BEAM There, Done That - The BEAM security wake-up call episode

AI just changed the threat model for our ecosystem - here’s what’s happening and what you should do

That’s a scary headline. Maximum fear! Great marketing. I bet it was written by AI.

Cui bono? Here comes the ‘security consultants’, regulators and foundations. For your safety.

For library maintainers specifically: Jonathan’s single recommendation is to enable private vulnerability reporting on GitHub (three clicks) and write a security policy. If Peter finds something in your library, this is how he reaches you privately before anything is public. Without it, disclosure gets significantly harder for everyone.

Good idea, I added a SECURITY.md and enabled private channel reporting on all my Elixir repos

Can you break this down? I haven’t yet watched the video.

Sorry I forgot to add the quote to my answer! I was referring to that low hanging fruit of just enabling private reporting on github.

Still correct. Did you listen to the episode?

In short Peter started using LLMs to find massive vulnerabilities in the most used libs in the Erlang ecosystem. He discusses how he found them and Jonatan talks about how we should respond, how you can protect yourself as a maintainer and user, and he also discusses how the EEF is at a breaking point and needs help with handling CVEs in the long term.

Self-serving FUD, ambulance chaser vibe. “Give to my charitable foundation” (which pays me)

Here’s an alternative:

• build a CVE tracking website (for the MVP: an afternoon’s work?)
• auto-send CVE alert to the project maintainer
• display aggregate stats for the public
• keep a leader board of CVE reporters

Payoff for the website author and CVE reporters: reputation

Payoff for the community: transparency

Where does the CVE come from though. Sure you can build a tracking platform, but what the foundation built is actually being able to have CVE issued for our ecosystem in the first place - one controlled by people understanding our ecosystem.

These are the people with more work on their hands than time to deal with it. You’re free to think their claims are FUD, but their trackrecord of securing funding, becoming a CVE Numbering Authority – creating not just a CVE tracking page but one validating, scoring and issuing CVEs – working with the standards bodies involved in all that, working through the raising number of CVEs, handling communciation with maintainers and reporters. All these are real accomplishments of the foundation in recent years. These are the people telling you they’re understaffed and/or underfunded. What they do is not an lazy afternoon job.

If you don’t trust them the problem is real, there’s other reports of the same problems like e.g. of the maintainer of curl:

To your individual suggestions:

• build a CVE tracking website (for the MVP: an afternoon’s work?)

We have something better: https://cna.erlef.org/. Not just a tracker, but an issuing body of CVEs.

• auto-send CVE alert to the project maintainer

The point is that maintainers should be informed before CVEs are made public, so fixes are available at the time the CVE becomes public. Reporting is just a part of the work we need to deal with.

• display aggregate stats for the public

This exists on https://cna.erlef.org/

• keep a leader board of CVE reporters

That doesn’t seem to exist, but I’m very sure Peter Ullrich is at the top currently. I’m also sure there would be ways to calculate the data based on the APIs you get of https://cna.erlef.org/. You could try to build it. The website is also open source on Erlang Ecosystem Foundation CNA · GitHub.

That makes it sound like there’s no transparency. The foundation has been talking at conferences, creating blog posts (like this one), is free for people to join and attend the meetings and all their financials are public. I’m not sure what else you’re expecting in terms of transparency.

TLDR: It’s fine to think this is less urgent than stated, but making is sound like what the people at the foundation do is to be challenged by some random afternoon coding session doesn’t match reality.

It’s fine to think this is less urgent than stated

I do believe the CVE problem is real. I just wonder why the heavy push towards a centralized organization with insider ‘experts’ that spread heavy FUD. Building a cadre of middle-manager / regulators should be an anti-goal. IMO the first impulse should be towards a lightweight/decentralized approach, which could be done readily.

I understand AI can be divisive but this is not an accurate summary of the episode and both the EEF and Jonatan have done a lot of positive work for the community, especially when it comes to security.

You can criticize the process and the structure but it is unfair to describe the work they have done as FUD or a way to get funds. Let’s please respect each other.

• You need to have a handful of people you can trust and are security experts to coordinate the whole process. The number of CVEs are going to increase in the short-medium term and the community will need assistance because it will be the first-time experience for many of us

• Most funds related to security will require an organization and those funds are important for projects like Hex Security Audit

• There is literally one person working on it today and yet it is being labelled as a cadre of middle-manager and bureaucracy

But most importantly, if you believe in a lightweight/decentralized approach, you can either:

• engage constructively with the current process to improve it

• or go ahead and build the solution you want to see: gather the funds (or don’t), perform security audits for important projects, establish your own CNA for Hex package owners, and reach out to maintainers

The only reason we have a podcast episode to listen to is because people are doing work for the community. So if we want to challenge them, we should put our work into it too.