Michael Lubas's guest appearances

Michael Lubas

Elixir Mix

Elixir Wizards

Thinking Elixir Podcast

OwlTail

In today's episode of Elixir Wizards, Michael Lubas, founder of Paraxial.io, joins hosts Owen Bickford and Bilal Hankins to discuss security in the Elixir and Phoenix ecosystem. Lubas shares his insights on the most common security risks developers face, recent threats, and how Elixir developers can prepare for the future.  Common security risks, including SQL injection and cross-site scripting, and how to mitigate these threats The importance of rate limiting and bot detection to prevent spam SMS messages Continuous security testing to maintain a secure application and avoid breaches Tools and resources available in the Elixir and Phoenix ecosystem to enhance security The Guardian library for authentication and authorization Take a drink every time someone says "bot" The difference between "bots" and AI language models The potential for evolving authentication, such as Passkeys over WebSocket How Elixir compares to other languages due to its immutability and the ability to trace user input Potion Shop, a vulnerable Phoenix application designed to test security Talking Tom, Sneaker Bots, and teenage hackers! The importance of security awareness and early planning in application development The impact of open-source software on application security  How to address vulnerabilities in third-party libraries Conducting security audits and implementing security measures  Links in this episode: Michael Lubas Email - michael@paraxial.io LinkedIn - https://www.linkedin.com/in/michaellubas/ Paraxial.io - https://paraxial.io/ Blog/Mailing List - https://paraxial.io/blog/index Potion Shop - https://paraxial.io/blog/potion-shop Elixir/Phoenix Security Live Coding: Preventing SQL Injection in Ecto Twitter - https://twitter.com/paraxialio LinkedIn - https://www.linkedin.com/company/paraxial-io/ GenServer Social - https://genserver.social/paraxial YouTube - https://www.youtube.com/@paraxial5874 Griffin Byatt on Sobelow: ElixirConf 2017 - Plugging the Security Holes in Your Phoenix Application Erlang Ecosystem Foundation: Security Working Group - https://erlef.org/wg/security Article by Bram - Client-Side Enforcement of LiveView SecuritySpecial Guest: Michael Lubas.

In today's episode of Elixir Wizards, Michael Lubas, founder of <a href="http://Paraxial.io" rel="nofollow" target="_blank">Paraxial.io</a>, joins hosts Owen Bickford and Bilal Hankins to discuss security in the Elixir and Phoenix ecosystem. Lubas shares his insights on the most common security risks developers face, recent threats, and how Elixir developers can prepare for the future. <ul> <li>Common security risks, including SQL injection and cross-site scripting, and how to mitigate these threats</li> <li>The importance of rate limiting and bot detection to prevent spam SMS messages</li> <li>Continuous security testing to maintain a secure application and avoid breaches</li> <li>Tools and resources available in the Elixir and Phoenix ecosystem to enhance security</li> <li>The Guardian library for authentication and authorization</li> <li>Take a drink every time someone says "bot"</li> <li>The difference between "bots" and AI language models</li> <li>The potential for evolving authentication, such as Passkeys over WebSocket</li> <li>How Elixir compares to other languages due to its immutability and the ability to trace user input</li> <li>Potion Shop, a vulnerable Phoenix application designed to test security</li> <li>Talking Tom, Sneaker Bots, and teenage hackers!</li> <li>The importance of security awareness and early planning in application development</li> <li>The impact of open-source software on application security </li> <li>How to address vulnerabilities in third-party libraries</li> <li>Conducting security audits and implementing security measures</li> </ul> Links in this episode: Michael Lubas Email - <a href="mailto:michael@paraxial.io" rel="nofollow">michael@paraxial.io</a> LinkedIn - <a href="https://www.linkedin.com/in/michaellubas/" rel="nofollow" target="_blank">https://www.linkedin.com/in/michaellubas/</a> <a href="http://Paraxial.io" rel="nofollow" target="_blank">Paraxial.io</a> - <a href="https://paraxial.io/" rel="nofollow" target="_blank">https://paraxial.io/</a> Blog/Mailing List - <a href="https://paraxial.io/blog/index" rel="nofollow" target="_blank">https://paraxial.io/blog/index</a> Potion Shop - <a href="https://paraxial.io/blog/potion-shop" rel="nofollow" target="_blank">https://paraxial.io/blog/potion-shop</a> Elixir/Phoenix Security Live Coding: Preventing SQL Injection in Ecto Twitter - <a href="https://twitter.com/paraxialio" rel="nofollow" target="_blank">https://twitter.com/paraxialio</a> LinkedIn - <a href="https://www.linkedin.com/company/paraxial-io/" rel="nofollow" target="_blank">https://www.linkedin.com/company/paraxial-io/</a> GenServer Social - <a href="https://genserver.social/paraxial" rel="nofollow" target="_blank">https://genserver.social/paraxial</a> YouTube - <a href="https://www.youtube.com/@paraxial5874" rel="nofollow" target="_blank">https://www.youtube.com/@paraxial5874</a> Griffin Byatt on Sobelow: <a href="https://www.youtube.com/watch?v=w3lKmFsmlvQ" rel="nofollow" target="_blank">ElixirConf 2017 - Plugging the Security Holes in Your Phoenix Application</a> Erlang Ecosystem Foundation: Security Working Group - <a href="https://erlef.org/wg/security" rel="nofollow" target="_blank">https://erlef.org/wg/security</a> Article by Bram - <a href="https://blog.voltone.net/post/31" rel="nofollow" target="_blank">Client-Side Enforcement of LiveView Security</a>Special Guest: Michael Lubas.

Michael Lubas on the Future of Elixir Security

In this episode, Allen, Adi, and Sascha are joined by Michael Lubas, the founder of paraxial.io, as they delve into the world of bot defense. Michael highlights the importance of bot defense, especially for small companies who are often deliberately targeted. The group examines the issues with "man-in-the-middle" solutions like Cloudflare and how this can be avoided by having bot defenses built into the application itself - the approach paraxial.io is taking. He explains how paraxial's bot detection and defense work on a high level, how it tries to reduce the runtime overhead to a minimum, and what other security topics are relevant for the day-to-day Elixir developer.SponsorsChuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksElixir and Phoenix Application Security PlatformGitHub - michalmuskala/plug_attack: A plug building toolkit for blocking and throttling abusive requestsGitHub - nccgroup/sobelow: Security-focused static analysis for the Phoenix FrameworkGitHub - mirego/mix_auditmix hex.audit - Hex v2.0.6GitHub - dimitarvp/trie: A basic Elixir implementation of the Trie data structurePhoenix Application SecuritySecuring Elixir/Phoenix Applications: 5 Tips to Get Startedpersistent_termGet in touch with Michael Lubas michael@paraxial.ioLinkedIn: Paraxial.ioLinkedIn: Michael LubasTwitter: @paraxialioParaxial.ioPicksAdi - Hogwarts LegacyAdi - Captain Sonar GameAllen - Alfred Hitchcock - Vertigo on SteamMichael - 3Blue1Brown (YouTube Channel)Michael - Deus Ex™ GOTY EditionSascha - Disco ElysiumSascha - GitHub - ExHammer/hammer: An Elixir rate-limiter with pluggable backendsAdvertising Inquiries: https://redcircle.com/brandsPrivacy &amp; Opt-Out: https://redcircle.com/privacy

In this episode, Allen, Adi, and Sascha are joined by Michael Lubas, the founder of <a href="http://paraxial.io" rel="nofollow" target="_blank">paraxial.io</a>, as they delve into the world of bot defense. Michael highlights the importance of bot defense, especially for small companies who are often deliberately targeted. The group examines the issues with "man-in-the-middle" solutions like Cloudflare and how this can be avoided by having bot defenses built into the application itself - the approach <a href="http://paraxial.io" rel="nofollow" target="_blank">paraxial.io</a> is taking. He explains how paraxial's bot detection and defense work on a high level, how it tries to reduce the runtime overhead to a minimum, and what other security topics are relevant for the day-to-day Elixir developer. <h1>Sponsors</h1><ul><li><a href="https://topenddevs.com/resume" rel="nofollow" target="_blank">Chuck's Resume Template</a></li><li><a href="https://topenddevs.com/book-club" rel="nofollow" target="_blank">Developer Book Club</a></li><li><a href="https://topenddevs.com/sign_up" rel="nofollow" target="_blank">Become a Top 1% Dev with a Top End Devs Membership</a></li></ul> <h1>Links</h1><ul><li><a href="https://paraxial.io/" rel="nofollow" target="_blank">Elixir and Phoenix Application Security Platform</a></li><li><a href="https://github.com/michalmuskala/plug_attack" rel="nofollow" target="_blank">GitHub - michalmuskala/plug_attack: A plug building toolkit for blocking and throttling abusive requests</a></li><li><a href="https://github.com/nccgroup/sobelow" rel="nofollow" target="_blank">GitHub - nccgroup/sobelow: Security-focused static analysis for the Phoenix Framework</a></li><li><a href="https://github.com/mirego/mix_audit" rel="nofollow" target="_blank">GitHub - mirego/mix_audit</a></li><li><a href="https://hexdocs.pm/hex/Mix.Tasks.Hex.Audit.html" rel="nofollow" target="_blank">mix hex.audit - Hex v2.0.6</a></li><li><a href="https://github.com/dimitarvp/trie" rel="nofollow" target="_blank">GitHub - dimitarvp/trie: A basic Elixir implementation of the Trie data structure</a></li><li><a href="https://www.elixirconf.eu/trainings/phoenix-application-security/" rel="nofollow" target="_blank">Phoenix Application Security</a></li><li><a href="https://paraxial.io/blog/securing-elixir" rel="nofollow" target="_blank">Securing Elixir/Phoenix Applications: 5 Tips to Get Started</a></li><li><a href="https://www.erlang.org/doc/man/persistent_term.html" rel="nofollow" target="_blank">persistent_term</a></li></ul> Get in touch with Michael Lubas<ul><li> michael@paraxial.io</li><li><a href="https://www.linkedin.com/company/paraxial-io/" rel="nofollow" target="_blank">LinkedIn: Paraxial.io</a></li><li><a href="https://www.linkedin.com/in/michaellubas/" rel="nofollow" target="_blank">LinkedIn: Michael Lubas</a></li><li><a href="https://twitter.com/paraxialio" rel="nofollow" target="_blank">Twitter: @paraxialio</a></li><li><a href="https://genserver.social/paraxial" rel="nofollow" target="_blank">Paraxial.io</a></li></ul> <h1>Picks</h1><ul><li>Adi - <a href="https://www.hogwartslegacy.com/en-gb" rel="nofollow" target="_blank">Hogwarts Legacy</a></li><li>Adi - <a href="https://www.rainbowresource.com/product/010674/Captain-Sonar-Game.html?gclid=CjwKCAiAioifBhAXEiwApzCzthQa3UmIE5YZgJr6YgtIG-xKKVlN404aBZqLkHLHc8zUcXMLRy8_MxoCcA0QAvD_BwE&amp;trackcode=googleBase" rel="nofollow" target="_blank">Captain Sonar Game</a></li><li>Allen - <a href="https://store.steampowered.com/app/1449320/Alfred_Hitchcock__Vertigo/" rel="nofollow" target="_blank">Alfred Hitchcock - Vertigo on Steam</a></li><li>Michael - <a href="https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw" rel="nofollow" target="_blank">3Blue1Brown (YouTube Channel)</a></li><li>Michael - <a href="https://www.gog.com/game/deus_ex" rel="nofollow" target="_blank">Deus Ex™ GOTY Edition</a></li><li>Sascha - <a href="https://discoelysium.com/" rel="nofollow" target="_blank">Disco Elysium</a></li><li>Sascha - <a href="https://github.com/ExHammer/hammer" rel="nofollow" target="_blank">GitHub - ExHammer/hammer: An Elixir rate-limiter with pluggable backends</a></li></ul>Advertising Inquiries: <a href="https://redcircle.com/brands" rel="nofollow" target="_blank">https://redcircle.com/brands</a> Privacy &amp; Opt-Out: <a href="https://redcircle.com/privacy" rel="nofollow" target="_blank">https://redcircle.com/privacy</a>

How To Secure Your Elixir Application With Michael Lubas - EMx 208

We talk with Michael Lubas about steps we can take to protect our Phoenix applications from common automated bot attacks. We cover API abuse to send email spam, carding attacks, and credential stuffing. We learn how Michael started paraxial.io which aims to specifically serve the Elixir community and more! Show Notes online - http://podcast.thinkingelixir.com/93 Elixir Community News  https://erlef.org/blog/eef/election-2022-results – Erlang Ecosystem Foundation board election voting results https://erlef.org/blog/eef/election-2022 – Previous election notice and explanations https://hexdocs.pm/ex_doc/changelog.html – ExDoc v0.28.3 was released https://twitter.com/josevalim/status/1508528099973120004 – Call to help move ExDoc away from webpack to esbuild https://twitter.com/dominicletz/status/1506675402059792388 – iOS app store now has an Elixir application deployed in it! https://podcast.thinkingelixir.com/69 – Previous interview with Dominic Letz about doing Elixir on the desktop and mobile. https://www.erlang.org/news/155 – Erlang 25.0 rc-2 was released and requesting feedback https://twitter.com/josevalim/status/1507443537851392007 – Jose Valim's experience compiling Elixir from scratch on Apple's new MacStudio M1 Max Conference reminders https://www.empex.co/mtn – Empex MTN in Salt Lake City on May 6 https://codesync.global/conferences/code-beam-sto-2022/ – CodeBEAM in Stockholm on May 19-20 https://www.elixirconf.eu/ – ElixirConf EU in London on June 9-10 https://elixirconf.com/events – ElixirConf US in Colorado on August 30-Sep2 https://github.com/lucasvegi/Elixir-Code-Smells – Elixir Code Smells - public project https://fly.io/phoenix-files/safe-ecto-migrations/ – Safe Ecto Migrations https://twitter.com/TylerAYoung/status/1508413319178297352 – Today I Learned about doctests and importing  Do you have some Elixir news to share? Tell us at @ThinkingElixir or email at show@thinkingelixir.com Discussion Resources  https://www.paraxial.io/blog/throttle-requests https://github.com/michalmuskala/plug_attack https://owasp.org/Top10/ https://github.com/magento/magento2/issues/28614 – What is a carding attack? https://owasp.org/www-project-automated-threats-to-web-applications/ http://paraxial.io/ https://frame.io/ https://news.adobe.com/news/news-details/2021/Adobe-Completes-Acquisition-of-Frame.io/default.aspx https://www.metasploit.com/ https://www.crunchbase.com/ https://owasp.org/www-community/attacks/Credential_stuffing https://en.wikipedia.org/wiki/Web_application_firewall  Guest Information  https://twitter.com/paraxialio – on Twitter https://github.com/paraxialio/ – on Github https://paraxial.io/ – Website sales@paraxial.io  Find us online  Message the show - @ThinkingElixir Email the show - show@thinkingelixir.com Mark Ericksen - @brainlid David Bernheisel - @bernheisel Cade Ward - @cadebward Sponsored By:Fly.io: Fly.io is a great place to deploy your next Phoenix application! Check them out!

We talk with Michael Lubas about steps we can take to protect our Phoenix applications from common automated bot attacks. We cover API abuse to send email spam, carding attacks, and credential stuffing. We learn how Michael started <a href="http://paraxial.io" rel="nofollow" target="_blank">paraxial.io</a> which aims to specifically serve the Elixir community and more! Show Notes online - <a href="http://podcast.thinkingelixir.com/93" rel="nofollow" target="_blank">http://podcast.thinkingelixir.com/93</a> Elixir Community News <ul> <li><a href="https://erlef.org/blog/eef/election-2022-results" rel="nofollow" target="_blank">https://erlef.org/blog/eef/election-2022-results</a> – Erlang Ecosystem Foundation board election voting results</li> <li><a href="https://erlef.org/blog/eef/election-2022" rel="nofollow" target="_blank">https://erlef.org/blog/eef/election-2022</a> – Previous election notice and explanations</li> <li><a href="https://hexdocs.pm/ex_doc/changelog.html" rel="nofollow" target="_blank">https://hexdocs.pm/ex_doc/changelog.html</a> – ExDoc v0.28.3 was released</li> <li><a href="https://twitter.com/josevalim/status/1508528099973120004" rel="nofollow" target="_blank">https://twitter.com/josevalim/status/1508528099973120004</a> – Call to help move ExDoc away from webpack to esbuild</li> <li><a href="https://twitter.com/dominicletz/status/1506675402059792388" rel="nofollow" target="_blank">https://twitter.com/dominicletz/status/1506675402059792388</a> – iOS app store now has an Elixir application deployed in it!</li> <li><a href="https://podcast.thinkingelixir.com/69" rel="nofollow" target="_blank">https://podcast.thinkingelixir.com/69</a> – Previous interview with Dominic Letz about doing Elixir on the desktop and mobile.</li> <li><a href="https://www.erlang.org/news/155" rel="nofollow" target="_blank">https://www.erlang.org/news/155</a> – Erlang 25.0 rc-2 was released and requesting feedback</li> <li><a href="https://twitter.com/josevalim/status/1507443537851392007" rel="nofollow" target="_blank">https://twitter.com/josevalim/status/1507443537851392007</a> – Jose Valim's experience compiling Elixir from scratch on Apple's new MacStudio M1 Max</li> <li>Conference reminders</li> <li><a href="https://www.empex.co/mtn" rel="nofollow" target="_blank">https://www.empex.co/mtn</a> – Empex MTN in Salt Lake City on May 6</li> <li><a href="https://codesync.global/conferences/code-beam-sto-2022/" rel="nofollow" target="_blank">https://codesync.global/conferences/code-beam-sto-2022/</a> – CodeBEAM in Stockholm on May 19-20</li> <li><a href="https://www.elixirconf.eu/" rel="nofollow" target="_blank">https://www.elixirconf.eu/</a> – ElixirConf EU in London on June 9-10</li> <li><a href="https://elixirconf.com/events" rel="nofollow" target="_blank">https://elixirconf.com/events</a> – ElixirConf US in Colorado on August 30-Sep2</li> <li><a href="https://github.com/lucasvegi/Elixir-Code-Smells" rel="nofollow" target="_blank">https://github.com/lucasvegi/Elixir-Code-Smells</a> – Elixir Code Smells - public project</li> <li><a href="https://fly.io/phoenix-files/safe-ecto-migrations/" rel="nofollow" target="_blank">https://fly.io/phoenix-files/safe-ecto-migrations/</a> – Safe Ecto Migrations</li> <li><a href="https://twitter.com/TylerAYoung/status/1508413319178297352" rel="nofollow" target="_blank">https://twitter.com/TylerAYoung/status/1508413319178297352</a> – Today I Learned about doctests and importing</li> </ul> Do you have some Elixir news to share? Tell us at <a href="https://twitter.com/ThinkingElixir" rel="nofollow" target="_blank">@ThinkingElixir</a> or email at <a href="mailto:show@thinkingelixir.com" rel="nofollow">show@thinkingelixir.com</a> Discussion Resources <ul> <li><a href="https://www.paraxial.io/blog/throttle-requests" rel="nofollow" target="_blank">https://www.paraxial.io/blog/throttle-requests</a></li> <li><a href="https://github.com/michalmuskala/plug_attack" rel="nofollow" target="_blank">https://github.com/michalmuskala/plug_attack</a></li> <li><a href="https://owasp.org/Top10/" rel="nofollow" target="_blank">https://owasp.org/Top10/</a></li> <li><a href="https://github.com/magento/magento2/issues/28614" rel="nofollow" target="_blank">https://github.com/magento/magento2/issues/28614</a> – What is a carding attack?</li> <li><a href="https://owasp.org/www-project-automated-threats-to-web-applications/" rel="nofollow" target="_blank">https://owasp.org/www-project-automated-threats-to-web-applications/</a></li> <li><a href="http://paraxial.io/" rel="nofollow" target="_blank">http://paraxial.io/</a></li> <li><a href="https://frame.io/" rel="nofollow" target="_blank">https://frame.io/</a></li> <li><a href="https://news.adobe.com/news/news-details/2021/Adobe-Completes-Acquisition-of-Frame.io/default.aspx" rel="nofollow" target="_blank">https://news.adobe.com/news/news-details/2021/Adobe-Completes-Acquisition-of-Frame.io/default.aspx</a></li> <li><a href="https://www.metasploit.com/" rel="nofollow" target="_blank">https://www.metasploit.com/</a></li> <li><a href="https://www.crunchbase.com/" rel="nofollow" target="_blank">https://www.crunchbase.com/</a></li> <li><a href="https://owasp.org/www-community/attacks/Credential_stuffing" rel="nofollow" target="_blank">https://owasp.org/www-community/attacks/Credential_stuffing</a></li> <li><a href="https://en.wikipedia.org/wiki/Web_application_firewall" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Web_application_firewall</a></li> </ul> Guest Information <ul> <li><a href="https://twitter.com/paraxialio" rel="nofollow" target="_blank">https://twitter.com/paraxialio</a> – on Twitter</li> <li><a href="https://github.com/paraxialio/" rel="nofollow" target="_blank">https://github.com/paraxialio/</a> – on Github</li> <li><a href="https://paraxial.io/" rel="nofollow" target="_blank">https://paraxial.io/</a> – Website</li> <li><a href="mailto:sales@paraxial.io" rel="nofollow">sales@paraxial.io</a></li> </ul> Find us online <ul> <li>Message the show - <a href="https://twitter.com/ThinkingElixir" rel="nofollow" target="_blank">@ThinkingElixir</a></li> <li>Email the show - <a href="mailto:show@thinkingelixir.com" rel="nofollow">show@thinkingelixir.com</a></li> <li>Mark Ericksen - <a href="https://twitter.com/brainlid" rel="nofollow" target="_blank">@brainlid</a></li> <li>David Bernheisel - <a href="https://twitter.com/bernheisel" rel="nofollow" target="_blank">@bernheisel</a></li> <li>Cade Ward - <a href="https://twitter.com/cadebward" rel="nofollow" target="_blank">@cadebward</a></li> </ul>Sponsored By:<ul><li><a href="https://fly.io" rel="nofollow" target="_blank">Fly.io</a>: <a href="https://fly.io" rel="nofollow" target="_blank">Fly.io is a great place to deploy your next Phoenix application! Check them out!</a></li></ul>