I don't think any of the national id services I've heard of stores all your data in a centralized place. Usually the national id service only provides identification to the service providers that request it. Each service provider (like, your bank, hospital, pension provider) will store their own data as they've always done, they just use the service to identify you.

Compared to the Java ecosystem, I think there's a couple of issues in the NPM ecosystem that makes the situation a lot worse:

1) The availability of the package post-install hook that can run any command after simply resolving and downloading a package[1].

That, combined with:

2) The culture with using version ranges for dependency resolution[2] means that any compromised package can just spread with ridiculous speed (and then use the post-install hook to compromise other packages). You also have version ranges in the Java ecosystem, but it's not the norm to use in my experience, you get new dependencies when you actively bump the dependencies you are directly using because everything depends on specific versions.

I'm no NPM expert, but that's the worst offenders from a technical perspective, in my opinion.

[1]: I'm sure it can be disabled, and it might even be now by default - I don't know. [2]: Yes, I know you can use a lock file, but it's definitely not the norm to actively consider each upgraded version when refreshing the lockfile.

Also badly named commands, `npm install` updates your packages to the latest version allowed by package.json and updates the lock file, `npm ci` is what people usually want to do: install the versions according to the lock file.

IMO, `ci` should be `install`, `install` should be `update`.

Plus the install command is reused to add dependencies, that should be a separate command.

This hasn't been true since version 5.4.2, released in 2017.

`npm install` will always use the versions listed in package-lock.json unless your package.json has been edited to list newer versions than are present in package-lock.json.

The only difference with `npm ci` is that `npm ci` fails if the two are out of sync (and it deletes `node_modules` first).

> The culture with using version ranges for dependency resolution

Yep, auto-updating dependencies are the main culprit why malware can spread so fast. I strongly recommend the use `save-exact` in npm and only update your dependencies when you actually need to.

This advice leaves you vulnerable to log4j style vulnerabilities that get discovered though.

The answer is a balance. Use Dependabot to keep dependencies up to date, but configure a dependency cooldown so you don't end up installing anything too new. A seven day cooldown would keep you from being vulnerable to these types of attacks.

Cooldowns only work if enough people don't use cooldowns (or don't use cooldowns longer than yours) for attacks to get noticed.

That may have been true two years ago, but now you have groups like Wiz doing scans and looking for these types of attacks. You don't have to wait for someone to get their shit destroyed to notice.

To add a few:

* NPM has a culture of "many small dependencies", so there's a very long tail of small projects that are mostly below the radar that wouldn't stand out initially if they get a patch update. People don't look critically into updated versions because there's so many of them.

* Developers have developed a culture of staying up-to-date as much as possible, so any patch release is applied as soon as possible, often automated. This is mainly sold as a security feature, so that a vulnerability gets patched and released before disclosure is done. But it was (is?) also a thing where if you wait too long to update, updating takes more time and effort because things keep breaking.

I haven't looked into it much, but I assume the point is that it avoids the SWIFT system.

At least here in Denmark, they seem to have opted for installing bigger "pipes", instead of just laying down some fiber cables. Then in the future they can just push new cables through the pipes. An idea I bet they wish they had gotten the first time around.

What do you mean? They can be in a single service file.

All the examples I see is there’s a network unit file, a cron unit file, etc all for one application. It would be nice to colocate.

Then there is composition of multiple applications too.

With docker compose I have a single file for running all my services.

With systemd it has to be N number of files for each service too.

The Senna series from 2024 is also pretty good.

It's been possible to use Content Blockers for Safari for a long time, which alters the page content. Firefox Focus came out about a decade ago, and can be used as one.

It's been possible for about a decade to use Firefox Focus as a Content Blocker for Safari. I assume it's open source, "well trusted" is of course subjective.

Firefox Focus doesn't exist on Mac, though.

And earlier than that, they jumped on the train.

And did amphetamines on trains...

anal_reactor says so.