# Security Working Group Minutes **URL:** \ **Category:** EEF Security\ **Tags:** minutes\ **Created:** [April 4, 2024, 1:36pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451 "2024-04-04T13:36:55Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [February 7, 2025, 8:50am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/21 "2025-02-07T08:50:44Z")
# February 5, 2025 Participants: Dan Janowski, @varnerac, Lee Barney, @maennchen, @voltone, Marc Nickert, Michael Lubas, Paul Swartz, Bas Wegh, @kiko ## Compliance updates ### CNA (CVE Numbering Authority) - Still pending a response from MITRE - Proposed meeting slots in February approaching ### CISA Self Attestation and NIST SSDF - To be discussed in call with NIST - Some uncertainty about whether EEF can do this on behalf of projects ### OpenChain - Erlang/OTP certified (see @kiko’s [announcement](https://erlangforums.com/t/erlang-otp-announces-an-openchain-iso-iec-5230-conformant-program/4442)) - Working on Elixir and Gleam - Source SBOM - Policies ### Source SBoM of OTP - Contributions to [OSS Review Toolkit](https://github.com/oss-review-toolkit/ort) accepted - Source SBOM will be published with OTP releases starting with OTP 28 - Working on splitting SBOM by application ### Application for Supply Chain Funding - Trying to obtain funding for ongoing supply chain work - Next step: align with documented package manager best-practices - Get hex.pm involved, as well as build tools (Mix, Rebar3) ## Erlang distribution protocol hardening - Picking up discussion started in Slack - Initial idea (Dan): make it easier to secure with TLS out of the box - Issuing certificates - Injecting kernel parameters - Broader use-cases (Lee): connecting (possibly transient) nodes across the Internet - Instead of having to go through e.g. HTTPS - Large clusters, frequent membership changes, unreliable nodes - Security aspects just one part of it - Invited Lee to present his work to the group in the future - Offered Dan support with first round of research into possible approaches ## Other updates ### PenTest Sample App - Michael just finished pen-testing Oban Pro, might be interested - Need to start collecting requirements for the app’s scope - Take it to Slack or Notion (see below) ### WG collaboration tooling - We have access to Notion, with non-profit discounts - Read-only access is free, must pay per write-enabled seat - Currently being used by @maennchen for broader EEF work - Open it up a bit, start linking from Slack and meeting notes - Create a landing page for the WG - Keep licensed seats at a minimum ## Next meeting Wed 5 March 2025 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 0:00 (Thu) JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [March 6, 2025, 2:41pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451/22 "2025-03-06T14:41:36Z")
# March 5, 2025 Participants: @maennchen, Daniel Janowski, @Alistair, @varnerac, @voltone ## Updates from the CISO ### CNA - New dates in March proposed at Mitre’s request - If/when meetings happen, CNA could be live in weeks ### Grant Application - Revised proposal, waiting for feedback - First phase is to pen-test existing package manager integrations - Got first offers for pen-test providers - Started discussions with two, one for code review, one for red team - Recommendations? Share with @maennchen - Started to define “initiative” for EEF website for the purpose of fundraising in general ### OpenChain - Elixir: done - Gleam: work started ### NIST SSDF Sub-Standard - Work started by Jonatan to define an SSDF “profile” - Progress can be followed in Notion - Contributions welcome - Alignment with other ecosystems would be useful - Just hard to find out who else might be working on something like this - We asked NIST, they do not have visibility (at this time) ## HTTP Clients in the ecosystem - Lots of clients, some not actively maintained - This state of things has security implications - Some discussion on whether to adopt “Mint” approach for Erlang/OTP - Perhaps as part of OTP? - Try and invite @ingela @kiko and perhaps Andrea next month ## Distribution TLS by default - Two operating modes can be considered: - PSK (not great with TLS 1.2, no support in OTP with TLS 1.3) - Shared self-signed certificate - Goal is to have some (build) tooling to prepare a release config “automatically” - Align with OpenRiak, looking for migration to secure cluster - Might need ability to listen both with and without TLS - Configuring TLS settings at boot is tricky - Next steps: - Continue digging and documenting in Notion - Discuss with OTP team, if they join next meeting (see above) ## Next meeting Wed 2 April 2025 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 0:00 (Thu) JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [April 3, 2025, 9:19am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/23 "2025-04-03T09:19:05Z")
# April 2, 2025 Participants: Daniel Janowski, @Alistair, @ingela, @varnerac, Dave Lucia, Lee Barney, George Madi, @voltone, @peerst ## Secure coding curriculum - [Project](https://github.com/podium/elixir-secure-coding) by Podium: - Livebooks for interactive training - Includes material related to our [Secure Coding Guidelines](https://security.erlef.org/secure_coding_and_deployment_hardening/index) - Currently seems abandoned, no activity for 2 years: - Dave suggests EEF take over the GH repository - Maintenance can be joint effort between SecWG, EduWG and TV Labs - Next step: Dave reached out to Podium and EduWG ## Compliance updates ### CNA (CVE Numbering Authority) - Meeting with MITRE finally took place: - On track to get setup in next couple of weeks - Need to define and document some internal policies, procedures and CVE record conventions ## Erlang distribution protocol hardening - Prototype by Daniel generates self-signed certificates using Rebar3: - Requires OTP patch to allow `verify_fun` for client certs to be customised - Private key the same on all nodes, simplifying key distribution - Reservations about promoting anything based on self-signed certs: - People tend to abuse those, at the expense of security - Peer mentioned [Braid](https://github.com/stritzinger/braid): - Delegates cert and key management to orchestrator (e.g. [fly.io](http://fly.io)) - As discussed previously, PSK would be a good fit: - Simplest, most universal setup, without assumptions about e.g. orchestrator - OTP team open to contributions to add PSK to TLS 1.3 - Needs to be driven by real use-cases, starting with requirements for APIs ## SEMP (Secure Erlang Message Protocol) - Paper sent by Lee in the Slack channel ([here](https://the-eef.slack.com/files/U01NA8WAC9M/F08M330CHPS/semp_proposal.pdf)): - Broader scope than just secure transport - Consider developing outside OTP as an alternative distribution protocol: - Compare [Bondy](https://developer.bondy.io) and [distribution protocol over UDP](https://dl.acm.org/doi/10.1145/3331542.3342572) ## Next meeting Wed April 30 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST (WG Calendar is [here](https://erlef.org/wg/security/calendar), including subscription link to import into your calendar app) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [May 1, 2025, 8:52am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/24 "2025-05-01T08:52:15Z")
# April 30, 2025 Participants: @kiko, @maennchen, @voltone, Michael Lubas, Paula Calgaro, Nicholas Adams, Dan Janowski, @ingela, @Alistair, Lee Barney, George Madi, @varnerac ## OTP purl type - Proposal (from several years ago): [‘otp’ Package URL type | EEF Security WG](https://security.erlef.org/specs/otp_purl_type) - Can help produce more accurate, actionable SBOMs - EEF becoming CVE Numbering Authority gives us an opportunity to define how OTP apps will be identified in CVE records - OTP team on board with the proposal - Next steps: create a PR to the [purl specs](https://github.com/package-url/purl-spec), then remove “draft”, write up an announcement ## Marketing WG proposal: interview series - To be published on YouTube by Marketing WG: - Along with shorts for other social media - Target for full length video perhaps 30 mins - Editing/publishing/promotion done by Marketing WG - Need to find host and interviewees: - Several people said they would be willing to be interviewed - Host may be trickier, may want to consider enlisting help from e.g. established podcasters - Topic and set of questions defined beforehand: - To be prepared by host, together with others - Shared with interviewee, for preparation - Consider audio-only version (podcast) as well ## Updates from the CISO - [purl library](https://github.com/erlef/purl) moved to EEF: - Core now in Erlang - PR to adopt as “Security WG project” - Consider teaming up with Build/Packaging WG - [GitHub dependency submission](https://github.com/erlef/mix-dependency-submission) tool: - Basics now working - Ongoing work to support all features - May require some fixes on GH side as well - [AEgis project](https://security.erlef.org/aegis/): - Looking for more funding/sponsors - Dashbit joined as contributing sponsor - [OIDC Client](https://github.com/erlef/oidcc) - Preparing for additional certification ## Industry groups partnerships - Alistair came across: - [https://www.grf.org/](https://www.grf.org/) - [Startseite - TeleTrusT - Bundesverband IT-Sicherheit e.V. / IT Security Association Germany](https://www.teletrust.de/startseite/) - Opportunity for EEF to join as non-profit partner - Gives us access to resources, events - If anyone is interested, e.g. to gain access to NIST [SSCA forum](https://csrc.nist.gov/projects/cyber-supply-chain-risk-management/ssca), reach out to Alistair ## Windows/Mac binary signing - EEF already helps release Elixir binaries for Windows - Could do the same for Gleam, Erlang/OTP - Also consider adding Mac - Look at how Livebook handles this - Also consider OpenRiak - Next step: Gleam binaries for Windows, then see what’s next ## Next meeting Wed May 28 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST (WG Calendar is [here](https://erlef.org/wg/security/calendar), including subscription link to import into your calendar app) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [May 30, 2025, 7:15am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/25 "2025-05-30T07:15:04Z")
# May 28, 2025 Participants: Dan Janowski, Lee Barney, @maennchen, @voltone, Paul Swartz, Marc Nickert, @kiko ## Updates from the CISO - CNA is live: [https://cna.erlef.org](https://cna.erlef.org) - Announcement: [Erlang Ecosystem Foundation - Supporting the BEAM community](https://erlef.org/blog/security/eef-cna-announcement) - Still pending: define guidelines for CVE record contents - OpenID Client: - Working on financial API certification - AEgis Initiative ([Ægis Initiative | EEF Security WG](https://security.erlef.org/aegis/)): - HCA Healthcare added as in-kind sponsor - @starbelly will contribute to [Hex Build Provenance | EEF Security WG](https://security.erlef.org/aegis/roadmap/hex-build-provenance.html) ## Interview series - Follow-up from last month’s call regarding Marketing WG proposal - Dan is willing to host - First topic should be CNA: - Interviewee could be @voltone (to avoid over-exposure of @maennchen, who is appearing on many podcasts lately) - Check with Marketing WG about partnering with podcast producer ## VEX - OTP team wants to publish VEX (Vulnerability Exploitability Exchange) statements: - Looking for feedback, anyone has experience? - OpenVEX versus CSAF: latter seems to be overly complex ## OTP 28 - Changes in `public_key` may impact applications/libraries that rely on ASN.1 encoding/decoding ## Public roadmap - Dan is working on a public roadmap of EEF activities - Not just ongoing work and their sponsors, but also work that should be done but needs sponsors - Will track Security WG items in Notion, extract data for public doc from there ## Next meeting Wed June 25 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST (WG Calendar is [here](https://erlef.org/wg/security/calendar), including subscription link to import into your calendar app) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [June 26, 2025, 11:31am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/26 "2025-06-26T11:31:57Z")
# June 26, 2025 Participants: Dan Janowski, @voltone, @varnerac, Paul Swartz, @maennchen, @Alistair, George Madi ## CVE Numbering Authority (CNA) - First CVEs published: [List of Issued CVE’s | Erlang Ecosystem Foundation CNA](https://cna.erlef.org/cves/) - Expressing affected versions remains challenging: - Especially for OTP, which [does not use semver](https://www.erlang.org/doc/system/versions.html#order-of-versions) - Not all systems/tools handle all features of CVE record schema - This leads to loss of information, e.g. in [EUVD](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-4748) - Linux distro advisories appear to be correct, probably processed manually - Embargo List: - [Looking into](https://github.com/orgs/erlef-cna/discussions/3) establishing an embargo list, like some other CNAs have - Allow for careful disclosure of vulnerabilities to trusted partners, allowing them to prepare their own advisory/fix/response - Example: Cisco was affected by the SSH RCE vulnerability, had to learn about it in public channels (but that one was still through GitHub’s CNA) ## Updates from the CISO - Windows code signing: - [Gleam PR](https://github.com/gleam-lang/gleam/pull/4724) opened - [Elixir PR](https://github.com/elixir-lang/elixir/pull/14604) for hardening of the existing code signing implementation - Next up: automate OTP (currently done manually) - Looking at Mac OS notarisation (Gleam, OTP) - OSS Review Toolkit (ORT) [fix PR](https://github.com/oss-review-toolkit/ort/pull/10502) - OIDC Financial API certification still pending ## Interview series - Currently stalled on our end: - We can help with people, topics, questions, answers, but nobody is chasing this - Could use Marketing WG “project management” - Consider (again) partnering with existing podcast producers - Dan will discuss with Marketing WG ## Next meeting Wed July 23 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [July 24, 2025, 9:54am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/27 "2025-07-24T09:54:17Z")
# July 23, 2025 Participants: George Madi, @varnerac, @voltone, @maennchen, @peerst, Dan Janowski ## Updates from the CISO - Affected versions for our CNA’s CVEs not picked up by some tools: - [OSV](https://osv.dev): - They are working on a PR - We may need to propose some further fixes later - [EUVD](https://euvd.enisa.europa.eu): - Data is ingested from NVD - May pick up more details once NVD data is enriched - Embargo list proposal ([https://github.com/erlef-cna/website/pull/61](https://github.com/erlef-cna/website/pull/61)) - How do we distribute vulnerabilites to members of the list? - Encrypted email? - Invite to private GH repo (fork of the actual CNA repo)? - Should we disclose selectively, or globally? - Selective disclosure requires tooling, is a liability - Global disclosure might reveal information to competitors - To be discussed in GitHub issue - Gleam windows code signing - Has been implemented using EEF cert, like Elixir - [https://github.com/erlef/trusted-signing-configuration](https://github.com/erlef/trusted-signing-configuration) (private repo) - Erlang code signing: - OTP team would welcome PRs - Build process is complicated, includes manual steps - Waiting for OTP team to come back from vacation - Should we build for Windows ARM too? - Peer might be able to help a bit (but not with Windows, specifically) - [ORT](https://oss-review-toolkit.org/ort/): - Can we have a binary (using Burrito) that can scan, without requiring install of e.g. Rebar3 - @maennchen to discuss with @voltone - (redacted) grant application - Initial (broad) application rejected - New one submitted for Hex security audit ## Community outreach - How can we reach out more regularly, raise awareness? - Something with less effort than the proposed video interviews - Blog posts, essentially - In the past it was mostly individual WG members posting on private/corporate blogs - There would be value in doing this from the EEF and the WG instead - There are a handful of posts on the EEF website - Need to add more content, to make this a “go-to” place for the community - Marketing WG can help spread the word through socials - Do we need an RSS feed, ideally per tag? - Not sure it is worth adding to the current website, it needs to be reworked anyway - For now update WG landing page to list security-related posts - Dan invites people to submit contents (old and new) - Start building up an initial collection of useful resources ## Next call Wed August 20 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [August 21, 2025, 8:50am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/28 "2025-08-21T08:50:37Z")
# August 21, 2025 Participants: @varnerac, @Alistair, @kiko, Dan Janowski, @voltone, Michael Lubas, @maennchen, George Madi, @georgeguimaraes ## OpenVEX in Erlang/OTP - @kiko has been working on adding OpenVEX statements for OTP 26+ - PR: [https://github.com/erlang/otp/pull/9790](https://github.com/erlang/otp/pull/9790) - Forum announcement: [OpenVEX in Erlang/OTP (testing phase)](https://erlangforums.com/t/openvex-in-erlang-otp-testing-phase/4990) - Affected version lists are verbose; necessary to ensure accuracy within the constraints of the spec - PR will be merged soon, follow-up activity to improve automation ## OTP release assets in CI - Starting with Windows binaries, including code signing - OTP team open to expanding this to include other platforms - Provided contributors continue to help with maintenance - Aim would be to eventually have binary distributions for all platforms in one place, signed where possible ## CNA embargo list - No feedback received on the PR [Implement Pre-Disclosure List Policy by maennchen · Pull Request #61 · erlef-cna/website · GitHub](https://github.com/erlef-cna/website/pull/61) - Some concerns about using email to distribute undisclosed vulnerability information - Still, that’s how other CNAs seem to handle it - Also, if we use GH to provide selective access, GH will still send e.g. comment notifications through email - Please comment on PR! ## Collection of security articles on SecWG website - No progress since last month - Manage suggestions via GitHub PRs - Initial batch: [Add Article Curation by maennchen · Pull Request #56 · erlef/security-wg · GitHub](https://github.com/erlef/security-wg/pull/56) - Add content from Paraxial, AppSignal, Voltone blog, … ## Doc warnings on dangerous functions - Not all functions in Erlang/OTP that can potentially (indirectly) create atoms warn about the risks of untrusted input - OTP team unsure whether we should aim for full coverage - It sets the expectation that any function without a warning is safe - First step: review [Preventing atom exhaustion | EEF Security WG](https://security.erlef.org/secure_coding_and_deployment_hardening/atom_exhaustion) and aim for completeness there ## Next call Wed September 18 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [September 19, 2025, 9:30am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/29 "2025-09-19T09:30:07Z")
# September 19, 2025 Participants: @Alistair, Lee Barney, @lawik, @ingela, @rickard, Paul Swartz, Dan Janowski, @kiko, @maennchen, @peerst, @voltone ## CNA updates - Scope expansion: - Considering adding two projects to CNA scope - Nerves: - Not all of Nerves is on Hex - Need to figure out how to define scope, preferably at GH org level, so we do not have to update the CNA scope for every new repo - OpenRiak - Embargo list ([PR](https://github.com/erlef-cna/website/pull/61)): - Feedback from Ericsson CNA: looking good, just prefer a different name - Alternative name: pre-disclosure list - @maennchen will make a list of common names used by other CNAs - Still need a decision on distribution channel - OSV.dev - Having trouble ingesting our CVEs directly, currently through GHSA - Our attempts to make CVEs accurate may be back-firing: tools cannot (yet) process latest CVE schema - Multiple conversions (CVE → GHSA → OSV) lead to loss of fidelity - Consider supporting OSV’s custom format directly - Ideally through automatic conversion from CVE; @maennchen to try ## OpenVEX in OTP - Trial is ongoing (see also last month’s notes) ## SEMP - [GitHub - yenrab/BEAM\_SEMP](https://github.com/yenrab/BEAM_SEMP) - TRUST (stable nodes) now working - TEMPUS (transient nodes) up next - Not an alternative Erlang distribution module; completely replaces distribution protocol - mTLS auth with certificates issued out-of-band ## Erlang distribution with TLS - Reviving old topic: can we help people get started? - Earlier attempts to find an alternative to mTLS (e.g. PSK) were not successful - For now focus on documenting what is possible today - Complete running example, e.g. with certificates issued using OpenSSL - Reference from [Distribution Protocol and EPMD | EEF Security WG](https://security.erlef.org/secure_coding_and_deployment_hardening/distribution) - Further work/enhancements to be added to AEgis project? ## Other topics - CodeBEAM coming up in November, several members are attending/presenting - If someone is unable to attend but wants to bring something up, reach out to Dan - Library of articles on WG website: - Contributions welcome, e.g. through [Add Article Curation by maennchen · Pull Request #56 · erlef/security-wg · GitHub](https://github.com/erlef/security-wg/pull/56) - Jonatan creating an updated list of achievements and goals for the WG - To share with (potential) sponsors - Suggestions welcome in the Slack channel ## Next meeting Wed October 15 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [October 16, 2025, 12:34pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451/30 "2025-10-16T12:34:02Z")
# October 15, 2025 Participants: @Alistair, @maennchen, Dan Janowski, @voltone, @peerst, Lee Barney ## Updates from the CISO - Hex attestations (part of project [Ægis](https://security.erlef.org/aegis/)): - Private [repo](https://github.com/erlef/hex-attestation-design) for design explorations - Reaching out to MS for collaboration - BEAM worm [post](https://erlef.org/blog/security/beam-worm): - Lots of engagement - Resulted in two volunteers who want to contribute to project [Ægis](https://security.erlef.org/aegis/) - CNA updates: - [EU vulnerability DB](https://euvd.enisa.europa.eu) have improved the way they ingest CVEs: - Our “affected versions” now presented correctly - OSV export, to improve Hex CVEs in [OSV.dev](https://osv.dev): - Seems to work, need to add an index page - Pre-disclosure list: - [PR](https://github.com/erlef-cna/website/pull/61) still open, but close to being finalized ## Erlang distribution over TLS - We discussed the merits of hostnames in certificates: - No real node identity, and no hooks in OTP to add custom verification - For simple use-cases (strong membership auth, encryption in-flight) strong node identity may not be a requirement - For use-cases that require it, secure distribution of a per-node private key (through orchestration) may replace identity in the cert (e.g. [Braid](https://github.com/stritzinger/braidnet)) - For now continue with prototype for minimal TLS distribution, e.g. as a Hex package - On a side note, Lee updated us on the progress with [SEMP](https://github.com/yenrab/BEAM_SEMP) ## Next meeting _Note: GMT and JST time changes due to end of DST in EU and US_ Wed November 12 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 00:00 JST (so effectively 13/11) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [November 13, 2025, 3:39pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451/31 "2025-11-13T15:39:54Z")
# November 12, 2025 Participants: Robert Carbone, George Madi, @voltone, @maennchen, @varnerac, Michael Lubas, @Alistair, Dan Janowski, Duncan Sparrell, Charles Lanahan, @kiko ## Updates from the CISO - CNA scope updated: - Now covers Nerves and OpenRiak - [cve.org](http://cve.org) already reflects the change - PURL “otp” type registration ([https://github.com/package-url/purl-spec/pull/472](https://github.com/package-url/purl-spec/pull/472)) - Some changes were requested before it can be merged - Need to decide how to express e.g. AtomVM’s `stdlib`, which is essentially a fork of OTP’s own - The `repository_url` qualifier may be sufficient - Grant signed for “Source SBOM tooling”: - Goal is to improve SBOM tooling for Mix, Rebar3 and Gleam - Also integrate into [ORT](https://oss-review-toolkit.org/ort/) - Pre-approved grant for hex.pm penetration testing: - Working with Zentrust and Paraxial - Later: improve support for vulnerability handing on hex.pm ## Updates from the Chairperson - @Alistair and @maennchen attended event by Eclipse Foundation in Brussels: - Primarily about CRA attestation - Briefly presented BEAM ecosystem, showing what has been accomplished - We seem to be ahead of the curve, compared to other ecosystems 👍 ## More SBOM and Supply Chain topics - OTP team hoping to present their supply chain work at FosDem - Some open discussion on the merits and applicability of: - CBOM ([Cryptography BOM](https://cyclonedx.org/capabilities/cbom/)) - [VXDF](https://vxdf.org) - [Omnibor](https://omnibor.io) ## Next meeting Wed December 10 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 00:00 JST (so effectively Thu) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [December 11, 2025, 9:58am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/32 "2025-12-11T09:58:09Z")
# December 10, 2025 Participants: Lee Barney, @maennchen, @voltone, Dan Janowski, Paul Swartz, @varnerac, @peerst, George Madi, @kiko ## Updates from the CISO - [Package URL](https://tc54.org/purl/) (purl) type “otp” is now official: - Has been in use by EEF CNA for a while - [purl Hex package](https://hex.pm/packages/purl) has been updated - [OSV.dev](https://osv.dev) export of EEF CNA CVEs is now operational: - Better accuracy, including full affected versions list - SBOM tooling grant work started: - Mix [sbom](https://hex.pm/packages/sbom) tool moved to EEF, updated - Also [released](https://github.com/erlef/mix_sbom/releases) as stand-alone binary - [rebar3\_sbom](https://hex.pm/packages/rebar3_sbom) moved to EEF, updates in progress - After that: integrate into [ORT](https://oss-review-toolkit.org/ort/) - Hex security audit Alpha-Omega grant: - Signed and announced (on Slack at least) - Preparations have started - In particular: how to test against staging environment - Testing starts in January, aiming to be done by early March - [FOSdem 2026](https://fosdem.org/2026/): - Several talk proposals submitted by WG members - Keep en eye on the website for announcements in coming days - Also panel participation ## **OpenVEX in OTP 28.3** - See [announcement post](https://erlangforums.com/t/erlang-otp-28-3-released/5309) - TL;DR: - 28.3 includes SPDX SBOM with references to available OpenVEX statements - OpenVex statements are available from 26 onwards - Work on signing is ongoing ## Erlang **secure coding standard proposal** - See OTP [PR](https://github.com/erlang/otp/pull/10431) - Current draft [here](https://github.com/erlang/otp/blob/b3c028eac2207fc93469b40f3a77511dda042222/system/doc/design_principles/secure_coding.md) (may be outdated; please use GH to navigate from PR to the latest version) ## **Eclipse Biscuit** - Dan started looking into [Biscuit](https://www.biscuitsec.org) - May create a package wrapping official implementation using Rustler ## Next meeting Wed January 7 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 00:00 JST (so effectively Thu) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [January 8, 2026, 11:58am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/33 "2026-01-08T11:58:48Z")
# January 8, 2026 Participants: Duncan Sparrell, @voltone, Michael Lubas, Dan Janowski, @maennchen, @Alistair, Lee Barney, @chiroptical, George Madi, Robert Carbone ## “Rebar 4” Kickstarter - Q: what is the status of the [kickstarter](https://www.kickstarter.com/projects/peerstritzinger/rebar3-integrating-with-erlang-otp/description)? - Latest [update](https://www.kickstarter.com/projects/peerstritzinger/rebar3-integrating-with-erlang-otp/posts) was Dec 20 - Confusing, because an older update was pinned to the top of the list ## Updates from the CISO - SBOM grant work: - Work covered by the grant is supposed to be done by 20th: - Some residual work till end of January - Erlang: no new version of Rebar3 plugin yet, discussing ownership - Elixir: aligning between SBOM task and [GH dependency submission](https://github.com/erlef/mix-dependency-submission) project, to reduce code duplication - Gleam: [post](https://gleam.run/documentation/source-bill-of-materials/#What-is-the-OSS-Review-Toolkit) on using ORT - Working on ORT plugin for deeper integration: - Run Mix task or Rebar plugin to produce SBOM - Ingest SBOM into ORT analyzer/scanner - Once the tools are available, need to work on adoption: - WG can play a role in getting key projects onboard - hex.pm security audit: - Preparatory work is done: - Testing against staging environment - Additional documentation for tester - Timeline: - 1st round till Jan 23 - 2nd round till Feb 13 - Remediations can start after first round - Planned to complete by end of March - Announcements planned upon completion - Erlang build setup: - Align various projects that build Erlang/OTP - Common setup for running in GH Actions: - Pushing OCI images for downloading built binaries - NSF grant: - Working through paperwork - Need letters by stakeholders to argue why the work has value ## Lee’s “BEAM 2.0” project - Lee provided an ad-hoc update on his “safe BEAM” built in Rust - Along with a project that emerged from it, called Silica - Further information, discussion and possible collaboration in EEF Slack’s Security WG channel ## Next meeting Wed February 4 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 00:00 JST (so effectively Thu) ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [March 5, 2026, 9:38am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/36 "2026-03-05T09:38:40Z")
# March 4, 2026 Participants: @maennchen, @voltone, @ingela, Paul Swartz, @Alistair, @LeeB ## Updates from the CISO - hex.pm audit: - This month’s report is [here](https://github.com/ossf/alpha-omega/blob/main/alpha/engagements/2026/Erlang%20Ecosystem%20Foundation%2C%20Inc.%20(EEF)/update-2026-02.md) - 27 findings are being addressed through remediation - 6 findings will not be addressed (accepted risk or out of scope) - Next step: retest remediation - Report and public communication in about a month, maybe two - Project on track to complete below budget - Maybe some money left to improve hex CLI auth (in Elixir, Gleam and Rebar3) to allow 2FA - hex.pm will enable strict Content Security Policy (CSP) on web pages - Please report any issues - SBOMs and [OSS Review Toolkit](https://github.com/oss-review-toolkit/ort) (ORT): - Done, incl. docs for Elixir, Gleam and Rebar3 - Some more publicity planned - FOSDEM follow-ups: - CISA “secure by design” pledge, on hold due to funding issues - Engaging with [GVIP project](https://www.gvip-project.org/) - NSF grant: - Working with North Carolina State University - Got pre-approval, now preparing full application ## Silica updates - Lee described plans to use compiler features to make Silica’s native crypto APIs safer - By making unsafe usages compiler errors - Proposal available in EEF Slack `#security` channel - Making progress on compiler - Targeting April for repo to be in good enough shape to make it public # **Article collection** - Curated articles by EEF SecWG on the website - Initiative was started some time ago, but not enough contributions - Call to action: submit more links to relevant articles! # Next meeting Wed 1 April 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [April 2, 2026, 12:28pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451/37 "2026-04-02T12:28:08Z")
# April 1, 2026 Participants: @maennchen, @varnerac, Michael Lubas, @Alistair, Dan Janowski, @voltone ## Hex.pm audit - Zentrust and Paraxial completed testing - CVEs assigned and published for real findings - Including RCE in unreleased feature - Also did GitHub CI (Actions) hardening, incl. [zizmor](https://zizmor.sh) - Which proved very relevant, considering what happened very recently in other ecosystems - See also further below - Some smaller findings will be addressed through future enhancements - Some tasks remain, incl. documentation - Some budget also remains: - Looking at adding OAuth2 support (“device” flow) to Rebar3 - Planning publicity - Hoping to get it out before Thinking Elixir episode 300 ## Other updates from the CISO - Grant application: - Preparing full proposal - Reaching out to community to get signed petitions, for inclusion with the application: - One coming from core maintainers (Erlang, Elixir, Gleam) - One coming from the community - CNA: - Increased rate of CVE requests lately - Some using AI-based testing - At least for now no AI slop - One CVE for which we could not get a response from a maintainer ## GitHub Action hardening - See recent news coming out of other ecosystems - We should do some outreach to package maintainers - Michael is planning a blog post (after the hex.pm audit one) - EEF SecWG can write a post that references it, and ask Marketing to help spread the word ## Next meeting Wed 29 April 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [April 30, 2026, 10:18am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/38 "2026-04-30T10:18:08Z")
# April 29, 2026 Participants: @LeeB, @voltone, Peter Ullrich, @maennchen, @varnerac, @Alistair, George Madi, Dan Janowski, @ingela, Marc Nickert, @kiko, Michael Lubas ## CNA updates - Sharp increase in vulnerability reports across industry - Several FOSS projects now have access to Mythos - Some projects releases stats, e.g. [Mozilla (Firefox)](https://blog.mozilla.org/en/firefox/ai-security-zero-day-vulnerabilities/) - Uptick in CVE requests to EEF CNA - Many more than we anticipated when we started - Streamlining - Continue to raise awareness of dangerous patterns (prevention) - E.g. still findings around `list_to_atom/1` and `String.to_atom/1` - Improve process: lightweight, automated - Improve tooling: - Leverage AI in triage and CVE record preparation - Case management tool (could be vibe-coded) - Get library owners to prepare - CVE process would be quicker if library owners set up e.g. GH correctly for vulnerability notification - Scaling up - Need more people, not just for increased throughput but also for redundancy - Get funding - @Alistair points out there are initiatives that can fund work in this are - Need a clearly defined problem statement and action plan - Prioritization - Using up all our bandwidth for issue triage will derail efforts to scale up and streamline - May have to push back a bit on low severity findings, treat them as bugs - Coordinate with reporters - Improve communication to the community - Integrate vulnerability data into Hex - Not just web UI, also CLI - In touch with hex.pm, some work being done - May be able to apply EEF funding to allocate resources ## WG leadership - Do we need leadership election? - It has been 5 years - Not much enthusiasm ## Lee’s project updates - See Slack channel ## Next meeting Wed 27 May 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [May 29, 2026, 1:48pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451/39 "2026-05-29T13:48:34Z")
# May 27, 2026 Participants: @LeeB, @voltone, @maennchen, Peter Ullrich, Michael Lubas, George Madi, @varnerac, @Alistair, @halostatue, @danj, Duncan Sparell, @kiko ## Updates from the CISO - Alpha/Omega grant: - Documentation work (threat model, etc.) - [specifications/security at main · hexpm/specifications · GitHub](https://github.com/hexpm/specifications/tree/main/security) - hex\_core: - Working to move OAuth into hex\_core (from Elixir client) - So other Hex clients can use it too - [https://github.com/hexpm/hex\_core/pull/178](https://github.com/hexpm/hex_core/pull/178) - Other enhancements: - List advisories on package pull (done) - Policies, for enterprise customers (in progress) ## CNA updates - Big jump in CVEs, see graph heres: [https://cna.erlef.org](https://cna.erlef.org) - Many of them from Peter, running Claude (Opus 4.7) on top Hex packages: - Running file-by-file, not full library - No access to Mythos yet, but in contact with Alpha/Omega - Scaling up: - Full CNA members necessarily have full repo access - Adding Peter and Eric MJ - Bringing in help for individual cases: - For advisories created using GH security reporting: can invite additional users there - Jonatan was working on a way to coordinate with volunteers - Put on hold, as Apache appear to be working on this too; wait and see - New role: coordinator - Described here: [Coordinator Process | Erlang Ecosystem Foundation CNA](https://cna.erlef.org/coordinator-process) - Volunteer using workflow in EEF Slack #cna-public - Reaching out to package owners, to streamline process - Ask to enable private reporting on GH - Could ask hex.pm to reach out - First list all packages that have a GH link to a repo that doesn’t have private reporting yet - Projects not on GH are a challenge - More stats: numbers per CWE - [Common Weaknesses | Erlang Ecosystem Foundation CNA](https://cna.erlef.org/common-weaknesses) - Most common: DoS through Atom creation ([post](https://erlef.org/blog/eef/atom-exhaustion)) ## Next meeting Wed 24 June 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [July 23, 2026, 7:44am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/40 "2026-07-23T07:44:48Z")
# July 22, 2026 _Note_: the June meeting was cancelled Participants: Dan Janowski, @varnerac, George Madi, @maennchen, @voltone, Peter Ullrich, Marc Nickert, @Alistair ## Updates from the CISO - Increased CVE request rate: - See [chart](https://cna.erlef.org/) - Some OTP findings require more effort/time - Peter onboarded, also Eric on Hex - Looking tentatively at funding fixes - CNA scope: - Overlap with GitHub: they sometimes assign - Encourage to delegate to EEF CNA, for better CVE records - RabbitMQ currently going through GitHub - Some parts may not benefit very much from EEF CNA, other parts might - Discuss with RabitMQ - Rebar3 OAuth: - New hex\_core available that makes this possible - Eliminate Basic auth - Vulnerability reports in Hex CLI: - Now live - Ongoing work on policies (public and private) ## CVE management system - Existing solutions not a good fit - @maennchen created and demoed prototype - Different views: - Public view (no sign-in required) - Signed-in view, with form to submit finding - CNA member view, for CVE management - Non-CNA members can be invited to collaborate on a CVE - Automation options: - API - MCP - Need to think about backups, disaster recovery - Integration with GH advisories needs better APIs - Next steps: - Some fixes pending, security scans - Hosting on [fly.io](http://fly.io), for now ## Lightweight Phoenix container image - Observation by Marc: SBOM for a Phoenix app container image is very big - Created a “from scratch”, using build-root, busybox - Note: CVE management system (above) does something similar, using Nix - Suggestion: make it a build variant in Hex [Bob the builder](https://github.com/hexpm/bob) - Gather feedback, especially around NIFs - Contribute to Phoenix docs once it is proven ## Next meeting Wed 19 August 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST ---
**Author:** ![nzok](https://erlangforums.com/letter_avatar_proxy/v4/letter/n/4af34b/32.png) [@nzok](https://erlangforums.com/u/nzok)\ **Post date:** [July 26, 2026, 5:46am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/41 "2026-07-26T05:46:53Z")
I found [https://cna.erlef.org/cves/CVE-2026-54888.html](https://cna.erlef.org/cves/CVE-2026-54888.html) sadly amusing. So much for Rust safety… ---
**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\ **Post date:** [September 18, 2026, 7:14am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/42 "2026-09-18T07:14:26Z")
# August 19, 2026 _Note_: Apologies for the late writeup, and thanks for sharing your notes Dan! ## Community outreach - Lots of work remaining around vulnerability scanning - Need to secure future funding from sponsors and grants - Community outreach needed to show that sponsor/grant money is well spent - Upcoming conference talks not enough - Security talk proposals often rejected: organizers want talks that bring crowds - Even if accepted, limited audience - Talk recordings are useful, but might get better reach with dedicated content - Proposal: record short videos in the form of interviews or fireside chats - Use conferences for in-person talks, when possible - Dan volunteered to be a regular host - Probably need to produce a few of them before committing to a regular schedule - Marketing WG may be able to help ## Vulnerability scanning - Peter shifting from scanning top packages to scanning frameworks - Bunch of packages always used together - E.g. Nerves, Ash - More interesting findings, and strong engagement with community behind those frameworks ## Library stewardship - CNA sometimes finds package maintainers unresponsive to findings - Package users don’t know which packages can be trusted to address vulnerabilities - OSS maintenance is largely volunteers, often one person - See if we can help both the maintainers and the users - Help maintainers think about continuity, finding and vetting contributors - Help users identify packages with a solid plan - Initially focus on key packages in the ecosystem ## Next meeting Wed 16 September 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST [Previous page](https://erlangforums.com/t/security-working-group-minutes/3451.md?page=1) [Next page](https://erlangforums.com/t/security-working-group-minutes/3451.md?page=3)