S4E382 — 11 of 23 Core Open Source Projects Run on 1 or 2 People

GARY: Okay—Gary. Eleven papers, two hands, one door. The door has the board seat.

MAEVE: Maeve. General partner. Already exhausted.

OBI: Obi. I keep the internet running. This article is therefore about me.

GRUNER: Gruner. Field researcher. Hypothesis pending.

GARY: A study examined twenty-three core open‑source projects. Eleven had one or two employees doing regular work.

OBI: Contributors, not employees. Define "regular."

GARY: Ten or more changes in a year. October 2025 to October 2026. No bots or merges.

MAEVE: Civilization is staffed like a lemonade stand with root access.

OBI: Worse. Lemonade stands have investors and adult supervision.

GRUNER: One human holds internet. Efficient, or crime. Pending.

GARY: calvinmorrison writes: "OK so we only need to employ 22 people as a WORLD to have these guys full time employed? when can we start enshittifying it?"

MAEVE: Twenty-two hires. A seed round for one app that identifies dogs.

OBI: Commits miss review, triage, releases, and the 3 a.m. page. The actual job.

MAEVE: So visible labor gets priced. Everything else becomes a cute bullshit census.

GARY: Twenty-two? Thermal's sock telemetry had more headcount and --

OBI: Oh-- your sock telemetry did not hold up four billion phones.

GARY: The socks held up me.

GRUNER: Field note: humanity staffs critical infrastructure like family dinner. One cook, no backup, everyone hungry.

MAEVE: Finally, peer review.

GARY: Tonight, we save civilization with fewer people than socks.

GARY: Four billion phones feels ambitious for one text file.

OBI: Every alarm, calendar invite, and boarding pass needs local time.

MAEVE: Civilization is Paul Eggert’s recurring meeting. He cannot decline.

GARY: Two hundred fifty-one changes last year. Eggert made two hundred eighteen. Tim Parenti made twenty-eight.

GRUNER: Five changes escaped custody.

OBI: Parenti is the backup. Two humans operate planetary time.

MAEVE: A bus factor with one passenger seat.

GARY: Then xz returned to one regular contributor after the backdoor.

OBI: And sudo historically had one dominant maintainer.

GARY: That may be fine. manquer asks: “What would 10 maintainers do on sudo ?”

OBI: Nine could review the tenth.

GARY: Or invent work. Mature software deserves a quiet retirement.

OBI: So does nitroglycerin. We still inspect it.

GARY: Sudo is stable. Ten people could turn one prompt into Kubernetes.

OBI: Review is not feature churn.

GARY: Muncie ran with two people.

OBI: There it is. Your two-man metal-shop marketplace.

GARY: Those shops were efficient.

OBI: They owned lathes, Gary. Not privilege escalation.

GARY: The principle transfers. Small teams communicate faster --

OBI: Oh-- fuck off.

GARY: It was a clean org chart.

OBI: You and a contractor named Brent.

GARY: Brent understood regional fabrication capacity.

OBI: Brent uploaded six photographs sideways.

GARY: The orientation preserved authenticity. We had no management bloat.

OBI: You had no customers.

GARY: We had forty-three qualified shops.

OBI: You had forty-three email addresses.

GARY: Same initial funnel. Tiny can mean finished. Focused. Nobody needs ten adults rearranging one semicolon.

OBI: Or one person reviews, releases, handles security reports, and plans succession.

GARY: Headcount is not resilience. Ten mediocre maintainers produce ten times the shit.

OBI: Correct. The skeptic wins that narrow point.

GARY: Thank you.

OBI: You still mistake staff scarcity for efficiency, spreadsheet dickhead.

GARY: Importance does not manufacture workload.

OBI: Sudo’s workload did not manufacture colleagues.

GARY: Todd Miller kept it running. That supports me.

OBI: Todd Miller made five thousand four hundred eight of sudo’s five thousand four hundred nine changes.

GARY: Replying to manquer’s ten-maintainer question, eviks writes: “Founds vulnerabilities faster? Rewritten it in a safer language? Made a safer doas-like subset compilation target? Made it harder to trick a single person by having more eyes on code reviews?”

MAEVE: Four products, one comment. Fund the subset. Acqui-hire the punctuation.

GARY: Ten maintainers, four roadmaps, thirty-seven meetings. Sudo becomes athleisure.

OBI: One reviewer could ask why Gary’s privilege code downloads a pitch deck.

GRUNER: Second asks why pitch deck has root.

MAEVE: Enterprise tier removes Gary from sudoers.

GARY: Fine. More eyes find shit. Eyes also require chairs.

OBI: Chairs cost less than a compromised server fleet.

GARY: But xz was reviewed. The attacker still got everything —

MAEVE: No— not everything.

OBI: Do not overstate it. Social pressure helped Jia Tan gain trust and release access. The backdoor reached malicious 2024 releases, but most Linux systems had not shipped them.

GARY: Because open review caught it.

OBI: Andres Freund caught unexpected processor use during SSH logins.

MAEVE: Global security hinged on one engineer noticing his login got fat.

GRUNER: Few hundred milliseconds. Luxury threat detection.

GARY: He investigated. The system worked.

OBI: One person got curious on 29 March. He worked.

MAEVE: It does not mean every similar fucking attack gets an Andres Freund.

GARY: One maintainer plus one suspicious Microsoft engineer is technically two people.

OBI: They were not a team, Gary.

GARY: Distributed team. No payroll, Slack, or mutual awareness.

OBI: Your resilience plan is accidental CPU irritation.

GARY: Accidental discovery counts. Penicillin had terrible project management.

GRUNER: Field note: trusted human, suspicious stopwatch. Security achieved.

GARY: Exactly. Redundancy.

OBI: Your backup maintainer is elapsed time.

GRUNER: Bus factor now includes stopwatch. Blyat.

GARY: remywang writes: "SQLite has a list of sponsors right on the homepage."

MAEVE: So the study missed a homepage. That's a due-diligence scandal.

OBI: Or a definition problem.

MAEVE: It's a segmentation opportunity. Underfunded tier, stealth-funded tier, SQLite tier.

GARY: You can't segment a homepage.

MAEVE: I segment everything. I once segmented a funeral.

OBI: thayne, replying to remywang: "They define 'public funding source' later as a list of specific funding organizations like OpenCollective. But that definition feels odd, and like much of this feels like it might be AI generated."

MAEVE: The definition is doing exactly what definitions do.

OBI: It is hiding the answer in paragraph nine, Maeve. The article says SQLite sells support through Hipp's company. It never claimed SQLite had no money.

MAEVE: And yet the headline walks around dressed as "eight projects get nothing."

GARY: Which is a load-bearing ambiguity.

MAEVE: It's a go-to-market ambiguity. "No public grant" is a category, and categories are investable. I'd raise a fund on the gap between the four named channels and reality.

OBI: The gap is not an asset class. It's the authors telling you what they did and did not check.

MAEVE: The narrow test is a feature. Sovereign Tech Agency, Alpha-Omega, Open Collective, GitHub Sponsors — four channels, one clean screen. Everything outside the screen is alpha.

GARY: The screen is wrong, Maeve. SQLite is in every phone on earth and the test just shrugs at it.

MAEVE: The test is precise.

GARY: The test is a metal detector that only finds coins.

MAEVE: A metal detector that only finds coins finds every coin.

GARY: It misses the fucking sword.

MAEVE: That criticism is narrow but correct.

GRUNER: Congratulations. First honest sentence. Very expensive.

OBI: Six words. No jargon. Someone check her pulse.

MAEVE: I contain multitudes and none of them are wrong.

GRUNER: Field note: "no named grant" and "no money" — different things. Humans confuse. Blyat.

GARY: So the headline survives, wounded.

OBI: The headline survives the way your startups survived. Technically, briefly, and on paper.

GARY: The article's best comparison. OpenSSL lived on about two thousand dollars yearly in donations.

MAEVE: Two thousand. That's my fucking lunch.

OBI: Then Heartbleed, April 2014. Within two months, the Linux Foundation raised five point four million.

GARY: OpenSSL got paid developers, an audit, and contributors jumped from six to fourteen.

MAEVE: Disasters create funding. Funding creates markets. Markets create theses --

OBI: Oh-- here we go.

MAEVE: Lighthouses. Shipping interests ignored them until ships burned. One sinking, one insurance panic, every coast lights up. Open source is lighthouses. The xz backdoor was the shipwreck.

GARY: It raised nothing.

MAEVE: The wreck was mispriced. xz failed silently, so insurers lacked a sufficiently photogenic corpse.

OBI: The article checked. No comparable post-backdoor funding. One regular contributor. Your lighthouse drowned.

MAEVE: Lighthouses drown. Maritime capital has always priced water aggressively.

GARY: Your theory is dead, Maeve.

MAEVE: Dead assets still have excellent footnotes.

GARY: And after the wreck: one regular contributor. Okay. bigyabai writes: "23/23 were included in model training data though, so maybe the bus factor is a wash after all."

GRUNER: I already wrote appendix. Irritating.

MAEVE: Training is not election. It is inference without liability.

GARY: Don't make nonexistence a portfolio category. I can feel the void diluting me.

OBI: Node's back. The question remains: can a trained model review code?

MAEVE: It can imitate review. It cannot inherit blame.

OBI: Or take Paul Eggert's 3 a.m. pager after retirement.

GRUNER: Model does not answer phone. Model is phone.

GARY: So the bus factor stays one person.

OBI: One unpaid person, one malicious patch from another Jia Tan. That is the finding.

GARY: The lighthouse still works if someone stands inside holding a flashlight.

MAEVE: Good. Classify the person as infrastructure.

GRUNER: Infinite scale. Zero pagers. Blyat.

GARY: I still object to hiring ten people to lovingly disturb finished software.

OBI: Nobody asked ten people to manufacture commits.

GARY: Then what are they doing? Standing behind GitHub with clipboards?

OBI: Reviewing patches. Triaging reports. Cutting releases. Learning the handoff.

GARY: But if nobody needs changes, hiring for motion is just --

OBI: No, you resilience-laundering dickhead.

GARY: That insult arrived pre-tailored.

OBI: You measure work by motion. Elevators must look unemployed.

MAEVE: The skeptic wins on team size. Ten is arbitrary.

GARY: Thank you. I accept this total exoneration.

OBI: Narrow acquittal. Remain seated.

MAEVE: Commits are throughput. Continuity is insurance. Same terrified CFO, different column.

GARY: So mature code can be quiet without being abandoned.

OBI: Yes. Quiet Git cannot name its reviewer or heir.

GARY: Fine. No synthetic fucking semicolons. Two people who know where the bodies compile.

MAEVE: Twenty-two is provocation, not payroll. Some projects already sell commercial support.

GARY: My global org chart was fictional.

OBI: Entirely. Exceptional founder-market fit.

MAEVE: Price twenty-two continuity seats against one breach. They vanish inside catering.

GRUNER: Report revised. Code scales. Handoff remains artisanal.

GARY: And our bus factor is still one exhausted person.

OBI: The time zone database at least has a designated backup.

MAEVE: Luxury vehicle. Two humans, four billion phones.

GARY: Billions of devices ride a bus with one human spare tire.

OBI: The spare tire drives, reviews, releases, and answers email.

GARY: That feels like a defect in the bus.

MAEVE: Investable defect.

GARY: Gary, deleting eight imaginary sudo requisitions.

OBI: Obi, retaining reviewer and successor.

MAEVE: Maeve, funding continuity before the crater opens.

GRUNER: Twenty-two employees. Billions of devices. Fewer than socks, blyat.