Solar Designer

Alexander Peslyak, born in 1977, is far better known in the security world by his handle "Solar Designer," which he adopted in 1994 to register on private bulletin-board systems where using real names was discouraged. He has been professionally involved in computer and network security since 1997, though he had been programming as a hobbyist since 1989. He generally avoids the spotlight as an individual, preferring to write about his technical work rather than about himself.

Founding Openwall

Peslyak founded and has led the Openwall Project since 1999, an effort focused on developing security-related free software, conducting information security research, and supporting community coordination around vulnerabilities. He became team leader of the associated Openwall GNU/*/Linux distribution in 2000, and in 2003 founded Openwall, Inc., a professional services company where he has served as CTO. In 2008 he co-founded the oss-security mailing list (and later the private linux-distros list), which became key venues for cross-vendor coordination of vulnerabilities in open-source software.

John the Ripper and Early Exploit Research

In 1996 Peslyak released John the Ripper, a password-cracking tool that became one of the most widely used security tools of its kind, with code later incorporated into other Unix-like systems such as OpenBSD and Debian. Around the same period he was an active exploit researcher: in 1997 he published some of the first "return-into-libc" style buffer overflow exploits and enhanced the Linux 2.0.x kernel with non-executable-memory (non-exec stack) protections, inspired by an earlier Solaris/SPARC patch, laying groundwork that influenced later hardening work across Linux, OpenBSD, and eventually Windows. In 1999-2000 he devised the first generic heap-based buffer overflow exploitation technique, which he disclosed to Netscape/AOL and for which he won a bug bounty.

Later Work and Recognition

Peslyak's password-security research continued with the adoption of hardened password schemes by major software including phpBB3, WordPress, and Drupal around 2007-2008, and later with yescrypt, a password-hashing scheme he designed that is intentionally memory-hard to resist GPU/FPGA/ASIC-accelerated cracking; yescrypt 1.0.0 was released by Openwall in March 2018 and has since become the default password-hashing scheme in Fedora, Debian, Ubuntu, and Arch Linux. In 2009 he received the Pwnie Award's Lifetime Achievement Award at Black Hat. Around 2023 he joined CIQ's Rocky Linux Security effort as Senior Principal Security Engineer.

Legacy

Operating almost entirely under his "Solar Designer" handle, Peslyak is regarded as one of the most consequential figures in open-source security: his tools and patches shaped password auditing practice, Linux memory-protection defaults, and cross-vendor vulnerability-disclosure norms that much of the open-source ecosystem still relies on.

Timeline

• 1977Alexander Peslyak is born.
• 1994Adopts the handle "Solar Designer" to register on private BBSes.
• 1996Releases John the Ripper, a password-cracking tool for Unix systems.
• 1997Publishes early return-into-libc buffer overflow exploits and a Linux kernel non-executable-memory hardening patch.
• 1999Founds and leads the Openwall Project.
• 2003Founds Openwall, Inc. and becomes its CTO.
• 2008Co-founds the oss-security mailing list.
• 2009Receives the Pwnie Award Lifetime Achievement Award at Black Hat.
• 2018-03-09Openwall releases yescrypt 1.0.0, the password-hashing scheme he designed.
• 2023Joins CIQ's Rocky Linux Security effort.