This was a fascinating reminder of what public service looks like in the late internet era. Ever since I first became aware of him in the early 1990s, I held Jon Postel in high regard. He was one of the first of this breed of people, and I still try to cleave to his robustness principle ("Be liberal in what you accept, and conservative in what you send"). 

This is beautiful, interesting, and thought-provoking. I’m left wondering how and why these solo maintainers have remained underfunded, considering that their software has been foundational in generating immense wealth in the last 30 years through the dot-com, crypto, and AI booms. Based on my daily experience with software developers over that same timeframe, I suspect there’s a deep attachment to the status quo on the part of the maintainers. 

The most surprising thing, to me, is that there haven't been more supply-chain attacks on these systems: these things just have huge targets painted on them.

Of course there has been one we know of.  There will be more.

Obligatory: https://xkcd.com/2347/

There was a big exploit of PHP (which much of the web runs on) and then a fix last week. Charlie Warzel:

Once the patch was released yesterday, websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.