23 core open-source projects were studied recently and it was found that almost half of them have one or two developers supporting their maintenance and this means there is a lot of single/few developers dependancy. That is a very dangerous situation for a lot of software infrastructure and modern internet. It means that important things are at risk as long as the few developers are doing well. We should care about the sustainability of the maintenance.
Analysis reveals critical infrastructure risks in xz, sudo, and tzdata maintenance
For example, xz compression tool. Lasse Collin makes about 97% of fixes. Or sudo command.
Todd Miller did 5408 out of 5409 changes made to sudo from 2008 to 2018. Or the IANA timezone database. Paul Eggert is its main maintainer and did 218 out of 251 changes made between 2008 and 2018.
It seems that the key of how projects can survive and have more contributors is about funding. Curl can receive about $89700 per year from Open Collective. They have 11 steady contributors. After Heartbleed vulnerability OpenSSL collected $5.4 million and the number of their contributors increased from 6 to 32.
In the report of Reddit user u/Mastbubbles there's no new funding for xz since 2024 backdoor incident. The statement is not verified by the source yet. This lack of verified new funding since 2024 incident might make situation for single maintainer dependancy of important tools like xz more dangerous.
Discussion
0 comments
Log in to join the thread with a thoughtful take, question, or correction.