本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

The people holding up the internet

The people holding up the internet. Billions of phones run on code looked after by a handful of people. We counted them from the code itself. Read it as a plain page. Your alarm, a boarding pass, a meeting in another country, the day your salary lands: anything on your phone that shows a time has to know where you are. Underneath sit every Android phone, every iPhone and most of the servers on the internet. They all get local time from one text file, the time zone database, which holds every clock rule a government has ever announced.

支撑互联网的人们。数十亿部手机运行的代码由少数几个人维护。我们通过代码本身统计了他们的人数。请以纯文本页面阅读。你的闹钟、登机牌、在另一个国家的会议、工资到账的那一天：手机上任何显示时间的内容都必须知道你身在何处。在这一切之下，运行着每一部安卓手机、每一部 iPhone 以及互联网上的大多数服务器。它们都从同一个文本文件——时区数据库中获取当地时间，该数据库记录了政府发布过的每一条时钟规则。

Paul Eggert, a lecturer at UCLA, keeps that file up to date in his spare time. Paul Eggert giving a talk on the time zone database, LibrePlanet 2022. Free Software Foundation, CC BY-SA 3.0. Paul Eggert Teaches computer science at UCLA, and has been the official coordinator of the time zone file since 2012. 4,000,000,000 Android phones and iPhones use his file. We didn’t count servers, Macs or laptops, which would push the number higher.

加州大学洛杉矶分校（UCLA）的讲师 Paul Eggert 在业余时间负责更新该文件。Paul Eggert 在 2022 年 LibrePlanet 大会上就时区数据库发表演讲（自由软件基金会，CC BY-SA 3.0）。Paul Eggert 在 UCLA 教授计算机科学，自 2012 年起担任时区文件的官方协调员。40 亿部安卓手机和 iPhone 使用他的文件。我们还没有统计服务器、Mac 或笔记本电脑，如果算上这些，数字会更高。

Your phone’s time zone, as the file has it today. On 29 September Paul put out version 2026e of the file. The first line of its notes says that Manitoba moves to permanent -05 on 31 October, which tells phones in Winnipeg not to set their clocks back on 1 November, and it was typed in by two volunteers a month ahead. Of the 251 changes made to the file in the last year, 218 were his and 28 were Tim Parenti’s.

你手机的时区，即该文件目前记录的内容。9 月 29 日，Paul 发布了该文件的 2026e 版本。其注释的第一行写道，曼尼托巴省将于 10 月 31 日永久改为 -05 时区，这告诉温尼伯的手机不要在 11 月 1 日拨回时钟，而这一条目是由两名志愿者提前一个月录入的。在过去一年对该文件所做的 251 次更改中，218 次由他完成，28 次由 Tim Parenti 完成。

In 2011 an astrology software company sued Paul and Arthur Olson, who started the file in 1986 at the National Institutes of Health, claiming some of its history came from an atlas the company owned. The file’s mailing list and download site were switched off until IANA, which keeps the internet’s master lists, took them over later that month. The Electronic Frontier Foundation defended them for free, and the company dropped the case in February 2012.

2011 年，一家占星软件公司起诉了 Paul 和 Arthur Olson（后者于 1986 年在美国国立卫生研究院启动了该文件），声称其部分历史数据来自该公司拥有的一本地图集。该文件的邮件列表和下载网站被迫关闭，直到当月晚些时候，负责维护互联网主列表的 IANA 接管了它们。电子前沿基金会（EFF）为他们提供了免费辩护，该公司于 2012 年 2 月撤诉。

“In case I am no longer available due to retirement or whatever.” Paul Eggert, asking the tz mailing list to make Tim Parenti his backup, 20 May 2020. I also make a daily word game. Play today’s sentence. About two minutes. Dependency, Randall Munroe, xkcd 2347. CC BY-NC 2.5, colours inverted. People post this comic whenever something breaks. The tower is labelled “all modern digital infrastructure” and it stands on one small block, “a project some random person in Nebraska has been thanklessly maintaining since 2003”.

“以防我因退休或其他原因无法继续工作。”——Paul Eggert，2020 年 5 月 20 日在 tz 邮件列表中请求将 Tim Parenti 设为他的备份。我还制作了一个每日文字游戏。玩今天的句子。大约两分钟。依赖关系，Randall Munroe，xkcd 2347（CC BY-NC 2.5，颜色反转）。每当出现故障时，人们就会发布这幅漫画。塔上写着“所有现代数字基础设施”，它矗立在一个小方块上，上面写着“一个内布拉斯加州的随机人士自 2003 年以来一直在默默维护的项目”。

We wanted to know how close to true it is. We downloaded the full history of 23 pieces of software that phones, browsers and servers depend on, and counted everyone who made ten or more changes to each one between October 2025 and October 2026. Then we listed what is actually installed on an Android phone, an iPhone and a Windows PC. 11 of 23 projects had one or two people doing the regular work.

我们想知道这有多接近事实。我们下载了手机、浏览器和服务器所依赖的 23 个软件的完整历史记录，并统计了在 2025 年 10 月至 2026 年 10 月期间，对每个软件进行过 10 次或以上更改的所有人。然后，我们列出了安卓手机、iPhone 和 Windows PC 上实际安装的内容。在 23 个项目中，有 11 个项目仅由一两个人负责日常工作。

“It’s also good to keep in mind that this is an unpaid hobby project.” Lasse Collin, xz mailing list, 8 June 2022. Lasse Collin Lives in Finland and looks after xz, the compression tool on almost every Linux server and inside every iPhone. He wrote that line in the same email where he said his ability to care had been “fairly limited mostly due to longterm mental health issues”.

“还要记住，这是一个无偿的业余项目。”——Lasse Collin，xz 邮件列表，2022 年 6 月 8 日。Lasse Collin 住在芬兰，负责维护 xz，这是一种几乎存在于每个 Linux 服务器和每部 iPhone 中的压缩工具。他在写下那句话的同一封电子邮件中表示，由于长期的心理健康问题，他“照顾项目的能力相当有限”。

For months, accounts calling themselves Jigar Kumar and Dennis Ens had been posting to the list about how slowly things were moving, and a contributor called Jia Tan had been sending useful fixes. Lasse gave Jia Tan more access. In 2023 Jia Tan made 304 changes to xz and Lasse made 172, which is the red on the wall below. In February 2024 the versions Jia Tan released carried a hidden way into Linux servers.

几个月来，自称 Jigar Kumar 和 Dennis Ens 的账户一直在邮件列表中抱怨项目进展缓慢，而一位名叫 Jia Tan 的贡献者一直在提交有用的修复程序。Lasse 给了 Jia Tan 更高的权限。2023 年，Jia Tan 对 xz 进行了 304 次更改，而 Lasse 进行了 172 次，这在下方的墙图中显示为红色。2024 年 2 月，Jia Tan 发布的版本中携带了一条进入 Linux 服务器的隐藏通道。

Andres Freund, an engineer at Microsoft, found it on 29 March because his logins were using more processor time than they should, before most Linux systems had shipped it. Nobody has found out who Jia Tan is. Lasse Collin, Jia Tan, everyone else. Every change to xz since January 2021, one square each. In 2021 almost all of them are Lasse’s. 28 January 2022: the first change written by Jia Tan goes in. By 2023 Jia Tan is making more changes than Lasse, 304 to his 172.

微软工程师 Andres Freund 于 3 月 29 日发现了这一点，因为他的登录过程占用的处理器时间超出了正常范围，而此时大多数 Linux 系统尚未发布该版本。没有人查出 Jia Tan 是谁。Lasse Collin、Jia Tan、其他人。自 2021 年 1 月以来对 xz 的每一次更改，每个方块代表一次。2021 年，几乎所有的更改都来自 Lasse。2022 年 1 月 28 日：Jia Tan 编写的第一次更改被合并。到 2023 年，Jia Tan 的更改次数超过了 Lasse，为 304 次，而 Lasse 为 172 次。

February 2024: Jia Tan releases two versions with the backdoor inside. Andres Freund finds it on 29 March. After that it is Lasse on his own again, and in 2025 he wrote 97 percent of the changes. $57 a month was what Denis Pushkarev raised when he asked for donations to keep core-js going. Denis Pushkarev Wrote core-js, which lets new JavaScript work in old browsers. By his own count it runs on about half of the thousand busiest websites in the world.

2024 年 2 月：Jia Tan 发布了两个包含后门的版本。Andres Freund 于 3 月 29 日发现。此后，Lasse 又回到了独自维护的状态，他在 2025 年完成了 97% 的更改。Denis Pushkarev 在请求捐款以维持 core-js 运行时，每月筹集到 57 美元。Denis Pushkarev 编写了 core-js，它使新的 JavaScript 能够在旧浏览器中运行。据他自己统计，全球最繁忙的 1000 个网站中，约有一半在使用它。

In 2019 he was working on core-js full time without pay, living in Russia because it was cheaper. By his own account, three weeks after a big release he was driving home at 3 a.m. when two young women on a dark road ended up under his car, and one of them died. The families asked for about $80,000, and the prosecutor asked for seven years. He added a message that appeared in the terminal every time anyone installed core-js, asking for help or a job.

2019 年，他全职无偿地从事 core-js 的开发，因为生活成本较低而住在俄罗斯。据他自己描述，在一次重大版本发布三周后，凌晨 3 点他开车回家时，两名年轻女子在黑暗的道路上被卷入他的车下，其中一人死亡。受害者家属索赔约 8 万美元，检察官要求判处七年监禁。他在 core-js 中添加了一条消息，每当有人安装该软件时，终端就会显示这条消息，请求帮助或工作机会。

Millions of developers saw it, and many of them complained about the message. He went to prison in January 2020 and was released early, about ten months later. Denis Pushkarev, everyone else. Every change to core-js, week by week, from June 2019. Nearly all of them are his. December 2019: 101 changes in a month. In January 2020 he goes to prison, and the weeks after that stay almost empty. October 2020: he is out and back at work. Downloads nearly doubled while he was inside.

数百万开发者看到了这条消息，许多人对此表示不满。他于 2020 年 1 月入狱，约十个月后提前获释。Denis Pushkarev、其他人。自 2019 年 6 月起，每周对 core-js 的每一次更改。几乎所有更改都由他完成。2019 年 12 月：一个月内有 101 次更改。2020 年 1 月他入狱，此后的几周几乎没有任何更改。2020 年 10 月：他出狱并重返工作岗位。在他入狱期间，下载量几乎翻了一番。

This year he wrote 95 percent of the changes, and he has two sponsors on GitHub. 5,408 of 5,409 changes to sudo between 2008 and 2018 were made by Todd Miller. “I’m currently in search of a sponsor to fund continued sudo maintenance and development.” Todd C. Miller, millert.dev, February 2026. Todd Miller Has maintained sudo, the command that gives you admin rights on a Mac or a Linux server, since the early 1990s. Sudo was first written around 1980 at SUNY Buffalo, and Todd has looked after it for longer than Linux has existed.

今年他完成了 95% 的更改，并在 GitHub 上有两名赞助商。2008 年至 2018 年间，sudo 的 5409 次更改中有 5408 次是由 Todd Miller 完成的。“我目前正在寻找赞助商，以资助 sudo 的持续维护和开发。”——Todd C. Miller，millert.dev，2026 年 2 月。Todd Miller 自 20 世纪 90 年代初以来一直维护着 sudo，这是一个让你在 Mac 或 Linux 服务器上获得管理员权限的命令。Sudo 最初于 1980 年左右在纽约州立大学布法罗分校编写，Todd 维护它的时间比 Linux 存在的历史还要长。