11 of 23 Core Open Source Projects Run on 1 or 2 People

A research analysis of 23 critical open source projects found that 11 rely on just one or two people for regular maintenance, with projects like xz, sudo, and the time zone database having single maintainers who receive little to no public funding. Despite these foundational tools being relied upon by billions of devices globally, most funding only materializes after security disasters, as demonstrated by the $5.4 million raised for OpenSSL following the 2014 Heartbleed vulnerability.