The Hidden Vulnerability of Modern Software
Modern computing systems and devices typically require pieces of crucial open-source software, usually maintained by unpaid or low-paid volunteers. A recent report collated a list of critical open-source projects, noting which of them are chronically underfunded and understaffed. The information indicates that 11 out of 23 listed projects currently rely on only one or two maintainers, while funding remains scarce or nonexistent.
The Data Drop report on open-source maintainers identifies that having very few sets of eyes on critical codebases means that failures can occur in dramatic fashion given their widespread ubiquity. This raises concerns about the stability and security of software that underpins global digital infrastructure.
Historical Precedents in Code Failures
In 2014, Shellshock made waves as a vulnerability in the Bash shell present across Linux, macOS, and Unix-type systems, traced back to a line of code dating to 1989. Bash commit history shows it is almost exclusively maintained by Chet Ramey.
In 2016, ImageMagick was exploited to allow remote code execution. This library supports image manipulation across webpages and mobile applications. Later analysis revealed hundreds of security issues found over years in its codebase, with nearly every code contribution in recent years handled by an individual named Dirk Lemstra.
Contemporary examples include the 2021 Log4Shell exploit in the Apache Log4j logging library used in millions of servers, a zero-day vulnerability in the libwebp image-handling library in 2023, and the compromise of the xz compression library across Linux and iOS in 2024.
Understaffed and Unpaid Repositories
Key points in the report highlight specific repositories facing severe threats. The low number of overall maintainers and the unpaid nature of the work make these critical roles largely unattractive.
The primary time-zone file used across Linux-based operating systems is maintained pro bono by Paul Eggert. Core-js, a support software enabling new JavaScript features in older browsers and estimated to be used in half of the busiest websites globally, is handled by Denis Pushkarev.
The HarfBuzz library, developed by Behdad Esfahbod, is a cornerstone for ligatures and text shaping in Middle Eastern languages where letters change shape based on context. Esfahbod handles the vast majority of the project's code without public or corporate funding.
Libjpeg-turbo handles JPEG images across Android, Firefox, LibreOffice, and Chromium-based browsers, maintained by D.R. Commander with occasional modest contracts. Libxml2 manages XML reading and writing across numerous applications, though its original maintainer stepped down after years of work with minimal income.
The SQLite project provides a single-file database integrated into WhatsApp, Dropbox, Android, Windows, and all major browsers, retaining standard SQL capabilities while avoiding heavy database infrastructure.
The project estimates around a trillion instances of SQLite are in use, managed by just four people who have removed their names and photos from project pages due to security concerns. Funding relies on paid support through the founder's company.
Growing Support and Industry Investment
Certain projects have secured better support. The curl data transfer utility, started by Daniel Stenberg, now has a team of 11 funded through Open Collective and Germany's Sovereign Tech Agency after years of solitary work.
Both the Log4j and OpenSSL projects are likewise funded by the Sovereign Tech Agency, alongside the FFmpeg video file handler and the OpenSSH secure shell software ubiquitous across Linux servers.
Industry players benefit immensely from open-source infrastructure and could mitigate substantial security risks by investing in these projects, particularly as automated AI tools increasingly discover exploitable vulnerabilities.
