A Reddit user’s deep dive into the commit history of 23 open source projects that power phones, browsers and servers has confirmed something developers have long joked about but rarely measured: much of the internet’s infrastructure depends on a handful of unpaid volunteers. Eleven of those 23 projects had only one or two people doing the regular maintenance work in the past year, and the findings landed just as the community is still processing the aftermath of a real backdoor planted in one of those very tools.

The post, titled “The People Holding Up the Internet” and published on sheets.works by a Redditor using the handle u/Mastbubbles, collected roughly 1,100 upvotes on r/linux within a day. It is a direct, data-driven echo of xkcd comic 2347, the famous drawing of a towering structure of modern software resting on one small block labeled as a project maintained by a lone volunteer.

How the analysis counted maintainers

The author pulled the full public commit history for each of the 23 projects, kept only the changes made between 7 October 2025 and 7 October 2026, and excluded merge commits and bot activity. Anyone who made ten or more changes in that window was counted as a “regular contributor.” For funding data, the analysis checked whether a project received support from four specific sources: the Sovereign Tech Agency, Alpha-Omega, Open Collective, or GitHub Sponsors. A project marked as having “no public grant” simply means none of those four programs are funding it, not that the maintainer has never been paid by anyone, anywhere.

This methodology has clear limits, which the original piece acknowledges. It can’t see private sponsorships, corporate salaries paid to maintainers for unrelated reasons, or informal arrangements. Still, counting actual commits over a full year is a more concrete measure than anecdote, and it gives a rough but useful picture of who is actually doing the work.

The xz backdoor: what happens when burnout meets a bad actor

The most consequential case study in the dataset is xz, the compression library found on nearly every Linux server. Lasse Collin, based in Finland, has maintained it largely alone. In June 2022, Collin told the project’s mailing list that this was an unpaid hobby and that his ability to keep up had been limited by long-term mental health issues. Around that time, accounts named “Jigar Kumar” and “Dennis Ens” began publicly pressuring him about slow progress, while a contributor identified as Jia Tan was submitting useful patches. Collin eventually gave Jia Tan broader access to the project.

By 2023, Jia Tan was outpacing Collin in commit volume, 304 changes to his 172. In February 2024, versions released by Jia Tan contained a hidden backdoor into Linux servers. It was discovered on 29 March by Andres Freund, a Microsoft engineer, who noticed his SSH logins were consuming more processor time than expected. The backdoor’s path into systems ran through distribution-level patches: several Linux distros link OpenSSH to libsystemd, which in turn depends on liblzma, a component of xz. The identity of Jia Tan has never been determined.

Collin is once again the sole regular maintainer of xz. He wrote 97 percent of the project’s changes in 2025, and in 2026 the project has exactly one regular contributor. Notably, the analysis found no new public funding reached xz after the backdoor was exposed, a sharp contrast to what happened after OpenSSL’s Heartbleed vulnerability prompted major new investment in that project.

The time zone database behind every clock on your phone

A less dramatic but equally striking example is the IANA time zone database, the text file that tells billions of devices what time it is in every region on Earth, including when daylight saving changes happen. Paul Eggert, a UCLA lecturer, has been its official coordinator since 2012. At least four billion Android and iPhone devices read this file to calculate local time correctly.

Of 251 changes made to the database in the past year, Eggert personally authored 218, with a second contributor, Tim Parenti, responsible for 28. The most recent release, 2026e on 29 September, included Manitoba’s shift to a permanent UTC-05 time offset starting 31 October, meaning phones in Winnipeg will not fall back an hour as usual. Back in 2020, Eggert asked the project’s mailing list to formally designate Parenti as his backup in case retirement or anything else pulled him away.

The role has carried real legal risk. In 2011, an astrology software company sued Eggert and Arthur David Olson, who originally started the database in 1986 at the National Institutes of Health, claiming parts of its historical data were copied from an atlas the company owned. The project’s mailing list and download site went offline until IANA took over hosting later that month. The Electronic Frontier Foundation represented both men for free, and the company dropped the lawsuit in February 2012. Today, the time zone database still has no sponsor page and, according to this analysis, no public grant funding.

Why this matters beyond these two projects

These two cases illustrate a structural problem that extends well past xz and the time zone file. Software that underpins global infrastructure, from SSH connections to the clock on every smartphone, often runs on the unpaid, unglamorous labor of a small number of individuals. When those individuals burn out, get sued, or simply have limited bandwidth, the entire chain of dependent software becomes exposed to either silent decay or, as with xz, deliberate exploitation.

For developers and companies that build on these projects, the practical takeaway is to actually look at who maintains the open source dependencies in their stack, rather than assuming popularity equals institutional support. Funding programs like the Sovereign Tech Agency and Alpha-Omega exist specifically to address this gap, but this analysis suggests their reach remains limited, and that a security incident alone, as xz shows, does not guarantee new resources will follow.

Frequently asked questions

Was the xz backdoor ever fully removed from affected systems?
The backdoor was caught before most Linux distributions had shipped the compromised versions widely, which limited real-world exposure, though the incident prompted broad reviews of dependency chains across major distros.

Does “no public grant” mean these maintainers receive no money at all?
No. It specifically means the project isn’t funded through the Sovereign Tech Agency, Alpha-Omega, Open Collective, or GitHub Sponsors. Maintainers could still receive income through employers, consulting, or informal arrangements not captured in this analysis.

Source: 11 of 23 Core Open Source Projects Run on 1 or 2 People