hex

I'd love to point you at some code from work but it's all closed source unfortunately. One example that gets used is https://github.com/hexpm/hex which is the code behind the Elixir package management website. It's more a good example of a Phoenix app than it is general OTP stuff, but there are some GenServers in there.

For point #3, take a look at Hex[0] which is a package manager for the erlang/elixir ecosystem. [0] https://github.com/hexpm/hex

You'll find a large number of these packages are actually Elixir, as hex is the native Elixir package manager :) Lovely to see this becoming more mainstream, and good marketing choice by Eric by making it the "Erlang ecosystem package manager". If you're interested, the package manager[0] and website/API[1] are open source. [0] https://github.com/hexpm/hex [1] https://github.com/hexpm/hex_web

An interesting coincidence is I noticed what I thought (and maybe is) a similar bug in the elixir hex module on the same day that this bug report was submitted to openssl. If you look at the hex partial chain method (https://github.com/hexpm/hex/blob/master/lib/hex/api.ex#L59-...) you can see it goes through all the certificates the other party supplied starting from the first one and tries to find one that is signed by a certificate in the trust store. it then explicitly returns it as the trusted_ca which effectively means the certificate has the CA bit set on it. in order to exploit the attack in hex you need find a CA that will directly issue certificates off of a certificate in a trust store. apparently, this is not the recommended policy for CAs. so I made this tweet: (https://twitter.com/benmmurphy/status/613733887211139072) 'does