Big Tech and governments should fund the open-source software that underpins the internet
Source: https://www.theguardian.com/profile/chris-stokel-walker. "The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it? | Chris Stokel-Walker | The Guardian." October 22, 2026. www.theguardian.com
The Gist
The internet keeps nearly breaking because the free software it runs on is looked after by a few overworked people with little money. With AI making it easier to find and exploit flaws, this is getting more dangerous. The companies that profit from this free software, and governments that rely on it, should pay to maintain it.
Conclusion
Big tech companies that profit from free open-source software, along with governments, should contribute properly to maintaining it, instead of relying on a handful of exhausted, under-resourced developers to keep the internet secure.
Premises
- Critical internet infrastructure (OpenSSL, Log4j, XZ Utils, PHP) depends on small, under-resourced teams of developers, and the same pattern of vulnerability and near-disaster keeps recurring.
- The PHP Foundation itself described its delay in fixing the 2024-identified flaw as a 'structural failure' caused by poor resource levels.
- AI makes it far cheaper and faster to find and exploit weaknesses in vast amounts of old code, so vulnerability discovery is accelerating (about 84,000 in 2026 versus 48,000 in 2025) and hackers are already exploiting flaws at scale.
- Fixing and documenting legacy software is difficult, costly and boring work, and many organisations, including the UK government, cannot even account for the old software they run.
- Modest funding has already helped (for example, Germany's sovereign tech fund giving the OpenSSL Foundation over €400,000, and the PHP Foundation hiring more staff), but this is not enough.
- Big tech companies make billions from open-source software they obtain for free, and governments also depend on it.
Assumptions
- More funding and staffing will materially improve the security and maintenance of open-source projects.
- Those who profit from or depend on a resource have a moral and practical obligation to help sustain it.
- The rising count of vulnerabilities reflects a growing threat, not just better detection or inflated counts of minor issues.
- Voluntary or policy-driven contributions from companies and governments are feasible and will be directed effectively to the right projects.
- The recurrence of incidents is caused mainly by under-resourcing rather than by inherent difficulties in writing secure software.
- AI-driven attack capability will continue to outpace human-only defence unless defenders are better resourced.