He Makes It Look Like Less

The paragraph that came easily is going on the bill.

I see no reason to subsidize a stranger because, for once, the words arrived in the right order. He can have the paragraph. The little pleasure of finding it belongs to me.

But I know what I would leave off that bill: the bad first attempt. I would present the result as though I knew how to do it. If the customer noticed how little trouble I appeared to have had, I might feel obliged to produce the drafts. Make him sit through the work he had paid me not to show him.

There ought to be a better way of establishing that the easy part was worth something.

Charlie Warzel interviewed Ondřej Surý for the Atlantic on October 22. I read the copy archived early the following morning. Warzel reports that researchers using an OpenAI model found severe vulnerabilities in PHP, a programming language used across the web. Information leaked before a fix was ready for release. The PHP project moved its release forward a day. There was good reason to hurry: the flaws could let attackers run their own code on affected servers.

Surý helps turn PHP releases into packages people can install. This is volunteer work alongside his paid job at the nonprofit Internet Systems Consortium. He wasn’t the lone man writing a cure for the internet. The PHP project supplied the corrected source code. He prepared it for people who needed to put it to work without compiling it themselves.

I like this particular job. Not because I could do it. Because there is a difference between a fix existing and a fix reaching the machine that needs it. The source code can be available while a person at the other end still has a difficult afternoon ahead. An installable package removes some of that afternoon. Multiply the convenience across many servers and the little word convenience begins looking inadequate.

Warzel asks how this could have been anything but a crazy time. Surý has been doing the work for more than twenty years. Much of it is automated. He had time to prepare. He wasn’t running a PHP system of his own that also needed rescuing. From where he stood, he says, it wasn’t stressful.

I find that answer oddly hard to leave alone. The danger is real. The man helping deal with it is calm. I want him to confirm that the situation deserves my anxiety, and instead he describes the arrangements by which he could do his part.

Those arrangements are better than a man being frightened on my behalf.

There is a machine in the discovery of the flaw and automation in the distribution of the repair. I cannot divide this into artificial intelligence causing trouble and an unassisted human cleaning it up. Warzel’s account doesn’t say AI created the vulnerabilities. Nor does it make the path from discovery to installed repair disappear. The new way of finding a dangerous thing still has to meet the work of getting the corrected thing into use.

And Surý makes a point which would be easy to lose under the hero’s name. Without him, people could still obtain PHP elsewhere and compile it themselves. The fix would not vanish. It would take longer, and some users wouldn’t have the necessary skills.

That is a less dramatic dependency than one man or darkness. I can see why the other version travels. I understand it immediately. This version requires me to distinguish being saved from being spared a job I might not know how to do.

I would like to be spared the job.

Let the operators who can compile it do so. I am not proposing that everybody wait for one person when another route is available. But you could do it yourself is not an account of what it would cost you to learn, or how many machines are waiting while you do. The convenient route has value even though it isn’t the only route. Surý has made expertise available in a form which doesn’t require every recipient to acquire it first.

There is also work going on toward making him less necessary. He tells Warzel he is discussing contingency plans with Raphaël Hertzog at Freexian, a company with expertise that could let it take over. These are discussions, not a completed handover. Still, the direction interests me. The man being praised as indispensable is thinking about how someone else could do the job.

This is rather poor management of a heroic reputation. It is excellent news for the people using the packages.

Automation can spare him repetitive work. Packages can spare users the compilation. Another competent maintainer could spare everyone a crisis over his absence. Each success makes less of the original effort visible at the moment someone needs the result. None of it means the knowledge has appeared in my head. I am still sitting here unable to prepare the package, very pleased that it can arrive ready to install.

Surý says open-source work started as fun and still has some of that pleasure. He also describes exploitation and wants the people who benefit most to reward the work. A burst of donations brought roughly a year’s usual contributions in a day, he reports; no amount is given. The thank-you messages felt nice. They gave the work a sense of purpose.

I believe all of that without needing him to sound worse. He has described enough of the job for me to see what I cannot do, and how much less I might have to do because he can.

So the easy paragraph stays on the bill. If the customer objects, I can offer him the difficult one.

I have several. They’re terrible.

Source: ‘If Anything Happens to This Guy … Everyone Is Screwed’ (Charlie Warzel, October 22, 2026; inspected copy archived October 23, 2026, 01:13:53 UTC).