Secure Coding and Deployment Hardening Guidelines

Congrats on what seems to be an excellent work, just by the quick lookup I made

Fantastic!! The community never ceases to amaze me! Congrats to everyone who had played a role in this!

I found this to be a good primer on secure ssl/httpc usage:

Maybe this would be a good resource to link to?

I am still surprised that a CVE was not open by the author of that talks due to the :httpc module dangerous defaults of ignoring https certificates. We need to explicitly tell to check for them.

If I am not in mistake this vulnerability is not fixed yet, or is it?

I’m not sure this is the topic to discuss if unsafe defaults due to not shipping certificates with erlang is a security vulnerability or not.

Haven’t read it all yet, but I think the idea of compiling these guidelines/hints is great.

typo on the 2nd last paragraph amaounts

Unfortunately this has been the documented behaviour of :ssl (and, by extension, :httpc) all along, so the OTP team does not consider this a vulnerability. It is important that everyone is aware of it, and I would highly recommend adding test cases to verify that connections fail when they should (e.g. using https://badssl.com) to any application that includes some sort of TLS client.

The fact that a CA trust store is not included is no real excuse for not setting {:verify, :verify_peer}. Ideally that would be the default, which would cause TLS clients to fail unless the caller passed in the :cacertfile/:cacerts option or explicitly disabled verification with {:verify, :verify_none}.

Well, I don’t get the value of using ssl when it it ignores SSL ceriticates, does from my point of view it’s a security vulnerability, despite being documented that the module doesn’t do what it’s name implies it does.

Announcement of the EEF Security Group’s Secure Coding and Deployment Hardening Guidelines at CodeBEAM SF 2020:

(That’s the full video, including the introductory 10 mins that were missing from a previous version)

This talk provides some background on where secure coding practices fit in a secure software development life cycle (SSDLC), and highlights some of the recommendations from the document.