The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting. So I wrote a blog post about it

An absolutely ridiculous amount of open source is one person projects. I have the data to prove it

https://opensourcesecurity.io/2025/08-oss-one-person/

Open Source is one person

The Register recently published a story titled Putin on the code: DoD reportedly relies on utility written by Russian dev. They should be ashamed of this story. This poor open source developer is getting beat up now to score some internet points. It’s very upsetting. But anyway, let’s look at some receipts. If you’re not real smrt, it seems like pointing out an open source project is written by one person in a country you don’t like is a bad thing. It could be. But it also could be the software running THE WHOLE F*CKING PLANET is written by one person. In a country. But we have no idea which country. It’s not the same person mind you, but it’s one person.

Open Source Security
@joshbressers Obligatory:
@WhyNotZoidberg @joshbressers it is, but Munroe was wrong in practice here. It seems over 90% of that image should be those sole-developer blocks.
@mweiss @WhyNotZoidberg Long ago I fixed the xkcd comic :)

@joshbressers @mweiss @WhyNotZoidberg Wow, Nebraska seems to be full of random persons. :)

Good version! 👍

@joshbressers @mweiss @WhyNotZoidberg
I'm currently working at $DAYJOB where we're integrating a newer ARM core into a system-on-chip.

The software team is having trouble connecting an external debugger to this core because they don't know how the core's debug interface is supposed to work and what the micro-architectural preconditions for stopping code execution on the core are. The setup requirements are documented by ARM, at least, but that team doesn't have all the expertise it needs to set up the standard development toolchains on this new platform.

Even in big companies, crucial digital and computing infrastructure knowledge and implementation experience are all funneled and concentrated to a very few subject matter experts. There are often issues which only one or two people know how to debug in a productive way. (When there are thousands of signals and hardware registers which might contribute to an issue, having to figure it all out from scratch is very hard.)

The number one reason why people don't spend more time learning how to debug other issues or understanding the fundamental architecture and operation is that there's a LOT of testing to do and a LOT of possible issues to investigate and check when debugging, and the schedule of the hardware project ticks on by regardless. There's a certain reckless disregard for creating ultra-low-bus-factor technology at that low level of hardware technology because we still need all the possible micro-optimizations at the hardware level to get the power efficiency and performance that are the standard.

Microelectronics design is also tediously cursed in this manner, though without the same hobby project burden.

@frummidge @joshbressers @WhyNotZoidberg proper BCPs should aim for a minimum of three, though in practical cases I often end up with two because of headcount constraints.

When it's one, you're one accident away from loss of business continuity. Or one "got a better offer somewhere else".