<

Bram Verburg

Relentless '{verify, verify_peer}' ssl option advocate

Bram is a developer, architect and security advocate with more than 20 years experience delivering complex software platforms for the telecom and financial industries, meeting their stringent security and reliability requirements. He has been using Erlang, and later Elixir, for almost 10 years.

As a security advocate he has taken an interest in the security aspects of the Erlang/OTP ecosystem, as a blogger (at https://blog.voltone.net/), trainer, speaker, and open source contributor. Bram is a founding member of the Security WG of the Erlang Ecosystem Foundation.

Past Activities

Bram Verburg
Code BEAM SF
05 Mar 2020
14.35 - 15.20

Off BEAM: Secure software development

The BEAM platform lets us develop uniquely robust systems for mission critical applications. But in the presence of malicious users, even a BEAM application is only as strong as its weakest link.

In this talk Bram will look at best practices for secure coding specifically for the BEAM ecosystem. He will cover Erlang, Elixir and several popular 3rd party frameworks and libraries.

THIS TALK IN THREE WORDS

BEAM

Security

Practices

OBJECTIVES

Help people identify potential weaknesses in their applications early in the product lifecycle and offer actionable advice.

TARGET AUDIENCE

Anyone developing applications that may be subject to malicious users or random attacks.

Bram Verburg
Code BEAM Lite Amsterdam 2018
30 Nov 2018
15.15 - 15.35

Learn you some 'ssl' for much security!

Erlang/OTP's built-in 'ssl' application forms the basis of many client and server packages. Unfortunately it has quite a few quirks, potentially leading to weak (or even broken) security. Many higher layer packages expose the 'ssl' application's socket options directly, with no additional defaults and little guidance on how to use them.

This talk highlights the most important client and server settings for 'ssl' sockets, how the defaults have evolved across OTP versions, and how popular libraries build on them. Topics include cipher suite selection, server hostname verification, known certificate issues (wildcard SAN, cross-signed CA), revocation checks, ECDSA servers, and more.

Practical code samples are given in Erlang and/or Elixir, as applicable.

OBJECTIVES

Learn to apply secure TLS configurations to clients and servers, either directly with the OTP 'ssl' application or through the many libraries that rely on it: Ranch, Cowboy, Plug, Phoenix, httpc, Hackney, HTTPoison, etc.