Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war).

This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.

Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.

I would not go that far to say all govts are like that. The main problem is majority of citizens cannot easily remember such things. Even simple PIN that is included in EU ID cards - most people don't remember or use. people want frictionless use.

> Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.

Or... it's something that you always have on you which is incredibly hard to fake.

You shouldn't model it as incredible hard to fake. It isn't. It's harder that typing a password you've stolen into a web site, but if you set out to do it, it's not that much harder.

This is the primary reason I'm against biometrics used for identity. Yeah, the privacy invasion is a problem, but I think that's completely dominated by the fact that if everyone uses it, it will be leaked, and once leaked, can indeed be quite practically faked. If used as a password, it's a password you can never change. That is useless.

The difficulty of overcoming a security measure should be greater in cost than the thing it is valuing. The cost of, for instance, replicating a fingerprint given a photo of it, is basically a home hobbyist project for the weekend. Check out Youtube for many people who have done exactly that and give instructions how. When the cost of bypass is "home hobbyist project on a weekend", the value of what it should be expected to protect is correspondingly low.

(In fact I don't even use it on my cell phone, with all its access to bank accounts and amazon accounts and other ways to spend my real money. The idea of a password to all that stuff that I leave arbitrary copies of sitting right on my screen is completely absurd. Everything important is locked behind codes and passwords. It's less convenient than fingerprints but at least those offer actual security.)

You also have to bear in mind the costs of the biometrics gathering. If you have a physical guard watching someone do a retinal scan and verifying that they have put their real eye up to it, you're at least on track to something that takes a lot of resources to overcome, especially if it's in combination with other techniques of identification. If you don't have that, now we're back to "how cheaply can we replicate whatever passes for a retina with this scanner" and that's likely to be cheaper than most people think. Real-world biometrics are in places where attackers can perform arbitrary attacks with impunity.

> something you know like SSN/tax id/password

How can you equal an SSN/Tax id with a password? The SSN/Tax id is more or less public knowledge while a password is not.

Maybe in the future, our driver licenses will become a physical token?

Biometrics are the only credential you can't roll after compromise.

It depends what the biometrics are. There have been successful hand transplants, so new finger prints are possible, but completely impractical.

https://en.wikipedia.org/wiki/Hand_transplantation

Thinking about it, I probably wouldn't remember to change my fingerprints to the new ones with all the services I use, I'd probably have to carry my "legacy fingerprints" wherever I go for some time to avoid a lockout.

kind of but others are hard as well... most people don't change their name, date of birth or even email address when they are leaked.

These aren't really "credentials" in that they're not secret the way your iris/retina pattern, fingerprint pattern, password, pin, secret key, or security token are.

Your name, DoB, and email address are identifiers, yes, but aren't really authenticators - they're more like a username, not a password.

this is exactly my problem with them

You can also race it with another promise, which e.g. resolves on timeout.

You can but it still won't get cancelled. I found out when I tried to implement a hard time limit to a call.

In Brazil you already can't access some government services without a smartphone, such as paying for municipal parking in various cities. So if you own a car but not a smartphone, you get a fine. Sadly the least of the country's problems.

There should be more noise about this here, but to whoever you talk about that issue they don't seem to grasp the situation, or simply don't care, and call you crazy/paranoid. I have been told you also need the GOV app for certain things related to companies.

Ah, so the minutes long wait hearing answering machine bs is a universal experience. I thought it was a local thing and limited to ISPs, utilities, and financials... When I can choose between competing companies, having a direct line to a human for customer support is at the top of my list. I'm happy with either chat or phone, I just don't want to go through a bot first.

I've used it for several years now, it's a great app. Not perfect, there is noticeable lag to capture high resolution images, and lacks shutter speed control. Still, beats other FOSS alternatives in my experience.

>every country that has imposed a considerable sugar tax has seen benefits across the board

Is there strong evidence for that? The first study that pops up if I search this suggests otherwise, that it could increase consumption of sugar-substitutes and overall caloric intake. https://doi.org/10.1016/j.tjnut.2025.05.019

>we need guardrails to defend against

There is no "we". You say that I and others need it, and you want to impose your opinion by taxing us.

Your link is _not_ about a country that _actually_ imposed a sugar tax.

This is honestly a very silly take. You could make the same counterargument about any tax of any kind, or really any law of any kind. Like it or not, we do need both taxes and laws to function as a society.

And for most it would be a valid point. Nozick makes the best case for this.

Reminds me of this 2023 post "re-implementing LangChain in 100 lines of code": https://blog.scottlogic.com/2023/05/04/langchain-mini.html

We did just that back then and it worked great, we used it in many projects after that.

How was this three years ago ;_;

A comment with an article citing published medical literature on risks associated with this type of vaccine was flagged and hidden. Why? I don't know the author nor am I a medical doctor to understand the topic at depth, so it's a genuine question. Was it misleading? If so, how? That's what the comment was asking, actually, if there were counter-points to the text, which was favorable to live vaccines (e.g. shingles) but critical of those developed with other methods. Is there no merit to that? I genuinely don't know, and since it seems impossible to discuss the topic, it's hard to say.

I sometimes vouch for incorrectly flagged posts. You got me curious, so I took a look. What I found was a blog from an anonymous conspiracist vaccine opponent claiming to be a doctor. He's a decent writer but in my estimation a loon.

So I'm fine with it being flagged and decline to vouch for it.

It was a misleading post.

For the HPV section specifically, there were at least two major omissions.

First, in his table showing autoimmune adverse effects, he has chosen to crop out the next column in the table containing the control conditions - which show very similar rates of adverse effects to the vaccine condition.

Secondly, when discussing negative efficacy in the case of existing persistent infection, he only quotes the data from one of three studies that the linked report covers. The linked report indeed covers the negative efficacy in study 013 as an area of concern. However, study 015 (which had roughly twice the number of total participants as study 013) showed no real evidence of negative efficacy. When all 3 studies are pooled together, the point estimate still says negative efficacy, (at ~-12%), however the error bars are quite wide.

Why this is tragic, is because these two omissions do actually point to failures in public communication about the vaccine. For example, the control condition in the Merck trials were a mix of saline injections (this is the traditional placebo), as well as injections with just the adjuvant (AAHS). This is less standard, and raises legitimate questions about why Merck used an adjuvant as the control, instead of just saline. There a cynical/conspiratorial angle to this question, which I think would be directionally correct.

The second omission is because I think there is a reasonable question of "are there extra risks associated with getting the HPV vaccine while having an active persistence infection", even when taking into account the different and larger study populations within the original trial data. Once again, I think the idea that both companies and public health agencies don't want to deal with a vaccine that requires testing before hand is true. I also believe that on a population level, even if there was a modest increase in risk in that specific subgroup, it makes sense to implement broad vaccination campaigns.

That said, I think the unwillingness of public health agencies to engage with this tricky area of communication and education creates these types of opening for anti-vaccine messaging. If you want a sense of "conspiracy" - here's a random review study - https://pmc.ncbi.nlm.nih.gov/articles/PMC8706722/

Notice that when reporting results, the groupings for HPV status at enrollment time are "naive" and "irrespective" - the "test positive" grouping isn't broken out.

EDIT: The article that we're discussing is https://www.midwesterndoctor.com/p/the-perils-of-vaccinating...

Thank you for the thoughtful response.

FYI: NetGuard is an open source rootless firewall for vanilla Android which also allows per-app network access control, for those unable or unwilling to go with other OSs. Works by leveraging Android VPN to block instead of tunneling packets.

Doesn't running as a VPN mean it's incompatible with running an actual VPN at the same time? That's a pretty big caveat.

pretty sure by design only one vpn can be running at a time per OS

With the hability to see and track every payment?