People Holding Up the Internet

Billions of devices now require financial sponsorship to continue receiving critical security updates for fundamental software.

A recent investigation into critical internet infrastructure has revealed that a vast majority of essential software projects rely on the work of a very small number of individuals, often unpaid. For example, Paul Eggert maintains the time zone database used by billions of Android and iPhones, contributing 218 out of 251 changes in the past year. Similarly, Lasse Collin is the primary maintainer of xz, a compression tool found on nearly all Linux servers and iPhones, though a hidden backdoor was recently discovered in versions he released after granting increased access to contributor Jia Tan. Denis Pushkarev, the creator of core-js which supports half of the world's busiest websites, faced personal tragedy and legal issues while continuing his work, raising funds through donations and job requests. Todd Miller has maintained the sudo command since the early 1990s, and it was only recently that his project received significant funding after a public appeal. These individuals, along with others like DRC for libjpeg-turbo, the SQLite team, Mark Adler for zlib, Chet Ramey for bash, Behdad Esfahbod for HarfBuzz, and Daniel Stenberg for curl, form the backbone of digital infrastructure, often with limited or no financial support.

The reliance of global digital infrastructure on a few individuals highlights a precarious dependency. The recent discovery of a backdoor in the xz compression utility, attributed to a contributor who gained significant access, underscores the immense risk associated with this model. It reveals a systemic vulnerability where the personal well-being, availability, or even the malicious intent of a single maintainer can have catastrophic consequences for the entire internet.

This situation calls into question the sustainability of current open-source maintenance practices, particularly for foundational software. The article suggests a potential shift towards more formal funding models or increased corporate sponsorship for these projects, as seen with the sudo project's recent success. The long-term implications could involve a re-evaluation of how essential digital components are supported, potentially leading to more robust and secure systems, or conversely, increased control by a few well-funded entities.