Introduction

In the pantheon of open-source security, few figures loom as large or as controversially as Theo de Raadt. A founder of OpenBSD and the original architect of OpenSSH, he has spent decades questioning every assumption, rejecting every blind trust, and building systems designed to assume the worst.

What Happened

De Raadt's journey began with a very public exile from the NetBSD project he helped build. After years of heated mailing-list debates and a definitive ousting in 1994, he forked the codebase and launched OpenBSD, committing to an auditing discipline that would become his trademark. Alongside colleagues, he stripped commercial SSH implementations into a free, auditable version that would eventually become the standard for remote access worldwide. The code's portability saw it embedded in Linux, Solaris, macOS, and Windows, powering everything from routers to enterprise data centers.

Why This Matters

De Raadt's philosophy rests on a simple but radical premise: assume every component is compromised, and build walls strong enough to contain the breach. Features like pledge and unveil force programs to declare exactly which system calls and files they may use; any deviation triggers an immediate kernel-level kill switch. This proactive security model has influenced how major operating systems handle sandboxing, and it proved its worth when the XZ backdoor attempt failed to penetrate OpenBSD's defenses.

Key Takeaways

  • OpenBSD's default install runs with almost no services exposed, reducing attack surface by design.
  • Pledge and unveil enforce strict system-call boundaries, killing programs that overreach.
  • OpenSSH, born from OpenBSD, now secures the majority of the world's remote server connections.
  • The XZ backdoor attempt highlighted how de Raadt's isolation strategies shield OpenBSD from supply-chain threats.
  • De Raadt's public battles underscore a central truth: security is political, financial, and deeply personal.

Conclusion

Theo de Raadt may not be everyone's idea of a pleasant colleague, but his impact on internet security is undeniable. By building systems that assume hostility, refusing unexamined code, and speaking truths others avoid, he has created digital infrastructure that remains standing when others crumble. As supply-chain threats grow more sophisticated, his philosophy paranoia as engineering feels less like quirk and more like blueprint.