The people holding up the internet

Your phone's time will now automatically adjust for Daylight Saving Time changes worldwide.

A significant portion of the internet's critical infrastructure relies on open-source software maintained by a small number of individuals, often as unpaid hobby projects. For example, Paul Eggert coordinates the time zone database, essential for billions of Android and iPhones, and personally handles the majority of updates. Similarly, Lasse Collin and Jia Tan were the primary maintainers of xz, a compression tool used in Linux servers and iPhones, until a backdoor was discovered in Tan's contributions. Denis Pushkarev single-handedly maintained core-js, which powers half of the world's busiest websites, while facing personal legal issues and seeking donations. Todd Miller has been the long-time maintainer of sudo, a command for administrative rights on Unix-like systems, and recently secured more funding after publicizing his need for sponsorship. These projects, despite their widespread use and importance, are often sustained by minimal personal effort and limited financial support.

The widespread reliance on a few individuals for critical software highlights a precarious dependency in the digital ecosystem. The discovery of a backdoor in the xz utility, introduced by a seemingly trusted contributor, demonstrates the significant security risks inherent in this model. It raises questions about vetting processes and the potential for malicious actors to exploit these vital, yet under-resourced, projects.

The article underscores the vulnerability of global digital infrastructure to the personal circumstances and motivations of its maintainers. Projects like the time zone database, sudo, and core-js are foundational, yet their continued operation often depends on the unpaid labor and goodwill of individuals facing personal hardships, legal troubles, or seeking employment. This model is unsustainable and poses a systemic risk that could be mitigated through better funding and community support structures.