I’m cold-blooded in these situations, says Czech “who saved the internet”
The international media have dubbed Ondřej Surý “the man who saved the internet” and “the unsung hero of the internet”. After serious flaws were recently discovered in PHP, a code used in most websites, the Czech – an expert in the field – managed to create a patch for the problem before attackers got a chance to do potentially enormous damage. I asked Surý what the specific risk to website operators had been.
“It was a RCE class of vulnerability, which means Remote Code Execution. In layman’s terms, it basically means that an attacker would be able to execute their own programmes on the victim’s machine.
“So it would be basically be possible for the attacker to do anything, because they would have full access to the server, or to the machine, running the vulnerable version of PHP.”
You’re a specialist in this area and are among those who worked to install security updates. How much work was it for you? How quickly were you able to turn the situation around?
“I was in a better situation than people running PHP, because my job in this was to prepare these ‘packages’, which people install on their machines to update the PHP version.
“It took me a couple of hours, and then some time to actually compile the source code into an executable programme.
“For me it wasn’t a huge deal, because I do this regularly. It was the impact that was serious, and the responsibility to have this prepared on time, so that people could install these updated packages in time.”
But did you feel like the clock was ticking? Bad actors could have done a lot of damage on the internet.
“Sure, but I’m cold-blooded in these situations [laughs].
“There are different kinds of stress, but usually my reaction to stress is that I keep a cool head – and for me it wasn’t that stressful.”
You say you have a cool head, but still, did you have a great sense of relief when you realised that things were not going to turn out badly, that the day had been saved?
“I wouldn’t say relieved. I was kind of happy for all these people who I helped.
“Personally I don’t run PHP myself, anywhere, but all these people who are using my packages were in danger and I was happy I was able to help them on time.
“There are so many grateful people; it must have been stressful for them, so I kind of felt relief for them.”
One headline about you said, “If anything happens to this guy, we’re all screwed.” I can tell from speaking to you that you’re a modest person, and I know you have been keen to share the credit with others, but still how does it feel to have done something so important?
“To be completely honest with you, for me it was just another update of PHP…You know, I don’t feel like I did anything special.”
To me the internet started out as a very positive thing but then for a lot of people it became something that made their lives worse in many ways. Do you think people just wanted an internet good news story?
“I think everyone wants to hear good stories, so yes [laughs].
“When you are doom scrolling, which I tend to avoid, it’s nice to read something genuinely nice, that someone helped someone else.
“These are better stories to read than what is wrong with this world.”
