget to do just like a SAS platform?
It, it's very hard to say because every customer is so
different. What I, what I and this
information is public. What I would say is that if you,
if you look at major providers like very big name cybersecurity
firms, the BIG4 does a lot of penetration tests.
Those contracts get into the like floor of $100,000 up to the
millions. And that's very common.
And that's staffed with people. Often times it's multiple
applications. It can be ongoing and it's, it's
going to be interesting to see if those keep happening or if
regulation will allow people to use AI for that.
But that's kind of the scale you're talking about because
it's human labour. And personally, what I tell
customers is that, you know, I'm the person doing the penetration
test. Paraxial actually doesn't
subcontract out. So, you know, my, I, my bids are
often much higher than what they come in, for example.
But I say the, the reason I can't do a discount in that
situation is just because it's my time, because I have
obligations. I have to run Paraxial as a
company. I love doing events like this,
but you know, that's hourly time.
I, I, I wish I had more hours in the day.
I feel like a lot of people do. That's common.
But it's. Also more energy during the day.
Energy plus hours. But that, that's just the nature
of it. And it's, it's getting harder.
I actually, that's why I also tell people now it's getting
even harder because demand keeps going up.
You know, we're entering this era where cybersecurity, you
know, things are just changing so quickly and it's getting more
important. People just need more pen tests.
They need more cybersecurity help.
And I'm grateful to help when I have the opportunity.
I really am. But just there's, you know,
there's only so many hours in the day.
And the good news is everyone that comes to me, they're using
Elixir. They're not so much in the NPM
ecosystem. So things are things are not
quite on fire. At the same time, I think we
should look to what's happening outside the ecosystem and kind
of learn, you know, how how can Elixir stay secure and by a
leader. Oh, and the the nice thing there
right is Elixir isn't the popular choice.
So you see, the popular choices have the problems first.
That does happen that that is very common.
Yeah. So it gives us a chance to
respond a little bit right or prepare.
And this is a common phenomenon. There was the famous Mac and PC
ad campaign. Whereas, you know, Macs don't
get viruses. That's because no one used them.
Meaning, yeah, the the malware developers are mostly targeting
window, which was a true phenomenon.
And you see that same dynamic cloud at the same time.
I actually, I make this argument a lot and I, I believe it's very
true that Elixir developers do tend to be more experienced.
Every time I talk to a Lexir developer, they tend to come
from a different language. So these kind of novice
programmer mistakes that often show up in a, you know, MPM
library that's used by 10 million people.
I'll, I'll look at a library and I just won't have them.
For example, these JWT libraries, there was this very
common problem where you could just say algorithm none and you
just bypass JWTS. And this was a this was a
problem in a few ecosystems. And I had a pen test where I
looked at it was it's like Jose and a few other libraries that
do JWT and none of them are vulnerable to it.
But we'll see. Maybe the AIS will will find
something, but I. I'm wondering like like the hex
package manager in general, Like I kind of was like I was talking
to another developer buddy. I was like, I kind of feel bad
for that project right now because the influx of packages
being created and just AI generated is just one.
I mean, like, we're seeing a lot of good stuff, but there's also
a lot of slop and probably crap entering our ecosystem because
of it. That's true.
That does happen. And I think it's it's, it's so
important to talk about this because people don't know unless
you make noise and you're public about it.
So the EEF has been very strong on this in raising money because
there's actually a lot of programs and grants from
governments and from non profits where they allocate millions of
dollars in some cases. And they say, hey, we want to
help with this problem. But in order to get that help,
you need a non profit such as the EEF with Standee and the
community. And you need people, you know,
like Alistair, like Jonathan Bram is the head of the security
working group. I mean, everyone there works
extremely hard and they're putting in a lot of hours to
raise the money that can then go to hacks to deal with this
problem because, you know, having it just being volunteer
effort is not sustainable at all.
I think the funding is really important and it's why I'm very
grateful to all the donors. I think Dash Bit has actually
been one of the biggest ones. They're on the page and a lot of
companies. So that's for Aegis, which is
the initiative and then Alpha Omega as well, which we've been
talking about. So those companies have all been
been really fantastic. Yeah, no, that's really awesome.
Let's see. Dalton, being new to Elixir, are
there common gotchas security wise and does paraxial leverage
that? I feel like yeah, there are.
There are some gotchas, right? Yeah, the one, the one I always
say is, well, the Elixir specific one is the binary
deserialization. So number one, if you're like
taking base 64 input from the public Internet and then putting
that into binary to term because, you know, you wanted
to, you didn't want to serialize like some complex Elixir term
where you know, like it's a map and then inside the map there's
less and you're supposed to serialize that to Jason and
you're like, ah, that's annoying.
I'm just going to put it in a term that's a really common
remote code execution vector. So don't do that.
Serializing to Jason is a great security layer there.
I would also say for Elixir developers, server side request
forgery is kind of an underrated vulnerability.
Where does does your application take input from a user and then
do outbound Http://requests? OK?
If it does, then a bad guy could use that function to then send a
request to like your AWS like it's called the instance
metadata server. And and Amazon has actually
gotten better about this because now they check it and there's
like some setting you can flip where it's not vulnerable
anymore. But that that's another common
one I've seen too. The good news is Phoenix
actually gives you a very good base.
And if you're using Phoenix with something like Paraxial IO,
you're, you're better off than I would say 95% of like web
developers, you know, you get people coming from WordPress,
for example. And I don't want to dump on
WordPress. I think WordPress is a great
project for what it is, you know, web publishing software.
But when people try to use it for situations like a bank as
that primary application, that is not the right decision.
A lot of security problems there with the plug in system.
Just watching my like traffic requests on in like any public
domain, right? Like I'll go on the paraxial
dashboard and it's always just bots looking for the WordPress
vulnerabilities, you know? Yeah, WordPress exploits.
Yeah. And but it's also because it's
the most popular website that is out there, right?
So it makes sense. Yeah.
And people will say, oh, this is security through obscurity, like
you're using Phoenix instead of WordPress.
And I'm like, yes, but by any honest conversation about
security, your probability of an incident is far lower with
Elixir in Phoenix than with WordPress.
It is. It is not.
Even close well and then like like if you're using ACTO for
any CRUD like you're, you're really avoiding like SQL
injection problems and a lot of issues that you can run into
with any like. Open, we should mention yeah,
use Ecto. Don't try to roll your own on
that one. That's bad because you get SQL
injection. Don't don't execute like raw SQL
query like Ecto's actually great if you're using the default Ecto
query syntax that is perfect. Do that like don't try to get
creative with it. You don't have to roll your own
and then when you don't, you don't even have to worry about
sequel injection, so. I, I actually had someone ask
me, they said, oh, you know, like we're using Ecto and I'm,
and I'm worried about sequel injection because I don't, I
don't really trust Ecto. Could paraxial help me with
that? And I had to explain like how
Paraxial worked and what the product was.
And I'm like, look, I'm not gonna misrepresent this here.
Ecto is the best. Like use ecto in the default say
paraxial will tell you the the actual value of paraxial is
telling you if you've gone off of the guardrails ecto set for
you, yes. Yeah, which is really good.
I actually like when I first add paraxial to a project too.
Like, you'll have a ton of noise 'cause you just do, you do nasty
things on accident, you know, but that that noise is great
'cause then you just go through each of the, you know, warnings
and you just slowly clean it up. And it makes you feel better
about yourself too. I had an interesting moment
where when I was developing paraxial, kind of pre LLM
coding, I was writing guides for each SOBLO finding.
So the intent was you're a developer, you get a SOBLO
finding and you're kind of like, well what the heck does this
mean? And it's like, OK, well here's
what it means, here's the severity, here's how you fix it.
I wrote that 100% the audience was a human LLM show up on the
scene. If you feed a solo output to
Claude, it typically googles it and then like finds the paraxial
blog and reads it and then it's. Like that's hilarious.
So it's like kind of burning all these tokens.
But what I tell people is if you just use paraxial, you know, you
have the guide that I wrote you, you can save a lot of tokens.
So rather. Than I will say spawn.
Yeah, your notes like in your findings are so helpful.
That's the goal. And then, and then it saves you
tokens like because I know everyone always, I get my clawed
limit daily constantly. So you get more use out of it
and it costs money to use these things.
So I, I think that's actually a very important area of
cybersecurity right now is let's say you have to burn, you know,
$10,000 of tokens to secure a web application.
Well, as we just talked about your, that there's budgetary
problems there. What if you could combine it
with a stack analysis tool or, you know, some kind of software
that checks it and then you're down into maybe, you know, 4 or
$5. It seems like that has to happen
because, you know, budgets are kind of an inherent constraint.
I think a very good constraint for this field of, you know,
defensive engineering and cybersecurity.
Yeah. Well, and one thing to go back
to like Dalton or I don't the, I'm the Chinese characters like
the limited budget thing. I think this is just one thing
you have to get used to. Like when you're a developer or
is like entrepreneur building a platform, you have to do
everything yourself anyways. So you have to like learn
everything at a minimal, but enough to stay secure enough
till you can afford a full penetration test or whatever
you're doing, you know, and it's a long road.
And I've always had, I always had this hope like I'm going to
find a magic person to help me with sales, blah, blah, blah,
you know what I mean? And then you end up coming to
the realization like I'm the only one coming to my rescue to
find sales and customers. So you have to just do the thing
you don't want to do over and over.
Continue eating glass until your MRR is a number that you like.
And the interesting point you make is that that doesn't change
as your as your company gets bigger.
There's this phenomenon that a lot of people noticed when I
believe it was Paul Graham, he published A blog post called
Founder Mode, which was a big, the big term for a few weeks.
I remember, which was even at big companies, a lot of founders
had this moment where they tried to delegate things and just be
totally hands off and then nothing got done.
So then they got extremely involved, which is kind of
derisively called micromanagement.
But they found doing that made things happen again.
So it doesn't change even if you're leading a big company or
maybe you're you have a family or something, or you just you
have a task at work or something has to get done.
And you realize unless you are actively really pushing for it
to happen, you know, you can't just kind of rely on inertia.
Maybe that maybe that's more true of life in general as well.
Yeah, there's no like easy coast button.
You're always going to be having to hammer Bry J Bry makes a good
point. But like yeah, you never want to
dynamically create atoms either from like a user action.
Oh, that's a big one. The the the reason I don't
mention this one is I think it's as, as you mentioned with the
man in the middle thing, people kind of over index on it.
Like I constantly get people asking me about this one and OK,
I actually wrote an article about it.
We could put it in the show notes.
I'll send it to you. It's on the paraxial blog.
It's like the impact of Adam creation, just like let's say
your Elixir app is host on EC2, like a Linux server.
Just crash it in production or or dev, probably do it in dev
production if you're brave and see if it restarts like it's a
one liner. Just create a bunch of atoms.
It's not ideal, of course, but in most vulnerabilities that
I've seen with unbounded atom creation as well, you would just
send like one HTTP request per atom and it's like, OK, yeah,
maybe if a bad guy really wants to like crash it and then you
have 30, 30 seconds of downtime while it restarts, you know, it
the, the risk there is not so much the the DDoS, which is
real. It's make sure that it restarts
because like, just like real scenario, a bad guy probably
won't try to crash your Elixir app due to Adam creation there.
There were some recent vulnerabilities unplug where
that was a real issue, which is a little bit more important, but
I think they were mitigated by actually having like a like a
load balance or cloud flare in front, which most people do.
The reason your app will crash due to unbound atom creation is
probably due to like a company's AI bot these days, like a
scraper or something and it hits some code path where the atoms
get created and then it crashes. And then in that situation, just
make sure well, number one, you know, use practical to ban it.
I got a plug in once during the show at least.
No, but make sure that like when it crashes, see if it restarts.
And it's really simple to test that.
So that that's what I would promote on the show is you can
actually prepare for a situation like that by kind of
preemptively doing the attack on yourself.
Yeah, that's a good idea. Or just like don't use to atom
from string or whatever the function is.
I see it everywhere. Well the the big problem right
now is that actually like this exact vulnerability showed up in
some Elixir libraries that everyone uses.
So like well. I feel like it was just in.
Was there one like decimal? There was another one that there
was another. What was the HTT cowboy?
Was it cowboy? Yeah, there was one in, There
was one in Cowboy and Bandit. And I should mention, I should
mention Bandit because he's been really great about fixing those
vulnerabilities as well. Bandit has a a bit better
performance as well if you're if you're looking for which one to
use. Yeah, I had to Google the limit
of atoms 'cause I couldn't remember, but it you're had a,
it's a million. Yeah, it's just over 1,000,000.
But yeah, just don't. Dynamically kill yeah of of
Alexei and Erlang. I'm actually surprised.
Like, man, maybe I'm just not smart enough here.
Why wouldn't we just have like some kind of automatic garbage
collection for that? I'm not going to, I'm not an
Erlang expert either, but I from, I've, I've talked to
people in the working group and this is like a known issue in
the Erlang development community.
They've had proposals, they've looked at it.
You know, it's kind of like asking, you know, why don't you
just make a computer you can't hack and you know, everything it
seems so like, oh, just don't do that, you know, but there's, you
know, there's there's people rely on Erlang for
infrastructure and things like that.
I'm sure the complexity is like so deep and I don't like fully
understand it, but just don't do it guys.
Just don't use. String that that would be a that
would be a good guest for the show.
Like a like a super deep dive into the beam.
Dude, that would be cool. I'd have to.
It would be good. I'd have to research a lot just
to be able to have the conversation, which I guess.
Is there's a book there's like, it's like the beam book, right?
Like someone wrote an entire book just on the beam that I
saw. That was pretty cool.
That would be cool. Now I want to, let's see, pull
that up. Yeah.
The beam book. Steinman's Eric Steinman.
See. I should have Eric Steinman.
Yeah, Buy a copy. Buy a copy.
That's actually really cool. I'm going to buy a copy or it's
free too on dot org blog.steinmans.org but it's also
on Amazon. But we we support buying a copy
as well. Buy a copy.
You know, I always, I usually always try to buy books from
authors because I just feel like content creation is hard, so I
will support them. I like having books too.
I, because you know, I, I, I read a lot and I even like
reading programming books on, you know, like, like when I have
the terminal, but I, I kind of like just owning a copy.
You know, sometimes it's nice. Pass it to your children or show
it like it's good. See, I'm a big I love the Kindle
because I hate like, holding a book when I'm reading it.
Oh, how do you like? Which Kindle do you have?
I don't know the basic 1. I don't know.
Let me see, just whatever this one is.
It's not sponsored by Amazon, by the way.
The. Paper the paper Wyatt.
I think it's just the paper Wyatt.
I don't know, but I like it because like, you can travel
with this and have thousands of books on it, you know?
Yeah, I I read books on my phone and I like I get hand cramps
actually pretty frequently 'cause I on my phone anyway, so
I just. Like the phone is, it's an
awkward hold, right? Like I feel like I don't, I
don't know, get a Kindle dude. And it you don't fry your eyes
as much. Yeah, yeah.
Well, have you seen the technology now?
People want to do E Ink for like displays and stuff too I
thought. That was pretty cool.
I've been looking at some of the phones.
I'm like really tempted and they have like some really cool color
E Ink stuff too now and it's like I'm tempted, but like I
also just don't want to leave the the Apple universe because
all my stuff is Apple. I don't know.
Yeah, it seems. Like they should get.
I feel like E Ink display would be more Apple like.
They did the VR goggles for a while.
There's a lot of hype and then I haven't I haven't heard much
about them recently. Yeah, I haven't either, but
anyways, the beam book I could get on Kindle.
I feel like the beam book would be a cool one to have though.
You need that on your bookshelf, especially just being put it.
Put it in the background of your streams for.
Exactly. Erlang Land.
I've, I'm buying it right now. And then I have to have Doctor
Eric Steinman on. Yes, I'm going to have to reach
out to him. I would be a cool guest after I
read the book. So I'm not a.
Complaint. I wonder if your chat has read
it. I feel like there is.
If there is any audience on the Internet that has read it, it's
probably on this last. That's true.
Anyone listening, have you read the Beam book?
I'm really curious that'll. Browse through it.
I I was actually, I was doing something with binary terms like
a security thing. I remember actually reading it
because it's like how the deserialization format I think
is actually covered in the book. And then it's kind of like
what's called nerd sniping where it's something interesting.
And whatever I was wearing, I ended up like browsing through a
few times like that's how that works.
So that's why they did that. Or you know, like memory
allocation Erlang. Like yeah, I'll see how that
works. Yeah, well, I feel like, like
I'm bad at, like, it's good to know the foundation of like, why
certain things in Elixir are the way they are, right?
By understanding how the beam works.
And there you go. Is Paraxial a paid library like
Oban? That's a good question.
Yeah, go ahead. Yes, yeah, there's a free tier.
Well, to use the Paraxial library, you have to have the
software as a service. It's not a stand alone.
It's sort of like there's Oban, which is the free open source
and then Oban Pro it it links to their software as a service.
But the summary is you can use Paraxial for a free or like
nonprofit, but if your application makes money in a in
commercial context, you do have to pay for it.
And you know, Praxial customer, it's usually a business.
It's not something that like an individual developer usually
buys because of the price and support overhead.
I am very happy that the free tier exists and people can use
it. The other thing is if, if
security is very important and let's say you're just starting
out like you have a new business, it is a commercial
project. I actually think the open source
tools are very good because in, in my experience, I, I talk to a
lot of entrepreneurs. I, I love it when I get e-mail
from them. Usually they don't really need
Praxeal quite until the practice started kind of found its fit
and they've got revenue coming in.
They can budget for the the software.
So you know, if you're watching, I'd love to hear from you.
If you're an Elixir dev, I'm always happy if you go on the
Praxial home page and click book a demo.
It just goes right to my calendar.
But that's kind of the the scenario with Paraxial is the
the paid product. You sort of have to be a
business in order to really get the full value out of it.
Oh man I'll I was trying to find Eric's diamond on on X but I'm
struggling. Might be on LinkedIn, I think I
saw some posts from him on there.
All right, cool, I'll track him down.
My ADHD hit in the middle of a live stream.
I bought a book and was. Searching for him that's.
Great. Oh, and now he's asking paraxial
versus SOBLO, which I feel like you use SOBLO in paraxial,
correct? Yeah, that's a great question.
So I'm also a contributor to the SOBLO open source project as
well. And that's really good because
I, I, people often ask me about this.
They say like, well, why does Paraxial like use SOBLO as part
of the, why don't you fork it or do your own like soblo plus
plus. And that never made sense to me
because people don't buy paraxial as a slightly better
version of soblo. You know, if you need a stack
analysis tool and your budget is, you know, it could be 0,
could actually be a very high budget, you know, SOBLO serves
that market very well. It is the open source stack
analysis tool for Elixir. The reason people buy Paraxial
is very different. It's you are a business and you
need to make sure your software does not get hacked.
And that is different from a SAS tool.
The scope and the needs and the support are very, very
different. You know, Praxial is like a
suite of features and stack analysis is one part of that.
Enriching the SOBLO findings is part of it.
But I never thought, you know, oh, I'm going to make like a
fork of SOBLO with like better support.
I, I think that actually my contributions to SOBLO 8 Elixir
adoption. So you could argue that that
that does benefit Praxial because of more businesses use
Elixir. You know, I have a larger
customer base, but I think it aligns very well with the
community. I, I really love open source.
I think Jose and Chris have been very, very strong supporters of
open source. So, you know, it's natural that
I would be a developer and in that sense as well.
I am already connected with Eric Simon on LinkedIn.
Perfect. You like already chatted with
him? That's beautiful.
I haven't chatted with him but we are connected so that's good.
One step closer. Well The funny thing is like, I
don't know, my memory is trash and I have like I meet so many,
IE meet so many people, it's hard to like keep track.
Yeah, we've never read in person, have we?
No, we haven't. I was gonna try to go to Chicago
this year, but I don't think. It's yeah, yeah, I'm planning to
go to and if anyone, if anyone's watching, I know it's really
awkward when like you go to a conference and like you see
someone you know, online, but you're like, how's it like
weird? If I go up and please come up
and talk to me, like I won't get upset.
I'm not. Always.
Yeah, I know. It's like a little weird.
You're like, oh, like I kind of know you, but like, you've no
idea who I am. But like, I've, I've watched
like hours of your footage or I saw you on the podcast.
Please give up to me. That's why I go to the
conference. You know, what's hilarious is
people like, like when I was down, I went to Austin for Mike
Hessler or not Mike Hessler, Nathan Hessler's, Nathan
Hessler's conference, and people don't recognize my face.
They recognize my voice when I'm talking in a group of people.
They're like, I know that. I.
Know that voice? And I was like, oh, that's
hilarious. And but yeah, it's always good
to meet people. OK, Bry J Bry, he's asking, does
paraxial certify stuff like Sock 2 and HIPAA?
Oh, that's a good question. So no, like cybersecurity tool
can actually do that because those standards are actually a a
more complicated kind of set of controls that you have to show
compliance with. Sock 2 is a good example.
So for example, when you do a SoC 2 audit, you're actually
being evaluated by ACPA, it's an accounting firm that you have to
hire and then you have to show that you've done these security
controls. And it's, it's a bit confusing
because you can actually have a Elixir application that is
totally vulnerable and it's going to get hacked and
completely pass SoC 2 because it's basically a spreadsheet
that says, did you implement this control, yes or no?
Well, do you have like a process to triage vulnerabilities?
Yes or no? You can do all of the compliance
items to the letter in a way that sincerely fulfills every
single line item and just be totally not secure because
they're kind of different things that there is like a Venn
diagram overlap where you should use SoC 2 to actually improve
your security because you're kind of doing the work anyway.
It makes a lot of sense, but they're sort of different.
They're entirely different sets of like kind of sets of things.
So for example, like a using paraxial will fulfill several
controls like static analysis or runtime analysis.
Do you have a a runtime guard that blocks an exploit?
Are you keeping track of vulnerabilities?
Are you keeping track of the scans you do?
Like how are you communicating them to the management?
You know Paraxial helps with all of that, but it is not the same
as Praxial saying like you are sock 2 certified because that's
actually impossible. Praxial isn't an accounting
firm. I think some cybersecurity firms
are actually trying to do that a bit.
But I I'm very much on the kind of like, I like that the real
hacking stuff. We should also do a shout out to
XMEX, which is the Austin conference that Nathan runs.
If you're, if you're listening, go on.
Well, you'll put in the show notes, but it's xmexconf.com and
sign up for the newsletter. I feel like it's a good that's a
good plug for your audience. And it it, yeah, it was such a
good conference too. Like I'm a big fan of going to
small conferences 'cause you get to meet everyone that's there
like. I was disappointed I couldn't
go. Yeah, you chat in between, you
know, all the talks and you just, you know, you meet people
that like, I know a ton of people in the Elixir community,
but like you don't get to meet them in person.
And then you can finally get to and you just can chat about the
coolest stuff and all the projects people are working on
and it's a lot of fun. How?
How was the conference like? How did you think it was
organized? I thought it was really good.
I was like less hopeful that I was going to really enjoy the
talks, but all the talks were awesome.
Like Nathan did such a good job. And then like, yeah, the hallway
talk was way was like awesome. Just like connecting with
people. I think it's important for
developers especially to get to conferences because we kind of
stay siloed in our own work and at our own computers.
And I feel like it's good to to network that way.
Like met a handful of Apple developers and just it's cool A.
100%, yeah, yeah. Thank you so much for having me
on today. This was a great conversation.
Hopefully we see each other in person at Elixir Comp Chicago.
If anyone listening can attend to, I'd love to meet you as
well. I think you're doing a great job
with this whole project. It's been fantastic for Elixir
adoption and for the community to come together and talk about
what they're working on. It's been a lot of fun and
what's funny is so for everyone that doesn't know, Michael was
my very first guest as well. So if you want to see like the
worst performance ever would be our my first podcast episode.
It was still good. It was good content, right?
But like you can tell like whenever you do something brand
new. And now I think it is it almost
three years ago. No.
Two years ago 2. It's getting up there, yeah. 2
1/2 years ago, but yeah, Michael was my first guest and my first
sponsor, which is pretty cool. Thank you.
And it's been a fantastic partnership.
And yeah, I'm happy to be back on.
I love coming. Yeah, it's cool.
We'll have to make sure. I mean, I feel like, like we
stay in touch enough that like when, when there's, when it's
time, I don't know, we just connect again.
This was this was the right moment.
This was a good one. It was it was a good moment and
like seeing that just all the CV ES hit and all the I don't know,
I think that that stuff like I joke about being annoyed about
it, but it's really cool to see like all these vulnerabilities
get discovered very easily and like corrected.
Yeah, the work that Peter, Jonathan, the Hex team, really
all all of the people that had, I should actually mention the
maintainer specifically because a lot of people have these
vulnerabilities reported to them and then it's on the maintainer
to fix them. And that's a huge amount of
work. And you know, maintainer is
often, you know, it it's a struggle because it it is more
work for the maintainer. Yeah, it does benefit the
ecosystem where now everyone is more secure that's using Elixir.
So if you are a maintainer, mention that on your resume.
I would say that you are keeping, you know, thousands by
10s of thousands of businesses doing billions and billions of
dollars in transactions. And not even just commercial,
but, you know, hospitals, governments, non profits.
There's so much critical infrastructure that Elixir runs
on. If you're maintaining a library
and fixing security vulnerabilities, that is
extremely important and you should communicate that.
I agree. When and talk about yourself.
And since I've started like doing recruiting and like
looking at a lot of like coding projects and things 'cause I
like do the pre vetting right? The code from the project is
even less important than like things that you've already done.
And like, open source is a huge one that people love to see
like. Yeah, it'll be like a little
line. I'm like oh by the way I do this
little library. And have yeah, no that.
Should be emboldened. Yeah, you, you are writing code
that like businesses run on top of that is extremely impressive.
Yeah, well, 'cause like one thing that I'm seeing too is now
like over engineered solutions that are just all clearly be
written by AI and they're almost instant disqualifiers because I
don't want to 1. I don't want to look through
that much code anymore. And it's just like, no, I want
to see how you implement it. I don't want to go like you're
not going above and beyond adding like, I don't know what's
a word I'm looking for like a, like an analytics dashboard on
top of a project. Like people are adding like
extras to like a core like I, I, I just want to know that, you
know, Elixir and understand OTP, that's it.
In some ways that's the hardest part is I think everyone
probably listening to this call has struggled with this problem
is what should I work on? Yeah, yeah.
No easy answer the specs, dude, But yeah, thank you so much,
Michael. This is awesome.
You guys can find Michael on X, he's paraxial IO and then
paraxial dot IO is his website and it's always it's always
awesome having you on. Thanks so much.
Thank you if you've been watching, thank you for
listening to me. Feel free to reach out.
If you watch this stream and you just want to chat, I would love
to hear from you. Yeah, sounds good.
All right, everyone have a good weekend and I'll see you next
week testing.