A report by The Data Drop highlights that critical open-source software often relies on one or two unpaid maintainers, creating significant security risks. Vulnerabilities like Shellshock in 2014, ImageMagick in 2016, and Log4Shell in 2021 demonstrate the dangers of underfunded projects.
Many essential libraries lack corporate backing. For instance, the time-zone file for Linux is maintained pro bono, and the Core-js library, used by half of the world's busiest websites, is handled by a single developer. Similarly, the HarfBuzz text-shaping library and Libxml2 operate with little to no public or corporate funding.
The SQLite database, found in approximately one trillion instances including WhatsApp and Windows, is managed by only four people. These maintainers have removed personal information from their project page due to security concerns. Libjpeg-turbo maintainer D.R. Commander reports receiving only modest payments for his work.
Some projects have secured funding to improve sustainability. Daniel Stenberg now works full-time on curl with a team of 11, supported by Open Collective and the Sovereign Tech Agency. The latter also provides funding for Log4j, OpenSSL, FFmpeg, and OpenSSH, reflecting a shift toward institutional support for critical infrastructure.
