Which open-source projects are widely used but maintained by just a few people?

Hacker News Discussion ↗

Many widely used open-source projects — from core utilities like `curl`, `bash`, `zlib`, and `sqlite` to infrastructure such as the time zone database, NTP, and WireGuard — are effectively maintained by just one or a handful of people. Commenters highlight the systemic “bus factor” risk this creates, noting that even critical tools can be underfunded, understaffed, or effectively abandoned while corporations depend heavily on them. Alongside examples of single-maintainer projects and questions about how maintainers sustain this work, there are calls for better funding models, corporate support, and tooling to map and monitor the health and dependency networks of open-source software.

Scope of “widely used, few maintainers”

  • Many core tools, libraries, and protocols are cited: curl, Lua, OpenSSL, SQLite, Redis, zlib, PCRE, Bash/Readline, dnsmasq, ImageMagick, ncurses/xterm, e2fsprogs, unzip, Time Zone Database (tz/tzdata), NTP, OpenSSH/LibreSSL, Liblzma, tzdata, coreutils utilities (cat, uname, true), leveldb, wireguard, GnuPG, ffmpeg-related work, quic-go, etc.
  • Higher‑level tools and frameworks: Mocha, husky, FastAPI, Rich, Homebrew (disputed), Laravel, Coolify, dokku, Byte Buddy, OmegaT, Kapitan, Heyform, VLC, Orca/ATSPI/AccessKit, JSON Schema, various academic/research tools.
  • Some claim “this is basically all of OSS”: most projects have one or a few active maintainers, with occasional contributors.

What counts as “a few maintainers”?

  • Disagreement over boundaries: e.g., 15 people for OpenSSL or ~10–plus for PHP are seen by some as “not a few.”
  • Distinction is drawn between:
    • Contributors vs. maintainers with long‑term responsibility.
    • Historical maintainers vs. currently active ones.
  • Some tools appear “done” but still get minor maintenance (copyright bumps, docs, small fixes), raising ambiguity over whether they’re actively maintained.

Bus factor, quality, and governance

  • Many core components (e.g., Bash, dnsmasq, zlib, tzdb, unzip) have a bus factor near 1, despite massive deployment (billions of devices, foundational protocols).
  • Some argue more maintainers can dilute quality; others highlight benevolent dictatorships and what happens when communities disagree (e.g., tzdb drama, glibc history).
  • Forking is seen as a last‑resort governance mechanism.

Funding, motivation, and corporate dependence

  • Maintainers’ situations vary:
    • Employer‑supported work time.
    • Contractors with flexible schedules.
    • Donations, or none at all.
    • Some do it from duty rather than passion, describing it as a chore that remains socially important.
  • Concern that corporations heavily depend on such projects yet contribute little back; compared to historical environmental fights.
  • Donating to “motherships” (e.g., OpenBSD) is suggested where direct project donation channels are unclear.

Research and tooling around project health

  • Prior research on “truck factor” is linked.
  • A new effort (MOSS/SOL) aims to map open-source research software: usage, health, impact, abandonment, and security relationships, to guide support and funding decisions.