299: Don't Paste That Into Your Terminal

The Erlang Ecosystem Foundation is seeking community support for a major grant to fund the Ægis security project and the deadline is April 17th to show support, Hex.pm published the results of its first-ever comprehensive third-party security audit revealing three high-severity findings that have since been fixed, José Valim unveils a massive Tidewave update including UI Variants and a new "vision" mode that lets your coding agent take screenshots and record videos of your web app, Hex.pm gains the ability to serve llms.txt files for Elixir and Erlang packages, Remote releases a new Elixir LSP called Dexter written in Go, Lotus gets significant updates as an embeddable BI engine for Phoenix apps, Ghostty terminal emulator bindings land in Elixir bringing GenServer-based terminals to LiveView, and we discuss the alarming ClickFix supply chain attack that compromised Axios and what it means for open source maintainers everywhere, and more!

Show Notes online - http://podcast.thinkingelixir.com/299

Elixir Community News

https://paraxial.io/ – Paraxial.io is sponsoring today's show! Sign up for a free trial of Paraxial.io today and mention Thinking Elixir when you schedule a demo for a special offer.

https://marketing.erlef.org/news/grant-petition.html – The Erlang Ecosystem Foundation is seeking community backing for a grant that would fund two full years of work on the Ægis security project — improving how packages are published, verified, and trusted across Hex and the broader ecosystem. The deadline to show support is April 17th.

https://hex.pm/blog/security-audit – Hex.pm published the results of its first comprehensive third-party security audit, made possible by Alpha-Omega under the OpenSSF. Two firms — Paraxial.io and zentrust partners GmbH — reviewed the Hex registry, clients, documentation infrastructure, and supporting systems. Three high-severity issues were found and have all been fixed.

https://paraxial.io/blog/hex-pentest – Michael Lubas of Paraxial.io shares details of the white-box penetration testing performed on Hex.pm as part of the Ægis security audit.

https://hex.pm/reports/2026/zentrust.pdf – The published report from zentrust partners GmbH covering their adversarial/red-team style assessment of Hex.pm, including 3 high-severity findings (all now fixed) plus medium and low severity items.

https://x.com/josevalim/status/2042245524116439169 – José Valim announces a massive update to Tidewave, teasing several days of videos and screenshots covering new features.

https://hexdocs.pm/tidewave/ui_variants.html – Documentation for Tidewave's new UI Variants feature, which lets your coding agent build different versions of a page or UI component so you can pick and refine your favorite — all integrated directly in the browser.

https://www.youtube.com/watch?v=8px8GdpID74 – Video demo of Tidewave's new UI Variants feature in action.

https://x.com/adamwathan/status/2041977909502489060 – Adam Wathan (creator of TailwindCSS) shows off ui.sh, a set of skills for creating UIs in coding agent CLIs like Claude Code and Codex — noted as a comparison point to Tidewave's more integrated, browser-native experience.