Macro Mayhem

The eMudhra root certificates were compromised, and we cover how to check whether your Elixir app is affected. Elixir 1.20.5 fixes three CVEs, and we also look at Expert LSP 0.2, Cure, Popcorn 1.0, and Ash's Temporal Resources and Signals. Michael Lubas from Paraxial.io joins us for a discussion on cybersecurity in Elixir.

NEWS

1. eMudhra certificates compromised
   1. https://com.erlef.org/wg/sec/2026/10/20/root-certs-compromised.html
   2. https://paraxial.io/blog/emudhra-ca
   3. https://bob.hex.pm/docker
   4. https://emudhra.we-have-a-problem.com/apple.html
2. Elixir 1.20.5 released
   1. https://github.com/elixir-lang/elixir/releases/tag/v1.20.5
3. Security Question of the Week
4. Expert LSP 0.2 released
   1. https://expert-lsp.org/expert-v0.2-is-out/
   2. https://github.com/remoteoss/dexter
   3. https://elixirforum.com/t/dexter-a-fast-full-featured-elixir-lsp-optimized-for-large-codebases/74963
5. Cure - A new BEAM language
   1. https://cure-lang.org/
   2. https://elixirforum.com/t/cure-a-new-language-compiled-to-beam/73151
   3. https://github.com/josevalim/lynx

BLOGS

1. Johanna Larsson: The time Bluesky tried to kill my server
   1. https://jola.dev/posts/the-time-bluesky-tried-to-kill-my-server
2. Ash: Introducing Temporal Resources
   1. https://ash-hq.org/blog/introducing-temporal-resources/
3. Ash: Introducing Signals
   1. https://ash-hq.org/blog/introducing-signals/
4. Software Mansion: Popcorn 1.0 moving from AtomVM to OTP Beam
   1. https://swmansion.com/blog/popcorn-1-0-moving-from-atom-vm-to-otp-beam/
   2. https://elixirforum.com/t/popcorn-v1-0-is-out-and-runs-on-the-beam/77188
5. Oban: Monitoring Oban Health
   1. https://oban.pro/articles/monitoring-oban-health
6. Nelson Vides: Making DNS erlang fast
   1. https://blog.dnsimple.com/2026/10/making-dns-erlang-fast
   2. https://www.erlang-in-anger.com/

CONFERENCES

1. November Nerves Meetup - November 11 @ 19h CET
   1. https://nervesmeetup.eu/meetup/harald-ringvold-Armex-building-a-disc-ripping-appliance
2. CFP ElixirConf EU is open until December 15
   1. https://sessionize.com/elixirconf-eu-2027/
3. BEAM room at FOSDEM - Saturday, Jan 30, 2027 (Brussels)
   1. https://beam-fosdem.dev
4. BobKonf CFP ends tomorrow (2nd Nov)
   1. https://bobkonf.de/2027/en/cfc.html

A tribute to Margaret Hamilton’s fault-tolerant software opens a broad roundup of BEAM news: changes to Gleam compilation, Elixir type-system research, Sobelow and other library updates, faster Hologram compilation, Android devices running Nerves, and easier access to Hex-built images. The rest covers Goatmire recaps, Bluesky’s ATProto, doc tests and regression testing, community events, secure handling of local and production credentials, and AI-assisted vulnerability scanning.

NEWS

1. Margaret Hamilton dies
   1. https://news.mit.edu/2026/margaret-hamilton-computing-pioneer-dies-1007
2. Gleam doesn't compile to erlang source anymore
   1. https://gleam.run/news/gleam-doesnt-compile-to-erlang-source-anymore/
3. Post-doctoroal position in Type System for Elixir IRIF Paris
   1. https://elixirforum.com/t/postdoctoral-position-in-type-systems-for-elixir-irif-paris/76957
4. Sobelow 0.16.0 released
   1. https://sobelow.hexdocs.pm/0.16.0/changelog.html#v0-16-0
5. SPONSOR SNIPPET
6. Hologram 0.12 released
   1. https://hologram.page/blog/hologram-v0-12
7. Nervesinator - AI Assisted kit to port Nerves on android devices
   1. https://github.com/mlainez/nervesinator
   2. https://bsky.app/profile/genserver.be/post/3mxrl4le6z222
8. ReqLLM 1.27.0 released
   1. https://hex.pm/packages/req_llm/1.27.0/changelog
9. Jump CredoChecks 0.6.0 released
   1. https://github.com/Jump-App/credo_checks/releases/tag/v0.6.0
10. Hex shows Elixir builds with Bob the Builder
    1. https://bob.hex.pm/

BLOGS

1. Goatmire Recap Blogs
   1. https://underjord.io/goatmire-2-odins-folly.html
   2. https://ellyxir.com/posts/goatmire-2026/
   3. https://beamops.co.uk/blog/goatmire-2026-review
2. Johanna Larsson: Building an ATproto link aggregator
   1. https://jola.dev/posts/building-atproto-link-aggregator
3. Ryan Zidago: Using Doctests to understand a feature
   1. https://ryanzidago.com/posts/using-doctests-to-understand-a-feature/
4. Aleksei Matiushkin (mudasobwa): Aggressive Regression
   1. https://blog.yokerhood.com/aggressive-regression

MEETUPS AND CONFERENCES

• Nerves Meetup EU, Oct 14 (tonight!)
• Unconference + Code BEAM Europe, Oct 21-22
  • https://luma.com/1dq3t9tf
• BOB 2027 CFP - Berlin, Feb 26, 2027
  • https://bobkonf.de/2027/cfc.html
  • Due Nov 2nd

Recorded live from Goatmire in Varberg, we recap the conference, its Nerves-powered orchestra, LED tree, and badges, and discuss José Valim's post on evolving programming languages in the AI era. Plus OTP security patches you should install now.

NEWS

OTP 29.1.1, plus 28 and 27 patch releases, fix three CVEs
https://forum.elixirforum.com/t/patch-package-otp-29-1-1-released/76775
https://nvd.nist.gov/vuln/detail/cve-2026-65634
https://nvd.nist.gov/vuln/detail/cve-2026-68956
https://nvd.nist.gov/vuln/detail/cve-2026-89422

Explorer 0.13 is out
https://hex.pm/packages/explorer/0.13.0/changelog

LetMe 3.0.4 released
https://elixirforum.com/t/letme-3-0-4-released/76850

Flop 0.29.0 and Flop Phoenix 0.27.0 released
https://github.com/woylie/flop/blob/main/CHANGELOG.md
https://elixirforum.com/t/flop-phoenix-0-27-0-released/76849

Atomic Bucket 0.5 released
https://forum.elixirforum.com/t/atomic-bucket-fast-single-node-rate-limiter-impl
ementing-token-bucket-algorithm/74225/16

SmolNet, a user-mode TCP/IP stack
https://forum.elixirforum.com/t/smolnet-a-user-mode-tcp-ip-stack/76739

ExRatatui 0.16 released
https://forum.elixirforum.com/t/exratatui-elixir-bindings-for-the-rust-ratatui-t
erminal-ui-library/74403/17

Gale, a Phoenix adapter for HTTP/1.1, HTTP/2, and HTTP/3
https://elixirforum.com/t/gale-phoenix-adapter-for-http-1-1-http-2-and-http-3-qu
ic-without-needing-to-replace-bandit/76880

BLOGS

José Valim - Evolving programming languages in the AI era
https://dashbit.co/blog/evolving-ai-era
Discussion on ElixirForum: https://forum.elixirforum.com/t/thoughts-on-evolving-
programming-languages-in-the-ai-era/76825/3

Ryan Zidago - Keep product knowledge close to the code
https://ryanzidago.com/posts/keep-product-knowledge-close-to-the-code/

Herman Verschooten - Blue/Green deployments
https://til.verschooten.name/til/2026-09-19/blue_green
Mentioned in the Xamal thread: https://forum.elixirforum.com/t/xamal-deploy-elix
ir-releases-to-bare-metal-servers-via-ssh/74398/35

MEETUPS AND CONFERENCES

Nerves Meetup EU, Oct 14, 7 PM CET, remote via Zoom
EEF Unconference and Code BEAM Europe, Haarlem, Oct 21 - 22

DISCUSSION

Goatmire recap

We recap ElixirConf US in Chicago, unveil this year's AtomVM-powered Goatmire name badges, and dig into what happened after Pushin hit the front page of Hacker News. Plus OTP security releases and a Rebar4 call for input.

NEWS

• Jonatan is #69 and Peter is #102 globally for number of reported CVEs
– CVE reporter credits ranking (CIRCL):
https://cve.circl.lu/credits/?q=&page=7
• OTP security releases, and OTP 29.1 released
– OTP security updates (EEF CNA):
https://com.erlef.org/wg/cna/2026/09/01/otp-updates.html
– Erlang/OTP 29.1 released:
https://erlangforums.com/t/erlang-otp-29-1-released/5949
• Rebar4 asks for input: which plugins to prioritize for compatibility testing
– Rebar v4: which Rebar plugins should we prioritize for compatibility
testing? https://erlangforums.com/t/rebar-v4-which-rebar-plugins-should-we-prior
itize-for-compatibility-testing/5908
– Rebar3: integrating with Erlang/OTP (Kickstarter): https://www.kickstarter.
com/projects/peerstritzinger/rebar3-integrating-with-erlang-otp
• ElixirConf EU 2026 videos are also being released (43 videos as of this
morning)
– ElixirConf EU 2026 playlist: https://youtube.com/playlist?list=PLvL2NEhYV4Z
sIgecSexrk26--PBWiEyUy&si=6DYo_JX4Cl_uSHXp

BLOGS

• Announcing Pushin: https://peterullrich.com/announcing-pushin
• Nathan Long — Label your processes:
https://nathanmlong.com/2026/09/label-your-processes/
• EEF — Defending our ecosystem against AI threats:
https://com.erlef.org/wg/sec/2026/09/02/our-self-defense.html

MEETUPS & CONFERENCES

• Goatmire — Sept 27 – Oct 3, Varberg, SE: https://goatmire.com
• CodeBEAM — Oct 21 – 22, Haarlem, NL: https://codebeameurope.com

DISCUSSION

• ElixirConf US was last week — keynotes are already available
– ElixirConf US 2026 playlist:
https://www.youtube.com/playlist?list=PLVqsKC3zWaDc
• Deep dish pizza is a casserole
• Goatmire badges
• Pushin follow up

Peter announces Pushin.eu, a GitHub competitor hosted in the EU, written in Elixir. Other topics include Phoenix ships security patches spanning four versions, Oban 2.24 and Oban Pro 1.8rc land, and Ash publishes a batch of CVEs alongside a wave of new Elixir tool releases.

## FOLLOW UPS

- Steffen Deusch — Phoenix gets security patches going back 4 versions (1.5 to 1.8)
https://bsky.app/profile/steffend.me/post/3mthapcxlwk2v
- "Apps using old Phoenix should still update, for sure, but not necessarily for security reasons"
- "As a general note: a common misconception is also that people think they have to copy whatever changes we did to the generators. That's not the case. You can
of course do that, but it's in no way a requirement to update to later Phoenix versions. It's 1.x, so updates are generally non-breaking."

## NEWS

- Nerves has an AI policy now
https://github.com/nerves-project/nerves/blob/main/CONTRIBUTING.md#ai-assisted-contributions
- Oban 2.24 and Oban Pro 1.8rc are out
- Oban v2.24.0 released
https://elixirforum.com/t/oban-v2-24-0-released/76462
- Oban Pro announcement
https://bsky.app/profile/oban.pro/post/3mtwjkkwzy22v
- oban-bg/oban v2.24.0 release notes
https://github.com/oban-bg/oban/releases/tag/v2.24.0
- Oban Pro changelog
https://oban.pro/docs/pro/changelog.html
- samly (Elixir SAML client) has security issues and needs maintainers
https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/50
- Ash releases a bunch of CVEs
https://cna.erlef.org/cves
- Quite a lot of small tools were released. An overview:
- Abuuba — a drop-in replacement for Mastodon
https://elixirforum.com/t/abuuba-a-drop-in-replacement-for-mastodon/76501
- BeamConsole — an embeddable process map and flight recorder for BEAM applications
https://elixirforum.com/t/beamconsole-an-embeddable-process-map-and-flight-recorder-for-beam-applications/76486
- Voyager — a modern alternative to Observer
https://elixirforum.com/t/voyager-a-modern-alternative-to-observer/76247
- MapLibreX — MapLibre GL JS as Phoenix LiveView components
https://elixirforum.com/t/maplibrex-maplibre-gl-js-as-phoenix-liveview-components/76457
- Temper — flaky test detection for ExUnit
https://elixirforum.com/t/temper-flaky-test-detection-for-exunit/76476
- DSH — a DeepSeek coding harness written in Elixir
https://elixirforum.com/t/dsh-the-deepseek-harness/76497
- Probex — exact answers to structural questions about Elixir source, built by agents for agents
https://elixirforum.com/t/probex-exact-answers-to-structural-questions-about-elixir-source-built-by-agents-for-agents/76366
- PaperForge — a pure Elixir platform for building, securing, and transforming PDFs
https://elixirforum.com/t/paperforge-a-pure-elixir-platform-for-building-securing-and-transforming-pdfs/76241
- Press — a HTML-to-PDF library, 100% in Elixir
https://elixirforum.com/t/press-a-html-to-pdf-library-100-in-elixir/76418
- Announcing Pushin

## BLOGS

- Gleam — Takeaways from the GitHub Secure Open Source Fund
https://gleam.run/news/help-from-the-github-security-lab/
- LiveView Local: first release
https://swmansion.com/blog/local-live-view-first-release/
- River — We replaced our ledger with two functions
https://river.com/content/we-replaced-our-ledger-with-two-functions
- Johanna Larson — Speeding up a Phoenix LiveView web app with a CDN
https://jola.dev/posts/speeding-up-phoenix-liveview-cdn
- Aleksei Matiushkin (mudasobwa)
- Anti-Antipatterns in Elixir Libraries
https://rocket-science.ru/hacking/2026/08/09/anti-antipatterns-in-elixir-libraries
- Why LLMs Rock (or: BooLLMean Logic for the Uninitiated)
https://rocket-science.ru/hacking/2026/08/29/why-llm-rock
- Lars Wikman — Nerves, apparently popular with agents
https://underjord.io/nerves-iot-framework-apparently-popular-with-agents.html
- Terence Tao — Mathematics in the age of AI
https://arxiv.org/html/2608.16753v1
- "The goal of training a mathematician is not achieved by producing correct homework"
- "Above all, our community needs to come together to have open and honest discussions"

## MEETUPS & CONFERENCES

- Nerves Meetup — taking a break in September
- ElixirConf US — next week, Sept 10 & 11th. Ping Gus on socials if you're going and want to meet up
- CodeBEAM Europe — Oct 21–22, Haarlem
- Goatmire — Sept 28 – Oct 2, two days of workshops, three days of conference
- AshConf/Goatmire Hackathon — Oct 3

## DISCUSSION

- Pushin
- Options for Git Hosting
- Using LLMs for building big ideas

FOLLOW UPS — 00:00

- Audio. We'll do better.
- No interviews on this podcast (for now). But thanks for reaching out.

NEWS — 02:22

- Praia Labs — Phoenix version and Bandit adoption
https://www.praialabs.com/phoenix-version-adoption
https://www.praialabs.com/bandit-adoption

- Sobelow 0.15
https://github.com/sobelow/sobelow/blob/main/CHANGELOG.md

- New Elixir book: Elixir for Finance — Dr. Dimitrios Koutmos, Alex Koutmos, Hugo Baraúna
https://www.financialelixir.dev/#table-of-contents

- LLamex — a Credo plugin to clean up Ash-related LLM-isms
https://github.com/dmitriid/llamex
https://github.com/Jump-App/credo_checks
https://github.com/elixir-vibe/ex_slop

- Black Hat USA 2026: The OpenAI–Hugging Face incident
https://www.youtube.com/watch?v=87DyyMV0kCY

- Tip: Impeccable for design work with LLMs
https://github.com/pbakaus/impeccable

- Dokploy v0.30.0 released, with nice-to-haves
https://github.com/Dokploy/dokploy/releases/tag/v0.30.0

BLOG — 12:03

- Andrea Leopardi — GenStage Demand Visualized
https://andrealeopardi.com/posts/genstage-demand-visualized

- Arjun Gillard — The Elixir Hiring Paradox: notes from ElixirConf EU 2026
https://agtalent.co.uk/the-elixir-hiring-paradox-notes-from-elixirconf-eu-2026

- Tidewave — A new way to use Tidewave: from your terminal or editor
https://tidewave.ai/blog/tidewave-connect

- Mike Zornek — An Agent Skill for Updating Elixir Dependencies
https://mikezornek.com/posts/2026/8/elixir-dependency-update-skill

- João Paulo Abreu — Learning Elixir: Alias, Import, Require, and Use
https://dev.to/abreujp/learning-elixir-alias-import-require-and-use-2hk2

- DeClaude — How AI text watermarking works
https://declaude.org/watermarking/

- 28:36 — PSA: Don't generate blogs with AI

MEETUPS & CONFERENCES — 30:47

- UnConference US (Sep 9) + ElixirConf US (Workshops Sep 9 – Conf Sep 10–11)
https://luma.com/erlef
https://elixirconf.com

- Goatmire / AshConf / Hackathon (Workshops Sep 28–29 – Conf Sep 30 – Oct 2 – AshConf & Hackathon Oct 3)
https://www.goatmire.com/
https://luma.com/wz4z0iz6
https://luma.com/qm8gs6j4

- UnConference EU (Oct 20) + CodeBEAM EU (Workshops Oct 20 – Conf Oct 21–22)
https://luma.com/erlef
https://codebeameurope.com/

JOKE — 32:37

DISCUSSION — 33:11

- 33:11 — How will the work of a senior engineer look two years from now?
I'm done using AI
https://brettcodes.com/im-done-using-ai/
Don't be a meat proxy
https://gruhn.me/blog/2026-08-03/

- 45:59 — Staying in the loop: Grill Me, being the driver, and a better code-review skill

- 51:31 — The mental health crisis no one is talking about
https://ai-health.syntax.fm/
https://www.youtube.com/watch?v=iPUn1Fnfn0k

How much genuine enjoyment or flow do you get from coding now compared to before you started using AI heavily?
54% less or somewhat less — 26% more or somewhat more

Do you feel your actual coding skills are sharpening, holding steady, or diminishing?
60% diminishing or somewhat diminishing — 13% sharpening or somewhat sharpening
(careful: coding skills, not experience as a developer)

How often do you feel you should be producing more because AI makes it possible, even when you don't want to?
65% often or daily — 18% never or rarely

Strongest correlation between questions: coding enjoyment vs. perceived coding skill change

FOLLOW UPS

1. Deep dish is indeed pizza not a pie. (Is it though?)
2. Hologram is written in Elixir

NEWS

1. OTP Emergency Patch releases for OTP 27, 28, 29 fix a bunch of vulnerabilities
   1. https://elixirforum.com/t/patch-package-otp-29-0-4-released/76127
   2. https://elixirforum.com/t/patch-package-otp-28-5-0-4-released/76128
   3. https://elixirforum.com/t/patch-package-otp-27-3-4-15-released/76129
2. Gleam 1.18 released
   1. https://gleam.run/news/a-field-day-for-gleams-language-server/
3. ElixirConf US 2025 Talks are being published on YouTube
   1. https://forum.elixirforum.com/tag/elixirconf/147
4. Version 0.3.0 of the Programming Nerves book by Alex Koutmos and Hugo Barauna is out
   1. https://www.programmingnerves.dev/
   2. https://bsky.app/profile/akoutmos.bsky.social/post/3mrpthmrm6k2v

BLOGS

1. Mike Zornek - Shimming your way off a dead Elixir dependency
   1. https://mikezornek.com/posts/2026/7/shim-off-a-dead-elixir-dependency
2. Johanna Larson - Distributed rate limiter with HRW in Elixir
   1. https://jola.dev/posts/distributed-ratelimiter-with-hrw
3. Paul Ricks - Profiling Rust NIFs in Elixir (with hotpath)
   1. https://blog.smaller-infinity.com/posts/profiling-rust-nifs-in-elixir
4. Jacob Swanner - Batching Phoenix LiveView Updates
   1. https://jacobswanner.com/development/2026/batching-phoenix-liveview-updates/
5. Paraxial - Security Vendor's AI Best Practices Labels Critical Elixir RCE Safe
   1. https://paraxial.io/blog/ai-spam
6. German Velasco - Diverge then converge with LLMs
   1. https://www.germanvelasco.com/blog/diverge-then-converge-with-llms
7. PSA - Don’t write on medium

MEETUPS & CONFERENCES

1. Nerves Meetup - online via Zoom, this week (August 12)
2. UnConference before ElixirConf US (Sept 9) and CodeBEAM EU (Oct 20)
   1. https://luma.com/erlef
3. Goatmire - Varberg, Sweden Sept 28 - Oct 3
   1. https://goatmire.com

DISCUSSION

1. Deployment strategies in 2026 - Fly.io shifting focus:
   1. https://fly.io/blog/kurt-scott-money-sprites/
   2. https://community.fly.io/t/will-the-apps-and-machine-platform-start-winding-down/28380
   3. https://github.com/dmkenney/xamal
   4. https://coolify.io/
2. What will more intelligence actually do for us?
   1. https://www.noahpinion.blog/p/what-will-more-intelligence-actually
3. GCC To Decline Any Significant Contributions Made Via AI/LLMs - Except For Test Cases
   1. https://www.phoronix.com/news/GCC-Declining-AI-Contributions

NEWS

1. Hex 2.5.0 - mix deps.get vuln warnings
   1. https://github.com/hexpm/hex/releases/tag/v2.5.0
2. Elixir-lang redesign
   1. https://elixir-lang.org/
3. Elixirforum redesign
4. Stackoverflow 2026 Developer Survey is now open
   1. https://stackoverflow.blog/2026/06/23/the-2026-developer-survey-is-now-open-for-human-developers-only/
5. Filipe Cabaco announces Ex-Tauri
   1. https://github.com/filipecabaco/ex_tauri
6. Augmental Mouthpad launches - alternative input device for hands-free control
   1. 1. https://www.augmental.tech/news/mouthpad-and-vox-launch
7. Blog posts
   1. Bart from Hologram
      1. https://hologram.page/blog/backing-hologram
   2. Ryan Zidago - Each test should own its setup
      1. https://ryanzidago.com/posts/self-contained-tests-in-elixir/
   3. Mike Zornek - Guarding against AI drift
      1. https://mikezornek.com/posts/2026/7/guarding-against-ai-drift/?utm_source=elixir-forum&utm_campaign=guarding-against-ai-drift
   4. Johanna Larsson - Elixir Cluster 101
      1. https://jola.dev/posts/elixir-cluster-101
      2. https://incident.io/blog/dont-add-a-read-replica-until-youve-read-this
8. Meetups and Conferences
   1. 1. Nerves Meetup EU Aug 12, 19 CEST. https://nervesmeetup.eu/meetup/peter-ullrich-dont-get-pwned-by-mythos
      2. Goatmire - Sept 28th to Oct 3rd (Mon-Sat)
         1. AshConf + Hackathon - Oct 3nd (Sat)
      3. ElixirConf US - Sept 10-11th
      4. CodeBeam EU - Oct 21-22

DISCUSSION

1. Codeberg blocks LLM repos
   1. https://blog.codeberg.org/protecting-our-floss-commons-from-llms.html
   2. https://xn--gckvb8fzb.com/i-regret-migrating-to-codeberg/
2. OpenAI says it hacked HuggingFace
   1. https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/
   2. https://openai.com/index/hugging-face-model-evaluation-security-incident/
3. What it means to be a mathematician when AI does the math
   1. https://spectrum.ieee.org/ai-in-mathematics