// TOM'S HARDWARE US — HARDWARE & GADGET
Modern software is built on the backs of low-paid maintainers, opening the door to potential threats
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Modern computing systems and devices typically require pieces of crucial open-source software, typically maintained by unpaid or low-paid volunteers. Recently, a report collated a list of critical open-source projects, noting which of them are chronically underfunded and/or understaffed. The information is sobering: 11 out of 23 of the listed projects currently only have one or two maintainers, and funding is generally scarce and sometimes nonexistent.
The Data Drop's report on open-source maintainers identifies that having only one or two sets of eyes on critical pieces of software means that sooner or later something breaks — and it tends to do so in spectacular fashion, given its ubiquity. So, what happens when these projects, which are widely used across software, go underfunded or understaffed?
In 2014, the same year as Heartbleed, Shellshock made waves: a vulnerability in the Bash shell that's present in Linux, macOS, and Unix-type systems. The problem was traced back to a line of code present since 1989, displaying how even software that's thought to have all the bugs hammered out of it can still fall prey to attacks. A quick look at Bash's commit history shows it's almost exclusively maintained by Chet Ramey.
In 2016, ImageMagick was exploited, providing attackers with remote code execution. This library is used for image manipulation across a wide range of software, in webpages, mobile apps, and more. A 2020 analysis revealed that hundreds of security issues had been found over the years in its extensive codebase. Nearly every code contribution in the past couple of years has been done by an individual named Dirk Lemstra.
Contemporary examples include 2021's Log4Shell exploit, a critical vulnerability in the Apache Log4j logging library used in millions of servers. The libwebp image-handling library saw a zero-day vulnerability in 2023, and the xz compression library used across Linux and iOS was compromised in 2024.
Key points in the report mention specific repos, which might be under threat. Somewhat unsurprisingly, the low number of overall maintainers and the unpaid nature of the work make it unattractive to perform.
The main time-zone file used across Linux-based operating systems is maintained pro bono by Paul Eggert, a UCLA teacher. Core-js, a piece of support software that lets new JavaScript work in old browsers and is estimated by the author to be used in half of the busiest websites in the world, is handled by Denis Pushkarev. He once had to endure criticism from the community because he added a command-line message to the library's installer asking for help or a job.
The HarfBuzz library developed by Behdad Esfahbod is a cornerstone in ligatures and text shaping in Middle Eastern languages. In those writings, a letter changes shape and/or orientation according to what's around it. Esfahbod handles that vast majority of the project's code, and doesn't mention public or corporate funding.
Libjpeg-turbo handles JPEG images on Android, Firefox, LibreOffice, and every Chromium-based browser. It's kept ship-shape by D.R. Commander aka DRC, who occasionally is contracted for library-specific work, though at arguably modest values of "3-4 figures rather than 6 or 7." Libxml2, just like the label says, handles XML reading and writing across numerous applications and operating systems. Nick Wellnhofer, the original maintainer, stepped down in September 2025, after years of work with little income.