OpenSSH Ships on Every Mac, Linux Server and Windows PC. Its Creator Trusts No One.

October 05, 2026 · 36 min read OpenSSH creator Theo de Raadt was pushed out of NetBSD, lost a DARPA grant and fought half of open source. Now his paranoid code guards the world's servers.I. Half a SecondUntil the last days of March 2024, almost nobody outside a small circle of programmers had heard of liblzma. It was a compression library, a piece of plumbing buried deep in Linux, and for two years someone had been preparing to use it to walk through the front door of the internet.He called himself Jia Tan. He was patient. He wrote helpful patches. He was polite to an exhausted volunteer maintainer, and useful, and always there, and in time he was given the keys. Then he began to build. The payload went into the release tarballs in pieces, obfuscated and disguised as test files. It was aimed at OpenSSH, the program that guards remote access to nearly every server on Earth. Once the code shipped in the stable releases of the major Linux distributions, whoever held the private key could let himself into a large share of the world's machines.It nearly worked. What stopped it was half a second.Andres Freund, an engineer at Microsoft, noticed that SSH logins on his Debian test machine were burning about five hundred milliseconds more CPU than they should. Most people would have let it go. Freund didn't. He followed the delay down through the SSH daemon, through systemd, and into liblzma, and at the bottom he found the backdoor.He posted the disclosure to the oss-security list on March 29. Within hours the Linux world was doing triage. Red Hat issued an urgent advisory. Debian rolled back. At banks, cloud providers and hospital networks, engineers were pulled out of bed to tear open their build pipelines. They were all asking the same question: are we exposed?The city of Calgary sits on the high plains of southern Alberta, where the prairie runs flat to the east and the Rockies stand to the west like a wall. In winter the cold comes down hard and stays. Sometimes a wind called the Chinook pours off the mountains, warm and dry, and lifts the temperature twenty degrees in an afternoon. Snowbanks rot to slush by dark. Locals say the Chinook brings migraines and short tempers, and that dogs won't settle while it blows. It arrives without warning, and nobody asks for it.Here, one operating system was not asking.OpenBSD had never been in the blast radius. The attack depended on a chain. Linux distributions had patched their SSH daemons to talk to systemd, systemd pulled in liblzma, and liblzma carried the poison into the daemon's memory. OpenBSD had never let systemd in. It had never tied that dependency to its most sensitive process. For nearly a decade it had wrapped its programs in restraints called pledge and unveil. Under those rules, a program that reached for anything it hadn't declared in advance was killed by the kernel.Nine years earlier, at a conference in Quebec, the man who built that system had stood before a room and named the danger. He didn't speak of compressors in general. He named this one.

The first project he helped found threw him out. A single sentence to a newspaper cost him a million dollars of Pentagon money. And his code is almost certainly running on the machines that hold your bank balance, your medical records and the servers that delivered this page. He lives far from the centers of the technology industry, in a city known for cattle and oil. He trusts almost no one. That is why so many others can afford to trust.II. The Boy Who Left Before the Army CameIt begins with a departure.Pretoria, South Africa, 1977. Soweto burned the year before. The apartheid state is at war with its own people and its neighbors, and every white boy in the country has a date waiting in his future: two years of compulsory service in that army. Theo de Raadt was born on May 19, 1968. He is the eldest of four children of a Dutch father and a South African mother. He is nine, so the draft is still a decade away. The family doesn't wait.In November 1977 they leave for Calgary. It is the boy's first lesson in security, and the oldest one. When the system is rotten, you don't negotiate with it. You leave.A boy from the Highveld steps off a plane into a prairie November, into a cold that hurts your teeth under a white, enormous sky. He learns it. In 1983 the ground moves again. Canada falls into its worst recession since the Depression, the Alberta oil economy collapses, and the family relocates for a time to the Yukon, where caribou outnumber people and the winter light lasts only a few hours.By then he has a computer. It is a Commodore VIC-20, a wedge of beige plastic with five kilobytes of memory that plugs into a television. It speaks BASIC and, for the serious, 6502 machine code. It forgives nothing. There is no internet to ask and no one to call. There is the manual and the cursor. If you get one byte wrong the machine locks up, and you start again.An Amiga comes later. But the VIC-20 is the one that counts. The family has been uprooted twice. The country is still foreign, and the land outside is as hard and clean as a sheet of ice. Economies collapse and people fail you, but the machine is exact. Understand it down to the last register and it will never betray you.For a boy teaching himself to program alone in the northern dark, correctness isn't a matter of taste. It is shelter.He returns to Calgary and finishes a Bachelor of Science in Computer Science at the University of Calgary in 1992. He is twenty-four and brilliant. He hasn't yet learned that most people don't care about correctness the way he does.III. ExileIn 1993 the free Unix world is a frontier town. AT&T and Berkeley are fighting in court over who owns the code. Linus Torvalds is a Finnish student with a hobby kernel. A few hackers scattered across the continent are trying to turn 386BSD, a free Unix for the cheap Intel PC, into something that actually works. It isn't working well enough, and it's run too loosely. Four of them break away: Chris Demetriou, Adam Glass, Charles Hannum and Theo de Raadt. They call their project NetBSD.De Raadt pours himself into it. With Chuck Cranor he builds the Sun SPARC port, and he writes code in quantities that are hard to account for. When NetBSD 1.0 ships in October 1994, it is the project's first multi-platform release. Much of that portability has his fingerprints on it.Then there are the mailing lists.On a mailing list, de Raadt is a blowtorch. A user asks a naïve question and gets flayed. A developer sends a patch he considers sloppy, and it comes back stripped to the bone. He is usually right, which makes it worse. He is right in a way that leaves people bleeding, and he doesn't seem to see the blood. Or he sees it and doesn't think it matters next to whether the code is correct.The hacker culture of 1994 will forgive almost anything if the code is good. Almost. De Raadt finds the limit and goes past it.On December 20, 1994, five days before Christmas, the rest of the NetBSD core team revokes his access to the source repository.