I see the reasoning, but I think Plug should be considered to be more like a Pipeline, literally like lots of |> to transform the requests at each step until eventually returning, and it is indeed done in it’s own process, so it still seems conceptually similar?
OvermindDL1
cmkarlsson
I had to look into what sort of encryption was mentioned.
Your example has Cipher.encrypt and Cipher.decrypt but following this it is just plain AES-CBC-128 without any authentication. This means is open to padding-oracle attack, which are fast and straight-forward to implement.
The article even states:
Cipher is a popular library for Elixir, based on Erlang’s crypto module. It makes it easy to encrypt and decrypt data
It may be popular and it may be easy to use but the way the have documented usage is not secure in its current form. At least they add a MAC of some sort (and do a constant time comparison when checking the mac) or use and authenticated cipher like AES-GCM.
This feels too loose for me. It doesn’t feel like he understands crypto and there is too much indirection to other posts here. Which also doesn’t make it superclear what they are doing. It is very light on details. It may be that he understands all of it but he clearly doesn’t communicate it well.
Keyless encryption. What they are doing is deriving the encryption key from user data. It doesn’t discuss what key derivation algorithms they use or what sort of crypto protocol to actually protect the data.
Pubkey encryption. Is never used to protect “data” as such. It is way to slow for that. Instead it is used in hybrid-crypto protocols or just to exchange symmetric keys with each others. It is sort of mentioned in the section but pub key encryption is there to be able to exchange keys without giving away the secret key - not to encrypt data.
Plain old encryption. Well, this is symmetric crypto, which is the only way to do bulk encryption and it is used virtually every crypto protocol. But he is too light on the details, such as how to securely exchange keys (if needed), what algorithms to use or not and doesn’t mention any authentication. I don’t even know what “plain old encryption” means.
Crowdhailer
Creator of Raxx
My biggest problem with plug is the places were you can’t consider it as a transformation of a request.
Reading the body is an impure action and is unreliable if done multiple times. I had a real world issue were we were using message signing to authenticate requests. Our authenticate plug read the body, (needed to check the signature) then the Parser plug was broken because it tried to read the body (direct from the socket) again. We had to we write the parser. hardly a good example of compose-able.
If the request(conn) was just a data structure the model would be fine, but that is not the case
svilen
Author of Concurrent Data Processing in Elixir
Thanks for spotting this! I noticed you opened an issue on GitHub as well — let’s take the discussion there.
For anyone interested: Add authentication to your encrypt/decrypt operations. · Issue #18 · rubencaro/cipher · GitHub
PragTob
Benchee, a slow query, ecto, Postgres, explain analyze, a gripping story!
http://engineering.liefery.com/2018/02/27/the-mysterious-query.html
11
OvermindDL1
CptnKirk
PragTob
We’re using pryin but there are multiple ones. Appsignal is there and also looks nice, it crashed our app once in the early days but they fixed it. The Adopting Elixir book also mentions wombatoam and scout. There’s also a skylight agent but work on that seems to sadly have somewhat frozen.
@OvermindDL1 
thanks 