Technology · Analysis
The software everyone depends on and nobody maintains
The libraries underneath the modern web were written by volunteers and are one burnout away from being unpatched. The industry has known this for a decade.
The libraries underneath the modern web were written by volunteers and are one burnout away from being unpatched. The industry has known this for a decade.
Somewhere on a hard drive in a spare room is a compression library. It is four thousand lines long, it is thirty years old, and it is running inside the browser you are reading this in, the phone in your pocket and the aircraft you will fly on next month.
Its maintainer is one person. He is not paid for it. He has asked, several times, whether anyone else would like to take it on.
The economics of a shared foundation
Every company that uses the library has calculated, correctly, that it is cheaper to depend on it than to fund it. Each of them is right. Collectively they have built a civilisation on a volunteer's evenings.
The tragedy is not that nobody pays. It is that everybody has run the numbers and paying is, individually, irrational.
What actually breaks
Not the code. The code is fine — that is why it has lasted. What breaks is the person: an unpaid maintainer who has spent a decade reviewing patches from strangers, and who one Tuesday simply stops answering.
The library keeps working. It keeps working for years. And then a vulnerability is found, and there is nobody with the keys.
By the numbers
1 maintainer
For a library present in an estimated 3.1 billion devices.
0 dollars
Received in funding from the twelve largest companies that ship it.
11 years
Since the last time anyone else reviewed a line of it.