Open Source Isn't Free.

On March 29, 2024, Andres Freund posted a message to the oss-security mailing list that opened with one flat sentence: "The upstream xz repository and the xz tarballs have been backdoored." He hadn't been hunting for it. He noticed ssh logins taking a lot of CPU, some valgrind errors, and a delay of about half a second on his older machine, and he kept pulling the thread.

What he found got the highest possible severity. NVD scores CVE-2024-3094 at 10.0 and describes malicious code in the upstream tarballs of xz starting with version 5.6.0. CISA told developers and users to downgrade from 5.6.0 and 5.6.1 to an uncompromised version such as 5.4.6.

The technical story is clever. The human story is the one that matters. Almost two years earlier, xz's maintainer Lasse Collin had replied on the project's mailing list to a complaint that progress had stalled. He wrote that "this is an unpaid hobby project", that his ability to care had been limited by long-term mental health issues, and that he had been working off-list with someone named Jia Tan and that "perhaps he will have a bigger role in the future." The backdoored 5.6.0 and 5.6.1 tarballs were created and signed by Jia Tan. A compression library that ended up wired into ssh logins was, in practice, one tired volunteer and whoever offered to help him.

It was not a one-off. Less than three weeks later, OpenSSF and the OpenJS Foundation warned that OpenJS had seen a similar takeover attempt, with strangers pushing to be made maintainers of a popular JavaScript project, in a pattern that bore "strong resemblance to the manner in which 'Jia Tan' positioned themselves." The same alert put it plainly: "Maintainers often lack the time, people and expertise in areas such as security."

Log4Shell was the same lesson with a different mechanism. CVE-2021-44228, published in December 2021, also scored 10.0 and affected Apache Log4j2 from 2.0-beta9 through 2.15.0. The US Cyber Safety Review Board's report on it is worth reading in full. The flawed lookup feature was contributed in 2013. Log4j was maintained by "a group of volunteers." One federal cabinet department reported spending 33,000 hours responding to it. The Board called Log4j an "endemic vulnerability" that will stay in systems "for many years to come, perhaps a decade or longer," and named the root problem directly: the "thinly-resourced, volunteer-based open source community" is "not adequately resourced" to develop and audit code to the standard everyone downstream assumes.

So who is paying? Mostly nobody. Tidelift's 2024 maintainer report found that 60% of maintainers describe themselves as unpaid hobbyists, and only 12% earn most or all of their income from maintenance work. The work also concentrates on very few people. In the Linux Foundation and Harvard's Census III of free and open-source software, 17% of the top 50 non-npm projects had a single developer accounting for more than 80% of commits, and 40% had one or two.

Who gets paid to maintain open source

• Maintainers who call themselves unpaid hobbyists 60%
• Maintainers who earn most or all of their income from maintenance 12%

Meanwhile the value flowing out of that work is enormous. Hoffmann, Nagle and Zhou at Harvard Business School estimate that widely used open source would cost $4.15 billion to recreate once, but is worth $8.8 trillion on the demand side, and that firms would need to spend 3.5 times more on software if it didn't exist. Just 5% of developers create 96% of that demand-side value.

When nobody pays, the code doesn't vanish. It rots in place. Black Duck's 2026 Open Source Security and Risk Analysis found open source in 98% of the commercial codebases it audited, and 93% of them contained components with no development activity in over two years. Its term for these is "zombie components": still installed, still running, and with no one left to fix them when a vulnerability turns up.

Commercial codebases audited by Black Duck, 2026

• Contain open source 98%
• Contain components with no development activity in over two years 93%

Some governments have started treating this as infrastructure rather than charity. Germany's Sovereign Tech Agency lists 41.1 million euros invested in commissioned work, and its past investments include Log4j, OpenSSH and curl. That's a real model. It's also small next to the value figures above, and it covers a short list of projects out of millions.

Now bring it to civic tech. The open-data portals governments use to publish public records are built on this same stack. CKAN, the open-source data management system behind hundreds of portals, shows data.gov, Canada, the NHS and opendata.swiss among the sites it powers. Its install guide says it is "a Python application that requires three main services: PostgreSQL, Solr and Redis." Solr is CKAN's search engine, and in December 2021 Apache Solr issued a critical advisory because Solr 7.4.0 through 8.11.0 shipped the vulnerable Log4j. Any portal running an affected Solr inherited a 10.0 vulnerability it never chose, and stayed exposed until someone upgraded a component two layers below the portal itself.

Nobody at a records office chose Log4j. They chose CKAN, CKAN chose Solr, and Solr chose Log4j. That's how supply chains work, and it's why "we use open source" is not a security posture or a budget line. It's a list of debts somebody else is carrying, often alone, often for free.