People Holding Up the Internet

A data-driven survey of 23 widely used open-source projects shows that much of the internet runs on the labor of a handful of people. By counting contributors who made ten or more changes between October 2025 and October 2026 and mapping what software ships on Android, iPhone and Windows, the study finds many projects are sustained by one or two maintainers. Notable examples: Paul Eggert single-handedly coordinates the time zone database used by billions of phones; Lasse Collin largely maintains xz and weathered a mysterious contributor who introduced a backdoor; Denis Pushkarev drove core-js through personal hardship; Todd Miller made almost all sudo changes before a recent funding surge; D. Richard Hipp leads SQLite with a tiny paid team; Mark Adler remains central to zlib; Behdad Esfahbod drives HarfBuzz; curl represents a countermodel with broader contributor and corporate funding.

The findings make a clear argument about systemic fragility: critical infrastructure depends on unpaid hobbyists or minuscule teams, leaving single points of failure and uneven security posture. High-profile failures like Heartbleed produced a surge of funding and contributors for OpenSSL, illustrating that money flows reactively. Some projects now attract sustained support - sudo and curl secured sponsors - while others still operate on minimal patronage. Recent institutional funds such as Germany’s Sovereign Tech Agency and the Alpha-Omega fund are beginning to channel money to security-critical projects, but the overall picture is one of concentrated responsibility and precarious maintenance.