“The portion of respondents who reported they are unpaid hobbyists remains at 60 percent, the same as in last year’s survey.”
Maintainers spend three times as much time on security as they did three years ago, and two-thirds trust outside pull requests less since xz. Maintainers under 26 fell from 25 percent in 2021 to 10 percent. The xz attacker exploited exactly this: a tired, unpaid lone maintainer. Industry heard the warning and kept the 60 percent unpaid.