Lunduke
News • Science & Tech
"If this one guy got hit by a bus, the world's software would fall apart."
(Funny? Yes. But the reality is far worse...)
April 04, 2024
post photo preview
  • How many critical software packages are maintained by a small, unpaid team (or, worse, a single person)?
  • What happens when that person gets bored with the project... or decides to do something malicious (as in the case with a recent backdoor in the XZ compression tool)... or... gets hit by a bus?

These are not only fair questions to ask... but critical as well.

The reality is that we're not simply talking about a handful of key software packages here -- the entirety of our modern computing infrastructure is built on top of thousands of projects (from software packages to online services) that are built, maintained, and run entirely by one person (or, when we're lucky, 2 or 3 people).

One wrong move and the Jenga tower that is modern computing comes crashing down.

Source: xkcd

Just to give you an idea of how widespread -- and dire -- this situation truly is, I would like to call your attention to two projects that most people don't even think about... but that are critical to nearly every computer system in use today.

The TZ Database

Dealing with Timezones in software can be tricky.  Many rules, many time zone details.  As luck would have it, a standard database (TZ Database) was built to make it easier for software projects to get those details right.

And, every time those timezone details (across the world) are changed -- something which can happen several times per year, often with only a few days notice -- that database needs to be updated.

What happens if those details are not updated... if the timezone data is incorrect?

At best?  A few minor scheduling inconveniences.  At worst?  Absolute mayhem... computer-wise.  Times can become significantly out of sync between systems.  Which can mess up not only scheduling (an obvious issue), but security features as well (as some encryption tools require closely synced time).

To give you an idea of how widespread the TZ Database is, here is just a teeny tiny fraction of the number of software projects which rely upon it:

  • Every BSD system: FreeBSD, OpenBSD, Solaris
  • macOS & iOS
  • Linux
  • Android
  • Java, PHP, Perl, Ruby, Python, GCC, Javascript
  • PostrgreSQL, MongoDB, SQL Server

Yeah.  It's basically a list of "all software".  And that's just a sample of the software which heavily relies on the TZ Database for making sure timing (and everything that is time-critical) is correct.

Now.  With something this absolutely critical, surely a highly paid team of people -- from multiple companies -- is responsible for keeping it updated... right?

Oh, heavens, no.

Two people.  Two!

While the database itself has been officially published on ICANN (the "Internet Corporation for Assigned Names and Numbers") servers for the last few years, only 2 people actually maintain the TZ Database.

SQLite

Did you know that SQLite is the most used database system in the entire world?  More than MySQL, MS SQL Server, and all the rest of them.  Good odds, SQLite is used on more systems than all other database systems in the world... combined.

In fact, SQLite is a critial component in the following systems:

  • Android, iOS, macOS, & Windows
  • Firefox, Chrome, & Safari
  • Most set top boxes and smart TVs
  • An absolutely crazy number of individual software packages (from Dropbox to iTunes)

Now, ready for the fact you knew was coming?

SQLite is maintained by... 3 guys.

Not "3 lead developers who oversee an army of open source contributors"... just 3 guys.  Total.  And they don't accept public patches or fixes.

"SQLite is open-source, meaning that you can make as many copies of it as you want and do whatever you want with those copies, without limitation. But SQLite is not open-contribution."

A piece of software that is practically the cornerstone of modern computing.  Trillions of dollars worth of systems relying upon it -- every second of every day.  3 guys.

Corporations rest on the shoulders of... a couple volunteers

Add those two projects together.  5 guys, in total, are responsible for Timezones and SQLite databases.  Software and data used on practically every computer on the planet.

And that's just the tip of the iceberg.  Critical projects -- often with small teams of (more often than not) unpaid voluneers -- form the core of the vast majority of major software projects.  Including commercial ones.

ImagemagickXZFFmpeg?

You'll find those at the heart of more systems than you can count.  Good odds you use all three, every day, and don't even notice it.

And, as the small team behind FFmpeg pointed out in a recent X post, getting those large corporations to contribute -- in any meaningful way -- can be like pulling teeth:

The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion dollar corporations expect free and urgent support from volunteers.

 

Microsoft / Microsoft Teams posted on a bug tracker full of volunteers that their issue is "high priority"

 

 

After politely requesting a support contract from Microsoft for long term maintenance, they offered a one-time payment of a few thousand dollars instead.

 

This is unacceptable. 

 

We didn't make it up, this is what Microsoft actually did:
https://trac.ffmpeg.org/ticket/10341#comment:4

 

The lesson from the xz fiasco is that investments in maintenance and sustainability are unsexy and probably won't get a middle manager their promotion but pay off a thousandfold over many years.

 

But try selling that to a bean counter

In short: Microsoft wanted to benefit from the (free) work done by FFmpeg... but was only willing -- at most -- to toss a few peanuts at the team.  And, even then, that (mildly insulting) offer of meager support was only done when Microsoft needed assistance.

A few parting thoughts...

There are valuable lessons to be learned from all of this -- including the need for real, meaningful support (by large corporations) of the projects they rely so heavily upon.

But, for now, I'd like to leave you with a few observations.

  1. Corporations don't hesitate to throw large sums of money at Tech Trade Organizations (such as The Linux Foundation -- which brings in hundreds of Millions every year from companies like Microsoft)... yet they are hesitant to provide significant funding to projects they rely directly upon to ship their own, often highly profitable, products (see the projects listed earlier in this article).
  2. How many of these smaller projects -- which Linux desktops and servers rely entirely upon -- receive regular funding from The Linux Foundation (or companies which fund The Linux Foundation)?  I'll answer that question for you: Next to none.
  3. Even high profile Open Source projects -- such as KDE or GNOME -- struggle to bring in enough funding to afford two full time developers on payroll.
  4. We have avoided catastrophe, thus far, through dumb luck.  The recent XZ backdoor, for example, was found by a lone developer who happened to notice a half second slowdown... and happened to have the time (and interest... and experience) to investigate further.  The odds of that being discovered before significant harm was done... whew!... slim.  So much dumb luck.

Go take a look at that XKCD comic at the begining of this article again.  Funny right?  And it makes a solid point.

You know what's terrifying, though?  The reality is far more precarious. 

There's not simply one project -- by one guy -- holding all of modern computing up.

There's thousands of projects.  Each made by one guy.  And hundreds of those projects (at least) are load-bearing.

Dumb luck only lasts for so long.

community logo
Join the Lunduke Community
To read more articles like this, sign up and join my community today
18
What else you may like…
Videos
Podcasts
Posts
Articles
Python Says Discriminatory DEI Policies More Important Than $1.5 Million Dollars

The Python Software Foundation has turned down a $1.5 Million Dollar grant from the US government, as it would require them to cease discriminatory Diversity, Equity, & Inclusion practices.

More from The Lunduke Journal:
https://lunduke.com/

00:19:23
October 27, 2025
$20,000 Bounty Offered to Bribe FFmpeg Team to Fire Contributor

A popular YouTuber named Theo Browne offered $20k to the Open Source FFmpeg team if they remove their social media person, who Theo calls a "motherf***er".

The X Thread:
https://x.com/LundukeJournal/status/1982569289237352620

More from The Lunduke Journal:
https://lunduke.com/

00:26:32
October 24, 2025
Rust Clone of Core Utils Breaks Ubuntu Updates

Ubuntu 25.10 dropped the battle tested GNU Core Utils, in favor of the untested, incomplete "uutils". Why? Because they were programmed in Rust. And, as expected, things are breaking.

More from The Lunduke Journal:
https://lunduke.com/

00:16:47
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044
October 28, 2025

Proof slot-loading is eternal.

post photo preview

I had the fortunate opportunity to attend NetApp INSIGHT 2025 a couple of weeks ago in Las Vegas. It was so, so, so focused on AI. It was kinda ridiculous. The last INSIGHT I attended was in 2023 and AI was talked about, but it was not obsessively hyper-focused-on like this year.

At my day job I am a storage nerd. It's all I do. I am so thankful to have this job, it is what I was born to do.

Did any of you attend INSIGHT as well? I found the keynote talks and featured sessions to be generally useless marketing fluff. The breakout sessions are where the sausage is made. I was able to go to some really exceptional and beneficial breakout sessions. The one on Ansible and the one on ONTAP upgrades were the two best sessions I attended.

October 15, 2025
post photo preview
The Unpublished Anti-Lunduke Hit-Piece
A Tech Journalist interviewed me for a hit-piece article. But the questions made them look bad, and they shelved the story. So I'm publishing their hit-piece for them.

Back in September, shortly after the assassination of Charlie Kirk, I was contacted by a Tech Journalist writing for FossForce.com (a smaller, Open Source focused publication) who was working on an article around Open Source, Antifa, and the Lunduke Journal’s coverage of those topics.

This particular outlet had, several months prior, run an “anti-Lunduke” hit piece without first reaching out for comment — which resulted in their most popular article (at least on social media) in quite some time.

With that in mind, it seemed reasonable that they’d want to repeat that success with another “anti-Lunduke” story.

This time they were doing the responsible thing. They reached out to the subject of the hit-piece article with questions. I like encouraging Tech Journalists when they do actual journalism, so I answered each and every query with easy-to-quote responses.

But, it would appear that the answers they received were not conducive to creating the hit-piece they were hoping for — my guess is they realized their questions made them look like the villain in the story. The villain they, clearly, hoped to portray me as.

They opted to not publish the piece.

So I’m publishing their hit-piece for them.

Below is every question — and every answer (with no edits) — which I was asked, on September 19th, by a Tech Journalist by the name of Christine Hall, writing for FossForce.

Fair warning: This is very, very politically charged.

Enjoy.


September 19th

Hall:

The last time I mentioned you in an article, you castigated me for not reaching out to you beforehand. Well, I’m reaching out now. We’ll see what comes of this.

You do recognize that the vast majority of organizations using the term antifa as a descriptor are not in the least bit terrorist and pose no threat to society -- and indeed, the only threats they might pose to fascist groups are not physical or life-harming?

Lunduke:

Hello Christine! Nice to hear from you!

Many, if not most, of those proclaiming support for Antifa (within Open Source) have also made statements encouraging or supporting violence and discrimination.

Regardless of that fact -- which I have documented extensively in Lunduke Journal coverage -- when violent acts are committed (such as murder, riots, and lynchings) in the name of “Antifa”, to turn around and immediately declare yourself to be “Antifa” is a clear declaration of support of that violence.

Hall:

And why did you feel it necessary to call out Danielle Foré’s [the founder of the elementary OS Linux Distribution] trans status in such an ugly manner?

Lunduke:

There is a noteworthy overlap between “Trans activism” and support for political violence -- including in the recent murder of Charlie Kirk (the murderer’s boyfriend was “Trans”).

In the case of Daniel Fore, he, a leader of an Open Source project, regularly calls for discrimination (and violence) against people he disagrees with -- often in conjunction with his self-declaration as “Trans”.

Thus, his declaration of being “Trans” becomes a part of the overall story.

It is worth noting here that The Lunduke Journal has never -- and would never -- call for discrimination or violence against someone because of how they identify or who they may (or may not) vote for.

This is in stark contrast those, such as Mr. Fore, who consider themselves “Trans” or “Antifa” -- who actively advocate for both discrimination and violence.

Hall:

Mentioning a person’s trans status in ways that are pertinent to your argument necessates rudeness such as calling her a “dude who likes to wear dresses”?

Lunduke:

Dan Fore is, in fact, a dude who likes to wear dresses.

The only reason to view that as a negative is if you view dudes wearing dresses as a negative.

Hall:

I’ll quote you on that, which I’m pretty sure won’t bother you in the least.

Lunduke:

Absolutely! Quote anything I say here. In fact, I suggest quoting absolutely everything I’ve written to you here, today.

Hall:

You also understand, don’t you, that voicing disagreement with an assessment made by POTUS is not only legal but a healthy part of the national dialog.

Lunduke:

Absolutely! Did I say somewhere that it was illegal to disagree with a politician? It seems unlikely that I have ever said that.

Hall:

Also, how would you reply to this:

There have been very few murders linked to individuals associated with Antifa, some incidents of rioting attributed to Antifa supporters, and no credible evidence of lynchings conducted in the name of Antifa. Compared to far-right groups, violence attributed to Antifa is much less frequent and lethal, with only one suspected kill—Aaron Danielson in Portland, by an anti-fascist activist—officially confirmed in recent U.S. history.

Lunduke:

Murder is bad. I am opposed to all murder.

In the context of these discussions, bearing in mind the Kirk murder is important (as many statements were made in response to it). The murderer of Kirk appears to have been pro-Trans and pro-Antifa (based on all available information).

Hall:

Is there any evidence that the suspect was part of an antifa group? I haven’t seen any.

Lunduke:

I have seen some reporting to this effect (including statements from family and messages he wrote).

But, far more important to this story, is the response to the murder among Antifa supporters (including those within Open Source). A large portion of Antifa supporters have celebrated the murder as justified because it killed someone they considered to be a “fascist”.

Hall:

Also, no group should be held responsible for what some deranged person who identifies with the group has done.

Lunduke:

I agree that a broader group should not be held responsible for the actions of a small number of individuals.

However, and this is critically important, it is entirely appropriate to hold people responsible for their own statements and actions.

With that in mind: The overall messaging of Antifa (and Antifa supporters) tends heavily towards violence. Punching, killing, molotov cocktails, etc. are all common messaging used by Antifa (including by those I quote within the Open Source world -- many of whom have advocated violence against myself).

Advocating for violence, then celebrating when violence is committed, are not good things.

Yet we see a great deal of that among Open Source supporters of Antifa.

Read full Article
October 13, 2025
Sale ends in a few hours, Lifetime Subs set up.

Holy moly, you guys are amazing.

A few days ago I published a “50% off” sale for Lunduke Journal subscriptions… and all of you showed up. In a big way.

To everyone who grabbed a Lifetime Subscription over the last few days: All of you are set to full Lifetime access. You should have a confirmation email in your inbox. If not, email me and I’ll make sure you’re setup properly.

That “50% off” sale ends tonight at midnight. So you have a few hours to snag a discounted subscription, if you haven’t already.

A huge thank you to everyone who supports this work. Couldn’t do it without you.

-Lunduke

Read full Article
October 12, 2025
50% Off Lunduke Journal Extended Through Monday (Oct 13th)

Just a quick heads up:

The “50% off every kind of Subscription to The Lunduke Journal” sale has been extended through Monday (October 13th).

So. You know. Grab one at 50% off between now and end of the day on Monday.

To all of you amazing nerds who have picked up a Lifetime Subscription already this weekend: You are awesome. You’ll be receiving a confirmation email, with all of the Lifetime Subscription details, by tomorrow (if you haven’t already).

Oh, and remember how we hit 11 Million views last month? Yeah. We’re well on our way to blowing past those numbers in October.

Wild.

See you all on Monday!

-Lunduke

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals