Security Working Group Minutes

Erlang Ecosystem Foundation EEF Security
43

September 16, 2026

Participants: @kiko, @Alistair, @halostatue, @maennchen, Chris Hildebrand, Peter Ullrich, George Madi, @georgeguimaraes, Paul Swartz, Dan Janowski, @voltone

Updates from the CNA

  • New CNA software:
    • Makes job of managing CVEs easier
    • Lot of active use (1k req/hour), bots but also users looking up CVEs
    • Has already helped expedite OTP CVEs
    • Selective delegation to core teams (Ash)
    • Working on improving GHSA integrations
  • Stats (https://cna.erlef.org/):
    • 179 so far this quarter
    • Still rate-limiting findings from Peter, to not overload the process
    • New models find a bit more, but not a lot
      • Focussing on scanning more packages, not rescanning previous ones with a new model
    • Maybe in a year we’ll get to a state where we don’t produce more than we can process
    • Nice view: findings by CWE
  • Hex integration
    • Button to report vulnerability
    • Invite using hex handle (looks up email)
  • SID (Software ID) purl for things that are not in package repo
  • Compared to other CNAs (CNA Analysis - CVE.ICU):
    • EEF was #24 (of 376) over the last year

Syscalls to avoid path traversal vulnerabilities

  • Expose syscalls openat etc.
    • Needs to be in OTP

Community outreach

  • Some conferences coming up
    • Opportunity to record videos
  • Peter working on a blog post on Ash

hex.pm

  • Some work in progress:
    • SSO for orgs
    • Trusted publishing

Silica update

Next meeting

Wed 14 October 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST

1 Like
44

October 14, 2026

Participants: Dan Janowski, @maennchen, @Alistair, @voltone, @halostatue, @varnerac, George Madi, @georgeguimaraes, @kiko, Marc Nickert

Q3 Report

Update on tooling and agents

  • Tools:
    • SARIF reporting coming soon to Hex
    • Dependabot issues:
      • Open PRs with little progress for Elixir & co
      • Internal vuln DB rather than OSV; lagging behind
    • Argus GitHub - QuinnWilton/argus · GitHub
      • Datalog queries to find issues
      • Goatmire Elixir talk
  • AI:
    • Joined Anthropic cyber verification, using Mythos (defensive)

Linux Foundation Open Source Summit (Prague)

  • Jonatan and Alistair attended
  • CRA interest picking up
  • Alpha&Omega event:
    • About 20 language communitie
    • Some are struggling; we’re coping well, thanks to our CNA

“Bernies”

  • Unmaintained projects
  • Alpha&Omega are wondering how ecosystems deal with this
    • For us, being discussed in Libraries & Frameworks
    • Need to involve Hex team

Any other business

  • New file APIs (see last month):
    • PoC by Jonatan
    • Need OTP team feedback (code is here)

Next meeting

Wed 11 November 2026 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 0:00 JST (so effectively Thu)

Beware of DST switch; nothing changes if your timezone switches from DST to standard time in the next four weeks

Also note that next month’s meeting will use a different Zoom link; it will be shared in Slack one hour before the meeting starts, as usual

1 Like