173: Web App Security Best Practices and Sobelow

We delve into the tricky world of cybersecurity with our guest, Michael Lubas. We touch on the widely-discussed 23andMe data breach, discussing what went wrong and how it applies to Elixir apps. A significant part of our talk is centered around the informative guide by the EEF Security Working Group called “Web Application Security Best Practices for BEAM languages.” An essential tool featured in our discussion is Sobelow, a security-focused static code analysis tool invaluable in warding off potential security breaches. We wrap up the conversation by discussing the practical application of these tools, using Paraxial.io's vulnerable-by-design “Potion Shop” app as a case study to run Sobelow and practice fixing issues. Join us for an enlightening discussion packed full of important insights!
Show Notes online - http://podcast.thinkingelixir.com/173 (http://podcast.thinkingelixir.com/173)
Elixir Community News
- https://github.com/phoenixframework/phoenixliveview/pull/2845 (https://github.com/phoenixframework/phoenix_live_view/pull/2845?utm_source=thinkingelixir&utm_medium=shownotes) – Information on the upcoming LiveView that speeds up client DOM patching 5x.
- https://twitter.com/chris_mccord/status/1709681327019086044 (https://twitter.com/chris_mccord/status/1709681327019086044?utm_source=thinkingelixir&utm_medium=shownotes) – The post to further explain the upcoming LiveView.
- https://twitter.com/josevalim/status/1709841186972705033 (https://twitter.com/josevalim/status/1709841186972705033?utm_source=thinkingelixir&utm_medium=shownotes) – José Valim's clarification on how LiveView's 5x DOM patching works.
- https://twitter.com/wojtekmach/status/1709675064944144605 (https://twitter.com/wojtekmach/status/1709675064944144605?utm_source=thinkingelixir&utm_medium=shownotes) – Teaser about a cool new Req feature by Wojtek Mach.
- https://twitter.com/wojtekmach/status/1710053454217887970 (https://twitter.com/wojtekmach/status/1710053454217887970?utm_source=thinkingelixir&utm_medium=shownotes) – Release note for Req v0.3.12 and v0.4.4 and encouragement to upgrade.
- https://twitter.com/Tangui/status/1709645048906748378 (https://twitter.com/Tangui/status/1709645048906748378?utm_source=thinkingelixir&utm_medium=shownotes) – Announcement of a new HTTP Caching library called httpcache.
- http://svground.fr/blog/posts/introducing-http-cache/ (http://svground.fr/blog/posts/introducing-http-cache/?utm_source=thinkingelixir&utm_medium=shownotes) – Blog post that accompanies the release of the new HTTP Caching library.
- https://github.com/tanguilp/plughttpcache (https://github.com/tanguilp/plug_http_cache?utm_source=thinkingelixir&utm_medium=shownotes) – plughttpcache - An Elixir plug that caches HTTP responses.
- https://github.com/tanguilp/teslahttpcache (https://github.com/tanguilp/tesla_http_cache?utm_source=thinkingelixir&utm_medium=shownotes) – teslahttpcache - HTTP caching Tesla middleware.
- https://news.livebook.dev/remote-execution-smart-cell---launch-week-2---day-1-m3dv2 (https://news.livebook.dev/remote-execution-smart-cell---launch-week-2---day-1-m3dv2?utm_source=thinkingelixir&utm_medium=shownotes) – Post about Day 1 of Livebook's launch week with information on the new feature.
- https://twitter.com/thmsmlr/status/1709309268183367901 (https://twitter.com/thmsmlr/status/1709309268183367901?utm_source=thinkingelixir&utm_medium=shownotes) – Announcement of Livebook Copilot by Thomas Millar.
- https://github.com/thmsmlr/kino_copilot (https://github.com/thmsmlr/kino_copilot?utm_source=thinkingelixir&utm_medium=shownotes) – kinocopilot - Livebook SmartCell that refactors code, generates SQL for data analysis, writes documentation, and generates dashboards.
- https://twitter.com/hugobarauna/status/1709631824555573554 (https://twitter.com/hugobarauna/status/1709631824555573554?utm_source=thinkingelixir&utm_medium=shownotes) – Demonstration of Livebook voice transcription by Hugo Baraúna.
- https://github.com/brainlid/langchain_demo (https://github.com/brainlid/langchain_demo?utm_source=thinkingelixir&utm_medium=shownotes) – LangChain Demo project that includes an example of an Agent.
- https://fly.io/phoenix-files/created-my-personal-ai-fitness-trainer-in-2-days/ (https://fly.io/phoenix-files/created-my-personal-ai-fitness-trainer-in-2-days/?utm_source=thinkingelixir&utm_medium=shownotes) – Blog post - Created my Personal AI Fitness Trainer in 2 Days
- https://www.youtube.com/watch?v=AsfQNtoaB1M (https://www.youtube.com/watch?v=AsfQNtoaB1M?utm_source=thinkingelixir&utm_medium=shownotes) – YouTube video overview for AI Personal Fitness Trainer with demo
- https://spawnfest.org/ (https://spawnfest.org/?utm_source=thinkingelixir&utm_medium=shownotes) – Information on SpawnFest, a 48-hour online software development contest.
- https://codebeameurope.com/ (https://codebeameurope.com/?utm_source=thinkingelixir&utm_medium=shownotes) – Information on CodeBEAM Europe event.
Do you have some Elixir news to share? Tell us at @ThinkingElixir (https://twitter.com/ThinkingElixir) or email at show@thinkingelixir.com (mailto:show@thinkingelixir.com)
Discussion Resources
- https://www.wired.com/story/23andme-credential-stuffing-data-stolen/ (https://www.wired.com/story/23andme-credential-stuffing-data-stolen/?utm_source=thinkingelixir&utm_medium=shownotes) – 23andMe breach
- https://erlef.github.io/security-wg/webappsecuritybestpractices_beam/ (https://erlef.github.io/security-wg/web_app_security_best_practices_beam/?utm_source=thinkingelixir&utm_medium=shownotes) – Web Application Security Best Practices for BEAM languages - a guide from the EEF Security Working Group
- https://paraxial.io/blog/real-sobelow (https://paraxial.io/blog/real-sobelow?utm_source=thinkingelixir&utm_medium=shownotes) – Elixir Security - Real World Sobelow
- https://podcast.thinkingelixir.com/148 (https://podcast.thinkingelixir.com/148?utm_source=thinkingelixir&utm_medium=shownotes) – Security Scanning our Apps with Sobelow
- https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement (https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement?utm_source=thinkingelixir&utm_medium=shownotes) – Why use Sobelow? The Equifax breach, $425 million penalty, was a remote code execution (RCE) vulnerability
- https://paraxial.io/blog/elixir-rce (https://paraxial.io/blog/elixir-rce?utm_source=thinkingelixir&utm_medium=shownotes) – Understanding remote code execution (RCE) attacks in Elixir
- https://paraxial.io/blog/potion-shop (https://paraxial.io/blog/potion-shop?utm_source=thinkingelixir&utm_medium=shownotes) – Potion Shop
- https://www.meetup.com/new-york-city-elixir/events/296705817/ (https://www.meetup.com/new-york-city-elixir/events/296705817/?utm_source=thinkingelixir&utm_medium=shownotes) – The NYC Elixir meetup
- https://www.meetup.com/denver-erlang-elixir/ (https://www.meetup.com/denver-erlang-elixir/?utm_source=thinkingelixir&utm_medium=shownotes) – Denver Elixir meetup
Guest Information
- https://twitter.com/paraxialio (https://twitter.com/paraxialio?utm_source=thinkingelixir&utm_medium=shownotes) – on Twitter
- https://github.com/paraxialio/ (https://github.com/paraxialio/?utm_source=thinkingelixir&utm_medium=shownotes) – on Github
- https://genserver.social/paraxial (https://genserver.social/paraxial?utm_source=thinkingelixir&utm_medium=shownotes) – on Fediverse
- https://paraxial.io/blog/index (https://paraxial.io/blog/index?utm_source=thinkingelixir&utm_medium=shownotes) – Blog
- https://www.linkedin.com/company/paraxial-io (https://www.linkedin.com/company/paraxial-io?utm_source=thinkingelixir&utm_medium=shownotes) – LinkedIn
- https://www.youtube.com/@paraxial5874 (https://www.youtube.com/@paraxial5874?utm_source=thinkingelixir&utm_medium=shownotes) – Paraxial YouTube channel
Find us online
- Message the show - @ThinkingElixir (https://twitter.com/ThinkingElixir)
- Message the show on Fediverse - @ThinkingElixir@genserver.social (https://genserver.social/ThinkingElixir)
- Email the show - show@thinkingelixir.com (mailto:show@thinkingelixir.com)
- Mark Ericksen - @brainlid (https://twitter.com/brainlid)
- Mark Ericksen on Fediverse - @brainlid@genserver.social (https://genserver.social/brainlid)
- David Bernheisel - @bernheisel (https://twitter.com/bernheisel)
- David Bernheisel on Fediverse - @dbern@genserver.social (https://genserver.social/dbern)
- Cade Ward - @cadebward (https://twitter.com/cadebward)
- Cade Ward on Fediverse - @cadebward@genserver.social (https://genserver.social/cadebward)