Live data from Hacker News

Source code for Dutch DigiD app released under Dutch Open Government Act

github.com

51–60 of 161 posts

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#51

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

Stealthy dig at the European military acquisition strategy :)

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#52

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very localised and divided. The French do it their way, Italians another way, the Germans on their own way etc. It is hard to find gain common ground beyond what EU already represents(which is very good IMO). I do wish doing things at EU level becomes the norm, and individualities slowly disappear.

Imagine a single European rail service (not Euro rail where you can buy a single ticket that will make you take Dutch train, and then connect on a German train, and then on an Austrian train, and if you miss a connection, good luck figuring out your replacement..)

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#53
post #3

Earlier quoted context omitted.

Is this literate programming?

It's been extensively discussed on twitter, and the general conclusion seems to be that yes, this particular snippet is good code.

Discussed by whom? By people who deem every non-built-in data structure as "too clever" for maintenance?

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#54
post #3

Earlier quoted context omitted.

Is this literate programming?

It's been extensively discussed on twitter, and the general conclusion seems to be that yes, this particular snippet is good code.

It’s not, though. To confirm the method works you need to check every single comparison operator and value to ensure the range is bounded correctly. It’s code that stops you in your tracks.

Pull request denied.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#55
post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

That's a bad comparison, as you're comparing a full authentication process against just one step: with Office 365 (and SMS verification for DigiD) you additionally need to provide a username and password, which you don't need to do with the app.

I think the only part that can reasonably be simplified without compromising security is to use a push notification instead of having to scan the QR-code.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#56

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

Such a collaboration has the potential to save time, money, effort, and increase quality. But in reality it either ends up being "design by committee", or a few of the countries are the drivers and the rest are the followers who try all kinds of maneuvers to retain some control.

Even if this is done under the umbrella of an EU institution, the politics work the same way except now every other country is trying all kinds of maneuvers in an attempts to retain as much of the control as possible.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#57

Italy does the same: https://github.com/pagopa/io-app This is the official government app (you can get benefits, pay taxes, etc...), downloaded by 30+ million citizens, stack is React Native + Typescript

Wow, looks pretty nice from the screenshots. Do you have experience using it? Does it work well/do what it claims? I recently moved to Spain, who has a digital identity system, but is a pretty disjointed attempt.

Yes, the project started in February 2017, so it's been a while and the app is very mature and frequently used by many citizens (full disclaimer, I was leading the development of the app and the backend from the beginning until almost two years ago).

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#58

Earlier quoted context omitted.

maybe EU countries could save a bundle and co-develop these apps. might also improve quality / ensure best practises are available to all etc.

This is the baffling side of the EU to all outsiders/newcomers. When I first moved here, that was my first thought as well. There is just so much in common, why repeat everything everywhere instead of single effort with branches everywhere?! (police force, consular services, Identity services, and pretty much any Government paperwork one can think of, transportation services etc). However, the population is very loca…

there are many obstacles (pre-existing conditions, different legal context, national sensitivities etc)

in general the EU strategy has been to agree common rules and standards. But there are also examples of common infrastructure, e.g. the Euro bills

it will be interesting to see how this might develop for software related to public institutions

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#59
post #28

Earlier quoted context omitted.

The only thing that jumps out at me is this: if (percentage == 0) return […]; if (percentage > 0.0 && […] Can a double have a value that is larger than 0 but smaller or equal to 0.0? I would have expected '> 0' instead.

In any language I can think of, 0 and 0.0 are the same, once you're comparing them against a double.

Technically what is happening behind the scenes is that for most languages the compiler/interpreter will promote the integer to a double to avoid foot guns.

Nevertheless integer comparisons with any kind of floating point is not a wise choice.

The idiomatic way to compare a double would be to take into account whatever is the double precision epsilon for that language. Or just use the greater/less than like they have in the subsequent if statements in the original code snippet.

Re: Source code for Dutch DigiD app released under Dutch Open Government Act

#60
post #39

I find the DigiD app to be one of the most annoying implementations of 2FA out there. You have to unlock the app with a pin code, then enter an app-generated code on the site, then scan a QR with the app, and then grant permission to login to that site. If you compare that to 2FA for Office 365 for example, where you just have a push notification where you press a button to allow, then you can't help but think that s…

On the other side of this, push-phishing through MFA fatigue has become extremely frequently used to hack into enterprise O365 instances (as well as Google Cloud accounts and the like).

People don't generally read it when their phone apps send them a "please login" notification after the 200th one that day, they tend to approve it without thinking (or worse, accidentally approve a phishing notification while trying to login), especially when busy, which results in them letting phishers onto their device.

The DigiD login flow is a bit of a mess, but it seems very well designed to avoid that particular tendency. The entire process requires active involvement from the end-user, which means they'll be paying attention on whether it's them logging in or not.

Post reply on HN