Every phone that displays a time, every browser that loads a JPEG, every server that compresses a file depends on code maintained by a handful of unpaid or barely-paid individuals. A new investigation by sheets.works counted the contributors making ten or more changes to 23 foundational software projects over the past year. The finding: 11 of 23 had one or two people doing essentially all the regular work. The time zone database — used by four billion Android phones and iPhones, plus uncounted servers, Macs and laptops — is maintained by Paul Eggert, a UCLA lecturer, in his spare time. Of 251 changes in the past year, 218 were his and 28 were Tim Parenti's. Eggert has been the official coordinator since 2012 and asked the mailing list in 2020 to formalize Parenti as his backup "in case I am no longer available due to retirement or whatever." In 2011, when an astrology software company sued Eggert and original creator Arthur Olson, the file's mailing list and download site were simply switched off until IANA took them over. The xz compression tool, present on almost every Linux server and inside every iPhone, is maintained by Lasse Collin in Finland. In 2022 he wrote publicly that his ability to care had been "fairly limited mostly due to longterm mental health issues." Accounts pressured the mailing list about slow progress, and a contributor called Jia Tan sent useful fixes. Collin gave Jia Tan more access. By 2023 Jia Tan made 304 changes to Collin's 172. In February 2024, versions Jia Tan released carried a hidden backdoor into Linux servers. Andres Freund at Microsoft caught it on 29 March 2024 because his logins were using more processor time than expected. Nobody has identified Jia Tan. In 2025, Collin wrote 97 percent of the changes alone. The pattern repeats across the stack. Denis Pushkarev wrote 95 percent of changes to core-js, which runs on roughly half the top thousand websites, while raising $57 a month in donations; he went to prison in Russia in January 2020 and downloads nearly doubled while he was inside. Todd Miller has maintained sudo — the admin-rights command on every Mac and Linux server — since the early 1990s, making 5,408 of 5,409 changes between 2008 and 2018. After press coverage this year, sudo's Open Collective reached about $61,700 annually. DRC runs libjpeg-turbo, which opens every JPEG on Android and in Chrome and Edge, on funding described as covering "about 8-10 hours of labor per month." He wrote 98 percent of this year's changes. zlib, which compresses PNG images, web pages and Git repositories, counts on two regular contributors — Mark Adler and someone going by Vollstrecker — with no sponsor page and no public funding. Chet Ramey has maintained bash since about 1990 alongside his job at Case Western Reserve; every change in bash's public history is his, including the fixes for Shellshock, a vulnerability that sat undiscovered for 25 years on hundreds of millions of machines. Behdad Esfahbod wrote 85 percent of changes to HarfBuzz, the text-shaping engine for Android, Chrome, Firefox, Edge, Kindle and Figma. SQLite, present in every major phone, browser and desktop OS — with an estimated trillion databases in use — is maintained by a four-person team funded through D. Richard Hipp's support company. The xkcd comic about all modern digital infrastructure resting on one small block maintained by a random person in Nebraska is not satire. It is an architectural diagram. The investigation quantifies what the industry already knows but refuses to price in: critical path dependencies on individuals who can retire, burn out, go to prison, or be socially engineered by a state actor. The xz backdoor was not a failure of code review — it was the predictable consequence of a system that routes global security through one person's mental health. The structural question is not whether these maintainers are talented — they plainly are. It is whether an industry generating trillions of dollars in value has built any mechanism to ensure continuity when the single human at the bottom of the stack is no longer available. The answer, across 11 of 23 projects examined, is no.
