In this episode of the Elixir Mentor Podcast, I talk with Tjaco Oostdijk, a drummer turned Elixir developer now working at DPG Media, one of the largest media companies in the Netherlands. Tjaco played drums professionally from the age of seven and has taught for 22 years, before landing in software through a music distribution company writing Ruby and eventually moving to Elixir nearly a decade ago.

We get into what it takes to keep Elixir running inside a large enterprise. DPG adopted Elixir after a high-traffic Ruby service fell over at scale, and Tjaco describes the reality of working in a locked-down environment standardized on Kotlin, using Copilot with Anthropic models while waiting for Claude Code to be approved. He also talks about the colleagues who stay skeptical of AI tooling and why that skepticism can be healthy.

The heart of the conversation is muziekles.app, the application Tjaco built for Dutch music teachers to run their entire teaching practice, from year-long scheduling and student accounts to homework and assignments. He explains why he deliberately keeps payments out of the product, how he thinks about onboarding teachers, and the build process using Phoenix, Ash, Claude Code, and Tidewave. We also compare notes on shipping side projects fast, multi-tenancy in Ash, and the differences between hardware and software work.

If you are building with Elixir inside a company that hasn't standardized on it, or shipping a side project with AI tooling, this conversation is full of practical, hard-won lessons from someone doing both at once.

Connect with Tjaco:
- Website:https://drumusician.com
- X / Twitter:https://x.com/drumusician
- GitHub:https://github.com/drumusician
- LinkedIn:https://www.linkedin.com/in/tjaco-oostdijk

Resources Mentioned:
- muziekles.app:https://muziekles.app
- Tidewave:https://tidewave.ai
- Vocablo:https://vocabloapp.com
- Kabisa:https://kabisa.nl

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com

Peter Ullrich returns to talk about a CVE hunt across the most-downloaded Hex packages, run with Claude Code on Opus 4.7. After ElixirConf EU pulled him into AI security, he started pointing Opus at popular libraries day and night, and within half an hour of his first serious attempt he found the Decimal vulnerability, where raising 10 to a huge power can blow up an application's memory.

We get into what separates a real CVE from noise, how CVSS scoring works, and why reachability matters so much, since a flaw in Phoenix's default configuration is far more serious than a crash in a function nobody can call. Peter also walks through the process he runs with the EEF: verifying each issue, getting a second pair of eyes, coordinating a fix, and getting a number issued through a CNA, all while avoiding slop reports to maintainers. There's also a candid stretch on regulation and breach reporting.

From there it widens out, including how Opus compares to Mythos, why Peter keeps coming back to Claude, his first impressions of Opus 4.8, and the economics, with a simple scan costing about $10 in API tokens. He also shares his Session Watcher plugin, an update on Killswitch and its browser-side encryption, thoughts on AEO, and how he uses dev containers to sandbox coding agents.

Resources Mentioned:
- The blog post that started this:https://peterullrich.com/what-the-cve
- Peter's prompts:gist
- Scrutineer:github.com/alpha-omega-security/scrutineer
- Decimal advisory:GHSA-rhv4-8758-jx7v
- EEF CNA published CVEs:cna.erlef.org/cves
- EEF CNA security policy:cna.erlef.org/security-policy
- Responsible disclosure guidelines:security.erlef.org
- Anthropic article (the basis):red.anthropic.com

Connect with Peter:
- Website:peterullrich.com
- GitHub:github.com/pjullrich
- LinkedIn:linkedin.com/in/pjullrich
- Bluesky:@peterullrich.com

Thanks to our sponsors:
- BEAMOps:beamops.co.uk
- Paraxial.io:paraxial.io

SUPPORT ELIXIR MENTOR
- Elixir Mentor:elixirmentor.com

In this episode of the Elixir Mentor Podcast, I sit down with Jason Allum, creator of Bedrock and Beadwork and a 40-year veteran of computing, to talk about Bedrock: an embedded, distributed key-value store for Elixir with guarantees that go beyond ACID.

Jason walks through the problem Bedrock solves, keeping distributed state consistent when the same data is read and written across many nodes. We get into why the BEAM's decades-old ideas map cleanly onto today's AI and agent workloads, how Bedrock borrows its architecture from FoundationDB, and what serializable transactions actually buy you over plain ACID.

From there we dig into the machinery: log servers versus storage servers, the five-second version window and MVCC, letting it crash with supervision-tree thinking across a cluster, and how rows can live as values while indexes become keys. Jason also covers running distributed jobs with leases and what it takes to swap Postgres out for Bedrock.

Along the way Jason makes the case that none of this is magic, that the real wins come from understanding your machine and the shape of your data. We finish on Beadwork, his lightweight system for managing agent tickets directly in git. If you build with Elixir or care about distributed databases, there's a lot here to chew on.

Connect with Jason:
- X/Twitter:https://x.com/mullaj
- GitHub:https://github.com/jallum

Projects:
- Bedrock:https://github.com/bedrock-kv/bedrock
- Beadwork:https://github.com/jallum/beadwork

Resources Mentioned:
- Notes on the FoundationDB paper:https://uvdn7.github.io/notes-on-the-foundationdb-paper/
- FoundationDB architecture:https://apple.github.io/foundationdb/architecture.html
- Raft consensus algorithm (GeeksforGeeks):https://www.geeksforgeeks.org/system-design/raft-consensus-algorithm/
- The Raft Consensus Algorithm:https://raft.github.io/

Sponsors:
- BEAMOps:https://beamops.co.uk
- Paraxial.io:https://paraxial.io
- Jido (Elixir AI Collective Discord):https://agentjido.xyz/discord

SUPPORT ELIXIR MENTOR
- Elixir Mentor:https://elixirmentor.com