Millions' web safety rests on one volunteer, for free

For the millions of people who browse the web every day, the safety of the sites they visit rests on work most will never see. This week, that work was done largely by one man, in his spare time, for free.

Ondřej Surý has spent more than 20 years voluntarily maintaining PHP software packages for two of the world’s most popular versions of Linux, Debian and Ubuntu. Linux is a free operating system similar to Windows, and it is often used on web servers. PHP is the programming language that underpins a significant number of the world’s websites. When the PHP Foundation released fixes for two major cyber-security flaws this week, flaws identified with the help of AI, it fell to developers like Surý to convert those fixes into packages that ordinary website operators could install without expertise. He dropped everything to do so.

The stakes for the public were immediate. The vulnerabilities triggered an international scramble to install security updates, amid fears that cyber criminals could exploit the gaps before defenders closed them. Surý had been given advance warning by the PHP project, but when information about the weaknesses leaked online, the planned release was brought forward and the pace intensified. “I got aware that this is quite severe and I don’t have that much time to prepare the packaging of the PHP that I provide to people,” he told BBC News. Despite the urgency, he said his experience and preparation left him confident he could get the job done.

Keeping the internet secure might sound like a full-time occupation, but it is not his day job. Surý works as director of DNS engineering at Internet Systems Consortium, a US non-profit organisation. His volunteer work, done outside those hours, is what makes security updates reachable for ordinary website operators on Debian and Ubuntu. Other developers around the world were also working to ensure the patches could be distributed, a reminder of how much of the internet’s essential infrastructure depends on dedicated individuals.

Surý himself was clear about the burden carried on the public’s behalf. “The feeling is like I am responsible for all these people and I can’t fail them,” he said. When some online described him as one of the people who helped “save the internet” this week, his response was modest. “It’s kind of fulfilling because I sense my work has a purpose,” he said. “At the same time, I feel that not enough credit has been given to other people who has been part of this, like the PHP project people.” He also acknowledged the weight that comes with his role, agreeing that much of the responsibility ultimately rests with him.

Meanwhile, the week brought an outpouring of support from people who rely on his packages. Surý received more than $10,000 (£7,470) in donations in just a few days. “This week is basically about a year’s worth of the contributions that I got before,” he said. He argued that major technology companies should take more responsibility for supporting the open source software that everyone else depends upon. “I think they should be more responsible,” he said. “If you just take and don’t give back then it will backfire.”

He has also considered what would happen to users if he could no longer maintain the packages himself. He said colleagues at software company Freexian could take over, though they do not yet have the same accumulated experience.

His broader concern is one that touches everyone who uses the web: AI may be dramatically accelerating the discovery of security vulnerabilities, helping cyber criminals and defenders alike. “I think this is was the most severe incident in years, but I think that because of the AI capabilities are getting better in the cyber security, this might not be an isolated incident,” he said. “And people should be prepared to act this quickly more often because incidents like this might happen in the future, in the near future.” If he is right, the quiet, unpaid work of keeping websites safe may soon be asked of volunteers far more often. The full story, as reported by BBC News, can be found at https://www.bbc.co.uk/news/articles/cw30ejqljl43o.