Open Source Is Critical Infrastructure Maintained by Volunteers

Nearly all modern software is built on open source components. A considerable proportion of those components are maintained by very small numbers of unpaid people, and the fragility this creates is widely acknowledged and rarely addressed.

The dependency graph is deeper than anyone tracks

A typical application directly depends on dozens of packages, which depend on hundreds more. Most development teams have no meaningful visibility into this transitive layer. A single obscure package deep in the tree can affect an enormous number of downstream systems, as several well-known incidents have demonstrated.

Maintainer burnout is the primary risk

Maintainers receive bug reports, feature demands, security disclosures and frequently hostile messages, without compensation and usually alongside full-time employment. The predictable outcome is abandonment or handover to whoever volunteers — which is also how several supply-chain compromises have begun.

Commercial use vastly exceeds commercial contribution

Companies with substantial revenue build on components maintained by individuals and contribute nothing back, not through bad faith but because no process exists to identify what they depend on or how to support it. The imbalance is structural rather than malicious, which is why appeals to goodwill have had limited effect.

Funding models remain inadequate

Donation platforms, foundations and corporate sponsorship all help and none has solved the problem at scale. Money reaches high-profile projects; the obscure single-maintainer library that half the internet depends on typically receives nothing.

What actually helps

Organisations should know their dependency tree and fund the critical parts of it directly. Contributing developer time is frequently worth more than money. Reporting issues with reproducible detail rather than demands costs nothing. And for individuals, straightforward acknowledgement to maintainers is not trivial — burnout is as much about thanklessness as workload.

This is infrastructure. It is currently financed the way a hobby is, and that gap is where the next serious incident will come from.