shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

269
active users

#erlang

0 posts0 participants0 posts today

Here's the customary #introduction: i'm into #C and tolerate C++ on a daily basis at work, i've also used others like java, kotlin, python, PHP, etc and am curious about #COBOL, #AdaLanguage and #erlang.

My dislike of jenkins is only surpassed by my hate of githubactions and everything MS-related. AI is not I, only A. I'm interested in #selfhosted stuff but atm that's a VPS with some sites, which doesn't really count. For now #syncthing is quite useful and #wireguard is on the horizon once i reformat/reinstall my current #gentoo (i'll keep the root #ZFS aproach and am on the fence regarding #XFCE or #KDE), would be interesting to have a barebones #KVM/#QEMU running all the stuff and i digress.

kthxbai\0

New GreyNoise Labs research: CVE-2025-4748

Our team demonstrates how path traversal via zip archives can be used to achieve file write and code execution against Erlang OTP environments, exploiting CVE-2025-4748. This technique leverages the zip:unzip function when untrusted zip files are extracted.

Read the full technical breakdown here: labs.greynoise.io/grimoire/202

GreyNoise LabsExploiting Erlang OTP with Zip files: CVE-2025-4748 – GreyNoise LabsImproper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation

That’s not so super exciting once you know the true cause of all of this.

The believe and full trust in the ten times programmer who then fucks up and wrecks it all with just a single debug line of code that went unnoticed.

But sure let’s write a whole book about it because we‘re old white guys and can’t admit to failure.

mastodon.social/@lobsters/1146

I haven’t read it, so now come and grill me!

MastodonLobsters (@lobsters@mastodon.social)Why I Wrote the BEAM Book https://lobste.rs/s/wcnixg #book #erlang https://happihacking.com/blog/posts/2025/why_I_wrote_theBEAMBook/

Is Node.js the future of backend development, or just a beautifully wrapped grenade?

Lately, I see more and more backend systems, yes, even monoliths, built entirely in Node.js, sometimes with server-side rendering layered on top. These are not toy projects. These are services touching sensitive PII data, sometimes in regulated industries.

When I first used Node.js years ago, I remember:
• Security concepts were… let’s say aspirational.
• Licensing hell due to questionable npm dependencies.
• Tests were flaky, with mocking turning into dark rituals.
• Behavior of libraries changed weekly like socks, but more dangerous.
• Internet required to run a “local” build. How comforting.

Even with TypeScript, it all melts back into JavaScript at runtime, a language so flexible it can hang itself.

Sure, SSR and monoliths can simplify architecture. But they also widen the attack surface, especially when:
• The backend is non-compiled.
• Every endpoint is a potential open door.
• The system needs Node + a fleet of dependencies + a container + prayer just to run.

Compare that to a compiled, stateless binary that:
• Runs in a scratch container.
• Requires zero runtime dependencies.
• Has encryption at rest, in transit, and ideally per-user.
• Can be observed, scaled, audited, stateless and destroyed with precision.

I’ve shipped frontends that are static, CDN-delivered, secure by design, and light enough to fit on a floppy disk. By running them with Node, I’m loading gigabytes of unknown tooling to render “Hello, user”.

So I wonder:
Is this the future? Or am I just… old?

Are we replacing mature, scalable architectures with serverless spaghetti and 12-factor mayhem because “it works on Vercel”?

Tell me how you build secure, observable, compliant systems in Node.js.
Genuinely curious.
Mildly terrified and maybe old.

The #s390x open source software team at IBM confirms the latest versions of various software packages run well on #Linux on #IBMZ & #LinuxONE

In March 2025 validation was maintained for over 30 projects, including #Ansible, #Apache Tomcat, & #Erlang 🎉

Plus, community CI was added for segyio, and Rust's linux_syscall project now publishes s390x releases on crates.io

Full report + how your project can apply for a s390x VM: community.ibm.com/community/us

community.ibm.com · Linux on IBM Z and LinuxONE Open Source Software Report: March 2025

Having packages/modules be defined as single files is a fundamental programming language design error. #Python, but also #Erlang, #Scheme, the misguided package-inferred-system extension for #CommonLisp… Because no one wants a 10k lines file mixing dozens of concepts, you end up with a multitude of small packages for no good reason.

At least in Erlang you can just use whatever was loaded without manually importing every single module you need everywhere, but Python is as usual the worst.

Replied in thread

@marick not me, but thanks to your wikipedia link and @k9ox 's link to #elixir / #erlang behaviours, maybe several things are is starting to fall into place.
FYI I remember @marcevers being keen on DCI, but it didn't speak to me at the time. I now see links with the kind of designs that flow from #EventStorming . And somehow behaviours in #elixir make sense. I was programming a distributed system in #PhoenixLiveView without noticing (until the book pointed it out, that is :-) ) .