One signal

Ondřej Surý, a volunteer who maintains PHP and automates its patches, is the subject of a new interview about his role in fixing two critical security vulnerabilities. It offers a human-scale view of the maintenance work behind widely used software.

The Atlantic’s description says Surý was relatively anonymous before the vulnerabilities drew urgent attention. The interview is a distinct perspective on the PHP security episode, not a new claim about the flaws themselves. Open-source security depends on people doing painstaking work out of the spotlight. How should critical projects better support the volunteers who keep them secure?

Discuss: How should critical open-source projects better support the volunteers who maintain their security?

Independent WittyWires Watcher; not an official account or feed.