Elixir Mentor

Peter Ullrich returns to talk about a CVE hunt across the most-downloaded Hex packages, run with Claude Code on Opus 4.7. After ElixirConf EU pulled him into AI security, he started pointing Opus at popular libraries day and night, and within half an hour of his first serious attempt he found the Decimal vulnerability, where raising 10 to a huge power can blow up an application's memory.We get into what separates a real CVE from noise, how CVSS scoring works, and why reachability matters so much, since a flaw in Phoenix's default configuration is far more serious than a crash in a function nobody can call. Peter also walks through the process he runs with the EEF: verifying each issue, getting a second pair of eyes, coordinating a fix, and getting a number issued through a CNA, all while avoiding slop reports to maintainers. There's also a candid stretch on regulation and breach reporting.From there it widens out, including how Opus compares to Mythos, why Peter keeps coming back to Claude, his first impressions of Opus 4.8, and the economics, with a simple scan costing about $10 in API tokens. He also shares his Session Watcher plugin, an update on Killswitch and its browser-side encryption, thoughts on AEO, and how he uses dev containers to sandbox coding agents.Resources Mentioned:- The blog post that started this:https://peterullrich.com/what-the-cve- Peter's prompts:gist- Scrutineer:github.com/alpha-omega-security/scrutineer- Decimal advisory:GHSA-rhv4-8758-jx7v- EEF CNA published CVEs:cna.erlef.org/cves- EEF CNA security policy:cna.erlef.org/security-policy- Responsible disclosure guidelines:security.erlef.org- Anthropic article (the basis):red.anthropic.comConnect with Peter:- Website:peterullrich.com- GitHub:github.com/pjullrich- LinkedIn:linkedin.com/in/pjullrich- Bluesky:@peterullrich.comThanks to our sponsors:- BEAMOps:beamops.co.uk- Paraxial.io:paraxial.ioSUPPORT ELIXIR MENTOR- Elixir Mentor:elixirmentor.com

Michael Lubas, CEO of Paraxial.io, returns to the Elixir Mentor Podcast to talk about AI's dual role in cybersecurity: finding the vulnerabilities and writing the code that creates them. Michael was my first-ever guest, and a lot has changed since his last appearance — most of it driven by the inflection point of the past six months.We open with the Hex package manager penetration test that Paraxial conducted as part of the Aegis initiative under the Erlang Ecosystem Foundation, funded through Alpha Omega and its donors. Michael caught a remote code execution vulnerability before it shipped, and the public report gives Elixir a strong story to tell about the security of its package ecosystem. From there we get into GitHub Actions supply chain attacks, why zizmor is the tool every maintainer should be running, and the recent campaigns where malicious code targets release pipelines rather than application source.The conversation turns to the AI inflection point. The Erlang Ecosystem Foundation's CNA issued nine CVEs in all of 2025 and is on track for well over a hundred in 2026, driven by researchers like Peter Ullrich using AI to find vulnerabilities that already existed in source code. Firefox went from an average of 20 valid bug reports a month to over 400 in April 2026. Michael argues that Anthropic and OpenAI have been responsible stewards of these capabilities, and that defenders without access to state-of-the-art models are at a structural disadvantage. We also talk about why bug bounty programs are collapsing under AI-generated noise — something I experienced firsthand running Killswitch's program earlier this year.In the second half we get practical. Michael walks through what a real penetration test costs, when Claude Code is actually useful for solo developers, and the common Elixir-specific gotchas: binary term deserialization, server-side request forgery, dynamic atom creation, and the importance of staying inside Ecto's default query syntax. We also touch on Erik Stenman's BEAM Book, the difference between Paraxial and Sobelow, and what SOC 2 compliance does and does not cover.Resources Mentioned:- Securing Hex, the Backbone of the Elixir Ecosystem (Paraxial blog): https://paraxial.io/blog/hex-pentest- Hex Package Manager security audit report: https://hex.pm/reports/2026/paraxial.pdf- Erlang Ecosystem Foundation CNA: https://cna.erlef.org/- Behind the Scenes Hardening Firefox with Claude (Mozilla Hacks): https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/- Project Glasswing (Anthropic): https://www.anthropic.com/project/glasswing- The First CVE Wave (VulnCheck): https://www.vulncheck.com/blog/ai-assisted-vulnerability-discovery- Third major Linux kernel flaw in two weeks found by AI (ZDNet): https://www.zdnet.com/article/third-major-linux-kernel-flaw-in-two-weeks-found-by-ai/- What the CVE? — Peter Ullrich: https://peterullrich.com/what-the-cve- Nicholas Carlini, "Black Hat LLMs" (unprompted 2026): https://www.youtube.com/watch?v=1sd26pWhfmgConnect with Michael:- Website: https://paraxial.io- X/Twitter: https://x.com/paraxialio- LinkedIn: https://www.linkedin.com/in/michaellubas/- GitHub: https://github.com/paraxialioSponsors:- BEAMOps: https://beamops.co.uk- Paraxial.io: https://paraxial.io- Jido — Elixir AI Collective Discord: https://agentjido.xyz/discord- Support Elixir Mentor: https://elixirmentor.com

In this episode of the Elixir Mentor Podcast, I chat with Jamil Bou Kheir, founder of Firezone, a YC-backed open-source zero-trust access platform. Jamil shares his journey from eight years as a Cisco security engineer to building an enterprise VPN replacement using Elixir and Rust.We explore how Firezone started as a simple WireGuard configuration tool that hit the front page of Hacker News, then evolved into a full zero-trust platform. Jamil explains the architecture decisions behind using Elixir for the control plane and Rust for the data plane, including their custom ICE implementation called Snownet for NAT traversal. The conversation covers practical insights on Phoenix PubSub for real-time signaling, Postgres WAL streaming for change data capture, and running a global Erlang cluster.Jamil also shares candid advice from the Y Combinator experience, discussing funding, product-market fit, and the challenges of rebuilding a product architecture mid-startup. We dive into the realities of open source licensing, security through transparency, and SOC 2 compliance. The episode touches on AI in development workflows, managing large refactors, and marketing strategies for technical founders.Whether you're interested in networking protocols, building with Elixir at scale, or the startup journey from side project to funded company, this conversation offers valuable perspective from someone doing it in production.Resources Mentioned:- Firezone: https://www.firezone.dev- WireGuard: https://www.wireguard.com- Github: https://github.com/firezone/firezoneConnect with Jamil:- Website: https://www.firezone.dev- X/Twitter: https://x.com/jamilbk- LinkedIn: https://www.linkedin.com/in/jamilbk/- GitHub: https://github.com/jamilbkSponsors:- Paraxial.io: https://paraxial.io- Jido: https://agentjido.xyz/discordSUPPORT ELIXIR MENTOR- Elixir Mentor: https://elixirmentor.com

In this episode of the Elixir Mentor Podcast, I chat with Mike Ratliff, a 30-year tech veteran and CTO currently building an energy tech startup. Mike shares his path from Ruby threading nightmares to leading 20-engineer Elixir teams, and how discovering the BEAM transformed his approach to building 24/7 grid systems.We dig into the technical challenges of power grid software, including distributed energy resource management, solar intermittency, and why utilities remain cautious about new technology. Mike explains how his current startup is tackling transmission interconnection problems using Elixir, and his plans to incorporate AI agents through the Jido framework.The conversation shifts to how AI is reshaping development teams and startup economics. Mike makes a compelling case for small, elite teams over large engineering organizations, sharing his philosophy on profit per headcount and why he believes we'll see one-person unicorn companies emerge. We discuss rethinking technical interviews for the LLM era, the Ash framework in production, and why great engineers become even greater with AI tools.Mike wraps up with hard-won startup wisdom: build painkillers not vitamins, learn to tell stories that move people, and understand that nobody buys on facts alone. Whether you're building energy infrastructure or SaaS products, this conversation offers practical perspective on scaling with small teams.Connect with Mike:- LinkedIn: https://www.linkedin.com/in/mike-ratliff-3096571/Sponsors:- Paraxial.io: https://paraxial.io- Jido Discord: https://agentjido.xyz/discordSUPPORT ELIXIR MENTOR- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

Mikh Ahmed joins me to talk about SWARMMO, a massively multiplayer online browser game he's building entirely with Elixir and Godot. After experiencing burnout from AWS Lambda and serverless tooling at a Canadian fintech startup, Mikh discovered Elixir and realized it was exactly what he'd been looking for to build his dream game project.We explore how the BEAM's actor model maps perfectly to game architecture, with individual player processes, hierarchical AI units that form squads and platoons, and a simulation where NPCs actively compete for territory. Mikh shares his experience going from zero Elixir knowledge to building a game server that can handle a thousand concurrent AI units while using only 4GB of RAM and 50% CPU.The conversation covers the realities of indie game development: failed crowdfunding campaigns that led to private support, the challenge of marketing when you'd rather be coding, and plans for a Steam release and version 1.0 launch. We also discuss the potential for LLM-powered NPC personalities, why minimal dependencies matter, and how game design psychology from board games applies to digital experiences.Connect with Mikh:- X: https://x.com/SWARMMOOFFICIAL- SWARMMO: https://swarmmo.games/?lang=enSUPPORT ELIXIR MENTOR- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

In this episode of the Elixir Mentor Podcast, I chat with Isaak Tsalicoglou, author of Elixir Software Engineering. Isaak shares hard-won lessons from building production Elixir API clients, covering validation strategies, error handling approaches, authentication flows, and architectural patterns that actually work in the real world.We explore Isaak's journey back into programming through building internal tools for his family's industrial equipment business, and how that led to writing a comprehensive guide on REST API client development. He explains his approach to request validation, why he ultimately decided against using Ecto schemas for API responses, and the importance of resisting unnecessary complexity in software architecture.The conversation covers practical API design topics including how to structure clean RESTful routes, avoiding tight coupling between APIs and UIs, and finding the right balance between over-serving and under-serving data. Isaak also shares his thoughts on LLM-assisted development, explaining why he prefers using AI as a code reviewer rather than fully automated coding, and discusses his self-hosting infrastructure setup for privacy-conscious applications.This episode offers valuable insights for anyone building API clients in Elixir or thinking critically about software architecture decisions and their long-term implications.Resources Mentioned:- Elixir Software Engineering: https://leanpub.com/elixir-software-engineeringConnect with Isaak:- X: https://x.com/realMrLaminar- LinkTree: https://linktr.ee/tisaakxSUPPORT ELIXIR MENTOR- Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor

In this episode, I chat with Alex Koutmos, author of Elixir Patterns and creator of numerous open source libraries, about building EagleMMS—a SaaS platform helping collision repair shops accurately calculate consumable costs for vehicle repairs. Alex shares his journey from two failed startups to building a profitable business with nearly a thousand customers.We discuss the outdated methods insurance companies use to calculate repair costs, the brutal reality of door-to-door sales, and how Alex's brother (a licensed auto body technician and appraiser) became his co-founder and sales partner. Alex explains why customer support load is heavier than expected when dealing with insurance company pushback and how they coach shops through negotiations.On the technical side, Alex walks through his evolution from a Vue SPA to a full LiveView application, building PWAs that work seamlessly on mobile, and why Elixir has never been a bottleneck for his business needs. We cover ETS caching strategies for performance, database backup lessons learned the hard way, and why he refuses to do standups. Alex also previews his upcoming books on financial analytics with Explorer and Scholar, plus a Nerves book entering beta soon.Connect with Alex:- X: https://x.com/akoutmos- Books: https://akoutmos.com/top/books/- EagleMMS: https://eaglemms.com/SUPPORT ELIXIR MENTOR- Elixir Mentor: https://elixirmentor.com

In this episode of the Elixir Mentor Podcast, I sit down with Daniil Popov to discuss CyanView, a system that brings Phoenix LiveView to embedded devices for professional video production. We examine the challenges of creating unified camera control systems that work across 27+ different protocols from manufacturers like Sony, Canon, and RED.Daniil shares how CyanView enables real-time camera shading for major broadcast events including the Olympics, Super Bowl, and Le Mans races. We discuss the technical implementation of LiveView on resource-constrained 32-bit ARM processors, managing distributed systems with MQTT, and solving complex problems like socket reconnection and performance optimization on embedded devices.Our conversation covers the unique advantages of using Elixir for embedded systems, from binary pattern matching for protocol reverse engineering to supervision trees for fault tolerance. Daniil explains how they utilize nearly 80% of Elixir's capabilities—far more than typical web applications—including NIFs for C integration, custom FPGA modules for color correction, and practical approaches to creating responsive interfaces on limited hardware.The episode wraps up with discussion of the future of camera control technology, the challenges of working with proprietary protocols, and why Elixir's actor model and distributed computing capabilities make it uniquely suited for this complex problem space. Whether you're interested in embedded systems, LiveView applications, or the intersection of hardware and software, this conversation offers valuable perspectives on pushing Elixir beyond traditional web development.Resources Mentioned:- CyanView:https://cyanview.com/- Phoenix LiveView Documentation- MQTT Protocol and Mosquitto- Burrito and Tauri for Binary CompilationConnect with Daniil:- X/Twitter:https://x.com/mrpopov_comSUPPORT ELIXIR MENTOR- Elixir Mentor:https://elixirmentor.com/?utm_source=elixir-mentor