As a Dutch citizen, I don't understand why we can't self-host an open source identity solution for 20M users with 30K requests an hour. How hard can it be?
How hard can it be to hire a competent engineer when you hire for a bank or a government.
Netherlands blocks US takeover of vital digital supplier
141–150 of 246 posts
Re: Netherlands blocks US takeover of vital digital supplier
#142Earlier quoted context omitted.
30k requests and hour? A 5 euro VPS can handle this easily.
If the owner of the stack (Logio or whatever it was called, see upthread) doesn't understand it, the consultants will run wild and soon it will require a hectare-sized datacenter running a zillion containers, and another DC for HA of course.
Containers with COBOL
Re: Netherlands blocks US takeover of vital digital supplier
#143As a Dutch citizen, I don't understand why we can't self-host an open source identity solution for 20M users with 30K requests an hour. How hard can it be?
As an American citizen supporting your government's work to do exactly that, I also wonder.
Re: Netherlands blocks US takeover of vital digital supplier
#144Earlier quoted context omitted.
All the more reason to block vital stuff going to the US. They cannot be trusted anymore.
True, but the question is if it isn't smarter to wait for the midterms in November where it currently looks like it's going to be a disaster for Trump and the Republicans.
Sale was happening soon, couldn't wait longer, IIUC.
Re: Netherlands blocks US takeover of vital digital supplier
#145Earlier quoted context omitted.
For the record, Logius (the government owned enterprise dealing with DigID) vacancy for Java developer: https://www.werkenvoornederland.nl/vacatures/lead-java-devel... . 92k EUR per year for whatever they measure as 40 hours a week (I bet they close the shop at 4 pm). >Did you know it costs 25 cents to send a message via the Berichtenbox? In a country with paid toilets what do you expect lol
That doesn't sound bad at all. At least for me as a German that would be a salary that you wouldn't get at every random company. Maybe the Netherlands are different (country can vary a lot with what is included in a salary) ?
It's a good salary if you don't work for booking, amazon or whatever americans of the day. I got lowballed a few days ago with 85 in a startup. On the other hand this wont buy you a house in Amsterdam on one income.
Re: Netherlands blocks US takeover of vital digital supplier
#146The concerning thing for the EU should be that this valuable firm had no European capital trying to buy it. The Dutch have protected their sovereignty today while decreasing the incentive for the next entrepreneur to make something on European shores. Probably the best choice but doesn't change the structural problem.
Concerning for you, perhaps. I take the opposite lesson: this incentivizes and invites the exact kind of entrepreneurs you want to have in a country. You profit-driven Americans assume that all entrepreneurs build things to maximize profit at the expense of everything else. No, not everyone is driven by that, and many of the best company builders were not primarily profit driven (e.g. Steve Jobs believed in beauty and excellence). There are plenty of entrepreneurs who want to build things to support the sovereignty and livelihood of the places that they live in while making a profit that doesn’t jeopardize that.
I say, blocking foreign takeover of vital companies would actually incentivize me as an entrepreneur to choose the EU, and I say that as a startup founder in Europe. Because it levels the playing field for founders who believe in sovereignty: now I don’t have to worry about competitors selling out to foreign capital doing better than me due to that.
Re: Netherlands blocks US takeover of vital digital supplier
#147If it's such a vital piece of Dutch infrastructure, why is it in private hands at all?
Because very powerful private VCs and investment bankers want to ensure that governments stay impotent when compared to their capital. Welcome to the Western world.
Re: Netherlands blocks US takeover of vital digital supplier
#148Can someone tell me what actual technical issue do identification providers solve that couldn't be solved with a public key cryptography or even a password and 2FA? The whole sector seems like it was created out of corruption and shortsightedness.
They don't solve the technical issue, that's the thing. Once you can match the public key to a legal person with their tax number, it's more or less a weekend of coding to get 80% there.
But to get there you first need to have access to the government API giving you information about a person with certain tax number (name, DOB, address) so you can send them a letter with the code, for which you likely need to be inside their security perimeter. Then you have to actually send the code and have the app generate the key. Then sure, you can expose oauth2 provider and authenticate user with an HOTP you enrolled after they entered the binding key from mail. That's about the whole thing if you don't count bells and whistles.
Bells and whistles include:
- talking to the physical id card so you can mark the key as high trust;
- keeping the session open so second login during 15 minutes would be confirmed with one tap in the app;
- backup authentication method with sms-otp;
- all the nasty stuff that happens with fraud and blocking access but you can't just block the customer and tell them to go somewhere else;
- antidebugging and obfuscation nonsence in mobile apps because CyBErsEcUritTy (second level scam);
- fancy paper to print one time codes that come by mail (not sure DigID does this, but banks do)
Re: Netherlands blocks US takeover of vital digital supplier
#149Can someone tell me what actual technical issue do identification providers solve that couldn't be solved with a public key cryptography or even a password and 2FA? The whole sector seems like it was created out of corruption and shortsightedness.
You want an idp who verified that the account belongs to a specific citizen. There needs to be some loop closing between your bsn (akin to a social security number) and user accounts. That in itself is not something you can just handoff to auth0 or that you want different departments to self select and self-host. Digid is used to submit taxes and for getting benefits from the government.
DigId is used to log into systems that one uses to submit taxes and claim benefits.
Re: Netherlands blocks US takeover of vital digital supplier
#150Earlier quoted context omitted.
>> Finally! You are behind the curve. You read here first. Lets revisit this comment in 2 years... This will be overturned by both Dutch and European courts after the company appeals, and specially after Mark Rutte Daddy calls. The only purpose of this action is for the Dutch government to save face, and its for internal consumption. They already have the internal legal advice stating this, hidden away in some closet…
> Mark Rutte Daddy calls Mark Rutte, the chief of NATO and ex-PM, that has nothing to do with civilian tech? Can we please leave unfounded conspiracy theories to Reddit?
I have no idea if he's involved in this at all (does seem fairly unrelated) but Mark Rutte is indeed an extremely dodgy bloke.
Not sure exactly who he represents but his actions as NATO secretary have been genuinely a bit concerning for me, he seems determined to start a war with Russia