B
Bruce Li
Guest
Theo de Raadt built OpenSSH and OpenBSD for a world he didn't trust. It cost him NetBSD, a DARPA grant and many friends. The world moved in anyway.
I. Half a Second
Until the last days of March 2024, almost nobody outside a small circle of programmers had heard of liblzma. It was a compression library, a piece of plumbing buried deep in Linux, and for two years someone had been preparing to use it to walk through the front door of the internet.
He called himself Jia Tan. He was patient. He wrote helpful patches and was polite to an exhausted volunteer maintainer, and in time he was given the keys. Then he began to build. The payload went into the release tarballs in pieces, disguised as test files. It was aimed at OpenSSH, the program that guards remote access to nearly every server on Earth.
It nearly worked. What stopped it was half a second.
Andres Freund, an engineer at Microsoft, noticed that SSH logins on his Debian test machine were burning about five hundred milliseconds more CPU than they should. Most people would have let it go. Freund didn't. He followed the delay down through the SSH daemon, through systemd, and into liblzma, and at the bottom he found the backdoor.
He posted the disclosure to the oss-security list on March 29. Within hours Red Hat issued an urgent advisory and Debian rolled back. At banks, cloud providers and hospital networks, engineers were pulled out of bed with the same question: are we exposed?
In Calgary, on the high plains of southern Alberta, one operating system was not asking.
OpenBSD had never been in the blast radius. The attack depended on a chain. Linux distributions had patched their SSH daemons to talk to systemd, systemd pulled in liblzma, and liblzma carried the poison into the daemon's memory. OpenBSD had never let systemd in. For nearly a decade it had wrapped its programs in restraints called pledge and unveil. Under those rules, a program that reached for anything it hadn't declared in advance was killed by the kernel.
Nine years earlier, at a conference in Quebec, the man who built that system had named the danger. He didn't speak of compressors in general. He named this one. "Especially with compressors like XZ," he said, "which had 2 memory system vulnerabilities in the last year…"
Nobody had taken much notice at the time.
His name is Theo de Raadt. He has called Richard Stallman "a lying cheating hypocrite" and called Linux "garbage." The first project he helped found threw him out. A single sentence to a newspaper cost him a million dollars of Pentagon money. And his code is almost certainly running on the machines that hold your bank balance, your medical records and the servers that delivered this page. He trusts almost no one. That is why so many others can afford to trust.
II. Exile
It begins with a departure. Theo de Raadt was born in Pretoria, South Africa, on May 19, 1968, the eldest of four children of a Dutch father and a South African mother. In 1977 the apartheid state was at war with its own people, and every white boy had two years of compulsory military service waiting in his future. In November that year the family left for Calgary. It was the boy's first lesson in security, and the oldest one. When the system is rotten, you don't negotiate with it. You leave.
When the Alberta oil economy collapsed in 1983, the family moved again, for a time, to the Yukon. By then he had a Commodore VIC-20, five kilobytes of memory that plugged into a television. There was no internet to ask and no one to call. Get one byte wrong and the machine locked up. Economies collapse and people fail you, but the machine is exact. For a boy uprooted twice, correctness wasn't a matter of taste. It was shelter.
He finished a computer science degree at the University of Calgary in 1992. In 1993 the free Unix world was a frontier town. AT&T and Berkeley were fighting in court over who owned the code, and a few hackers were trying to turn 386BSD, a free Unix for the cheap Intel PC, into something that actually worked. Four of them broke away: Chris Demetriou, Adam Glass, Charles Hannum and Theo de Raadt. They called their project NetBSD.
De Raadt poured himself into it. With Chuck Cranor he built the Sun SPARC port, and when NetBSD 1.0 shipped in October 1994 as the project's first multi-platform release, much of that portability had his fingerprints on it.
Then there were the mailing lists. On a mailing list, de Raadt was a blowtorch. A developer sent a patch he considered sloppy, and it came back stripped to the bone. He was usually right, which made it worse.
On December 20, 1994, the rest of the NetBSD core team revoked his access to the source repository. The project had locked out one of its own founders. Adam Glass wrote to the netbsd-users list:
Glass conceded that de Raadt had "written too much code to mention." That changed nothing. Years later Charles Hannum looked back: "I was certain it was going to bite us in the ass. I think the question for historians is not whether it did bite us in the ass, but how many times and how hard."
De Raadt made a rule. He would never again build anything whose keys another person could take from him.
III. Year Zero
October 1995, in Calgary. De Raadt took the NetBSD source, the same code he'd been locked out of, and forked it. The license permitted it, so no one could stop him. He called the new project OpenBSD.
This time there was no core team with the power to remove him. Releases came every six months, on schedule. The code was audited constantly, line by line across the whole tree, and when one bug was found, the team hunted down every other instance of that kind of mistake. Features came second. So did performance, hardware support and feelings. Only one question mattered: can this be broken?
The mascot is a pufferfish called Puffy. It looks cute enough for a T-shirt, but a pufferfish survives by swelling into a ball of spines and being poisonous.
OpenBSD turned paranoia into an engineering method, which it called proactive security. All code is assumed guilty. All networks are hostile. When something looks wrong, the program dies at once and loudly, because a crash can be recovered from and a compromise may not be. The default install turns almost nothing on.
Then de Raadt put a boast on the front page of the website, where every attacker on Earth could read it: "Five years without a remote hole in the default install!" In 2002, Mark Dowd found a flaw in OpenSSH, and in 2007 Alfredo Ortega found a second hole in the network stack. The slogan became:
"Only two remote holes in the default install, in a heck of a long time!"
That is two remote holes in more than a decade. The people who called him paranoid have their answer.
IV. The Padlock
Until the mid-1990s, the internet ran unencrypted. System administrators logged into remote machines with Telnet or rlogin, and every keystroke crossed the wire in cleartext, root passwords included. In 1994, a CERT advisory described intruders who had quietly collected login credentials for tens of thousands of systems.
In 1995, Tatu Ylönen at the Helsinki University of Technology wrote the Secure Shell, which encrypted the session and verified the server with cryptographic keys. He released it free, then founded a company, and the license began to tighten. By 1999 new versions carried commercial restrictions.
For de Raadt, this was intolerable. A company would hold the keys to everyone's front door.
The OpenBSD developers found an old version of Ylönen's code, 1.2.12, that was still under a free license. OpenBSD 2.6 was due to ship in less than two months, and de Raadt decided it would ship with an SSH that was entirely free. Niels Provos drove up to Calgary again and again to strip out restricted and GPL-licensed code. In Germany, Markus Friedl rewrote the protocol support. They had no office and no investors, only a deadline they had set themselves.
On December 1, 1999, OpenBSD 2.6 shipped with OpenSSH 1.2.2.
What happened next was never part of the plan. Damien Miller and Philip Hands ported the code to Linux and other Unix systems. The code was free, the paranoid team had audited it, and so everyone took it. It went into Linux, Solaris, AIX and macOS, and into millions of routers, firewalls and appliances. By 2008 a survey found it on more than 80 percent of SSH servers. In 2018 Microsoft built it into Windows 10.
A man who had been thrown out of his own project had built a fortress for himself and a few like-minded paranoiacs. He ended up making the lock the whole world uses. He built it to keep the world out, and the world moved in.
The industry built fortunes on it. In 2004, accepting an award from the Free Software Foundation, de Raadt noted that the hardware vendors who used OpenSSH in all their products had given the project "a total of one laptop" in five years. "And asking them for that laptop took a year. That was IBM."
V. Half a Cruise Missile
A University of Pennsylvania security project called POSSE had won a $2.125 million grant from DARPA, the Pentagon's research agency. The government wanted hardened, open security software, and it chose OpenBSD. About $1 million went to de Raadt's project, which had lived on donations and CD-ROM sales. The money meant survival.
In March 2003 the United States invaded Iraq. In April a reporter from the Globe and Mail called de Raadt and asked how he felt about taking military money.
With a million dollars at stake, the expected answer was gratitude, and then silence. De Raadt said this:
Within days DARPA cut off the funding. The million dollars was gone.
De Raadt did not retract anything. He would not put a closed, unaudited binary in his kernel, and he would not put an unaudited opinion in his mouth either. His independence was part of the security model. If someone else's money could decide what he said, it could decide what he shipped.
VI. Nasty Things
If he would do that to the Pentagon, his peers could expect no better.
He saw Linux as everything wrong with software: features, hardware support and market share first, security as an afterthought. "It's terrible, everyone is using it, and they don't realize how bad it is," he told Forbes in 2005. Linus Torvalds answered in kind, calling the OpenBSD crowd "a bunch of masturbating monkeys" who made such a big deal of security that they "pretty much admit that nothing else matters to them." In Calgary it read as a fair description.
Then there were the blobs: secret firmware that Wi-Fi chips and network cards need, loaded into the device with high privileges and never shown to anyone outside the vendor. Linux mostly accepts them. De Raadt refused, because a blob might contain a bug or a backdoor and no one was allowed to look. He went after the hardware vendors in public, by name. At a conference in Melbourne, an HP executive warned him: "If you say nasty things like that to vendors you're not going to get anything."
The shaming worked. Several major Taiwanese wireless chipmakers opened their documentation, and free drivers followed for every open system, Linux included. Almost nobody thanked him.
Then there was Richard Stallman. De Raadt considered the GPL's copyleft a leash dressed up as freedom; OpenBSD used permissive licenses that let anyone use the code for anything, which is how OpenSSH ended up everywhere. In 2007 Stallman accused OpenBSD of steering users toward non-free software. De Raadt's reply ended: "Richard, you are a lying cheating hypocrite."
Hardly anyone speaks to Stallman that way. De Raadt does, because nothing stands between what he believes and what he types. It is the same trait that kept him from lying to the Globe and Mail and keeps him from shipping a blob.
In December 2010 that trait was tested from the other side. A former FBI consultant emailed de Raadt alleging that the FBI had paid contractors to plant backdoors in OpenBSD's IPsec code a decade earlier. An ordinary organization would have hired lawyers and hoped the story never got out. De Raadt forwarded the email, complete, to the public openbsd-tech mailing list. "I refuse," he wrote, "to become part of such a conspiracy." The audit that followed found real bugs but no confirmed backdoor. When the fortress was accused, it opened wider.
VII. Valhalla
In April 2014 the internet began to bleed.
Heartbleed was a flaw in OpenSSL, the library behind the padlock icon on most encrypted web traffic. An attacker anywhere could read back pieces of a server's memory: passwords, session cookies, private keys. The library protecting the world's credit card numbers turned out to be maintained by a small, exhausted team living on roughly $2,000 a year in donations.
De Raadt had never believed that "given enough eyeballs, all bugs are shallow." He didn't file a bug report. The OpenBSD team forked OpenSSL and called the fork LibreSSL.
What followed was a purge, logged on a blog called the "OpenSSL Valhalla Rampage." In the first week they cut more than 90,000 lines of C. Support for Classic Mac OS, NetWare, OS/2, 16-bit Windows and VMS went. "99.99% of the community does not care for VMS support," de Raadt said. "Code must be simple."
It was the same pattern as OpenBSD after NetBSD and OpenSSH after SSH Communications. When he was handed something rotten, he didn't negotiate. He forked it, gutted it and built a new wall.
VIII. The Walls Within the Walls
Most people never see OpenBSD itself. What reaches them are its ideas, which tend to leave Calgary and turn up years later, often uncredited, in other operating systems. PF, OpenBSD's packet filter, has shipped on every Mac since 2011. OpenSSH comes installed by default with Windows Server 2025.
The principle behind them is simple: complexity is the enemy of security. Programmers will make mistakes, so you build walls inside the walls.
- strlcpy and strlcat (1999): safer string functions that Linux's C library refused for 24 years, until glibc 2.38 quietly added them in 2023.
- Privilege separation: OpenSSH splits in two, so an attacker who breaks the network side finds himself locked in a cell without root.
- W^X: memory can be writable or executable, never both, so injected code cannot run.
- pledge (2015) and unveil (2018): a program declares in advance which system calls and files it will use. If it is hijacked and reaches for anything else, the kernel kills it.
Don't trust anyone's code, including your own. Make every program declare what it will do, and have the kernel kill it if it does anything else.
IX. Half a Second, Again
Back to Calgary at the end of March 2024. The Linux world is still cleaning up, pulling packages and rebuilding from clean sources. Somewhere, the people who built the backdoor have watched more than two years of work undone over half a second.
The fortress on the prairie is untouched.
Luck has nothing to do with it. A boy who had already been uprooted twice decided that nothing could be trusted unless he understood it all the way down. A young man locked out of the project he helped build resolved that no one would ever hold his keys again. He refused systemd, blobs, the GPL, and the Pentagon's money once he felt its strings. And in Quebec in 2015 he said the letters XZ aloud.
The traits cannot be separated. The paranoia that got him expelled from NetBSD built OpenBSD. The contempt that made vendors flinch produced free Wi-Fi drivers for everyone. The lack of any filter between his conscience and his mouth cost him the DARPA money and brought the FBI allegation into the open. The arrogance that wrote "lying cheating hypocrite" looked at Heartbleed and decided to rewrite OpenSSL.
At FISL in Porto Alegre, 2007, Jon "maddog" Hall presents Theo de Raadt with a pair of red devil horns.
By most accounts he is not a nice man, and he would probably not want to be called one. Nice men take the DARPA money and say nothing, ship the blobs, keep the old code, and leave the FBI letter in a drawer. Nice men have written most of the world's software, and that software is in poor shape.
Near the center of the internet, where the most sensitive traffic passes, is a lock made in Calgary by a man who trusts no one. It holds while systems worth billions fail around it. It holds because its maker assumed, every working day, that someone was coming to break it.
He was right more often than not.
This is a shortened version. The full story, with the complete list of 64 sources, is at zbruceli.org.
A note on method: this piece uses reconstructed scenes and dramatic compression. The events, dates, figures, and quotations come from the sources listed in the full version. The interior thoughts attributed to Theo de Raadt are the author's reconstruction, not reported fact.
Image Credits
- dunnottar-graded.jpg — Dunnottar Castle, Aberdeenshire, Scotland (converted to black and white; adaptation shared under the same license). Stratos Filalithis / Wikimedia Commons, CC BY-SA 4.0, https://commons.wikimedia.org/wiki/File:Dunnotar_Castle_with_clouds.jpg
- theo-de-raadt-bw.jpg — Theo de Raadt speaking at ruBSD 2013, Moscow (cropped and converted to black and white). FAndrey / Wikimedia Commons, CC BY 2.0, https://commons.wikimedia.org/wiki/File:Theo_de_Raadt_2013.jpg
- puffy.png — Puffy, the OpenBSD mascot (3D render) (converted to black and white). art.gnux.info / Wikimedia Commons, CC BY 1.0, https://commons.wikimedia.org/wiki/File:Puffy.png
- openssh-logo.png — OpenSSH logo (converted to black and white). OpenSSH / OpenBSD project, used for identification, https://www.openssh.com/
- tomahawk-2003.jpg — USS Donald Cook (DDG 75) launches a Tomahawk toward Iraq, 21 March 2003 (converted to black and white). U.S. Navy photo by Chief Journalist Alan J. Baribeau / Wikimedia Commons, Public domain, https://commons.wikimedia.org/wiki/...initial_stages_of_Operation_Iraqi_Freedom.jpg
- libressl.png — LibreSSL logo (converted to black and white). LibreSSL / OpenBSD project, used for identification, https://www.libressl.org/
- theo-de-raadt-2.jpg — Jon "maddog" Hall gives Theo de Raadt a set of red plastic horns, FISL 8, Porto Alegre, 2007 (converted to black and white; adaptation shared under the same license). Randal Schwartz / Wikimedia Commons, CC BY-SA 2.0, https://commons.wikimedia.org/wiki/File:Jon_"maddog"_Hall_gives_Theo_de_Raadt_a_set_of_red_plastic_horns.jpg