I understand AI can be divisive but this is not an accurate summary of the episode and both the EEF and Jonatan have done a lot of positive work for the community, especially when it comes to security.

You can criticize the process and the structure but it is unfair to describe the work they have done as FUD or a way to get funds. Let’s please respect each other.

• You need to have a handful of people you can trust and are security experts to coordinate the whole process. The number of CVEs are going to increase in the short-medium term and the community will need assistance because it will be the first-time experience for many of us

• Most funds related to security will require an organization and those funds are important for projects like Hex Security Audit

• There is literally one person working on it today and yet it is being labelled as a cadre of middle-manager and bureaucracy

But most importantly, if you believe in a lightweight/decentralized approach, you can either:

• engage constructively with the current process to improve it

• or go ahead and build the solution you want to see: gather the funds (or don’t), perform security audits for important projects, establish your own CNA for Hex package owners, and reach out to maintainers

The only reason we have a podcast episode to listen to is because people are doing work for the community. So if we want to challenge them, we should put our work into it too.

Just wanted to drop in and say that I am extremely impressed with the work that the EEF security folks are doing, especially given spike in workload due to these new AI scanning tools. Bravo team! Recently I was talking to maintainers of the GitHub Advisory Database, and unprompted they brought up the EEF team and praised them, so it’s not just me that’s noticing.

I don’t agree with the evaluation that they’re taken a heavyweight approach in any particular way. My experience having worked on several CVEs with them is that it’s very lightweight and substantially easier than doing it alone.

I do hope more BEAM companies step forward to support the security team. Their work is invaluable and saves us all a great deal of money and risk.

Where does the CVE come from though. Sure you can build a tracking platform, but what the foundation built is actually being able to have CVE issued for our ecosystem in the first place - one controlled by people understanding our ecosystem.

These are the people with more work on their hands than time to deal with it. You’re free to think their claims are FUD, but their trackrecord of securing funding, becoming a CVE Numbering Authority – creating not just a CVE tracking page but one validating, scoring and issuing CVEs – working with the standards bodies involved in all that, working through the raising number of CVEs, handling communciation with maintainers and reporters. All these are real accomplishments of the foundation in recent years. These are the people telling you they’re understaffed and/or underfunded. What they do is not an lazy afternoon job.

If you don’t trust them the problem is real, there’s other reports of the same problems like e.g. of the maintainer of curl:

To your individual suggestions:

• build a CVE tracking website (for the MVP: an afternoon’s work?)

We have something better: https://cna.erlef.org/. Not just a tracker, but an issuing body of CVEs.

• auto-send CVE alert to the project maintainer

The point is that maintainers should be informed before CVEs are made public, so fixes are available at the time the CVE becomes public. Reporting is just a part of the work we need to deal with.

• display aggregate stats for the public

This exists on https://cna.erlef.org/

• keep a leader board of CVE reporters

That doesn’t seem to exist, but I’m very sure Peter Ullrich is at the top currently. I’m also sure there would be ways to calculate the data based on the APIs you get of https://cna.erlef.org/. You could try to build it. The website is also open source on Erlang Ecosystem Foundation CNA · GitHub.

That makes it sound like there’s no transparency. The foundation has been talking at conferences, creating blog posts (like this one), is free for people to join and attend the meetings and all their financials are public. I’m not sure what else you’re expecting in terms of transparency.

TLDR: It’s fine to think this is less urgent than stated, but making is sound like what the people at the foundation do is to be challenged by some random afternoon coding session doesn’t match reality.