Macro Mayhem

The eMudhra root certificates were compromised, and we cover how to check whether your Elixir app is affected. Elixir 1.20.5 fixes three CVEs, and we also look at Expert LSP 0.2, Cure, Popcorn 1.0, and Ash's Temporal Resources and Signals. Michael Lubas from Paraxial.io joins us for a discussion on cybersecurity in Elixir.NEWSeMudhra certificates compromisedhttps://com.erlef.org/wg/sec/2026/10/20/root-certs-compromised.htmlhttps://paraxial.io/blog/emudhra-cahttps://bob.hex.pm/dockerhttps://emudhra.we-have-a-problem.com/apple.htmlElixir 1.20.5 releasedhttps://github.com/elixir-lang/elixir/releases/tag/v1.20.5Security Question of the WeekExpert LSP 0.2 releasedhttps://expert-lsp.org/expert-v0.2-is-out/https://github.com/remoteoss/dexterhttps://elixirforum.com/t/dexter-a-fast-full-featured-elixir-lsp-optimized-for-large-codebases/74963Cure -  A new BEAM languagehttps://cure-lang.org/https://elixirforum.com/t/cure-a-new-language-compiled-to-beam/73151https://github.com/josevalim/lynxBLOGSJohanna Larsson: The time Bluesky tried to kill my serverhttps://jola.dev/posts/the-time-bluesky-tried-to-kill-my-serverAsh: Introducing Temporal Resourceshttps://ash-hq.org/blog/introducing-temporal-resources/Ash: Introducing Signalshttps://ash-hq.org/blog/introducing-signals/Software Mansion: Popcorn 1.0 moving from AtomVM to OTP Beamhttps://swmansion.com/blog/popcorn-1-0-moving-from-atom-vm-to-otp-beam/https://elixirforum.com/t/popcorn-v1-0-is-out-and-runs-on-the-beam/77188Oban: Monitoring Oban Healthhttps://oban.pro/articles/monitoring-oban-healthNelson Vides: Making DNS erlang fasthttps://blog.dnsimple.com/2026/10/making-dns-erlang-fasthttps://www.erlang-in-anger.com/CONFERENCESNovember Nerves Meetup - November 11 @ 19h CEThttps://nervesmeetup.eu/meetup/harald-ringvold-Armex-building-a-disc-ripping-applianceCFP ElixirConf EU is open until December 15https://sessionize.com/elixirconf-eu-2027/BEAM room at FOSDEM - Saturday, Jan 30, 2027 (Brussels)https://beam-fosdem.devBobKonf CFP ends tomorrow (2nd Nov)https://bobkonf.de/2027/en/cfc.html

A tribute to Margaret Hamilton’s fault-tolerant software opens a broad roundup of BEAM news: changes to Gleam compilation, Elixir type-system research, Sobelow and other library updates, faster Hologram compilation, Android devices running Nerves, and easier access to Hex-built images. The rest covers Goatmire recaps, Bluesky’s ATProto, doc tests and regression testing, community events, secure handling of local and production credentials, and AI-assisted vulnerability scanning.NEWSMargaret Hamilton dieshttps://news.mit.edu/2026/margaret-hamilton-computing-pioneer-dies-1007Gleam doesn't compile to erlang source anymorehttps://gleam.run/news/gleam-doesnt-compile-to-erlang-source-anymore/Post-doctoroal position in Type System for Elixir IRIF Parishttps://elixirforum.com/t/postdoctoral-position-in-type-systems-for-elixir-irif-paris/76957Sobelow 0.16.0 releasedhttps://sobelow.hexdocs.pm/0.16.0/changelog.html#v0-16-0SPONSOR SNIPPETHologram 0.12 releasedhttps://hologram.page/blog/hologram-v0-12Nervesinator - AI Assisted kit to port Nerves on android deviceshttps://github.com/mlainez/nervesinatorhttps://bsky.app/profile/genserver.be/post/3mxrl4le6z222ReqLLM 1.27.0 releasedhttps://hex.pm/packages/req_llm/1.27.0/changelogJump CredoChecks 0.6.0 releasedhttps://github.com/Jump-App/credo_checks/releases/tag/v0.6.0Hex shows Elixir builds with Bob the Builderhttps://bob.hex.pm/BLOGSGoatmire Recap Blogshttps://underjord.io/goatmire-2-odins-folly.htmlhttps://ellyxir.com/posts/goatmire-2026/https://beamops.co.uk/blog/goatmire-2026-reviewJohanna Larsson: Building an ATproto link aggregatorhttps://jola.dev/posts/building-atproto-link-aggregatorRyan Zidago: Using Doctests to understand a featurehttps://ryanzidago.com/posts/using-doctests-to-understand-a-feature/Aleksei Matiushkin (mudasobwa): Aggressive Regressionhttps://blog.yokerhood.com/aggressive-regressionMEETUPS AND CONFERENCESNerves Meetup EU, Oct 14 (tonight!)Unconference + Code BEAM Europe, Oct 21-22https://luma.com/1dq3t9tfBOB 2027 CFP - Berlin, Feb 26, 2027https://bobkonf.de/2027/cfc.htmlDue Nov 2nd

Recorded live from Goatmire in Varberg, we recap the conference, its Nerves-powered orchestra, LED tree, and badges, and discuss José Valim's post on evolving programming languages in the AI era. Plus OTP security patches you should install now.NEWSOTP 29.1.1, plus 28 and 27 patch releases, fix three CVEshttps://forum.elixirforum.com/t/patch-package-otp-29-1-1-released/76775https://nvd.nist.gov/vuln/detail/cve-2026-65634https://nvd.nist.gov/vuln/detail/cve-2026-68956https://nvd.nist.gov/vuln/detail/cve-2026-89422Explorer 0.13 is outhttps://hex.pm/packages/explorer/0.13.0/changelogLetMe 3.0.4 released                    https://elixirforum.com/t/letme-3-0-4-released/76850Flop 0.29.0 and Flop Phoenix 0.27.0 releasedhttps://github.com/woylie/flop/blob/main/CHANGELOG.mdhttps://elixirforum.com/t/flop-phoenix-0-27-0-released/76849Atomic Bucket 0.5 released              https://forum.elixirforum.com/t/atomic-bucket-fast-single-node-rate-limiter-implementing-token-bucket-algorithm/74225/16SmolNet, a user-mode TCP/IP stack       https://forum.elixirforum.com/t/smolnet-a-user-mode-tcp-ip-stack/76739ExRatatui 0.16 releasedhttps://forum.elixirforum.com/t/exratatui-elixir-bindings-for-the-rust-ratatui-terminal-ui-library/74403/17Gale, a Phoenix adapter for HTTP/1.1, HTTP/2, and HTTP/3https://elixirforum.com/t/gale-phoenix-adapter-for-http-1-1-http-2-and-http-3-quic-without-needing-to-replace-bandit/76880BLOGSJosé Valim - Evolving programming languages in the AI erahttps://dashbit.co/blog/evolving-ai-era Discussion on ElixirForum: https://forum.elixirforum.com/t/thoughts-on-evolving-programming-languages-in-the-ai-era/76825/3Ryan Zidago - Keep product knowledge close to the codehttps://ryanzidago.com/posts/keep-product-knowledge-close-to-the-code/Herman Verschooten - Blue/Green deploymentshttps://til.verschooten.name/til/2026-09-19/blue_greenMentioned in the Xamal thread: https://forum.elixirforum.com/t/xamal-deploy-elixir-releases-to-bare-metal-servers-via-ssh/74398/35MEETUPS AND CONFERENCESNerves Meetup EU, Oct 14, 7 PM CET, remote via ZoomEEF Unconference and Code BEAM Europe, Haarlem, Oct 21 - 22DISCUSSIONGoatmire recap

We recap ElixirConf US in Chicago, unveil this year's AtomVM-powered Goatmire name badges, and dig into what happened after Pushin hit the front page of Hacker News. Plus OTP security releases and a Rebar4 call for input.NEWS  • Jonatan is #69 and Peter is #102 globally for number of reported CVEs     – CVE reporter credits ranking (CIRCL):  https://cve.circl.lu/credits/?q=&page=7  • OTP security releases, and OTP 29.1 released     – OTP security updates (EEF CNA):  https://com.erlef.org/wg/cna/2026/09/01/otp-updates.html     – Erlang/OTP 29.1 released:  https://erlangforums.com/t/erlang-otp-29-1-released/5949  • Rebar4 asks for input: which plugins to prioritize for compatibility testing     – Rebar v4: which Rebar plugins should we prioritize for compatibility  testing? https://erlangforums.com/t/rebar-v4-which-rebar-plugins-should-we-prior  itize-for-compatibility-testing/5908     – Rebar3: integrating with Erlang/OTP (Kickstarter): https://www.kickstarter.  com/projects/peerstritzinger/rebar3-integrating-with-erlang-otp  • ElixirConf EU 2026 videos are also being released (43 videos as of this  morning)     – ElixirConf EU 2026 playlist: https://youtube.com/playlist?list=PLvL2NEhYV4Z  sIgecSexrk26--PBWiEyUy&si=6DYo_JX4Cl_uSHXp  BLOGS  • Announcing Pushin: https://peterullrich.com/announcing-pushin  • Nathan Long — Label your processes:  https://nathanmlong.com/2026/09/label-your-processes/  • EEF — Defending our ecosystem against AI threats:  https://com.erlef.org/wg/sec/2026/09/02/our-self-defense.html  MEETUPS & CONFERENCES  • Goatmire — Sept 27 – Oct 3, Varberg, SE: https://goatmire.com  • CodeBEAM — Oct 21 – 22, Haarlem, NL: https://codebeameurope.com  DISCUSSION  • ElixirConf US was last week — keynotes are already available     – ElixirConf US 2026 playlist:  https://www.youtube.com/playlist?list=PLVqsKC3zWaDc  • Deep dish pizza is a casserole  • Goatmire badges  • Pushin follow up

Peter announces Pushin.eu, a GitHub competitor hosted in the EU, written in Elixir. Other topics include Phoenix ships security patches spanning four versions, Oban 2.24 and Oban Pro 1.8rc land, and Ash publishes a batch of CVEs alongside a wave of new Elixir tool releases.## FOLLOW UPS  - Steffen Deusch — Phoenix gets security patches going back 4 versions (1.5 to 1.8)https://bsky.app/profile/steffend.me/post/3mthapcxlwk2v- "Apps using old Phoenix should still update, for sure, but not necessarily for security reasons"- "As a general note: a common misconception is also that people think they have to copy whatever changes we did to the generators. That's not the case. You canof course do that, but it's in no way a requirement to update to later Phoenix versions. It's 1.x, so updates are generally non-breaking."## NEWS- Nerves has an AI policy nowhttps://github.com/nerves-project/nerves/blob/main/CONTRIBUTING.md#ai-assisted-contributions                                                          - Oban 2.24 and Oban Pro 1.8rc are out- Oban v2.24.0 released    https://elixirforum.com/t/oban-v2-24-0-released/76462- Oban Pro announcement    https://bsky.app/profile/oban.pro/post/3mtwjkkwzy22v- oban-bg/oban v2.24.0 release notes    https://github.com/oban-bg/oban/releases/tag/v2.24.0- Oban Pro changelog    https://oban.pro/docs/pro/changelog.html- samly (Elixir SAML client) has security issues and needs maintainershttps://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/50- Ash releases a bunch of CVEshttps://cna.erlef.org/cves- Quite a lot of small tools were released. An overview:- Abuuba — a drop-in replacement for Mastodon    https://elixirforum.com/t/abuuba-a-drop-in-replacement-for-mastodon/76501- BeamConsole — an embeddable process map and flight recorder for BEAM applications    https://elixirforum.com/t/beamconsole-an-embeddable-process-map-and-flight-recorder-for-beam-applications/76486- Voyager — a modern alternative to Observer    https://elixirforum.com/t/voyager-a-modern-alternative-to-observer/76247- MapLibreX — MapLibre GL JS as Phoenix LiveView components    https://elixirforum.com/t/maplibrex-maplibre-gl-js-as-phoenix-liveview-components/76457- Temper — flaky test detection for ExUnit    https://elixirforum.com/t/temper-flaky-test-detection-for-exunit/76476- DSH — a DeepSeek coding harness written in Elixir    https://elixirforum.com/t/dsh-the-deepseek-harness/76497- Probex — exact answers to structural questions about Elixir source, built by agents for agents    https://elixirforum.com/t/probex-exact-answers-to-structural-questions-about-elixir-source-built-by-agents-for-agents/76366- PaperForge — a pure Elixir platform for building, securing, and transforming PDFs    https://elixirforum.com/t/paperforge-a-pure-elixir-platform-for-building-securing-and-transforming-pdfs/76241- Press — a HTML-to-PDF library, 100% in Elixir    https://elixirforum.com/t/press-a-html-to-pdf-library-100-in-elixir/76418- Announcing Pushin## BLOGS- Gleam — Takeaways from the GitHub Secure Open Source Fund                                                                                             https://gleam.run/news/help-from-the-github-security-lab/- LiveView Local: first releasehttps://swmansion.com/blog/local-live-view-first-release/- River — We replaced our ledger with two functionshttps://river.com/content/we-replaced-our-ledger-with-two-functions- Johanna Larson — Speeding up a Phoenix LiveView web app with a CDNhttps://jola.dev/posts/speeding-up-phoenix-liveview-cdn- Aleksei Matiushkin (mudasobwa)- Anti-Antipatterns in Elixir Libraries    https://rocket-science.ru/hacking/2026/08/09/anti-antipatterns-in-elixir-libraries- Why LLMs Rock (or: BooLLMean Logic for the Uninitiated)    https://rocket-science.ru/hacking/2026/08/29/why-llm-rock- Lars Wikman — Nerves, apparently popular with agentshttps://underjord.io/nerves-iot-framework-apparently-popular-with-agents.html- Terence Tao — Mathematics in the age of AIhttps://arxiv.org/html/2608.16753v1- "The goal of training a mathematician is not achieved by producing correct homework"- "Above all, our community needs to come together to have open and honest discussions"## MEETUPS & CONFERENCES- Nerves Meetup — taking a break in September- ElixirConf US — next week, Sept 10 & 11th. Ping Gus on socials if you're going and want to meet up- CodeBEAM Europe — Oct 21–22, Haarlem - Goatmire — Sept 28 – Oct 2, two days of workshops, three days of conference- AshConf/Goatmire Hackathon — Oct 3## DISCUSSION- Pushin- Options for Git Hosting- Using LLMs for building big ideas

FOLLOW UPS — 00:00  - Audio. We'll do better.  - No interviews on this podcast (for now). But thanks for reaching out.  NEWS — 02:22  - Praia Labs — Phoenix version and Bandit adoption    https://www.praialabs.com/phoenix-version-adoption    https://www.praialabs.com/bandit-adoption  - Sobelow 0.15    https://github.com/sobelow/sobelow/blob/main/CHANGELOG.md  - New Elixir book: Elixir for Finance — Dr. Dimitrios Koutmos, Alex Koutmos, Hugo Baraúna    https://www.financialelixir.dev/#table-of-contents  - LLamex — a Credo plugin to clean up Ash-related LLM-isms    https://github.com/dmitriid/llamex    https://github.com/Jump-App/credo_checks    https://github.com/elixir-vibe/ex_slop  - Black Hat USA 2026: The OpenAI–Hugging Face incident    https://www.youtube.com/watch?v=87DyyMV0kCY  - Tip: Impeccable for design work with LLMs    https://github.com/pbakaus/impeccable  - Dokploy v0.30.0 released, with nice-to-haves    https://github.com/Dokploy/dokploy/releases/tag/v0.30.0  BLOG — 12:03  - Andrea Leopardi — GenStage Demand Visualized    https://andrealeopardi.com/posts/genstage-demand-visualized  - Arjun Gillard — The Elixir Hiring Paradox: notes from ElixirConf EU 2026    https://agtalent.co.uk/the-elixir-hiring-paradox-notes-from-elixirconf-eu-2026  - Tidewave — A new way to use Tidewave: from your terminal or editor    https://tidewave.ai/blog/tidewave-connect  - Mike Zornek — An Agent Skill for Updating Elixir Dependencies    https://mikezornek.com/posts/2026/8/elixir-dependency-update-skill  - João Paulo Abreu — Learning Elixir: Alias, Import, Require, and Use    https://dev.to/abreujp/learning-elixir-alias-import-require-and-use-2hk2  - DeClaude — How AI text watermarking works    https://declaude.org/watermarking/  - 28:36 — PSA: Don't generate blogs with AI  MEETUPS & CONFERENCES — 30:47  - UnConference US (Sep 9) + ElixirConf US (Workshops Sep 9 – Conf Sep 10–11)    https://luma.com/erlef    https://elixirconf.com  - Goatmire / AshConf / Hackathon (Workshops Sep 28–29 – Conf Sep 30 – Oct 2 – AshConf & Hackathon Oct 3)    https://www.goatmire.com/    https://luma.com/wz4z0iz6    https://luma.com/qm8gs6j4  - UnConference EU (Oct 20) + CodeBEAM EU (Workshops Oct 20 – Conf Oct 21–22)    https://luma.com/erlef    https://codebeameurope.com/  JOKE — 32:37  DISCUSSION — 33:11  - 33:11 — How will the work of a senior engineer look two years from now?    I'm done using AI    https://brettcodes.com/im-done-using-ai/    Don't be a meat proxy    https://gruhn.me/blog/2026-08-03/  - 45:59 — Staying in the loop: Grill Me, being the driver, and a better code-review skill  - 51:31 — The mental health crisis no one is talking about    https://ai-health.syntax.fm/    https://www.youtube.com/watch?v=iPUn1Fnfn0k    How much genuine enjoyment or flow do you get from coding now compared to before you started using AI heavily?    54% less or somewhat less — 26% more or somewhat more    Do you feel your actual coding skills are sharpening, holding steady, or diminishing?    60% diminishing or somewhat diminishing — 13% sharpening or somewhat sharpening    (careful: coding skills, not experience as a developer)    How often do you feel you should be producing more because AI makes it possible, even when you don't want to?    65% often or daily — 18% never or rarely    Strongest correlation between questions: coding enjoyment vs. perceived coding skill change

FOLLOW UPSDeep dish is indeed pizza not a pie. (Is it though?)Hologram is written in ElixirNEWSOTP Emergency Patch releases for OTP 27, 28, 29 fix a bunch of vulnerabilities https://elixirforum.com/t/patch-package-otp-29-0-4-released/76127https://elixirforum.com/t/patch-package-otp-28-5-0-4-released/76128https://elixirforum.com/t/patch-package-otp-27-3-4-15-released/76129Gleam 1.18 releasedhttps://gleam.run/news/a-field-day-for-gleams-language-server/ElixirConf US 2025 Talks are being published on YouTubehttps://forum.elixirforum.com/tag/elixirconf/147Version 0.3.0 of the Programming Nerves book by Alex Koutmos and Hugo Barauna is outhttps://www.programmingnerves.dev/https://bsky.app/profile/akoutmos.bsky.social/post/3mrpthmrm6k2vBLOGSMike Zornek - Shimming your way off a dead Elixir dependencyhttps://mikezornek.com/posts/2026/7/shim-off-a-dead-elixir-dependencyJohanna Larson - Distributed rate limiter with HRW in Elixirhttps://jola.dev/posts/distributed-ratelimiter-with-hrwPaul Ricks - Profiling Rust NIFs in Elixir (with hotpath)https://blog.smaller-infinity.com/posts/profiling-rust-nifs-in-elixirJacob Swanner - Batching Phoenix LiveView Updateshttps://jacobswanner.com/development/2026/batching-phoenix-liveview-updates/Paraxial - Security Vendor's AI Best Practices Labels Critical Elixir RCE Safehttps://paraxial.io/blog/ai-spamGerman Velasco - Diverge then converge with LLMshttps://www.germanvelasco.com/blog/diverge-then-converge-with-llmsPSA - Don’t write on mediumMEETUPS & CONFERENCESNerves Meetup - online via Zoom, this week (August 12)UnConference before ElixirConf US (Sept 9) and CodeBEAM EU (Oct 20)https://luma.com/erlefGoatmire - Varberg, Sweden Sept 28 - Oct 3https://goatmire.comDISCUSSIONDeployment strategies in 2026 - Fly.io shifting focus:https://fly.io/blog/kurt-scott-money-sprites/https://community.fly.io/t/will-the-apps-and-machine-platform-start-winding-down/28380https://github.com/dmkenney/xamalhttps://coolify.io/What will more intelligence actually do for us?https://www.noahpinion.blog/p/what-will-more-intelligence-actuallyGCC To Decline Any Significant Contributions Made Via AI/LLMs - Except For Test Caseshttps://www.phoronix.com/news/GCC-Declining-AI-Contributions

NEWSHex 2.5.0 - mix deps.get vuln warningshttps://github.com/hexpm/hex/releases/tag/v2.5.0Elixir-lang redesignhttps://elixir-lang.org/Elixirforum redesignStackoverflow 2026 Developer Survey is now openhttps://stackoverflow.blog/2026/06/23/the-2026-developer-survey-is-now-open-for-human-developers-only/Filipe Cabaco announces Ex-Tauri https://github.com/filipecabaco/ex_tauriAugmental Mouthpad launches - alternative input device for hands-free controlhttps://www.augmental.tech/news/mouthpad-and-vox-launchBlog postsBart from Hologramhttps://hologram.page/blog/backing-hologramRyan Zidago - Each test should own its setuphttps://ryanzidago.com/posts/self-contained-tests-in-elixir/Mike Zornek - Guarding against AI drifthttps://mikezornek.com/posts/2026/7/guarding-against-ai-drift/?utm_source=elixir-forum&utm_campaign=guarding-against-ai-driftJohanna Larsson - Elixir Cluster 101https://jola.dev/posts/elixir-cluster-101https://incident.io/blog/dont-add-a-read-replica-until-youve-read-thisMeetups and ConferencesNerves Meetup EU Aug 12, 19 CEST.  https://nervesmeetup.eu/meetup/peter-ullrich-dont-get-pwned-by-mythosGoatmire - Sept 28th to Oct 3rd (Mon-Sat)AshConf + Hackathon - Oct 3nd (Sat)ElixirConf US - Sept 10-11thCodeBeam EU - Oct 21-22DISCUSSIONCodeberg blocks LLM reposhttps://blog.codeberg.org/protecting-our-floss-commons-from-llms.htmlhttps://xn--gckvb8fzb.com/i-regret-migrating-to-codeberg/OpenAI says it hacked HuggingFacehttps://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/https://openai.com/index/hugging-face-model-evaluation-security-incident/What it means to be a mathematician when AI does the mathhttps://spectrum.ieee.org/ai-in-mathematics