Modern software is built on the backs of low-paid maintainers, opening the door to potential threats
Modern computing remains vulnerable to the low bus factor of many open-source projects — continued lack of funding and manpower for voluntary-maintained infrastructure makes for a perennial threat
Open-source software forms the backbone of modern computing, yet the individuals who maintain these crucial projects often operate under dire financial circumstances. A recent report analyzing 23 critical open-source projects reveals that 11 of them currently possess only one or two maintainers, with funding frequently either scarce or nonexistent.
This leaves room for potential vulnerabilities and threats, as the impact of inadequate oversight can be catastrophic when these widely-used software components are compromised. The history of past vulnerabilities, like Heartbleed, Shellshock, and recently Log4Shell, demonstrate the severe consequences of underfunded and understaffed projects.
In specific instances, maintainers like Chet Ramey, Dirk Lemstra, Paul Eggert, and Behdad Esfahbod have been forced to handle massive workloads alone, often without financial compensation or recognition. Despite the challenges, some projects, such as curl, Log4j, and OpenSSL, have received funding from industry players, suggesting that investment in these essential software components is not only warranted but could also serve as a preventive measure against potential security threats.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
