Which open-source projects are widely used but maintained by just a few people? | Hacker News Reader

Which open-source projects are widely used but maintained by just a few people?

106 pointsudev4096108 comments

I can think of sudo (https://github.com/sudo-project/sudo/graphs/contributors) which is maintained by just one person and is being used by every major linux distribution

View on HN

It almost feels like it's easier to list which fundamental projects have more than one active maintainer.

Many of the core library and tools are mostly finished and have very little yearly activity. How many maintainers does a project have if the last activity was one or two commits made or maybe just merged by one maintainer 3 years ago, and few more 5 years ago. Does it count as 2 maintainers, 1 maintainer, 0 maintainers? Does the "maintainer" from 5 years ago still have commit permission and how likely are they to get involved if some merge requests show up.

Even for active projects it's very common for 90% of work being done by one main maintainer.

Looking at the example of sudo it seems there are still plenty of regular and recent commits.

https://github.com/sudo-project/sudo/commits/main/

> Many of the core library and tools are mostly finished and have very little yearly activity

Yeah. The ad-hoc, de-facto "Standard Library" for JavaScript, the "web", and fullstack web apps.

OSS ecosystem is sometimes so very "Down and out in the magic Kingdom" adhocracy like. Shame we haven't got the rest of the Bitchun' society's perks. :) hahaha!

- curl: Daniel Stenberg et al. - https://github.com/orgs/curl/people

- Lua (programming language): team of 3 - https://www.lua.org/authors.html

- openssl: 15 people - https://github.com/orgs/openssl/people

maybe also: sqlite, vim, nginx, redis

> maybe also: sqlite [...]

SQLite won't accept contributions from outside the core team; joining the core team is an involved process, as they're taking extreme measures to ensure it will continue to be recognised as a work in public domain in as many jurisdictions as humanly possible. You can still support the project by paying them for their work (or by getting your employer to do so):

https://www.sqlite.org/prosupport.html

My understanding was that you could absolutely contribute without joining the core team, but you do need to file some paperwork to ensure that code can remain in the public domain. The need for the legal paperwork is that public domain is not a thing in multiple countries.

The justification and legal requirements are pretty clearly explained: https://www.sqlite.org/copyright.html

TL;DR: they have a company that legally employs every single co-author, to be able to sell you a Warranty of Title, just in case your company/jurisdiction/etc has a problem with public domain.

15 people is not "a few", it's a substantial group.

How many maintainers for the other ones you mentioned?

There's 724 people listed as contributors on the redis GitHub.

Right, but the question is concerned with the number of maintainers. The people who play some role, not just passing by.

Redis team consists of 8 people: https://github.com/orgs/redis/people

In this thread: Wildly different definitions of what "widely used" means :)

Did you know tools like uname [1] and cat [2] in GNU coreutils have essentially only had two contributors in the past decade?

[1] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=histor... [2] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=histor...

I'm actually surprised by the amount of changes in 'cat'. One would assume a program like that is already 'done'.

> I'm actually surprised by the amount of changes in 'cat'.

"'cat -v' considered harmful" is an ongoing meme, but there's truth to it. http://harmful.cat-v.org/cat-v/

cat(1) concatenates files. Some software should be considered done.

Starting in ~2008, the ones marked 'maint' and 'all' touch multiple files and don't appear to make substantive changes to e.g. cat. Since that categorization started, only 10 of the changes have been specific to cat.

How about the history for "true": https://github.com/coreutils/coreutils/commits/master/src/tr...

To be fair, there are a lot of commits that just update copyright years or documentation. IMHO that's just regular housekeeping and cannot mean that cat was not "done" in first place.

And most of what happens in those utilities is updating the copyright year numbers.

Which seems wholly unnecessary. The way I understand it, having only the starting year is sufficient.

Absent any changes in a year, the copyright year shouldn't be updated. Otherwise what you're claiming is that the copyright term starts from a date after creation of the content, so it's getting artificially extended.

The change in question isn’t about going from “Copyright (C) 2023” to “Copyright (C) 2024” but from “Copyright (C) 1998-2023” to “Copyright (C) 1998-2024”. Thus your case doesn’t apply, it’s not confusing. What I’m saying is that as far as I understand, having “Copyright (C) 1998” and not changing it would suffice.

Yes, I read your comment as saying that having the starting year and changing it every year would be sufficient. Which it isn't, but I've seen it often enough elsewhere that it's worth calling out.

Every time you change code and commit it, is it not a new program?

New editions of books have new copyright years, since they’re new books.

Same thing with code

That's why my first word was "absent".

Reading https://en.wikipedia.org/wiki/Copyright_formalities#Shift_aw..., even that isn’t necessary (at the moment) in a large part of the world.

Nevertheless I wouldn’t dare make any claim on this. Even in the presence of the Berne convention (https://en.wikipedia.org/wiki/Berne_Convention) the world is large and diverse.

Time Zone Database

https://github.com/eggert/tz/graphs/contributors

https://en.wikipedia.org/wiki/Tz_database

This is a good answer. Especially in the light of the 2021 drama and the maintainer's benevolent dictator status. What happens when the community disagrees with a benevolent dictator's decision?

https://lwn.net/Articles/870478/

> What happens when the community disagrees with a benevolent dictator's decision?

They discuss it, try to come to a compromise, and if all else fails, fork it.

Maybe it's not ideal, but then again, people seem to have a big problem when you have 'boards' running these projects too, so...

All hail the actual time lord

Same as with glibc and Ullrich Drepper.

A revolution

It would probably be easier to enumerate the small number of projects which have a larger amount of maintainers. I think the vast majority only have a few maintainers.

Just curious what arrangement theses people have.

-do their employers recognize their effort and give hours to the side projects?

-they mostly contractors so can arrange their time accordingly?

-donations?

-or is it mostly a hobby done out of passion?

You forgot an important option:

No payment, not a hobby, very little passion, doing it because the public needs it. (And possibly got started because, damn it, somebody had to write it / take over maintenance.)

Sounds terrible. Is there such a software project?

Oh yes, I'm sure there are. I maintain a few; none are ultra-popular but some are kind-of-popular. And I am sure that others have had this sentiment before and wrote something which others now rely on, without being particularly passionate about continued development of that thing. And it becomes like a chore which you know is important to many people rather than just one or two.

I don't have something nearly as popular as these other projects; but if you have a popular project, a potential employer might offer work hours for it to get you as an employee.

Further, as a contributor of some now popular projects with one other maintainer, I can say that I mostly do it for fun. My current employer gives zero-fucks about it but if a new employer were to use it to woo me away, I would jump in a heartbeat.

My employment contract specifically allows me to keep any rights that I do on my own time and equipment that doesn't compete in certain areas -- and enumerates those industries.

Maybe but you may have permissions to make it open source.

Note that the situation will not be much better for closed sourced projects.

Sure, your vendor will probably fix bugs, but it may take some time until they find someone who has any knowledge of that codebase and survived last week's reshuffle, the re-org in spring and last year's buyout.

I don't know that it is better for closed source projects, but regardless open source has an escape hatch closed source doesn't. If something goes wrong, you can maintain it yourself, or fork it.

I've done it myself.

That one property along is enough if you want longevity, open source is always a safer bet than closed source.

In my case, I guess it extended the projects life by another 20 years.

Nice try Jia Tan!

SQLite - https://www.sqlite.org/draft/crew.html

Looks like this is the non-draft URL - https://www.sqlite.org/crew.html

In some sense, the ubiquitous "unzip" has 0 maintainers.

Per the upstream, https://infozip.sourceforge.net/, "UnZip 6.0 was released on 29 April 2009".

But there are not truly 0 maintainers, because distros maintain their own patchsets, for example: https://git.launchpad.net/ubuntu/+source/unzip/log/

(By the way, unzip is arguably not feature complete. The ZIP spec has been updated multiple times since 2009, with the notable addition of the Zstandard compression method, among other things https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT)

zstd is not zip and pkware has long been irrelevant

DEFLATE isn't zip either, what's your point?

bash and readline - Chet Ramey. Both originally by Brian Fox https://twobithistory.org/2019/08/22/readline.html

maybe less of a bus factor now with OSH approaching feature/speed parity and having more maintainers https://www.oilshell.org/

For a moment I thought you meant open source hardware. Then came my disappointment.

Byte Buddy - runtime code generation for the Java virtual machine - https://github.com/raphw/byte-buddy

> It is stable and in use by distinguished frameworks and tools such as Mockito, Hibernate , Jackson, Google's Bazel build system and many others. Byte Buddy is also used by a large number of commercial products to great result. It is currently downloaded over 75 million times a year.

If you really want to dwelve into this, while the applications have plenty of cases let's not forget the underlying libraries that "everyone" depends on.

Not only software but also infrastructure & protocols: N.T.P.: — https://www.newyorker.com/tech/annals-of-technology/the-thor...

I found it quite a good read!

PCRE https://github.com/PCRE2Project/pcre2/issues/426

There's been some research into the topic:

https://www.researchgate.net/publication/308894462_What_is_t...

Edit: I missed the "widely used" part.

[Orca](https://gitlab.gnome.org/GNOME/orca). Very important for blind Linux desktop users. If you like frameworks more, [ATSPI](https://gitlab.gnome.org/GNOME/at-spi2-core), or [AccessKit](https://accesskit.dev/) may fit you more. Or, if you like contributing others' apps, take a look at how you could make them more accessible, with these [Tips for application developers](https://github.com/GNOME/orca/blob/main/README-APPLICATION-D...).

Liblzma rather infamously.

Mocha js testing framework is widely used and maintained by a small team https://github.com/mochajs/mocha/issues/5027

OmegaT is widely used in the professional translation world and maintained by 1 person with a very few active contributors (except for localizers).

https://omegat.org

VLC - VideoLan

https://github.com/orgs/videolan/people

As i recollect, GnuPG was also a one man band for some time.

Jia Tan is looking for a new project ?

GnuPG and Werner Koch comes to mind, there was this HN thread 10 years ago https://news.ycombinator.com/item?id=9003791

Also Fabrice Bellard of FFMpeg and his projects comes to mind.

I might be wrong too.

JSON Schema is the industry standard schema language for JSON, used by big players like OpenAPI and by an insanely high number of APIs and products out there.

The TSC core team stays at ~6 people (I'm one of them)

Not very typical "widely used" project but recently surpassed 100k+ installs with two people working on it part-time.

https://github.com/heyform/heyform

Expat

LibreSSL

Linux-PAM

OpenSSH

re2c

tzdata

zlib

Those are just the ones that came to mind.

Good list. Sometimes the easiest way to contribute is to just donate some money, so that the existing maintainers can continue to focus on their work. OpenBSD is the "mothership" project for both OpenSSH and LibreSSL: https://www.openbsd.org/donations.html

Unfortunately I couldn't find any information on how to donate to these projects:

- https://re2c.org

- https://github.com/libexpat/libexpat

- https://github.com/linux-pam/linux-pam

- https://zlib.net

tzdata is actually maintained by IANA:

- https://www.iana.org/time-zones

I didn't realize the IANA contributed debian packages and rpms. /s

They maintain the list, but someone has to package it.

Please link on how to contribute to Debian then: https://www.debian.org/devel/join/

Coolify! https://github.com/coollabsio/coolify

Kapitan

https://github.com/kapicorp/kapitan

e2fsprogs (https://github.com/tytso/e2fsprogs) is a widely-used utility suite for creating, maintaining, and repairing ext2, ext3, and ext4 filesystems

dnsmasq. Running on billions of of devices (including Android), one guy (Simon Kelley).

This has been observed before https://xkcd.com/2347/

Imagemagick

Ones that are highly complex but poorly documented.

Rich. 197 million downloads a month. There are two maintainers.

Perfect software doesn't need to be maintained. TM

flex & bison. Especially flex seems close to unmaintained.

wireguard [1] https://www.wireguard.com/repositories/

see the success of laravel https://github.com/laravel/laravel

quic-go: https://github.com/quic-go/quic-go/

husky (git hooks) https://github.com/typicode/husky

All of them!

Php

I'm surprised to hear this, any more info?

Its wrong, or at least not my definition of few people.

https://thephp.foundation/structure/

"Core Developers The PHP Foundation contracts 10 full-time and part-time engineers to maintain and develop the PHP language."

There are many, people doing (good, valuable) things on PHP, however active people with deep understanding of the engine can be counted on less than a hand. (I contributed some small things to the engine and other parts in the past)

One of those people is Nikita Popov (nikic). PHP core development took a hard hit when he left to work on other projects at JetBrains.

Not to mention all the volunteers.

FastAPI

All the better ones. The more maintainers, the quality goes down. Down to total destruction

zlib: Mark Adler

ncurses/xterm: Thomas Dickey

Most of the projects I am aware of :-)

People ask this question a lot in academia. The system just about incentivizes creating dupliware and/or abandonware that is critical to a domain, field, or niche, so there is tons of it (there is also A LOT of very good stable software, but ignoring this for now). This makes it very difficult for new parties to find open source software they can rely on, for funders to determine what software to support, for institutions to track their contributions, etc.

I am working on a project solving for this specific question (and many others), across the open source and open science ecosystems, starting with open source research software but ultimately intends to touch the whole space. Among other things, we want to take continuous measurements of the health of open source projects, the use of open source projects, the perception of open source projects, the "impact of open source projects", and the needs of open source projects. We are combining data collection with stigmergic markers and eventual webs of trust.

It is incubated by NumFOCUS, and includes collaborations from across the academic industry.

Bringing it here for your thoughts.

The project is called "The Map of Open Source Science" (MOSS) and is built on the "Simply Omniscient Layer" (SOL). It is essentially an omniscient open permissionless graph database of the digital knowledge and research ecosystems, as well as a corresponding visualization (eventually people will be able to build their own visualizations interfacing with SOL).

Very recent presentation at PyData Vermont: https://www.youtube.com/watch?v=7c51njj9JPs

Recentish update: https://www.opensource.science/updates/the-map-of-open-sourc...

Landing page for the program: https://opensource.science

From our site:

"MOSS is a comprehensive, composable, interactive map of the digital knowledge and research ecosystems. We identify connections between open source research software projects, research papers, organizations, patents, datasets, funding pathways, AI models and applications, and the people who drive it all.

The MOSS proof of concept so far demonstrates nine use-cases:

Identify relevant tools for your research

Showcase the impact and connections of the people that make and maintain open source research tools

Showcase the impact and connections of the organizations that build, support, and fund development of open source research tools

Showcase the impact and connections of open source research tools

Identify gaps in open source research tooling

Navigate repetition of open source research tool features

Identify, prevent, and reinvigorate abandoned open source research tools

Streamline the grant submission and review process

Navigate security flaw identification - who to contact, what downstream tools are effected, what alternative tools exist"

see the success of laravel

google's leveldb

bash

dokku

brew

Homebrew has a healthy amount of maintainers. Some people leave as priorities change but others join.

https://github.com/Homebrew/brew#who-we-are

The brew formulae are maintained by many people, and the “brew” command line tool has dozens of contributors with >100 commits.

curl

Linux Kernel

Could not be further from the truth. 1900+ people contributed to the latest release.

https://lwn.net/Articles/981559/

There are more commiters than maintainers can control quality.

There are also very few testers of stable release candidates for such a big project.

People used to fight for upstream factories to return the water they used clean to the river. It was an ecologist's fight.

Now corporations do projects with 5 or more zeroes in budget and a high percentage of the code is free software or open source. And they give 0 back to free or open projects that they parasite.

I wrote an article years ago in my blog (in Spanish, sorry), "Free software has failed": https://tomatesasesinos.com/2019/07/11/el-software-libre-ha-...

I think this belongs under "Show HN: My Tangentially Related Thoughts"

Reply on news.ycombinator.com