11 of 23 Core Open Source Projects Run on 1 or 2 People
A Reddit analysis of 23 critical open source projects found that 11 rely on just one or two regular contributors. The time zone database, used by four billion phones, is kept current by a UCLA lecturer in his spare time. xz has a single contributor and no new funding after its 2024 backdoor. sudo, bash, and zlib are similarly fragile. Money tends to follow disasters, as OpenSSL's post-Heartbleed windfall shows.
Money follows disasters. Within two months of Heartbleed in 2014 the Linux Foundation had raised $5.4 million, and OpenSSL, which lived on about $2,000 a year in donations, got paid developers and an audit.
- remywang
> Eight projects, including … SQLite … show no grant or sponsorship in any public funding source the analysis checked
SQLite has a list of sponsors right on the homepage https://www.sqlite.org/
- duhhhhh1212
https://www.pangram.com/history/66de9897-c6ef-4dc3-8e89-0e24...
Don't waste your time.
- jszymborski
> "xz: The Backdoor That Put One Maintainer in the Spotlight"
Do people who publish this stuff read this and think "this LLMism sounds good to me"?
- compass_copium
…and the second person in how many of the two-person projects is Jia Tan?
- roenxi
Reflecting the enormous effectiveness of free markets in the software space. If there was a strong regulatory system around software development it might cost orders of magnitude more to run a modern OS.