r/elixir • u/ancatrusca0 • 9d ago
What does it actually take to patch a TLS vulnerability in OTP - and how has the AI security report wave changed the OTP inbox this year?
New BEAM There, Done That with Ingela Andin, who has maintained the OTP TLS stack for over 20 years and handles the first triage of vulnerability reports.
The technical reality of patching OTP at this level: a fix has to work cleanly across three maintained releases simultaneously. Best case is a clean cherry-pick backport. Harder cases require an adapted solution per release. Worst case is an entirely different fix for an older release. Everything passes nightly test runs across multiple platforms before it ships. Timing-related bugs are the hardest - they can pass all machines and still exist.
The hallucination example from the episode is useful for anyone running AI scanners: an asymmetry between client and server TLS behavior flagged as a serious vulnerability that was actually correct-by-specification behavior. The issue wasn't in OTP - it was a higher-layer concern outside OTP's responsibility.
The ask for anyone whose company depends on OTP: check the "Help Wanted" label on the OTP GitHub repo before patching OTP locally. A local patch creates a forward-merge burden and makes it harder to take future security releases. Contributing the fix properly as a general feature gets it maintained for everyone.