Data Drop at sheets.works visualises who actually maintains 23 pieces of software that phones, browsers and servers depend on, counting everyone who made ten or more changes to each project between October 2025 and October 2026 and then checking which of those libraries ship on an Android phone, an iPhone and a Windows PC. It finds that 11 of the 23 projects had only one or two people doing the regular work, and sets that against what they are paid: Lasse Collin wrote 97 percent of xz changes in 2025 after years of unpaid hobby work that preceded the Jia Tan backdoor, core-js author Denis Pushkarev raised $57 a month and has two GitHub sponsors, Todd Miller has maintained sudo since the early 1990s and reached about $61,700 a year on Open Collective only after asking for a sponsor in February 2026, Daniel Stenberg’s curl takes in about $89,700 a year plus 195,000 euros from Germany’s Sovereign Tech Agency, and zlib’s Mark Adler and libxml2 have no public funding at all. The piece also contrasts OpenSSL’s $5.4 million from the Linux Foundation after Heartbleed with the absence of new money after the xz backdoor, and notes that Germany’s Sovereign Tech Agency has funded about 90 open source projects since 2022 while Alpha-Omega gave out nearly $6 million last year.
The People Holding Up the Internet
Data Drop at sheets.works visualises who actually maintains 23 pieces of software that phones, browsers and servers depend on, counting everyone who made ten or more changes to each project between October 2025 and October 2026 and then checking which of those libraries ship on an Android phone, an iPhone and a Windows PC. It finds that 11 of the 23 projects had only one or two people doing the regular work, and sets that against what they are paid: Lasse Collin wrote 97 percent of xz changes in 2025 after years of unpaid hobby work that preceded the Jia Tan backdoor, core-js author Denis Pushkarev raised $57 a month and has two GitHub sponsors, Todd Miller has maintained sudo since the early 1990s and reached about $61,700 a year on Open Collective only after asking for a sponsor in February 2026, Daniel Stenberg's curl takes in about $89,700 a year plus 195,000 euros from Germany's Sovereign Tech Agency, and zlib's Mark Adler and libxml2 have no public funding at all. The piece also contrasts OpenSSL's $5.4 million from the Linux Foundation after Heartbleed with the absence of new money after the xz backdoor, and notes that Germany's Sovereign Tech Agency has funded about 90 open source projects since 2022 while Alpha-Omega gave out nearly $6 million last year.
Source: Sheets