11 of 23 Core Open Source Projects Run on 1 or 2 People

The core open source projects that run your digital life are maintained by alarmingly few people, and most receive no dedicated funding.

A recent analysis of 23 core open source projects revealed that 11 rely on just one or two individuals for regular maintenance and contributions. These projects underpin critical digital infrastructure, including operating systems, security tools, and widely used applications. For instance, the xz compression tool, which experienced a significant backdoor incident, is primarily maintained by Lasse Collin. The time zone database, essential for all smartphones, is largely managed by UCLA lecturer Paul Eggert, with minimal external funding. Similarly, Todd Miller has been the long-term maintainer of sudo, and Chet Ramey has maintained the bash shell. Many of these projects, such as the time zone database, SQLite, and bash, show no public grant or sponsorship funding. The analysis highlights a stark contrast with projects like OpenSSL, which received substantial funding and increased contributor numbers after the Heartbleed vulnerability was discovered.

The reliance of critical infrastructure on a handful of maintainers, often working unpaid, presents a significant systemic risk. Incidents like the xz backdoor, where a malicious actor exploited a single point of failure, underscore the fragility of this model. While some projects like sudo have recently attracted more funding after public appeals, many others, including essential tools like the time zone database and bash, operate with minimal or no financial support, indicating that funding often follows crises rather than proactively securing these vital components.

This situation suggests a market failure in sustaining essential open source projects. The analysis indicates that without dedicated financial backing, the sustainability and security of these foundational technologies remain precarious. Future high-profile vulnerabilities could lead to increased pressure for formal funding mechanisms, but the current model relies heavily on individual dedication, often without recognition or adequate compensation, leaving the broader digital ecosystem vulnerable to burnout and exploitation.