Most of the internet runs on code maintained by one or two unpaid people

Published Oct 20, 2026, 1:30 PM EDT Aggy is a veteran writer and editor in the technology and gaming space. Having served as a Managing Editor for high-traffic digital publications, alongside being an editor and consultant for over a dozen sites. Aggy's published work spans a wide and respected array of tech and gaming outlets, including WePC, Screen Rant, How-To Geek, Android Police, PC Invasion, and Try Hard Guides. Beyond editorial work, Aggy's direct experience in the tech sphere extends to app development. Aggy has published two games under Tales and is always eager to learn and do more. He also likes working on computers and researching in his spare time. He knows about Windows, Linux, Audio, Video, and much more. The code on the internet that is doing the heaviest lifting only came to be because a person thought it up and made it open source. The internet isn't a massive, well-staffed operation, as much as it may seem to be. In a lot of places, it's a single developer with a bug tracker and no salary. They do it for the love of programming, but that shows you how fragile the internet actually is. A few unpaid developers are holding up the internet Huge companies rely on tiny hidden projects Software engineering has changed a lot over the decades because people don't write everything from scratch anymore. They build apps by gluing together long chains of open-source libraries, which happens a lot more often than you realize. That's a staple of using a computer. In fact, when I was in school for animation, I learned that real animators have bases they start with or perfect ears and noses they reuse on multiple models. On the software side, tools like npm, PyPI, and Maven grab hundreds of third-party packages every time a project builds. That's a huge speedup, but it also means some tiny unknown library can wind up sitting inside millions of apps and products and nobody even realizes it's there. Between 2016 and 2020, the average count of open-source components in a typical enterprise app went from 84 to 528. Today's software stack has huge heaps of hidden, nested code. At the bottom of that heap are foundational C and C++ libraries that deal with network protocols, encryption, compression, timekeeping, and logging. These get compiled straight into operating systems and hardware, so they're running behind almost everything you use. libcurl, the network transfer library built and kept up mostly by one guy named Daniel Stenberg, lives inside billions of devices around the world, like phones, smart TVs, routers, nuclear fusion experiments, and cars from 47 big automakers. OpenSSL handles encryption for more than 60 percent of the world's web servers. The zlib compression library turns up in game engines, browsers, and standard OS runtimes. The tz database, which tells software everywhere what time it is in any time zone, is run by just one or two people. xz Utils, a compression tool baked into Linux distros all over the planet, was looked after by a single developer. Back in the day, the people who started our industry shared code casually, and a lot of it was passion projects. Over the last 30 years, corporations came in and built commercial products and global cloud infrastructure on top of these tools, and they don't even pay the people who maintain the underlying code anywhere near as much as you'd expect they would. We really do rely on these people to keep the internet running. Before 2014, OpenSSL was securing two-thirds of the world's encrypted web traffic on an annual donation budget of about $2,000. It was kept alive by two developers named Steve, and only one of them worked on it full time. Basically, billion-dollar industries are alive because of one or two people working for very little. The internet breaks when unpaid projects fail A burned-out developer costs companies millions If we lose the Steves, things could go really wrong. Projects without enough money or help start falling apart. Security holes don't get patched, one person pulling their code can break thousands of builds, serious bugs sit unnoticed in popular frameworks, and attackers spend months working on developers who are already burned out. The Heartbleed bug is one of the most famous examples of what happens when foundational C code goes without proper security review. The flaw was in OpenSSL's implementation of a TLS feature called the Heartbeat extension. By sending a specially crafted packet that claimed to carry 64 KB of data while actually sending just one byte, an attacker could trick the server into handing back 64 KB of raw memory from the heap, which could have private encryption keys, passwords, and session tokens. This worked against servers running vulnerable versions of OpenSSL, which was used by as many as two-thirds of active websites. It left no log traces and likely cost the industry a lot of money to clean up. At the time, OpenSSL had one full-time developer. In 2016, a developer named Azer Koçulu got into a trademark fight with a company over an unrelated project and decided to pull all of his npm packages in protest. One of them was left-pad, an 11-line function that just pads strings with characters. Since left-pad was a hidden dependency inside tools like Babel and React, removing it instantly broke builds at tens of thousands of companies, and all they got back were 404 errors. The whole software world noticed. npm ended up changing its policies, so authors couldn't delete widely used packages after the fact. Log4Shell hit in 2021 and affected Log4j2, a Java logging library that around 88 percent of enterprises were using in some version. The bug let attackers run arbitrary code just by getting a malicious string logged anywhere in the system. The xz Utils backdoor in 2024 was something totally new. xz Utils is a compression library used across Linux systems worldwide. Its longtime solo maintainer, Lasse Collin, has talked publicly about being burned out. Everyone likes to say that big things are the effort of hundreds of people, which is true, but you can't get the same result without certain people leading. You wouldn't get Metal Gear Solid without Hideo Kojima, you wouldn't get Apple without Steve Jobs, and you wouldn't get Toy Story without John Lasseter. In these cases, it's even worse. We're seeing millions of dollars' worth of fixes, all because one or two people are gone. Some have tried to fix the problem with funding Corporate money might ruin the open-source spirit People have tried to fix this. After Heartbleed, the Linux Foundation started the Core Infrastructure Initiative, rounding up $100,000 annual commitments from major tech companies to fund full-time work on projects like OpenSSL and OpenSSH. In 2020, that grew into the Open Source Security Foundation, which started programs like Alpha-Omega to pay for security work on the most important projects. Germany set up the Sovereign Tech Fund in 2022, which pays maintainers through service agreements to fix technical debt, improve security, and close bugs. But none of this comes easily because open-source software was always voluntary. Maintainers picked permissive licenses knowing companies could use their work for free. When you bring government money, corporate contracts, or formal service agreements into these projects, you could kill the independence and community feel that made them worth using in the first place. On the other hand, companies making billions off free software have every reason to pay for the code they depend on, and you could argue they owe it. And for maintainers, answering bug reports all day with no pay and no thanks is exactly how people burn out, and burnout turns into a security risk. There's no good answer yet There's no clean answer to any of this. When big tech companies or governments become the main funders, they can quietly pull projects toward their own priorities. Also, money alone doesn't solve everything. When one person has spent 20 years building irreplaceable expertise in a project, a grant can't just create someone to take their place. We're in danger of losing a lot if any of the original creators die, so we need a solution fast.