[flexagoon]

Why is DigiD even a product that needs constant maintenance? From my experience using it it's just a pretty simple authentication/data sharing system. Every oauth provider has something similar. Why is it a whole separate product that is owned by some company?

[ivan_gammel]

Any network service with 24x7 availability and millions of users requires constant maintenance. Hardware has some lifetime and needs to be maintained and replaced. OS needs patching. Dependencies need security updates and, time to time, migrations to next major LTS update. Sometimes new requirements come from regulatory, that need development of new features. The skill set needs to be maintained. Support requests need to be served. Law enforcement may ask for some data.

Add to this hard digital sovereignty requirements: continuity of service must be guaranteed for decades. All this requires quite a special setup in which commercial entities are rather tolerated than welcomed, but they may still make more sense than a government agency so constrained by budget process that they cannot hire any decent engineer.

[flexagoon]

Of course, I understand why some maintenance is required. I just don't get why there is apparently a big maintenance burden over something that is usually a single small feature of a service

[ivan_gammel]

Digital ID is in no way just a „single small feature of a service“, but even if it would be so, for every tiny thing there exist 10x more requirements that make it a product.