The editorial argues there is a layer of US digital infrastructure — rural hospitals, water utilities, county election offices — that sits below the enterprise market CrowdStrike/Mandiant/Wiz serve and outside CISA's federal scope. Newmark's roughly $200M into groups like Global Cyber Alliance (Quad9, DMARC tooling), Consumer Reports Digital Lab, and university training pipelines directly funds defenders for that 'soft underbelly' that has driven recent ransomware headlines.
By submitting The Independent's profile (which highlights Newmark living in a one-bedroom NYC apartment, flying coach, still doing Craigslist customer service, and pledging to zero out his net worth before death), Tomte foregrounds the contrast between Newmark and other tech billionaires. The 235-point score on HN suggests the community resonates with framing him as an aspirational counter-example to typical founder wealth behavior.
The synthesis explicitly names Quad9 DNS and Global Cyber Alliance's DMARC deployment tooling as widely-used resources whose funding source is opaque to the engineers relying on them. The editorial's framing — 'most developers have never heard of them despite using infrastructure they help defend' — positions Newmark's giving as quietly load-bearing for the open internet rather than a vanity philanthropy play.
Craig Newmark, the 73-year-old founder of Craigslist, has now donated more than $500 million through Craig Newmark Philanthropies, according to a profile in The Independent picked up by Hacker News (235 points). The bulk of that — Newmark himself pegs it at around $200 million — has gone into cybersecurity, an area he calls "cyber civil defense." The rest is split across veterans' services, journalism integrity programs, and pigeon rescue (genuinely).
Newmark still owns Craigslist. He stopped running it in 2000, handing the CEO role to Jim Buckmaster, and has worked as a customer service rep on the site ever since. He lives in a one-bedroom apartment in New York, flies coach, and has publicly committed to giving away essentially everything. The current $500M figure is cumulative; his stated goal is to zero out his net worth before he dies.
The specific cyber recipients are worth naming because most developers have never heard of them despite using infrastructure they help defend. Newmark money flows to the Aspen Digital cybersecurity group, the Global Cyber Alliance (which runs the free Quad9 DNS resolver and the DMARC deployment tooling many of you have used without knowing who funded it), Consumer Reports' Digital Lab, the Cybercrime Support Network, and a long list of programs at NYU Tandon, Stanford, and the US Naval Academy that train the next generation of defenders. He has also funded targeted hardening grants for hospitals, water utilities, and county election offices — the exact "soft underbelly" targets that have dominated the past three years of ransomware headlines.
There's a structural gap in US cybersecurity that most engineers don't see because we work above it. The big firms — CrowdStrike, Mandiant, Wiz — sell to enterprises that can afford seven-figure annual contracts. CISA covers federal civilian agencies and publishes advisories. Between those two layers sits everything that actually breaks: rural hospitals, regional water districts, school networks, small municipalities, nonprofits, and the local journalism outlets that report on all of them. None of those entities can afford a SOC. None of them are CISA's direct constituents. They are, however, exactly what Newmark's grants pay for.
This matters for practitioners in a specific way. If you have shipped a library, a SaaS tool, or a piece of OSS that touches civic infrastructure in the last five years, there is a meaningful chance the security review on the other end was done by someone whose salary, training, or tooling traces back to Newmark money. The Global Cyber Alliance's DMARC deployment work alone has been used by thousands of small organizations that would otherwise have sat exposed to spoofing. Quad9 — free, privacy-respecting, malware-filtering DNS — exists in part because Newmark wrote checks early. Consumer Reports' Digital Standard, which is now the de facto baseline for IoT security labeling work at NIST, was seeded the same way.
The comparison that sharpens this: in 2024 the top five US cyber VCs deployed roughly $4B combined. Newmark's $200M is 5% of that — which sounds small until you notice that VC money goes into companies that need to exit at 10x. Newmark's money goes into 501(c)(3)s that don't. The ROI on a grant to a water utility CISO program isn't measured in IRR; it's measured in the ransomware attack that didn't happen because someone got MFA turned on in time. That's a category of work the market structurally cannot fund, and it has, until recently, been almost entirely one billionaire deep.
The other thing worth saying out loud: Newmark is roughly the same age as several other tech-fortune holders who have signed the Giving Pledge. The difference is enforcement. Bill Gates' foundation has an endowment and a multi-decade spend-down plan. MacKenzie Scott gives in large, fast, no-strings tranches. Newmark's model is narrower — pick a small number of underfunded fields, fund them year over year, stay alive to course-correct. Cyber civil defense is one of maybe four buckets he touches. The concentration is the point.
Two concrete implications for engineers reading this.
First, if you maintain anything used by small civic operators — a Helm chart, a Terraform module, an open-source auth library, a Postgres extension — your downstream users include organizations operating on Newmark-funded shoestrings. The realistic threat model isn't a nation-state APT; it's a county clerk who can't tell a real release tag from a typosquat. Defaults matter more than features. Sane defaults for TLS, secret rotation, and dependency pinning save lives in this audience in a way that more configuration flags do not. The recent npm and PyPI supply-chain incidents land hardest on exactly these users.
Second, if you're looking for high-leverage volunteer work, the orgs in Newmark's portfolio are mostly understaffed and would take a Friday afternoon of your time. The Global Cyber Alliance maintains open-source tooling; Consumer Reports' Digital Lab needs technical reviewers; the Cybercrime Support Network needs engineers who can translate "we got phished" into actionable incident response for non-technical victims. These are not glamorous gigs. They are the closest thing the industry has to a functioning civil defense corps, and they are funded by a guy who still answers Craigslist support tickets.
Third, the practical career note: there is a growing employment surface in civic cyber that didn't exist five years ago, much of it funded by this ecosystem. NYU Tandon's cyber fellowship, the various state-level cyber civilian corps programs, and the CISA Cyber Innovation Fellows track all hire mid-career engineers and pay competitively-for-nonprofit rates. If the current AI-bubble layoff cycle hits you, these are real jobs, not pity work.
Newmark has stated he wants the $500M figure to be "closer to all of it" by the time he's gone, which gives this ecosystem maybe another decade of guaranteed funding. The interesting question is what happens after. Cyber civil defense is currently a single-donor field in a way that should make anyone nervous. The most useful thing the rest of the industry could do — large vendors included — is treat the Newmark grant list as a shopping list of orgs to also fund, so the next county hospital ransomware case isn't the one where the lights actually stay off.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.