OpenSSH Ships on Every Mac, Linux Server and Windows. Its Creator Trusts No One
Profile of OpenSSH creator Theo de Raadt, whose OpenBSD design stayed outside the 2024 xz backdoor.
A long profile of OpenSSH and OpenBSD founder Theo de Raadt uses the March 2024 XZ Utils (liblzma) supply-chain backdoor as its frame. Persona Jia Tan placed an obfuscated payload in release tarballs targeting OpenSSH through Linux systemd integration; Microsoft engineer Andres Freund noticed SSH logins burning about 500 milliseconds of extra CPU and disclosed it on 29 March 2024. OpenBSD was outside the blast radius because it never adopted systemd and confines processes with pledge and unveil. The article then recounts de Raadt's childhood move from South Africa to Calgary and his break with NetBSD.
24