Theo de Raadt: The Man Who Built the Internet's Locks

Theo de Raadt is the creator of OpenSSH and OpenBSD, two widely used open-source software projects. He built these projects for a world he did not trust, which led to the loss of his involvement with NetBSD and many friends. Despite the setbacks, the world continued to move forward. In early March 2024, a man known as Jia Tan created a backdoor in liblzma, a compression library hidden within Linux.

Tan was patient and polite, gaining the trust of an exhausted maintainer before introducing his malicious code. The backdoor went undetected for two years, affecting nearly every server on Earth that used OpenSSH. It was discovered by Microsoft engineer Andres Freund, who noticed an unusual increase in CPU usage during SSH logins.

Upon investigation, Freund found the backdoor in liblzma, and it was quickly addressed by Red Hat and Debian. OpenBSD, however, remained unaffected because it had never integrated systemd, which was part of the attack chain. The attack highlighted the importance of trust and security in software development, with Theo de Raadt's code potentially running on critical systems such as banks, hospitals, and medical records.