Theo de Raadt: The Split That Led to OpenBSD

Theo de Raadt has spent more than thirty years building an operating system that advertises itself with a single boast: "Only two remote holes in the default install, in a heck of a long time!"

He's also the reason the command ssh works on nearly every server on Earth. OpenSSH, the program his team pried loose from a licensing mess in a few frantic weeks of 1999, ships inside Linux, macOS, Windows and the routers that carry the internet.

And he is, by wide agreement, one of the most abrasive people in open source. Thrown out of the project he co-founded, cut off by the Pentagon over one sentence, nearly switched off over an electricity bill, de Raadt kept building. The puzzle is how the hardest man in the room produced the most careful code in it.

Theo de Raadt at a Glance

• Born in Pretoria, South Africa, in 1968, de Raadt moved to Canada at nine, grew up in Calgary and the Yukon, and studied computer science at the University of Calgary.
• In 1993 he co-founded NetBSD with Chris Demetriou, Adam Glass and Charles Hannum, and looked after its SPARC port.
• On December 20, 1994, the rest of the NetBSD core team asked him to resign over complaints that he harassed users and developers, and disabled his accounts.
• In October 1995 he forked NetBSD 1.0 into OpenBSD, a system built around auditing every line of code for bugs before anyone could exploit them.
• In 1999 his team held the first "hackathon" in Calgary and shipped OpenSSH, a free SSH, inside OpenBSD 2.6.
• In 2003 DARPA pulled the rest of a $2.3 million grant after de Raadt told a newspaper he hoped the money meant "a half of a cruise missile doesn't get built."
• In 2010 he published an email claiming the FBI had paid to backdoor OpenBSD's IPsec code. The audit that followed found bugs, but no backdoor.
• OpenBSD nearly shut down over a $20,000 power bill in 2014, then forked OpenSSL into LibreSSL after Heartbleed. Its 60th release arrived in May 2026.

The Life of Theo de Raadt

De Raadt's Early Years

Theo de Raadt, whose surname is pronounced "wrought," was born in Pretoria in 1968. When he was nine, his family left South Africa for Canada.

They settled in Calgary, Alberta, and later spent years in Whitehorse, in the Yukon. De Raadt came back south to study computer science at the University of Calgary.

He never wanted a conventional career. "I didn't want a job, I wanted to go play with software and make stuff better," he said later. "I was trying to write extremely reliable small chunks of code."

Founding NetBSD

In the early 1990s the free Unix for PCs was 386BSD, and its patches were a mess. Frustrated at how hard it was to get fixes accepted, Chris Demetriou, Theo de Raadt, Adam Glass and Charles Hannum founded NetBSD in 1993.

NetBSD 0.8 shipped on April 20, 1993. De Raadt took charge of the SPARC port, the version for Sun workstations.

NetBSD 1.0, released on October 26, 1994, was the payoff. It was also the last NetBSD release de Raadt would work on from the inside.

The Letter From Core

On December 20, 1994, the other core members sent de Raadt a letter. "Over the past year and a half," it said, "we have received a considerable number of complaints about the fact that you seem to harass and abuse both users and developers of NetBSD."

They asked him to resign. His accounts on the development machines were disabled, and he was dropped from the core and port-masters mailing lists.

De Raadt spent months trying to get his access back, and later published the whole exchange. Six years on, he was still blunt: "They shut me out for seven months, where I couldn't work on a project with other people. I felt like they stole a community from me."

OpenBSD Is Born

The re-creation began in October 1995, when de Raadt forked NetBSD 1.0 and named the result OpenBSD. The first releases followed in 1996, and so did the idea that'd define the project.

That summer a team of six to twelve developers began a file-by-file audit of the entire system. They were hunting ordinary bugs rather than security holes, on the theory that fixing enough mistakes removes the holes before anyone finds them. The system shipped "Secure by Default," with every non-essential service switched off.

"It was very hard for the first year-and-a-half," de Raadt admitted. The money was harder. He lived on donations, CD sales and T-shirt sales, and by 2003 the project was moving roughly 8,000 CDs a year.

Having no sponsor became a discipline. OpenBSD committed to a release every six months, and de Raadt could tell his developers: "In two months, we have to make a release. If you break this, we'll be dead."

Freeing SSH

In 1999 the team took on a problem every system administrator shared. SSH, the encrypted replacement for telnet, had drifted from free software into a tangle of restrictive licensing. Early that year Björn Grönvall dug up Tatu Ylönen's last free release, ssh 1.2.12, and began fixing bugs in a version he called OSSH.

OpenBSD's developers heard about it less than two months before their 2.6 release and forked it on September 26, 1999. Niels Provos stripped out the remaining encumbered code, Markus Friedl worked on the protocol, and Bob Beck made OpenSSL compile without patented algorithms.

OpenSSH 1.2.2 shipped with OpenBSD 2.6 on December 1, 1999. Ports to Linux followed within months, and OpenSSH 2.0, with SSH 2 protocol support, arrived on June 15, 2000.

That same summer, ten developers had gathered in Calgary from June 4 to 6, 1999, to hammer on IPsec code. Either de Raadt or Provos called it a "hackathon," and the word stuck.

Half a Cruise Missile

By 2003 OpenBSD's reputation had brought it an unlikely patron: a $2.3 million DARPA grant, routed through University of Pennsylvania professor Jonathan Smith's POSSE project, that paid developers and funded hackathons.

Then the Iraq war began. In April 2003 de Raadt told The Globe and Mail the war sickened him, and added: "I try to convince myself that our grant means a half of a cruise missile doesn't get built."

Within two weeks the remaining money, about $1 million, was gone. DARPA cited concern that too much of it went to foreign researchers, as well as the remark.

De Raadt's verdict: "This is it. It's over." And: "In the U.S., today, free speech is just a myth."

Housing for nearly 60 developers at the May hackathon was suddenly $30,000 short. The Dutch foundation NLnet stepped in, and 51 developers turned up in Calgary from May 8 to 20 anyway.

Two years later, at FOSDEM in Brussels on February 26, 2005, Richard Stallman handed de Raadt the FSF's Award for the Advancement of Free Software for 2004: a compliment from across the licensing aisle.

The FBI Email

On December 11, 2010, a former contractor named Gregory Perry emailed de Raadt. His non-disclosure agreement with the FBI had expired, he said, and he wanted de Raadt to know the bureau had paid to put backdoors and key-leaking side channels into OpenBSD's IPsec stack around 2000 and 2001.

De Raadt did what no company would do. Three days later he forwarded the whole email to the public openbsd-tech list.

"I refuse to become part of such a conspiracy," he wrote. Publishing it meant "those who use the code can audit it for these problems" and "if it is not true, those who are being accused can defend themselves."

The audit turned up real bugs, including a cipher-block-chaining oracle fixed in the software crypto stack but not in several hardware drivers. By December 22 de Raadt had his conclusion: the contractor "was probably contracted to write backdoors as alleged," but "if those were written, I don't believe they made it into our tree."

Keeping the Lights On

In January 2014 the project announced it might not survive the year. The OpenBSD Foundation was $20,000 short on the electricity bill for its build machines.

"OpenBSD will shut down if we do not have the funding to keep the lights on," wrote developer Bob Beck. Within days Mircea Popescu, a Bitcoin exchange operator, announced on IRC that he'd cover it.

Three months later the Heartbleed bug exposed how neglected OpenSSL had become, and the OpenBSD team did what it always does: it forked the code and started deleting. The result was LibreSSL.

The same instinct produced pledge, which de Raadt presented at Hackfest in 2015 and which shipped in OpenBSD 5.9. A program declares which system calls it'll ever need, and the moment an exploit tries anything else, the kernel kills it.

Thirty Years and Two Holes

OpenBSD 7.8, released on October 22, 2025, marked the project's thirtieth year. OpenBSD 7.9 followed on May 19, 2026, as the 60th release, and the announcement repeated the line the project has polished for decades: "more than thirty years with only two remote holes in the default install."

De Raadt still runs the project from Calgary, where he also helped establish YYCIX, the city's internet exchange. His personal web page gives OpenBSD and OpenSSH two lines and the rest of its space to mountain photographs, from the Rockies to Ladakh.

Theo de Raadt: Secure by Default

The lesson of de Raadt's career is that security isn't a product you add. It's a habit of reading code, deleting what you don't understand, and refusing to ship what you haven't checked, repeated every six months for thirty years.

He paid for that habit in friendships, grants and goodwill, and he never pretended otherwise. The NetBSD letter, the cruise-missile quote and the FBI email all live on public servers because he put them there.

Every time you type ssh, you're running code from the man who got kicked out of the room and built a better one.