Data Drop Exposes Internet’s One-Person Dependencies

The internet’s biggest infrastructure risk is often organizational, not technical: critical dependencies remain one maintainer’s burnout or compromise away from failure.

• –The project makes “bus factor” concrete by connecting individual maintainers to software embedded in phones, browsers, servers, and operating systems.
• –The xz backdoor and Heartbleed examples show two failure modes: a malicious takeover of an understaffed project and a vulnerability in infrastructure that lacked adequate funding.
• –Developers should treat dependency ownership, maintenance activity, and funding as part of security review—not merely track versions and CVEs.
• –Public funding helps, but the investigation suggests support remains reactive, arriving after crises instead of sustaining the quiet maintenance that prevents them.
• –Its strongest contribution is making invisible open-source labor legible to the companies and developers who routinely depend on it.