The people holding up the internet reveals how critical digital infrastructure depends on remarkably few maintainers. The time zone database, which governs clock settings for approximately 4 billion Android and iPhone devices, is maintained by Paul Eggert, a UCLA lecturer who works on it in his spare time. In the year leading to version 2026e released September 29, 2026, Eggert authored 218 of 251 total changes, with Tim Parenti contributing 28. Similarly, Todd Miller has maintained sudo - the command granting administrative access on Mac and Linux systems - since the early 1990s, authoring 5,408 of 5,409 changes between 2008 and 2018. SQLite, present in every Android phone, iPhone, Mac, Windows system and major browser, was modified by only four people in the past year.

Paul Eggert on a video call wearing headphones, the volunteer maintainer of the time zone database
Paul Eggert, who maintains the time zone database used by billions of Android and iPhone devices in his spare timesheets.works

The article notes that Eggert authored 218 of 251 changes to the time zone database in the year leading to version 2026e, highlighting the reliance on a single volunteer.

This pattern of minimal maintenance teams created vulnerabilities exploited in the xz compression tool incident. Lasse Collin, a volunteer developer living in Finland, had maintained xz for years until granting access to contributor Jia Tan in 2023. By that year, Jia Tan was making more changes than Collin (304 to 172). In February 2024, Jia Tan released versions containing a hidden backdoor into Linux systems, which remained undetected until Microsoft engineer Andres Freund discovered it on March 29, 2024 due to unusual processor usage. After the discovery, Collin resumed sole maintenance and wrote 97 percent of xz changes in 2025. The incident highlights how reliance on a small number of volunteers can open supply chain risks when trust is misplaced.

XKCD comic showing a tower of blocks representing modern digital infrastructure resting on a single small block labelled a project some random person in Nebraska has been thanklessly maintaining since 2003
Illustration of the disproportionate reliance on few maintainers for critical internet infrastructuresheets.works

This visual metaphor matches the article's discussion of how reliance on a small number of volunteers can open supply chain risks when trust is misplaced, as seen in the xz incident.

Funding and support disparities further highlight the fragility of this maintenance model. While Germany's Sovereign Tech Agency has awarded grants of €596,160 to log4j, €437,930 to FFmpeg, €405,888 to OpenSSL, €200,000 to OpenSSH, and €195,000 to curl since 2022, projects including the time zone database, SQLite, zlib, libxml2, libjpeg-turbo, HarfBuzz, xz, bash, nghttp2 and expat have received no identifiable public grants. This contrast is mirrored in GitHub Sponsors, where Daniel Stenberg has attracted 64 supporters for curl while maintainers of the time zone database, xz, libjpeg-turbo and zlib lack sponsor pages entirely. Even when funding exists, as with libxml2's transition from maintainer Nick Wellnhofer's September 2025 departure to volunteers Daniel Garcia Moreno and Iván Chavero taking over in December 2025, the infrastructure serving 5.6 billion phones and computers experienced an 85-day period without dedicated maintenance.

Daniel Stenberg, maintainer of curl, pictured in a portrait
Daniel Stenberg, whose project curl received €195,000 in grants from Germany's Sovereign Tech Agency, contrasted with unfunded maintainerssheets.works

The article cites curl as an example of a project that received public funding, while many critical infrastructure projects like the time zone database, xz, libjpeg-turbo, and zlib lack such support.