The world dodged a big one last month. Either bend an elbow or bow your head (depending on your preferred mode for giving thanks) to Andres Freund, one of the army of volunteers who labor daily, unpaid and largely unrecognized, to keep the world from tipping over.
Freund, a software engineer, last month stumbled on to shenanigans that one cybersecurity expert told The New York Times could have been “the most widespread and effective backdoor ever planted in any software product.” That language signals that this is not your usual cybersecurity story. While it is another reminder of the importance of cybersecurity, it also highlights the largely unappreciated central role that open-source software (OSS) plays in the digital economy.
Running routine checks on a software system, Freund noticed an inexplicable delay in SSH, a protocol that allows remote login to devices over the internet. He discovered that the problem was the result of updates to XZ Utils, an open-source data compression utility that runs on virtually every Linux system and other Unix-like operating system.