randysecrist
Quick question …
I’m working to bring elixir into a enterprise level environment and one of the requirements is to check hex dependencies over time for security vulnerabilities etc. What (if any) tools are people in the elixir community using to cover this space?
Thanks!
– Randy
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #phoenix_html
- #elixirconf-us
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Bringing learning, work and compliance together since 1987.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 8- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
cpgo
I think you are looking for GitHub - nccgroup/sobelow: Security-focused static analysis for the Phoenix Framework · GitHub
gregvaughn
Does
mix hex.auditmeet those needs?randysecrist
Thanks all; I didn’t know about either of those. Will take a look.
voltone
I run a Dependency Track server, and every build automatically uploads a bill-of-materials of all Hex and NPM packages to the server. I also track OS packages for the deployment VMs in the same server. New vulnerabilities (from NVD, NPM, OSS Index) across all projects and ecosystems trigger Slack notifications. The dashboard lets me track the overall status of projects over time, audit vulnerabilities, check license usage, etc.
I wrote a blog post about it here.
voltone
The
hex.audittask is useful, but not enough: it requires that the package maintainer acknowledges and fixes the reported vulnerability, and retires the affected package versions. If this doesn’t happen, the only alternative may be to switch to another package or accept the risk.Right now my DependencyTrack server tells me that I’m affected by CVE-2019-15160, which has been an open issue in SweetXml for almost a year. Since no package has been retired,
hex.auditwould not make me aware of the issue, and I wouldn’t know to audit it.quatermain
Check this DependaBot. It was acquired by GitHub. We use it and it works very well.
voltone
There is now another (commercial, but free to start) option: Secure Elixir development with Snyk | Snyk
I’ve tried their beta, it had a few issues with more complex projects, but they’ve been quite responsive about addressing those early hiccups. You can run a scan locally and get the results displayed in the terminal, or you can submit your dependency list to their server so you’ll get notifications for new vulnerabilities. Nice thing is that it works regardless of where your code resides, which I imagine would be useful in enterprise environments…
realcorvus
Paraxial.io now supports tracking vulnerabilities in dependencies over time, here’s the announcement blog post - https://paraxial.io/blog/vuln-scan
There’s a 30 day free trial, no credit card required. If you have any questions you can DM me on here as well.