A public analysis of 23 widely used open-source projects finds 11 are maintained regularly by just one or two people. The author counted anyone with ten or more commits between 7 October 2025 and 7 October 2026 (excluding merges and bots). Standouts include xz, where Lasse Collin wrote 97% of changes in 2025 after a 2024 backdoor incident and no new public funding was found; the time zone database, where UCLA lecturer Paul Eggert made 218 of 251 edits (Tim Parenti is a designated backup) and its data powers billions of phones; sudo, long dominated by Todd C. Miller (5,408 of 5,409 changes from 2008-2018) that later gained ~€61.7k/year via Open Collective and GitHub sponsors; and bash, maintained by Chet Ramey and the source of the long‑running Shellshock vulnerability.
Funding patterns show concentration around disasters and toward projects with organizations that can apply for grants. Eight projects - including the time zone database, SQLite, zlib, libjpeg‑turbo, HarfBuzz, xz, bash and nghttp2 - had no public grants found from Sovereign Tech Agency, Alpha‑Omega, Open Collective or GitHub Sponsors. By contrast curl draws about $89.7k/year via Open Collective, 64 GitHub sponsors and a €195k Sovereign Tech Agency contract, and OpenSSL received roughly $5.4M raised after Heartbleed, which funded paid developers and sharply increased its contributor count. The pattern is clear: many critical libraries rely on tiny teams or volunteers, while major funding arrives reactively and favors projects with institutional structures.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.