7 ms·

At least if I followed that path, I would not be required to have my purchase recorded in an insecure government database.

tptacek 3y ago
Why are you worried about the government recording your usage of Sudafed? What is anybody going to do with that information? Serious question! I understand the principle involved; I just want to know if there's some practical concern.
- fluidcruft 3y ago
  Every database that contains your PII increases your exposure to a breach and likelihood of having to deal with it. It's not the sudafed use that makes it a target: it's the driver's license.
  - tptacek 3y ago
    Right, but this particular database presumably doesn't have anything especially sensitive in it, apart from your Sudafed consumption. I don't mean to dismiss that point, it's a valid point, I'm just considering it closely.
    - fluidcruft 3y ago
      Anything a government uses to uniquely identify and track individuals (i.e. driver's license) is the target.
      - tptacek 3y ago
        Until very recently, drivers license numbers were effectively public in a lot of states (they're deterministically generated from public information).
        fluidcruft 3y ago
        Hey, that's pretty cool. I suppose I now know Ron DeSantis's drivers license number up to the last digit. And the soundex algorithm is cool (using fuzzy lookup in a list that way to get close/vague matches is novel to me and might be useful). I had heard of soundex but didn't know how it worked until now. Thanks for the TILs! https://stevemorse.org/dl/dl.html https://stevemorse.org/dl/dl.html http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html
    - CamperBob2 3y ago
      It's none of their business. Simple as that.
    - lazide 3y ago
      Sudafed usage, probably a copy of the drivers license, your address, any phone number you give them, and how often you buy a drug the DEA considers a precursor to something really terrible. Usually no one even looks at it (so why have it even?!?), but when they do it’s a potential intro to a full on Brazil situation. Luckily the whole thing is generally considered a waste of time, so usually nothing comes of it. But why make yourself a target if you can avoid it?
      - tptacek 3y ago
        Well, it seems pretty obvious why they have it: so they can match purchases of Sudafed at different retail outlets at different points in time. And it's obvious why they want to do that: because there really was a huge epidemic of people making straw purchases of Sudafed to feed large numbers of low-volume amateur meth labs. In the years after this policy was put into place, there were news stories about how effective it had been in eliminating backyard meth production. You don't see those stories anymore. I suggest, with weak confidence, that the reason you don't isn't that backyard meth has roared back, but rather that it's so decisively not a part of the equation anymore that stats about it don't really matter. Meth comes from overseas now, not from backyards. That doesn't solve the meth consumption problem, but it does eliminate one significant meth externality.
        lazide 3y ago
        I love how we're still stuck not being able to buy Sudafed normally though. :(
        tptacek 3y ago
        You mean, by walking into the drug store and asking for it?
        lazide 3y ago
        By literally going to the aisle with the decongestants, taking a pack, and paying for it like every other thing I would be buying. Like every other OTC drug. Without having to give ID, find a pharmacist, etc. I remember those days. They're long gone, obviously.
- akira2501 3y ago
  What they're going to do with it is prevent me from making a purchase if I've crossed some arbitrary limit as if exceeding that limit automatically makes me a drug trafficker. From there, it's not too far of a stretch to imagine the government assigning someone to review the list and to expend additional investigative resources into merely "suspicious" cases. Plenty of good tragedies start this way. If the government has an interest in preventing drug manufacture then this is the absolute worst way to go about prosecuting that agenda. It harms the wrong people and it offers no impediment to actual producers. The information cannot possibly be useful, it may become a liability, and I didn't ask to be protected from myself.
  - tptacek 3y ago
    They're just going to say "no", right? They're not going to "automatically make you a drug trafficker". They're just trying to enforce a rate limit.
    - akira2501 3y ago
      So, if the concern isn't that I'm trafficking, then why am I being told no? Isn't this the logic the government used to assert this right for itself in the first place? Otherwise, what right is it of the government to enact this rate limit? What interest are they protecting? How is the rate limit decided? What can I do if I disagree with the rate limit? Why is a private business being burdened with the governments agenda here? I get where you're coming from, it _is_ a /small/ thing, but the implications immediately become onerous if you think about their meaning inside of a "free" country.
      - tptacek 3y ago
        You're not being told "no". You can just go buy some Sudafed right now if you want to. It's not like there's an application process. There is a rate limit; that's it.
        akira2501 3y ago
- kstrauser 3y ago
  For me, it’s a matter of it’s none of their business. No one’s accused me of making meth, but here’s all my PII in a database “just in case”. It’s literally harder for me to buy cold medicine than a gun. I hate everything about that situation.
  - tptacek 3y ago
    I mean, the reason they keep the database is especially clear here, right? They're just trying to enforce a rate limit. It's the most obvious public policy response you can have to "a drug that in small quantities is a useful decongestant, but in moderate quantities or above is an ultra powerful stimulant whose abuse is ravaging parts of the country".
    - phone8675309 3y ago
      The primary question to me is whether the risk of data breech outweighs the harm from not keeping the data, and while 20 years ago this tradeoff may have made sense, I'm not so sure it makes sense now.
      - akerl_ 3y ago
        If the data is breached, an attacker learns... that sometimes you have a cough?
        kstrauser 3y ago
        ...and your SSN, and your driver's license info, and all the other personally identifying information they collect and store in the DB.
        phone8675309 3y ago
        Generally not your SSN - I've never had to give it for Sudafed - but at least full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address. Much of which would be covered as PII and PPI, and, in combination with info from other other data breaches can tell someone a lot about you.
- civilitty 3y ago
  It's legal defense in depth, similar to not talking to police without an attorney present. All it takes is an overzealous prosecutor or social worker to ruin someone's life by misrepresenting some random circumstantial facts. This happens all the time in drug cases, for example, where the possession of innocuous items like small baggies allows prosecutors to take charges from regular possession to intent to distribute or trafficking. Even if someone isn't doing anything illegal, since >90% of cases end in plea deals it's good legal hygiene.
- deleted 3y ago
  [deleted]
- scarface_74 3y ago
  https://www.zdnet.com/article/buy-too-much-sudafed-and-you-may-get-a-visit-from-a-cop/ https://www.zdnet.com/article/buy-too-much-sudafed-and-you-m... But if cops will choke someone to death about selling a cigarette, do you really want them to know about you buying Sudafed? It’s funny that there is no outrage about a national psuedophredrine database. But people go nuts about a national gun database
  - tptacek 3y ago
    It's almost like people generally understand why pharmacies are regulated to rate limit the purchase of Sudafed, and that the political consensus generally isn't an ideological opposition to any kind of regulation, the way you mind find it on a message board. Sudafed PE is a much more salient and annoying topic than the behind-the-counter real Sudafed. I think it really does piss people off to get tricked into buying fake decongestant. But that's a separable issue from having to ask (and to show ID) to buy the real stuff.
    - scarface_74 3y ago
      I know of families who struggle to keep enough psuedophredrine in the house when their minor kids get sick and they need some for themselves.
- beanjuiceII 3y ago
  These people are just very paranoid. This is my field of work for the last 15 years.. people think way too highly of the govt capabilities and negatively on their goals. If we actually did 1/10th of what people accused us of our lives would probably be much easier.
mikeweiss 3y ago
Something tells me there is more than just a government owned database involved. Likely at least one third party vendor system... Not to mention every pharmacy chain probably stores or at least transmits it through one their own systems.
mancerayder 3y ago
But what if it were a secure government database?

tptacek 3y ago

Why are you worried about the government recording your usage of Sudafed? What is anybody going to do with that information? Serious question! I understand the principle involved; I just want to know if there's some practical concern.

fluidcruft 3y ago
Every database that contains your PII increases your exposure to a breach and likelihood of having to deal with it. It's not the sudafed use that makes it a target: it's the driver's license.
- tptacek 3y ago
  Right, but this particular database presumably doesn't have anything especially sensitive in it, apart from your Sudafed consumption. I don't mean to dismiss that point, it's a valid point, I'm just considering it closely.
  - fluidcruft 3y ago
    Anything a government uses to uniquely identify and track individuals (i.e. driver's license) is the target.
    - tptacek 3y ago
      Until very recently, drivers license numbers were effectively public in a lot of states (they're deterministically generated from public information).
      - fluidcruft 3y ago
        Hey, that's pretty cool. I suppose I now know Ron DeSantis's drivers license number up to the last digit. And the soundex algorithm is cool (using fuzzy lookup in a list that way to get close/vague matches is novel to me and might be useful). I had heard of soundex but didn't know how it worked until now. Thanks for the TILs! https://stevemorse.org/dl/dl.html https://stevemorse.org/dl/dl.html http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html
  - CamperBob2 3y ago
    It's none of their business. Simple as that.
  - lazide 3y ago
    Sudafed usage, probably a copy of the drivers license, your address, any phone number you give them, and how often you buy a drug the DEA considers a precursor to something really terrible. Usually no one even looks at it (so why have it even?!?), but when they do it’s a potential intro to a full on Brazil situation. Luckily the whole thing is generally considered a waste of time, so usually nothing comes of it. But why make yourself a target if you can avoid it?
    - tptacek 3y ago
      Well, it seems pretty obvious why they have it: so they can match purchases of Sudafed at different retail outlets at different points in time. And it's obvious why they want to do that: because there really was a huge epidemic of people making straw purchases of Sudafed to feed large numbers of low-volume amateur meth labs. In the years after this policy was put into place, there were news stories about how effective it had been in eliminating backyard meth production. You don't see those stories anymore. I suggest, with weak confidence, that the reason you don't isn't that backyard meth has roared back, but rather that it's so decisively not a part of the equation anymore that stats about it don't really matter. Meth comes from overseas now, not from backyards. That doesn't solve the meth consumption problem, but it does eliminate one significant meth externality.
      - lazide 3y ago
        I love how we're still stuck not being able to buy Sudafed normally though. :(
        tptacek 3y ago
        You mean, by walking into the drug store and asking for it?
        lazide 3y ago
        By literally going to the aisle with the decongestants, taking a pack, and paying for it like every other thing I would be buying. Like every other OTC drug. Without having to give ID, find a pharmacist, etc. I remember those days. They're long gone, obviously.
akira2501 3y ago
What they're going to do with it is prevent me from making a purchase if I've crossed some arbitrary limit as if exceeding that limit automatically makes me a drug trafficker. From there, it's not too far of a stretch to imagine the government assigning someone to review the list and to expend additional investigative resources into merely "suspicious" cases. Plenty of good tragedies start this way. If the government has an interest in preventing drug manufacture then this is the absolute worst way to go about prosecuting that agenda. It harms the wrong people and it offers no impediment to actual producers. The information cannot possibly be useful, it may become a liability, and I didn't ask to be protected from myself.
- tptacek 3y ago
  They're just going to say "no", right? They're not going to "automatically make you a drug trafficker". They're just trying to enforce a rate limit.
  - akira2501 3y ago
    So, if the concern isn't that I'm trafficking, then why am I being told no? Isn't this the logic the government used to assert this right for itself in the first place? Otherwise, what right is it of the government to enact this rate limit? What interest are they protecting? How is the rate limit decided? What can I do if I disagree with the rate limit? Why is a private business being burdened with the governments agenda here? I get where you're coming from, it _is_ a /small/ thing, but the implications immediately become onerous if you think about their meaning inside of a "free" country.
    - tptacek 3y ago
      You're not being told "no". You can just go buy some Sudafed right now if you want to. It's not like there's an application process. There is a rate limit; that's it.
      - akira2501 3y ago
kstrauser 3y ago
For me, it’s a matter of it’s none of their business. No one’s accused me of making meth, but here’s all my PII in a database “just in case”. It’s literally harder for me to buy cold medicine than a gun. I hate everything about that situation.
- tptacek 3y ago
  I mean, the reason they keep the database is especially clear here, right? They're just trying to enforce a rate limit. It's the most obvious public policy response you can have to "a drug that in small quantities is a useful decongestant, but in moderate quantities or above is an ultra powerful stimulant whose abuse is ravaging parts of the country".
  - phone8675309 3y ago
    The primary question to me is whether the risk of data breech outweighs the harm from not keeping the data, and while 20 years ago this tradeoff may have made sense, I'm not so sure it makes sense now.
    - akerl_ 3y ago
      If the data is breached, an attacker learns... that sometimes you have a cough?
      - kstrauser 3y ago
        ...and your SSN, and your driver's license info, and all the other personally identifying information they collect and store in the DB.
        phone8675309 3y ago
        Generally not your SSN - I've never had to give it for Sudafed - but at least full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address. Much of which would be covered as PII and PPI, and, in combination with info from other other data breaches can tell someone a lot about you.
civilitty 3y ago
It's legal defense in depth, similar to not talking to police without an attorney present. All it takes is an overzealous prosecutor or social worker to ruin someone's life by misrepresenting some random circumstantial facts. This happens all the time in drug cases, for example, where the possession of innocuous items like small baggies allows prosecutors to take charges from regular possession to intent to distribute or trafficking. Even if someone isn't doing anything illegal, since >90% of cases end in plea deals it's good legal hygiene.
deleted 3y ago
[deleted]
scarface_74 3y ago
https://www.zdnet.com/article/buy-too-much-sudafed-and-you-may-get-a-visit-from-a-cop/ https://www.zdnet.com/article/buy-too-much-sudafed-and-you-m... But if cops will choke someone to death about selling a cigarette, do you really want them to know about you buying Sudafed? It’s funny that there is no outrage about a national psuedophredrine database. But people go nuts about a national gun database
- tptacek 3y ago
  It's almost like people generally understand why pharmacies are regulated to rate limit the purchase of Sudafed, and that the political consensus generally isn't an ideological opposition to any kind of regulation, the way you mind find it on a message board. Sudafed PE is a much more salient and annoying topic than the behind-the-counter real Sudafed. I think it really does piss people off to get tricked into buying fake decongestant. But that's a separable issue from having to ask (and to show ID) to buy the real stuff.
  - scarface_74 3y ago
    I know of families who struggle to keep enough psuedophredrine in the house when their minor kids get sick and they need some for themselves.
beanjuiceII 3y ago
These people are just very paranoid. This is my field of work for the last 15 years.. people think way too highly of the govt capabilities and negatively on their goals. If we actually did 1/10th of what people accused us of our lives would probably be much easier.

mikeweiss 3y ago

Something tells me there is more than just a government owned database involved. Likely at least one third party vendor system... Not to mention every pharmacy chain probably stores or at least transmits it through one their own systems.

mancerayder 3y ago

But what if it were a secure government database?