voltone
The EEF’s Security WG has released the first public draft of the Secure Coding and Deployment Hardening Guidelines for BEAM languages.
“Secure coding practices can help reduce vulnerabilities in software projects by steering programmers away from dangerous functions or patterns, and towards more robust alternatives. Deployment hardening is the process of reducing the attack surface of a production environment, e.g. by removing unused components and revising unsafe configurations.”
We welcome feedback and suggestions through the group’s GitHub repo.
Where Next?
Trending in Guides/Tuts
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #elixirconf-eu
- #metaprogramming
- #hex
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 13 to 4- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
michalmuskala
Looks good, thanks!
voltone
Ah, that was not intentional, thanks for pointing it out. We just wanted to illustrate how the hardening flags need to be added to other flags the user might want to set. There is some more copy & paste weirdness going there.
How’s this: Do not recommend `-g` in CFLAGS by voltone · Pull Request #15 · erlef/security-wg · GitHub ?
michalmuskala
I noticed the Installing section suggests using
-gflag for compiling Erlang. I would imagine omitting debug symbols should generally increase security or be neutral, but definitely not increase it. What is the reasoning behind this recommendation?voltone
Announcement of the EEF Security Group’s Secure Coding and Deployment Hardening Guidelines at CodeBEAM SF 2020:
(That’s the full video, including the introductory 10 mins that were missing from a previous version)
This talk provides some background on where secure coding practices fit in a secure software development life cycle (SSDLC), and highlights some of the recommendations from the document.
Exadra37
Well, I don’t get the value of using
sslwhen it it ignores SSL ceriticates, does from my point of view it’s a security vulnerability, despite being documented that the module doesn’t do what it’s name implies it does.voltone
Unfortunately this has been the documented behaviour of
:ssl(and, by extension,:httpc) all along, so the OTP team does not consider this a vulnerability. It is important that everyone is aware of it, and I would highly recommend adding test cases to verify that connections fail when they should (e.g. using https://badssl.com) to any application that includes some sort of TLS client.The fact that a CA trust store is not included is no real excuse for not setting
{:verify, :verify_peer}. Ideally that would be the default, which would cause TLS clients to fail unless the caller passed in the:cacertfile/:cacertsoption or explicitly disabled verification with{:verify, :verify_none}.amnu3387
typo on the 2nd last paragraph
amaountsamnu3387
Haven’t read it all yet, but I think the idea of compiling these guidelines/hints is great.
LostKobrakai
I’m not sure this is the topic to discuss if unsafe defaults due to not shipping certificates with erlang is a security vulnerability or not.
Exadra37
I am still surprised that a CVE was not open by the author of that talks due to the
:httpcmodule dangerous defaults of ignoringhttpscertificates. We need to explicitly tell to check for them.If I am not in mistake this vulnerability is not fixed yet, or is it?