5 ms·

Supporting the BEAM community with free CI/CD security audits

93 points by todsacerdoti 1y ago

lagniappe 1y ago
The title is "Supporting the BEAM Community with Free CI/CD Security Audits" There is no need to editorialize the title.
- dang 1y ago
  (Submitted title was "Free security audits for Erlang and Elixir open source projects")
- kamilap 1y ago
  in OPs defense, there are people that already commented that "BEAM" part wasn't clear to them
mananaysiempre 1y ago
Highlights (emphasis mine): > Open source maintainers can request a free license by emailing safe@erlang-solutions.com and including a link to their [GitHub] repository. Once approved, we provide a SAFE license for one month or up to a year, depending on the project’s needs, at no cost. The legalese[1] (is incoherent but apparently) does not pass the Curl test, that is, the maintainer of Curl—who gets money by providing commercial support for his completely FOSS project—wouldn’t be allowed to use this had it applied to him: > You can only use SAFE for open-source software. Any commercial use is prohibited. [1] https://www.erlang-solutions.com/policies/safe-for-open-source-projects/ https://www.erlang-solutions.com/policies/safe-for-open-sour...
- justin66 1y ago
  The point you're trying to make about Curl is more unclear than anything in that license.
  - mananaysiempre 1y ago
    It’s a reference to a four-year-old discussion[1] in the Curl bug tracker about Travis CI introducing a similar prohibition on commercial activity in relation to open-source projects. The more general point is, fully open-source projects that earn money via support contracts are few and precious, and it’s a dick move to cut them off. [1] https://github.com/curl/curl/issues/7150 https://github.com/curl/curl/issues/7150
victorbjorklund 1y ago
Is it just me or does the font look really stretched out on the site?
- tiffanyh 1y ago
  That's just the normal look of the font they are using (which I'm not a fan of either if that's what you're implying) https://fonts.adobe.com/fonts/aktiv-grotesk-extended https://fonts.adobe.com/fonts/aktiv-grotesk-extended
Animats 1y ago
Took a while to find out what BEAM was. It's the run-time interpreter for Erlang.[1] It's not in Acronym Finder. There are many hits for BEAM, but this isn't in the top 10. [1] https://en.wikipedia.org/wiki/BEAM_(Erlang_virtual_machine) https://en.wikipedia.org/wiki/BEAM_(Erlang_virtual_machine)
- cisrockandroll 1y ago
  Congratulations
- giancarlostoro 1y ago
  Not just Erlang, but all the other languages like Elixir (powers Discord), Gleam and others.
- jonathanlydall 1y ago
  I guess you’re one of today’s lucky 10,000 (as per XKCD). I’ve never really looked into Erlang or other similar languages, but it’s come up often enough on HN that I know of BEAM.
  - Rendello 1y ago
    To learn more about Erlang, OP needs only look back at the threads on the day HN went Erlang-mad: https://news.ycombinator.com/front?day=2009-03-11 https://news.ycombinator.com/front?day=2009-03-11
citizenpaul 1y ago
I've seen BEAM mentioned several times on here in the last few months. Is there some sort of thing going on with erlang that I'm out of the loop on?
- arcanemachiner 1y ago
  Erlang/BEAM/Elixir stuff shows up on the front page of Hacker News pretty often, I'd say at least once per month. Elixir was a HN darling a few years back. Publicity has somewhat waned since then. To answer your question, I would say "no", that no particularly interesting things have emerged from that community lately. Just more stuff happened to make it to the front page. (That is not to say anything bad of the BEAM community, just that I see nothing particularly outstanding of late which would warrant such a claim.) I would say the most recent newsworthy events would include: - The Erlang `:ssh` module had a serious CVE that required an immediate upgrade for anyone using it. - Gleam, a BEAM language with static typing, had a v1.0 release. - Phoenix LiveView also reached v1.0. - Elixir is making steady progress on the implementation of a static type system, using a novel "set theoretic" type system. Overall, I would say that the ecosystem as a whole is progressing slowly but steadily.
  - Towaway69 1y ago
    There is Erlang-Red[1] that is bring a visual flow based programming approach to Erlang. That’s something new in the Erlang world. [1] = https://github.com/gorenje/erlang-red https://github.com/gorenje/erlang-red
    - no_wizard 1y ago
      Neat project, and I think erlang (or its offshoots, like elixir) are great candidates for this sort of thing. That said, I take issue with this: >is great for creating data flows that actually describe concurrent processing, it is just a shame the NodeJS is single threaded Its not really true, there are `worker_threads`[0] as well as a cluster process module[1] for multi processing. The nodejs runtime has really come a long way here. Though, it is true that by default, its single threaded, and one could argue, and I'd agree with it, that its much easier to do multi process / multi threaded work on the BEAM since it was built with this in mind from the get go. Never the less, its not so true that NodeJS is limited to a single thread! [0]: https://nodejs.org/api/worker_threads.html https://nodejs.org/api/worker_threads.html [1]: https://nodejs.org/api/cluster.html https://nodejs.org/api/cluster.html
hexagrams64 1y ago
[dead]

93 points by todsacerdoti 1y ago

The title is "Supporting the BEAM Community with Free CI/CD Security Audits" There is no need to editorialize the title.

dang 1y ago
(Submitted title was "Free security audits for Erlang and Elixir open source projects")
kamilap 1y ago
in OPs defense, there are people that already commented that "BEAM" part wasn't clear to them

mananaysiempre 1y ago

Highlights (emphasis mine): > Open source maintainers can request a free license by emailing safe@erlang-solutions.com and including a link to their [GitHub] repository. Once approved, we provide a SAFE license for one month or up to a year, depending on the project’s needs, at no cost. The legalese[1] (is incoherent but apparently) does not pass the Curl test, that is, the maintainer of Curl—who gets money by providing commercial support for his completely FOSS project—wouldn’t be allowed to use this had it applied to him: > You can only use SAFE for open-source software. Any commercial use is prohibited. [1] https://www.erlang-solutions.com/policies/safe-for-open-source-projects/ https://www.erlang-solutions.com/policies/safe-for-open-sour...

justin66 1y ago
The point you're trying to make about Curl is more unclear than anything in that license.
- mananaysiempre 1y ago
  It’s a reference to a four-year-old discussion[1] in the Curl bug tracker about Travis CI introducing a similar prohibition on commercial activity in relation to open-source projects. The more general point is, fully open-source projects that earn money via support contracts are few and precious, and it’s a dick move to cut them off. [1] https://github.com/curl/curl/issues/7150 https://github.com/curl/curl/issues/7150

victorbjorklund 1y ago

Is it just me or does the font look really stretched out on the site?

tiffanyh 1y ago
That's just the normal look of the font they are using (which I'm not a fan of either if that's what you're implying) https://fonts.adobe.com/fonts/aktiv-grotesk-extended https://fonts.adobe.com/fonts/aktiv-grotesk-extended

Animats 1y ago

Took a while to find out what BEAM was. It's the run-time interpreter for Erlang.[1] It's not in Acronym Finder. There are many hits for BEAM, but this isn't in the top 10. [1] https://en.wikipedia.org/wiki/BEAM_(Erlang_virtual_machine) https://en.wikipedia.org/wiki/BEAM_(Erlang_virtual_machine)

cisrockandroll 1y ago
Congratulations
giancarlostoro 1y ago
Not just Erlang, but all the other languages like Elixir (powers Discord), Gleam and others.
jonathanlydall 1y ago
I guess you’re one of today’s lucky 10,000 (as per XKCD). I’ve never really looked into Erlang or other similar languages, but it’s come up often enough on HN that I know of BEAM.
- Rendello 1y ago
  To learn more about Erlang, OP needs only look back at the threads on the day HN went Erlang-mad: https://news.ycombinator.com/front?day=2009-03-11 https://news.ycombinator.com/front?day=2009-03-11

citizenpaul 1y ago

I've seen BEAM mentioned several times on here in the last few months. Is there some sort of thing going on with erlang that I'm out of the loop on?

arcanemachiner 1y ago
Erlang/BEAM/Elixir stuff shows up on the front page of Hacker News pretty often, I'd say at least once per month. Elixir was a HN darling a few years back. Publicity has somewhat waned since then. To answer your question, I would say "no", that no particularly interesting things have emerged from that community lately. Just more stuff happened to make it to the front page. (That is not to say anything bad of the BEAM community, just that I see nothing particularly outstanding of late which would warrant such a claim.) I would say the most recent newsworthy events would include: - The Erlang `:ssh` module had a serious CVE that required an immediate upgrade for anyone using it. - Gleam, a BEAM language with static typing, had a v1.0 release. - Phoenix LiveView also reached v1.0. - Elixir is making steady progress on the implementation of a static type system, using a novel "set theoretic" type system. Overall, I would say that the ecosystem as a whole is progressing slowly but steadily.
- Towaway69 1y ago
  There is Erlang-Red[1] that is bring a visual flow based programming approach to Erlang. That’s something new in the Erlang world. [1] = https://github.com/gorenje/erlang-red https://github.com/gorenje/erlang-red
  - no_wizard 1y ago
    Neat project, and I think erlang (or its offshoots, like elixir) are great candidates for this sort of thing. That said, I take issue with this: >is great for creating data flows that actually describe concurrent processing, it is just a shame the NodeJS is single threaded Its not really true, there are `worker_threads`[0] as well as a cluster process module[1] for multi processing. The nodejs runtime has really come a long way here. Though, it is true that by default, its single threaded, and one could argue, and I'd agree with it, that its much easier to do multi process / multi threaded work on the BEAM since it was built with this in mind from the get go. Never the less, its not so true that NodeJS is limited to a single thread! [0]: https://nodejs.org/api/worker_threads.html https://nodejs.org/api/worker_threads.html [1]: https://nodejs.org/api/cluster.html https://nodejs.org/api/cluster.html

hexagrams64 1y ago

[dead]