Which open-source projects are widely used but maintained by just a few people?

https://news.ycombinator.com/item?id=41486565

by udev4096 • 2 years ago

106 108 2 years ago

news.ycombinator.com

I can think of sudo (https://github.com/sudo-project/sudo/graphs/contributors) which is maintained by just one person and is being used by every major linux distribution

jamiehewitt• 2 years ago

Mocha js testing framework is widely used and maintained by a small team https://github.com/mochajs/mocha/issues/5027

robthebrew• 2 years ago

curl

shprd2• 2 years ago

- curl: Daniel Stenberg et al. - https://github.com/orgs/curl/people

- Lua (programming language): team of 3 - https://www.lua.org/authors.html

- openssl: 15 people - https://github.com/orgs/openssl/people

maybe also: sqlite, vim, nginx, redis

rollcat5• 2 years ago

maybe also: sqlite [...]

SQLite won't accept contributions from outside the core team; joining the core team is an involved process, as they're taking extreme measures to ensure it will continue to be recognised as a work in public domain in as many jurisdictions as humanly possible. You can still support the project by paying them for their work (or by getting your employer to do so):

https://www.sqlite.org/prosupport.html

mrweasel• 2 years ago

My understanding was that you could absolutely contribute without joining the core team, but you do need to file some paperwork to ensure that code can remain in the public domain. The need for the legal paperwork is that public domain is not a thing in multiple countries.

einpoklum3• 2 years ago

15 people is not "a few", it's a substantial group.

How many maintainers for the other ones you mentioned?

pledg• 2 years ago

There's 724 people listed as contributors on the redis GitHub.

shprd2• 2 years ago

Right, but the question is concerned with the number of maintainers. The people who play some role, not just passing by.

Redis team consists of 8 people: https://github.com/orgs/redis/people

lipitic• 2 years ago

husky (git hooks) https://github.com/typicode/husky

suman99pro• 2 years ago

Linux Kernel

201984• 2 years ago

Could not be further from the truth. 1900+ people contributed to the latest release.

https://lwn.net/Articles/981559/

v3ss0n• 2 years ago

There are more commiters than maintainers can control quality.

bubblesnort2• 2 years ago

There are also very few testers of stable release candidates for such a big project.

nolok• 2 years ago

If you really want to dwelve into this, while the applications have plenty of cases let's not forget the underlying libraries that "everyone" depends on.

jacooper• 2 years ago

Imagemagick

passwordoops• 2 years ago

Just curious what arrangement theses people have.

-do their employers recognize their effort and give hours to the side projects?

-they mostly contractors so can arrange their time accordingly?

-donations?

-or is it mostly a hobby done out of passion?

withinboredom4• 2 years ago

I don't have something nearly as popular as these other projects; but if you have a popular project, a potential employer might offer work hours for it to get you as an employee.

Further, as a contributor of some now popular projects with one other maintainer, I can say that I mostly do it for fun. My current employer gives zero-fucks about it but if a new employer were to use it to woo me away, I would jump in a heartbeat.

mirekrusin• 2 years ago

einpoklum3• 2 years ago

You forgot an important option:

No payment, not a hobby, very little passion, doing it because the public needs it. (And possibly got started because, damn it, somebody had to write it / take over maintenance.)

senko• 2 years ago

Sounds terrible. Is there such a software project?

skyfantom• 2 years ago

brew

sneak• 2 years ago

The brew formulae are maintained by many people, and the “brew” command line tool has dozens of contributors with >100 commits.

latexr3• 2 years ago

Homebrew has a healthy amount of maintainers. Some people leave as priorities change but others join.

https://github.com/Homebrew/brew#who-we-are

bueny• 2 years ago

FastAPI

cba85• 2 years ago

Php

ale42• 2 years ago

I'm surprised to hear this, any more info?

0x073• 2 years ago

Its wrong, or at least not my definition of few people.

https://thephp.foundation/structure/

"Core Developers The PHP Foundation contracts 10 full-time and part-time engineers to maintain and develop the PHP language."

bazzargh• 2 years ago

bash and readline - Chet Ramey. Both originally by Brian Fox https://twobithistory.org/2019/08/22/readline.html

maybe less of a bus factor now with OSH approaching feature/speed parity and having more maintainers https://www.oilshell.org/

Fnoord• 2 years ago

For a moment I thought you meant open source hardware. Then came my disappointment.

alexk6• 2 years ago

Byte Buddy - runtime code generation for the Java virtual machine - https://github.com/raphw/byte-buddy

It is stable and in use by distinguished frameworks and tools such as Mockito, Hibernate , Jackson, Google's Bazel build system and many others. Byte Buddy is also used by a large number of commercial products to great result. It is currently downloaded over 75 million times a year.

michaelt• 2 years ago

In this thread: Wildly different definitions of what "widely used" means :)

Did you know tools like uname [1] and cat [2] in GNU coreutils have essentially only had two contributors in the past decade?

[1] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=histor... [2] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=histor...

delusional• 2 years ago

And most of what happens in those utilities is updating the copyright year numbers.

latexr3• 2 years ago

Which seems wholly unnecessary. The way I understand it, having only the starting year is sufficient.

Maken• 2 years ago

I'm actually surprised by the amount of changes in 'cat'. One would assume a program like that is already 'done'.

mauvehaus• 2 years ago

Starting in ~2008, the ones marked 'maint' and 'all' touch multiple files and don't appear to make substantive changes to e.g. cat. Since that categorization started, only 10 of the changes have been specific to cat.

rollcat5• 2 years ago

I'm actually surprised by the amount of changes in 'cat'.

"'cat -v' considered harmful" is an ongoing meme, but there's truth to it. http://harmful.cat-v.org/cat-v/

cat(1) concatenates files. Some software should be considered done.

danirod• 2 years ago

To be fair, there are a lot of commits that just update copyright years or documentation. IMHO that's just regular housekeeping and cannot mean that cat was not "done" in first place.

Izkata• 2 years ago

How about the history for "true": https://github.com/coreutils/coreutils/commits/master/src/tr...

mih• 2 years ago

SQLite - https://www.sqlite.org/draft/crew.html

chubot• 2 years ago

Looks like this is the non-draft URL - https://www.sqlite.org/crew.html

teeceepee• 2 years ago

Time Zone Database

https://github.com/eggert/tz/graphs/contributors

https://en.wikipedia.org/wiki/Tz_database

fouronnes3• 2 years ago

This is a good answer. Especially in the light of the 2021 drama and the maintainer's benevolent dictator status. What happens when the community disagrees with a benevolent dictator's decision?

https://lwn.net/Articles/870478/

koliber• 2 years ago

A revolution

blueflow2• 2 years ago

Same as with glibc and Ullrich Drepper.

squigz• 2 years ago

What happens when the community disagrees with a benevolent dictator's decision?

They discuss it, try to come to a compromise, and if all else fails, fork it.

Maybe it's not ideal, but then again, people seem to have a big problem when you have 'boards' running these projects too, so...

etewiah• 2 years ago

dokku

thibaut_barrere• 2 years ago

Most of the projects I am aware of :-)

ratmice• 2 years ago

It would probably be easier to enumerate the small number of projects which have a larger amount of maintainers. I think the vast majority only have a few maintainers.

bubblesnort2• 2 years ago

Expat

LibreSSL

Linux-PAM

OpenSSH

re2c

tzdata

zlib

Those are just the ones that came to mind.

rollcat5• 2 years ago

Good list. Sometimes the easiest way to contribute is to just donate some money, so that the existing maintainers can continue to focus on their work. OpenBSD is the "mothership" project for both OpenSSH and LibreSSL: https://www.openbsd.org/donations.html

Unfortunately I couldn't find any information on how to donate to these projects:

- https://re2c.org

- https://github.com/libexpat/libexpat

- https://github.com/linux-pam/linux-pam

- https://zlib.net

tzdata is actually maintained by IANA:

- https://www.iana.org/time-zones

withinboredom4• 2 years ago

I didn't realize the IANA contributed debian packages and rpms. /s

They maintain the list, but someone has to package it.

KeplerBoy• 2 years ago

Liblzma rather infamously.

2d8a875f-39a2-4• 2 years ago

All of them!

Karliss• 2 years ago

It almost feels like it's easier to list which fundamental projects have more than one active maintainer.

Many of the core library and tools are mostly finished and have very little yearly activity. How many maintainers does a project have if the last activity was one or two commits made or maybe just merged by one maintainer 3 years ago, and few more 5 years ago. Does it count as 2 maintainers, 1 maintainer, 0 maintainers? Does the "maintainer" from 5 years ago still have commit permission and how likely are they to get involved if some merge requests show up.

Even for active projects it's very common for 90% of work being done by one main maintainer.

wiercin• 2 years ago

Looking at the example of sudo it seems there are still plenty of regular and recent commits.

https://github.com/sudo-project/sudo/commits/main/

keepamovin• 2 years ago

Many of the core library and tools are mostly finished and have very little yearly activity

Yeah. The ad-hoc, de-facto "Standard Library" for JavaScript, the "web", and fullstack web apps.

OSS ecosystem is sometimes so very "Down and out in the magic Kingdom" adhocracy like. Shame we haven't got the rest of the Bitchun' society's perks. :) hahaha!

bux93• 2 years ago

Note that the situation will not be much better for closed sourced projects.

Sure, your vendor will probably fix bugs, but it may take some time until they find someone who has any knowledge of that codebase and survived last week's reshuffle, the re-org in spring and last year's buyout.

rstuart4133• 2 years ago

I don't know that it is better for closed source projects, but regardless open source has an escape hatch closed source doesn't. If something goes wrong, you can maintain it yourself, or fork it.

I've done it myself.

That one property along is enough if you want longevity, open source is always a safer bet than closed source.

In my case, I guess it extended the projects life by another 20 years.

lynx23• 2 years ago

bash

_tk_• 2 years ago

There's been some research into the topic:

https://www.researchgate.net/publication/308894462_What_is_t...

_micheee• 2 years ago

Not only software but also infrastructure & protocols: N.T.P.: — https://www.newyorker.com/tech/annals-of-technology/the-thor...

I found it quite a good read!

7222aafdcf68cfe• 2 years ago

Jia Tan is looking for a new project ?

chpatrick• 2 years ago

Nice try Jia Tan!

gdevenyi• 2 years ago

This has been observed before https://xkcd.com/2347/

rurban• 2 years ago

All the better ones. The more maintainers, the quality goes down. Down to total destruction

gburiola• 2 years ago

Kapitan

https://github.com/kapicorp/kapitan

fanf2• 2 years ago

PCRE https://github.com/PCRE2Project/pcre2/issues/426

eqvinox• 2 years ago

flex & bison. Especially flex seems close to unmaintained.

tw1984• 2 years ago

google's leveldb

blueflow2• 2 years ago

zlib: Mark Adler

ncurses/xterm: Thomas Dickey

udev4096• 2 years ago

e2fsprogs (https://github.com/tytso/e2fsprogs) is a widely-used utility suite for creating, maintaining, and repairing ext2, ext3, and ext4 filesystems

Retr0id2• 2 years ago

In some sense, the ubiquitous "unzip" has 0 maintainers.

Per the upstream, https://infozip.sourceforge.net/, "UnZip 6.0 was released on 29 April 2009".

But there are not truly 0 maintainers, because distros maintain their own patchsets, for example: https://git.launchpad.net/ubuntu/+source/unzip/log/

(By the way, unzip is arguably not feature complete. The ZIP spec has been updated multiple times since 2009, with the notable addition of the Zstandard compression method, among other things https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT)

dagelf4• 2 years ago

zstd is not zip and pkware has long been irrelevant

Retr0id2• 2 years ago

DEFLATE isn't zip either, what's your point?

mianos• 2 years ago

dnsmasq. Running on billions of of devices (including Android), one guy (Simon Kelley).

willm• 2 years ago

Rich. 197 million downloads a month. There are two maintainers.

chirag70042• 2 years ago

see the success of laravel

chirag70042• 2 years ago

see the success of laravel https://github.com/laravel/laravel

brandelune• 2 years ago

OmegaT is widely used in the professional translation world and maintained by 1 person with a very few active contributors (except for localizers).

https://omegat.org

mdtrooper• 2 years ago

People used to fight for upstream factories to return the water they used clean to the river. It was an ecologist's fight.

Now corporations do projects with 5 or more zeroes in budget and a high percentage of the code is free software or open source. And they give 0 back to free or open projects that they parasite.

I wrote an article years ago in my blog (in Spanish, sorry), "Free software has failed": https://tomatesasesinos.com/2019/07/11/el-software-libre-ha-...

ericyd• 2 years ago

I think this belongs under "Show HN: My Tangentially Related Thoughts"

bestest• 2 years ago

Coolify! https://github.com/coollabsio/coolify

Mainan_Tagonist• 2 years ago

VLC - VideoLan

https://github.com/orgs/videolan/people

As i recollect, GnuPG was also a one man band for some time.

devinprater• 2 years ago

Edit: I missed the "widely used" part.

[Orca](https://gitlab.gnome.org/GNOME/orca). Very important for blind Linux desktop users. If you like frameworks more, [ATSPI](https://gitlab.gnome.org/GNOME/at-spi2-core), or [AccessKit](https://accesskit.dev/) may fit you more. Or, if you like contributing others' apps, take a look at how you could make them more accessible, with these [Tips for application developers](https://github.com/GNOME/orca/blob/main/README-APPLICATION-D...).

dearroy• 2 years ago

Not very typical "widely used" project but recently surpassed 100k+ installs with two people working on it part-time.

https://github.com/heyform/heyform

jringo_-• 2 years ago

People ask this question a lot in academia. The system just about incentivizes creating dupliware and/or abandonware that is critical to a domain, field, or niche, so there is tons of it (there is also A LOT of very good stable software, but ignoring this for now). This makes it very difficult for new parties to find open source software they can rely on, for funders to determine what software to support, for institutions to track their contributions, etc.

I am working on a project solving for this specific question (and many others), across the open source and open science ecosystems, starting with open source research software but ultimately intends to touch the whole space. Among other things, we want to take continuous measurements of the health of open source projects, the use of open source projects, the perception of open source projects, the "impact of open source projects", and the needs of open source projects. We are combining data collection with stigmergic markers and eventual webs of trust.

It is incubated by NumFOCUS, and includes collaborations from across the academic industry.

Bringing it here for your thoughts.

The project is called "The Map of Open Source Science" (MOSS) and is built on the "Simply Omniscient Layer" (SOL). It is essentially an omniscient open permissionless graph database of the digital knowledge and research ecosystems, as well as a corresponding visualization (eventually people will be able to build their own visualizations interfacing with SOL).

Very recent presentation at PyData Vermont: https://www.youtube.com/watch?v=7c51njj9JPs

Recentish update: https://www.opensource.science/updates/the-map-of-open-sourc...

Landing page for the program: https://opensource.science

From our site:

"MOSS is a comprehensive, composable, interactive map of the digital knowledge and research ecosystems. We identify connections between open source research software projects, research papers, organizations, patents, datasets, funding pathways, AI models and applications, and the people who drive it all.

The MOSS proof of concept so far demonstrates nine use-cases:

Identify relevant tools for your research

Showcase the impact and connections of the people that make and maintain open source research tools

Showcase the impact and connections of the organizations that build, support, and fund development of open source research tools

Showcase the impact and connections of open source research tools

Identify gaps in open source research tooling

Navigate repetition of open source research tool features

Identify, prevent, and reinvigorate abandoned open source research tools

Streamline the grant submission and review process

Navigate security flaw identification - who to contact, what downstream tools are effected, what alternative tools exist"

sukunrt• 2 years ago

quic-go: https://github.com/quic-go/quic-go/

daoistmonk• 2 years ago

wireguard [1] https://www.wireguard.com/repositories/

constantinum• 2 years ago

GnuPG and Werner Koch comes to mind, there was this HN thread 10 years ago https://news.ycombinator.com/item?id=9003791

Also Fabrice Bellard of FFMpeg and his projects comes to mind.

I might be wrong too.

dagelf4• 2 years ago

Perfect software doesn't need to be maintained. TM

jviotti• 2 years ago

JSON Schema is the industry standard schema language for JSON, used by big players like OpenAPI and by an insanely high number of APIs and products out there.

The TSC core team stays at ~6 people (I'm one of them)

skyzyx• 2 years ago

Ones that are highly complex but poorly documented.

Which open-source projects are widely used but maintained by just a few people?

Related Stories