Alexander Mikhailian

One thing about Peppol is how worryingly complex it is. I really hope it will be lobbied out in favor of a simpler solution.

As a reminder... remember the structured communication in your Belgian bank transfers? The one with triple pluses at the beginning and at the end? Like +++250/4171/01095+++.

The below shell script generates a unique one from today's year, month, day, hour and minute.

Things should not be more complex that they need be.'

DATE=date  +"%y%m%d%H%M"
CHECKSUM=printf "%02d" $((DATE%97?DATE%97:97))
echo $DATE$CHECKSUM |\
  sed -e 's#\([0-9]\{3\}\)\([0-9]\{4\}\)\([0-9]\{5\}\)#+++\1/\2/\3+++#'

Bert Hubert wrote at length and more openly about EU dependance on US software since the election of Trump. Not that engineers did not know about all that, but European IT is not run by engineers to the same extent as in US.

The situation is slightly different in Belgium:

1. We have our own government cloud. It runs on US software, but we are pretty much in control of it.
2. We have our own authentication service, but large parts of it run on COTS software from US.
3. We forgot how to host our own email, even the Ministry of Foreign Affairs and the Cabinet of the Prime Minister use M365.
4. We voluntarily gave up control over Belgian Certificate Authority to the US-based conglomerate DigiCert.

I guess things have to be fixed in the reverse order:

1. Take back control of Belgium Root CA
2. Host our own email
3. Own government auth
4. Migrate government cloud off Broadcom and IBM (anyway we need to migrate off Broadcom for money reasons)

That's a nice task list and luckily we already have an IT czar

P.S and Disclaimer: I indirectly work for the government, but everything above is public knowledge, for instance:

A few weeks ago I received an unsolicited email from the Belgian Center for Cyber Security. It starts with the statement that 80% of cyber attacks could be avoided if 2FA was active and then says literally that If you only use a username and password for your remote logins, you're a sitting duck.

This is not true, username and password are no less secure than 2FA. In a way, they are more secure. I know this is controversial, but please bear with me, and I will explain CCB assumptions, my assumptions, and how it all makes sense.

CCB assumes that people can not be trusted with passwords. Over the years, the most popular passwords have been 123456 and password, closely followed by 12345678 and qwerty. Research has proven time and again that we use weak passwords whenever possible.

But hold on. These same people behave reasonably and optimally. Whenever they start using a new website or app, its value is close to zero, so it it an optimal strategy to use a weak password. More often than not, the interaction is unique or spaced in time so much that it makes no sense to save the password at all. When I visit a website I have not visited for years, my old password usually does not work anymore, and I have to reset it.

I have a workflow for auto-generating passwords and storing them in a password manager, but it is totally reasonable to expect other strategies for occasional users:

Back in 2011 my team built a news website with adaptive delivery. It loaded a small html page with a JavaScript that checked the screen size and user agent, then based on whether the user was on a phone, a tablet or a desktop, downloaded and displayed the content crafted for that particular device. It then left a cookie to avoid the extra round-trip for returning visitors.

Nowadays people tend to adapt the design to devices with CSS frameworks and flexbox layout, but this does not always reduce traffic and CPU time for low-powered devices.

While our engineering feat was adorable and I praised the team for the achievement, this architecture did not last. The editorial team did not want to maintain essentially 3 different content layouts daily, the marketing team was not willing to compromise on ads on smaller screens.

None was happy except the readers.

I moved a business of ~100 FTEs from AWS to Hetzner once. Aside from the migration cost, the price was roughly 25% of AWS. I left many years ago, the business switched frameworks since then but they stayed on Hetzner.

Thinking again of this old story I now realize that the biggest gain was not monetary, but human. For years, that business could retain skilled engineers who had the opportunity to work closer to bare metal, caring about the nitty-gritty technical details of backups, failover and high availability.

And they did not even cost much. That they had so much leeway in designing the system instead of "relying on the cloud" was a major retainer.