The Internet Runs on Code Maintained by People You Have Never Heard Of.

You have probably seen the XKCD comic numbered 2347. A towering, precarious stack of blocks labeled “all modern digital infrastructure,” with the whole thing balanced on 1 tiny block at the bottom, captioned “a project some random person in Nebraska has been thanklessly maintaining since 2003.” People love to edit it, usually getting it wrong by stacking company logos that do not actually depend on each other. The real point is a dependency chain. The giants everyone knows all rest on small pieces of code written and maintained by a handful of people, often 1 person, who almost nobody can name. I want to put real names and real numbers to that bottom block, because once you see them, the comic stops being funny.

I went looking for how deep this goes, and it is deeper than the cartoon suggests. A 2024 study by the Linux Foundation and Harvard estimated that if the most widely used open source software had to be rebuilt from scratch, it would cost about $8.8 trillion. The people maintaining a lot of it are not on anyone’s payroll. The same body of research has found that a small number of projects carry an outsized share of the load, and that the median open source developer is doing it in their own time. So this is not a story about a few unlucky projects. It is the normal condition of the code under almost everything you touch.

The clock on your phone comes from 1 text file

Anything on your phone that shows a time has to know where you are, your alarm, a boarding pass, a meeting in another country, the day your salary lands. Every Android phone, every iPhone, and most of the servers on the internet get their local time from the same place, a single file called the time zone database. It holds every clock rule a government has ever announced, including historical ones going back more than a century, because if you want to render a timestamp from 1895 correctly, the rule for 1895 has to be in there.

Paul Eggert, a computer scientist at UCLA, keeps that file current, largely in his spare time, and has been its editor since 2005. When a government changes its rules, a maintainer has to type the new entry in, by hand, ahead of the deadline. Governments do this constantly and often on short notice, a few weeks of warning before daylight saving shifts or a region moves to a new offset, and every one of those changes has to land in the file before it takes effect or clocks in that region quietly go wrong. The file lives on GitHub with a short list of people who have ever contributed to it, and the day to day work comes down to Eggert and 1 collaborator, Tim Parenti. That is the team behind the clock on several billion devices.

Figure 1. A few named individuals maintain software that ships on billions of devices. The time zone database, behind every phone clock, is kept current mostly by 2 people. Source: Author chart based on project histories and GitHub data

It gets stranger. In 2011, an astrology software company called Astrolabe sued Eggert and Arthur David Olson, the researcher who had coordinated the database since 1986, claiming its historical data came from an atlas the company held a copyright on. For a short period the project’s mailing list and files went dark, and the people who maintain the world’s timekeeping data suddenly had to think about legal exposure. The Electronic Frontier Foundation stepped in, IANA took over hosting the database, and Astrolabe dropped the suit and apologized in February 2012. A company that sells date and time software tried to sue the people who maintain the world’s date and time data, and for a few weeks the foundation of civil timekeeping on the internet was a legal target.

The backdoor that almost shipped to every Linux server

The thin staffing is a security story as much as a funding one, and the clearest proof arrived in March 2024. XZ Utils is a compression tool installed on effectively every Linux system. For years its lead maintainer was Lasse Collin, who ran it as an unpaid hobby project and had been open about his limited time and long running health struggles.

Starting around 2021, a contributor using the name Jia Tan began sending useful fixes and slowly built trust over more than 2 years, while sock puppet accounts pressured Collin in public about how slowly the project was moving. By 2023 Jia Tan had maintainer level access. In February 2024 a carefully hidden backdoor went into the project, built to let an attacker run commands on any server that used the compromised version. It was caught almost by accident. Andres Freund, an engineer at Microsoft, noticed that SSH logins on a test system were using a little more processor time than they should, around half a second longer, chased the anomaly, and found the backdoor before the poisoned version reached most production systems. It was logged as CVE-2024–3094 and rated the maximum severity of 10 out of 10. The identity behind Jia Tan has never been established publicly, and the operation remains one of the most patient supply chain attacks on record. Had Freund not been curious about half a second of CPU time, the backdoor would likely have shipped into the stable releases of major Linux distributions and onto servers worldwide.

Figure 2. 3 incidents where thinly staffed core projects became global risks. Shellshock in Bash, Heartbleed in OpenSSL, and the XZ backdoor, with how long each flaw sat before discovery. Source: Author timeline of open source security incidents

The maintainers barely anyone pays

Walk through the rest of the stack and the same shape keeps appearing. 1 or 2 people, enormous reach, very little money.

Denis Pushkarev maintains core-js, a compatibility library that runs on a large share of the most visited websites in the world, downloaded tens of millions of times a week. His own fundraising brought in about $57 a month, and payments got harder as financial firms stopped processing donations to Russia. When he added a plea for support to the library’s install message, millions of developers saw it, and a lot of them complained about the message while few actually helped. He also served about 10 months in prison in 2020 following a fatal road accident, a matter of public record that he has spoken about himself, and the project kept limping along on its tiny donations throughout.

Todd Miller has maintained sudo, the command that grants administrative access on nearly every Linux and macOS machine, since 1993. A corporate sponsor funded that work for over a decade until the arrangement ended in 2024, and by early 2026 Miller was publicly looking for a new sponsor to keep development going, with the work slowing to mostly bug fixes in the meantime. Mark Adler cowrote zlib, the compression library inside PNG images, web pages, Git, Android, iPhones, and Chrome, back in 1995. His other job was managing NASA’s Spirit rover on its way to Mars. zlib has no sponsor page at all.

Dr. Richard Hipp wrote SQLite in 2000 after a database on a US Navy destroyer kept failing whenever a separate server went down, so he built one that lives in a single file with no server at all. It is now in every Android phone, every iPhone, every Mac, every copy of Windows, every major browser, and countless apps and games, with the project estimating over 1 trillion databases in use. SQLite is open source but not open contribution, a deliberate choice where only the core team commits code, and the team funds itself by selling support through Hipp’s company. It is one of the few in this list that chose its own sustainable path on purpose.

Figure 3. Reach versus people. Each of these projects ships on billions of devices or across most of the web, and the regular work is done by a very small number of maintainers. Source: Author chart based on project histories

The man who held up the world’s email encryption

In February 2015, ProPublica published a piece headlined that the world’s email encryption software relies on 1 guy who is going broke. The guy was Werner Koch, a German developer who wrote GnuPG in 1997 and had kept it alive almost single handedly ever since. GnuPG is the encryption that secures email, software signatures, and a long list of Linux tools, and it is the implementation Edward Snowden used when leaking his documents. Koch had been making about $25,000 a year from it since 2001, a fraction of what he could earn in industry. German government funding dried up in 2010, and in 2012 he had to let his only programmer go. A fundraising drive in December 2014 had reached about $43,000 against a goal of $137,000.

Then the article ran, and the money arrived. Koch hit his funding goal within days, the Linux Foundation’s Core Infrastructure Initiative gave him a $60,000 grant, and Facebook and Stripe each pledged $50,000 a year to the project. For almost 18 years the padlock on a huge amount of secure communication had rested on 1 man working himself close to broke, and it took a viral article to change that.

25 years from the bug going in to anyone noticing

The bash shell runs on Linux servers and Macs everywhere, and Chet Ramey has maintained it since around 1990, alongside his job in the networking group at Case Western Reserve University. Every change in bash’s public history is his, including the official security fixes.

In September 2014, Stéphane Chazelas reported a bug to Ramey that let anyone run commands on a server by sending it a specially shaped piece of text. It went public as Shellshock, under CVE-2014–6271. The vulnerable line had gone into bash on 5 August 1989. 25 years passed between the flaw entering the code and anyone reporting it, in software that sat on a huge share of the world’s servers the entire time, maintained by 1 person on the side of a university job. Within days of the disclosure, attackers were scanning the internet for vulnerable machines, and more flaws turned up in the same code as people finally looked closely at it.

The pattern of famous flaws in underfunded core code is not new. In April 2014, a bug called Heartbleed in OpenSSL, the library that puts the padlock on a large share of the web, let attackers read passwords and private keys straight out of server memory across a significant share of secure sites. At the time, the OpenSSL Software Foundation was taking in roughly $2,000 a year in donations, and 1 person worked on it full time. It took a global security panic to change that. Within weeks the Linux Foundation’s Core Infrastructure Initiative gathered pledges from 13 major technology companies, $100,000 each per year for 3 years, a pool of almost $4 million, and OpenSSL finally got full time paid developers and a professional audit.

The weekend 16 volunteers held the internet together

In December 2021, a flaw turned up in Log4j, a logging library used in a staggering range of Java software, from enterprise servers to the game Minecraft. The bug, Log4Shell, let an attacker run code on a server by getting it to log a single crafted string, and it was rated the maximum severity. It was described at the time as one of the most serious vulnerabilities in years, present in hundreds of millions of devices.

Log4j was maintained by the Apache Logging Services team, 16 volunteers, all unpaid, working in their spare time across nearly every time zone. When the exploit went public on 9 December, they spent the weekend scrambling to ship fixes while the rest of the world scrambled to patch. Gary Gregory, one of the maintainers, described working on about 4 hours of sleep. Christian Grobmeier, a former member of the team, said his old colleagues had families and other obligations and still spent the whole weekend on it. The first fix was not good enough, so they shipped another, then another, versions 2.15, 2.16, and 2.17 arriving over about 10 days. The security of a large slice of the internet’s servers ran, for that weekend, on a handful of exhausted volunteers and a private Slack channel.

The money is starting to arrive, unevenly

The picture is not uniformly bleak. Some of these projects have built real funding, and the difference almost always comes down to a maintainer treating the business side as part of the job.

Daniel Stenberg has run curl since 1996, the data transfer tool inside phones, cars, TVs, and shipped in Windows since 2018. He works on it full time because companies pay for commercial support, the project takes in a meaningful annual budget through its open collective, and Germany’s public fund for open source has paid for specific work on it. In his 2025 review, Stenberg noted that other contributors had now added more lines to curl than he has, something he had wanted for years, because a project that depends on 1 person is fragile no matter how healthy its funding looks today.

Institutional money has started filling some of the gap. Germany’s Sovereign Tech Agency has funded dozens of open source projects since 2022, including a direct investment in Log4j after the scare. The Alpha Omega project, backed by the Open Source Security Foundation, handed out millions last year, much of it to security engineers at foundations like Python and Ruby. The city of Munich began paying a developer to work on Expat, an XML parser, in 2026. Nick Wellnhofer raised a low six figure sum over the decade he maintained libxml2, the XML library on Android phones, iPhones, and in Chrome, and when he stepped down in late 2025 a new maintainer picked it up within a day. These are real improvements, and they are nowhere near the scale of the dependence.

Figure 4. The same move keeps saving these projects, money arriving only after a public crisis. OpenSSL, GnuPG, and Log4j all got sustained funding within weeks of a security event or a viral article, not before. Source: Author chart based on CII, ProPublica, and Sovereign Tech reporting

What you can actually do about it

The honest summary is that a lot of the software your devices depend on is maintained by 1 or 2 people who are underpaid or not paid at all, and the fixes that exist are patchy and often arrive only after something breaks badly. Some people will tell you AI is going to maintain this code soon. Maybe it will, eventually. The projects are understaffed now, and the risks are present now, so betting the world’s infrastructure on a future that may or may not arrive is not a plan.

If you build on open source, which is to say if you build anything, the useful move is small and specific. Pick 1 of the projects your own stack quietly depends on, the compression library, the XML parser, the shell, the time zone file, and find out who maintains it and whether they have a way to be funded. If your company uses it, sponsor it. A recurring sponsorship of a few hundred dollars a month, trivial against most engineering budgets, is life changing money for a solo maintainer. If you have time, become a contributor to a project that has 1 or 2 people doing the work, so there is a second set of hands if the first pair walks away. The Nebraska maintainer in the cartoon is real, there are dozens of them, and they have been holding this up for years while almost nobody noticed.