一项新闻调查揭示了互联网基础设施面临的严峻现状：全球数十亿部手机和计算机所依赖的关键开源软件项目由极少数人维护，其中许多维护者工作无报酬或资金严重不足。1记者通过分析23个项目的代码历史，确认了时区文件、xz压缩工具、SQLite数据库、bash、curl等核心软件的维护负担分布。1
Android和iPhone均使用的时区文件自2012年起由Paul Eggert一人负责维护，去年218项改动全由他完成。1xz压缩工具的维护者Lasse Collin因心理健康问题精力有限，贡献者Jia Tan在2024年2月发布的版本中植入了隐藏后门，直至2024年3月29日才被微软工程师Andres Freund发现。1
SQLite数据库已被集成到Android、iPhone、Mac、Windows 10/11及所有主流浏览器内，据估计超过一万亿个SQLite数据库在使用中。该项目由D. Richard Hipp自2000年创建并维护。1
部分维护者的资金状况令人担忧。libjpeg-turbo的维护者今年贡献了98%的改动，但仅获得约8至10小时每月的资金支持。1sudo命令的维护者Todd Miller从2008至2018年进行了大部分改动，直到2026年2月后才获得约61700美元年度资金和30个GitHub赞助者。1
libxml2库部署在5.6亿部手机和计算机上。其维护者Nick Wellnhofer于2025年9月15日宣布退出，12月9日由两名志愿者接手。12014年4月爆发的Heartbleed漏洞影响了全球约17%的可信安全服务器，当时OpenSSL基金会仅获得年度2000美元捐款。1
A journalistic investigation has revealed the precarious state of critical internet infrastructure maintenance, where billions of smartphones and computers depend on open-source software projects maintained by a handful of often underfunded or unpaid individuals 1. Through analysis of code histories across 23 major projects, researchers documented the maintenance burden and funding gaps affecting core technologies that power modern digital life 1.
Several cases illustrate this vulnerability. The timezone database, used by both Android and iPhone devices, has been maintained since 2012 by Paul Eggert, who completed all 218 code changes submitted to the project in the previous year 1. The xz compression utility, maintained by Lasse Collin who faces mental health challenges limiting his availability, saw a contributor named Jia Tan introduce a hidden backdoor in February 2024 that went undetected until Microsoft engineer Andres Freund discovered it on March 29, 2024 1. SQLite, which powers Android, iPhone, Mac, Windows 10/11, and all major web browsers, has been stewarded by D. Richard Hipp since its creation in 2000, with an estimated one trillion SQLite databases currently in active use 1.
The funding disparities underscore the problem. The sudo command's maintainer Todd Miller performed the majority of updates from 2008 to 2018 before securing approximately $61,700 in annual funding and 30 GitHub sponsors as of February 2026 1. In contrast, libjpeg-turbo's maintainer authored 98% of this year's code changes while receiving only 8–10 hours per month of paid support 1. The 2014 Heartbleed vulnerability, which affected approximately 17% of the internet's trusted security servers globally, occurred while the OpenSSL Foundation was receiving only $2,000 in annual donations 1. More recently, libxml2, deployed on 560 million devices worldwide, saw its longtime maintainer Nick Wellnhofer announce his retirement on September 15, 2025, with two volunteers assuming responsibility on December 9, 2025 1.
评论
还没有评论，欢迎留下第一条。