The people holding up the internet

On 29 September Paul put out version 2026e of the file. The first line of its notes says that Manitoba moves to permanent -05 on 31 October, which tells phones in Winnipeg not to set their clocks back on 1 November, and it was typed in by two volunteers a month ahead. Of the 251 changes made to the file in the last year, 218 were his and 28 were Tim Parenti's.

In 2011 an astrology software company sued Paul and Arthur Olson, who started the file in 1986 at the National Institutes of Health, claiming some of its history came from an atlas the company owned. The file's mailing list and download site were switched off until IANA, which keeps the internet's master lists, took them over later that month. The Electronic Frontier Foundation defended them for free, and the company dropped the case in February 2012.

He wrote that line in the same email where he said his ability to care had been "fairly limited mostly due to longterm mental health issues". For months, accounts calling themselves Jigar Kumar and Dennis Ens had been posting to the list about how slowly things were moving, and a contributor called Jia Tan had been sending useful fixes.

Lasse gave Jia Tan more access. In 2023 Jia Tan made 304 changes to xz and Lasse made 172, which is the red on the wall below. In February 2024 the versions Jia Tan released carried a hidden way into Linux servers. Andres Freund, an engineer at Microsoft, found it on 29 March because his logins were using more processor time than they should, before most Linux systems had shipped it. Nobody knows who Jia Tan is.

In 2019 he was working on core-js full time without pay, living in Russia because it was cheaper. By his own account, three weeks after a big release he was driving home at 3 a.m. when two young women on a dark road ended up under his car, and one of them died. The families asked for about $80,000, and the prosecutor asked for seven years.

He added a message that appeared in the terminal every time anyone installed core-js, asking for help or a job. Millions of developers saw it, and many of them complained about the message. He went to prison in January 2020 and was released early, about ten months later.

Sudo was first written around 1980 at SUNY Buffalo, and Todd has looked after it for longer than Linux has existed. After The Register wrote about his note in February, the project's Open Collective budget reached about $61,700 a year and 30 people sponsored it on GitHub, which makes sudo the best funded one-person project in our count.

He started it in 2010 by taking the JPEG code from the 1990s and making it two to six times faster, and in 2019 it became the reference version of JPEG for the ISO and the ITU. He runs it on his own as a small business, which the project describes as "sustained solely through patronage and funded development". At one point he wrote that it had general funding "for about 8-10 hours of labor per month". This year he wrote 98 percent of the changes.

D. Richard Hipp wrote SQLite in 2000 after working on software for a US Navy destroyer, where the database kept failing whenever a separate server went down, so he made one that lives in a single file. When you open WhatsApp, your chats load from one. The project's own estimate is over a trillion SQLite databases in use, and the team pays for the work by selling support through Hipp's company.

zlib makes files smaller. It is inside PNG images, web pages, Git, Android, iPhones and Chrome, and Debian counts it on 291,615 of the machines that report to it, which is all of them. In the last year two people did most of the work, Mark and a contributor who goes by Vollstrecker. Mark has no sponsor page, and zlib is not on any public funding list we checked.

In September 2014 Stéphane Chazelas reported a bug in bash to Chet. Anyone could use it to run commands on a server by sending it a specially shaped piece of text, and on 24 September it went public as Shellshock, on hundreds of millions of machines. The line behind it had gone into bash on 5 August 1989. Every change in bash's public history is Chet's, including the official fixes.

For English the job is mostly simple. In Hindi, Arabic, Tamil and most of the world's writing, letters change shape depending on their neighbours, and without shaping a word comes out as a row of pieces. Behdad started the rewrite around 2012 while he was at Google. This year he wrote 85 percent of the changes, with five other people doing regular work.

This year eleven people did regular work on curl, and the one with the most changes was Viktor Szakats. In his review of 2025 Daniel wrote that everyone else has now added more lines to curl than he has. He works on it full time because companies pay for support, the project takes in about $89,700 a year through Open Collective, and Germany's public fund for open source paid €195,000 for work on it.

Heartbleed

OpenSSL puts the padlock on a large share of the web. In April 2014 a bug called Heartbleed let anyone read passwords and private keys out of the memory of about 17 percent of trusted secure servers, by Netcraft's count. That week the OpenSSL foundation's president, Steve Marquess, wrote that it received about $2,000 a year in donations, and he told NPR that one person worked on it full time.

Within two months the Linux Foundation raised $5.4 million from technology companies, and OpenSSL got two paid developers and an audit. It had six people doing regular work in 2013, fourteen in 2014 and thirty-two this year. xz had its backdoor in 2024 and has one.

The money

Germany's Sovereign Tech Agency has funded about ninety open source projects since 2022, and the Alpha-Omega fund gave out nearly $6 million last year, much of it to security engineers at foundations like Python's and Ruby's. Both give money to organisations that can apply for it and report on it.

On GitHub Sponsors, Daniel Stenberg has 64 sponsors. Paul Eggert, Lasse Collin, DRC and Mark Adler do not have a sponsor page.

libxml2 reads XML, the format behind a lot of documents, feeds and settings, and it is on Android phones, iPhones and in Chrome. On 15 September 2025 its maintainer, Nick Wellnhofer, wrote on the GNOME forum that he was stepping down, "which means that this project is more or less unmaintained for now". On 9 December two volunteers, Daniel Garcia Moreno and Iván Chavero, took it on, and Chavero announced it on the PostgreSQL mailing list with "contributions are welcome!"