> 3- one or some of the domain owners, for example for fraser.name, acted as a registry themselves managing authoritative DNS servers for NS records of .fraser.name domains, these third level DNS servers being pointed to by the name. NS records.
There was no domain owner for fraser.name. Verisgn acted as the registry for fraser.name and allowed a registrar to directly register bob.fraser.name.
Before 2004 these third-level domains were the only way to register .name domains. It was the intended structure. See Wilipedia for an explanation: https://en.wikipedia.org/wiki/.name#Structure
> On the other hand I estimate that between 50% and 200% of the taxes collected like this are wasted and not applied to their ultimate goals. The average collected amount per submission is so small that you cannot pay the bureaucrats managing the complex submissions from these sums.
The point of this tax is not to raise revenue bit to disincentivize wate. Since the tax weight based, companies have an incentive to reduce packaging.
Customers already pay for the disposal. You could achieve the same thing by requiring sellers to list in checkout how much the disposal of their packaging will cost. That's a 10 minute change for Claude Code, but of course then it would not give more money and power to the useless bureaucrats.
First of all that's a weaker signal to the manufacturer/seller to make changes as it'd only indirectly affect them.
It's also moot - in most (all?) European cities you only pay for waste but not recycling (paper, plastic, glas, aluminum, etc.). Those are free and paid for by exactly the kind of recycling fees we're discussing here.
Thats not enough. This problem pops up everywhere people do CVE analysis. If a tertiary part of some library is hit by some arbitrary CVE, why should that affect the core functionality people actually use? If I use ChaCha20, and that's bundled in a library with md5.do I care that their md5 library has a vulnerability? No, not really.
If you keep driving the "seperate the packages" angle you end up with is-odd, and that not a nice play to be either.
Even more than that, a lot of vulnerabilities require untrusted input to exploit, but the library or executable is usually only used with trusted input. For example, suppose the chacha20 function had a vulnerability that was exploitable with a malicious secret key, but you only call it with your own, definitely not malicious, key. The vulnerability doesn't impact you, but your security policy might still require you to update. And no amount of splitting the package will help with that.
I have concluded that even though I won't use that key, I still want the issue fixed. You never know if the key I randomly choose next year is the vulnerable one. Worse, you never know if someone else won't make a bug that allows outsiders to select a key...
At least for native binaries it's not too hard to write a scanner that extracts symbols from the binaries and checks them against the symbol names of the vulnerable code. If the code is properly dead and got pruned by the linker, it cannot cause any problems.
Yes it can cause you troubles, even if you don't link to it. Just having a vulnerability scanner (incorrectly) flag it can cause you numerous problems.
Say you distribute your application to a customer and link against libzip, and that customer points to the minizip 8.8 CVE above and says "if you don't fix this vulnerability our scanner is flagging, we are required to stop using your product", that'll cause you plenty of problems even though you don't use nor provide any way to reach the vulnerable code.
That sort of blind CVE adherence is so common in the industry that it's usually easier to do meaningless updates than fight back.
It hasn't even been formally approved by the cabinet. Right now it's just a political agreement between the coalition party. A law still has to be drafted that the cabinet can then submit to the Bundestag.
The slogan "Wer hat uns verraten? – Sozialdemokraten!" has a rather long history. Coined by communist during the 1918 November Revolution, it referenced the social democrats at least tentative support of the suppression of the communist revolution and the murder of Karl Liebknecht und Rosa Luxemburg.
During Weimar times it was popular with both right-wing and left-wing forces. The Nazis - who sent social democrats to the concentration camps - also used it in their propaganda.
As much as I disagree with many of the things today's social democrats say and do, it's worth remembering that this slogan was popularized and predominantly used by anti-democratic forces. It's not a particularly fair thing to throw around carelessly.
> 3- one or some of the domain owners, for example for fraser.name, acted as a registry themselves managing authoritative DNS servers for NS records of .fraser.name domains, these third level DNS servers being pointed to by the name. NS records.
There was no domain owner for fraser.name. Verisgn acted as the registry for fraser.name and allowed a registrar to directly register bob.fraser.name.
Before 2004 these third-level domains were the only way to register .name domains. It was the intended structure. See Wilipedia for an explanation: https://en.wikipedia.org/wiki/.name#Structure
reply