ericmj
Hex.pm is adding private packages and organizations
We are announcing the addition of private packages on Hex.pm. With private packages you can publish packages to Hex.pm that only your organization members can access and download. With your organization you get a repository namespace on Hex.pm so that your private packages will not conflict with packages in the global, public repository. Go check out the documentation Private packages | Hex to learn exactly how it works and go the sign up form https://hex.pm/dashboard/signup to request access to the beta.
Link to full announcement: Private packages and organizations | Hex
First Post!
AstonJ
Most Liked
ericmj
Thanks, it has been fixed now.
Yes, that’s what we are working on right now. Hexdocs requires more work since it needs to change from static file hosting to a server with authentication and needs subdomain isolation between organizations so that cookies cannot be stolen or XSS attacks performed.
ericmj
Hi @zazaian!
This is a very broad question so I will give a general description of some of our infrastructure, how we authenticate access, and store private information. Some if this applies in general to all of hex.pm and some of it is specific to private packages.
All communication to the hex.pm API and repository happens over HTTPS. When a user authenticates a new machine with mix hex.user auth we generate three keys:
- A repository key used to authenticate against the repository when fetching private packages
- An API key for performing read-only actions on the API
- An API key encrypted with your passphrase for performing write actions on the API (for example publishing a new package)
All keys use HMAC, which means we never store your user secret.
Packages are stored on a private Amazon S3 bucket and we use Fastly as CDN to access the bucket. Based on the URL of the request to the repository we determine if the package requires authenticated access, if it does the CDN edge node makes a “preflight request” to the hex.pm API to verify the repository key against our database. Only if it succeeds do we continue with the request to the S3 bucket.
Our API servers run on Google Cloud servers and our database uses Google Cloud SQL with at rest encryption.
As I said this is a broad question so if you can elaborate on your security needs or if you have more specific questions you will probably get better answers. If you have any questions you cannot share in public please contact us on support@hex.pm.
All the code around organizations and private packages is open source so if you want to review the security the best thing may be to look at the sources themselves: GitHub - hexpm/hexpm: API server and website for Hex · GitHub.
josevalim
This is unwelcoming and unfair for both the work being put on Hex and to @ryanwinchester which is completely within his rights to sell software.
Last Post!
zazaian
Thanks @ericmj for the prompt and thorough response. I had only briefly reviewed the hex codebase and while I had seen the Fastly CDN and various mirrors, I wasn’t aware of the multi-key authentication process. It’s extremely helpful to have this high-ish level overview of auth and data flow into and out of Hex.pm. I do have some addiitonal questions about controls for wiping data and packages that have been published to organizations, but I’ll forward these to the support@hex.pm. Thanks again for your support here and all of your great contributions to the Elixir community.
Popular in News
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
Build Elixir applications with speed and confidence.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"