SOLAR DESIGNER▊
The rarest thing in the scene's rogues' gallery: a man with no rap sheet. While the underground argued about who crashed what, Alexander Peslyak wrote the password cracker every admin still runs, shipped one of the first exploit mitigations the Linux kernel ever had — a non-executable stack patch, in 1997, years before the industry made a religion of it — and then built the institution, Openwall, and the mailing list, oss-security, where the disclosure wars are refereed to this day. He is the builder on the defense side of a fight everyone else fought for the cameras.
Our goal is not to detect all port scans (which is impossible), but instead, in my opinion, to detect as many port scan kinds as possible while still being reliable enough.
Solar Designer, "Designing and Attacking Port Scan Detection Tools," Phrack 53:13 (1998) — the whole defense philosophy in one sentence: perfect is impossible, so build the thing that works
- WHO
- Alexander Peslyak — "Solar Designer," b. 1977 (Russia) FACT
- SCENE
- Phrack-era author — listed as "Elite" in Phrack 53 (1998); a builder in parallel with figures like Aleph One, whose "Smashing the Stack" ran two articles ahead of Solar's in the same issue
- THE WORK
- Author of John the Ripper; author of the Openwall non-executable stack patch (June 1997) — an early exploit mitigation; founder/leader of the Openwall Project (1999) and CTO of Openwall, Inc. (2003–)
- RECORD
- No criminal record. Co-founded the oss-security disclosure list; credited on landmark bugs (return-to-libc technique; the first generic heap-overflow exploitation write-up; help disclosing CVE-2015-0235, "GHOST"). 2009 Pwnie Lifetime Achievement Award FACT
- STATUS
- STILL BUILDING — the defense-side lifer. Poacher-turned-gamekeeper is the scene's usual arc; Solar Designer skipped the poacher part
This file is not an accusation; there is nothing to accuse. It is here because a rankings site that only logs the arsonists misreads the fire. For every hacker who crashed a network and got famous, someone was quietly writing the patch that made the next crash harder — and got famous only inside the guild. The through-line is that Solar Designer's fights were never with prosecutors or rival crews. They were with the problem itself: can a defense that can be bypassed still be worth shipping? His entire career is the answer, in code.
the drama timeline
ACT I — THE TOOL EVERYONE STILL RUNS (1996–1998)
Before he was an institution he was a coder who shipped the one program that outlived every flame war around it.
-
1996
John the Ripper
Solar Designer releases John the Ripper, a fast, free password cracker that auto-detects hash types and bundles multiple cracking modes into one package. It becomes, and remains, standard kit — on the defender's side to find weak passwords before an attacker does, and on the attacker's side for the same reason. Thirty years on it still ships from Openwall.
-
JUL 1998
"Elite," in Phrack's own words
Phrack 53 publishes his article on port scan detection — and, on the masthead, lists him under a single-word title: "Elite." In the same issue, Aleph One's work sits two articles ahead of his. Two builders, defense-minded, in the same table of contents while the tabloid version of hacking played out elsewhere.
ACT II — THE PATCH, AND THE ARMS RACE (1997–1998)
He makes the stack non-executable years before the industry copies the idea. Then someone bypasses it — publicly, civilly, exactly as he'd warned they could.
-
JUN 1997
The non-executable stack
Solar Designer posts a Linux kernel patch that makes a process's user stack non-executable, so shellcode injected onto the stack — the era's most common exploitation payload — simply won't run. Zero performance penalty, no recompilation of protected programs. It is one of the earliest exploit mitigations in a mainstream OS, predating the industry's eventual embrace of NX/DEP by years.
-
FEB 1998
"Defeating Solar Designer's..."
Rafal "Nergal" Wojtczuk publishes "Defeating Solar Designer's Non-executable Stack Patch," using return-to-libc to sidestep the non-executable stack without ever executing stack code. This is not a takedown; it is the arms race working as designed — and Solar Designer had already noted return-into-libc as the class of attack his patch couldn't stop. A perfect defense was never the claim. A meaningfully harder one was.
ACT III — THE INSTITUTION (1999–)
The lone patch becomes a project; the project becomes a company; the company keeps shipping the boring, load-bearing stuff.
-
1999
The Openwall Project
Solar Designer founds and leads the Openwall Project, home to John the Ripper, the hardening patches, and eventually Openwall GNU/*/Linux (Owl), a security-focused server distribution. Openwall's patches and extensions filter into many mainstream Linux distributions — the kind of quiet upstream influence that never trends.
-
2003
Openwall, Inc.
He founds Openwall, Inc. and serves as its CTO — consulting, professional-grade tools, and continued research. The through-line from the 1996 password cracker to the incorporated business is unbroken: build the defensive tool, keep it maintained, keep it honest.
ACT IV — THE REFEREE OF DISCLOSURE (2005–)
Having spent a decade on both the offense and defense of exploitation, he takes over the room where the two argue.
-
2008
oss-security
Solar Designer co-founds and runs oss-security, the open-source-software security disclosure list — the venue where vulnerabilities in the software the world runs on get coordinated, argued, and assigned. It is the opposite pole from the "antisec" posture that treated disclosure itself as the enemy (see Anti-Security Movement). Where that camp burned the discourse, he moderated it.
-
2009 / 2015
The guild says thank you
At Black Hat, the Pwnie Awards give him the Lifetime Achievement Award (2009) — the field honoring one of its own. In 2015 Qualys credits him for help disclosing CVE-2015-0235 ("GHOST"), a glibc buffer overflow. Still, decades in, doing the unglamorous coordination work that keeps the internet standing.
both sides, on the record
The offensive critique: a mitigation that can be bypassed is theater. The non-executable stack fell to return-to-libc; every defense Solar Designer has ever shipped can, given a determined enough attacker and the right primitive, be routed around. The offense always adapts; the defender is always one clever paper behind.
And the tool cuts both ways: John the Ripper cracks passwords for admins and intruders alike. The most-used thing he ever made is, by design, dual-use — a fact the defense-side halo tends to skip.
"Harder" is the whole game: no serious defender claims perfection, and Solar Designer never did — he flagged return-into-libc himself. A mitigation that forces attackers into narrower, more fragile, version-specific techniques is doing exactly its job. Raising the cost of exploitation is the win [3].
He was early, and he was right: the non-executable stack shipped in 1997; the industry spent the next decade catching up to the idea and calling it NX/DEP. Being years ahead of a consensus that later became mandatory is not theater. It is foresight [3].
Dual-use is honest, not damning: every real security tool is dual-use, and pretending otherwise is how charlatans sell snake oil. He built defensive tools, kept them open, maintained them for decades, and refereed the disclosure process rather than weaponizing it. The record is a builder's [1].
YOU DECIDE
There is no crime here and no cover-up, which on this site makes him an outlier. Strip away the scene's taste for villains and you are left with the least dramatic and most consequential kind of figure: the one who shipped the password cracker, wrote the mitigation, founded the project, and moderated the list. His fights were technical and public and he mostly won them by outlasting them.
The archive does not only keep the arsonists. It keeps the people who wrote the sprinklers. This is one of those files.
evidence locker
PRIMARY / REFERENCE
Wikipedia — Solar Designer ATTRIBUTED — identity (Alexander Peslyak, b. 1977), John the Ripper authorship, Openwall Project (leader since 1999) and Openwall, Inc. (CTO since 2003), return-to-libc and generic heap-overflow write-ups, co-founding oss-security, the 2009 Pwnie Lifetime Achievement Award, and the 2015 CVE-2015-0235 credit.
en.wikipedia.org/wiki/Solar_Designer Phrack 53:13 — "Designing and Attacking Port Scan Detection Tools" FIRST-PARTY — article authored by solar designer; source of the quoted line. Held in the local Phrack mirror at
research/zines/phrack/issue53/13.txt.
phrack.org/issues/53/13.html
CONTEXT & CROSS-LINKS
The standard. Alexander Peslyak is a public professional; his authorship of John the Ripper, the 1997 non-executable stack patch, the Openwall Project and company, the co-founding of oss-security, and the 2009 Pwnie Lifetime Achievement Award are matters of documented record, stated here at full strength. The only "conflict" is the ordinary technical dialectic of exploit mitigation — presented as such, with the bypass credited to its author and the mitigation's limits credited to Solar Designer's own foresight. No criminal conduct is alleged because none exists. If a line here couldn't survive scrutiny, it wouldn't be on the page.