What about the rest of us? If somebody posts my car's pictures online and asks people to help them find me, the same tricks will work. It will be even quicker, because I will not even be expecting any sort of pursuit...
When police try to use these methods, we are full of "big brother" gloom. When "the mob" does it, we are cheering...
it might actually go to something useful. I know that is a longshot, but it has a greater than 0% chance, which is what you have with a big corporation.
a prospering corporation means better service (for you and me) and prospering share-holders (you and me);
once you realize, the government might spend the largesses on something stupid or even evil — making negative rather than zero outcome possible — your equation becomes even less convincing.
So some New Yorkers get to save money while other New Yorkers (especially the Mom and Pops) lose out on MORE money. That does indirectly affect New Yorkers too, since less money being made by businesses translates into less jobs, lower salaries, less benefits, etc.
The New York shops have their home state to blame — there is a good reason, why interstate commerce is the federal government's prerogative: out-of-state can not vote and thus can't influence the state's government. Thus laws in a locale, which affect people from other locales, are to be avoided and are only acceptable.
Nothing prevents New York shops from taking advantage of the situation "in reverse" and enjoy their advantage. The sales tax in Seattle, WA, where Amazon is headquartered is 9%....
Forcing a company to know local tax codes (some goes to state, some to the city, but sometimes there are "sales-tax free" days, but only on items under $120, etc. etc.) of their every customer is what's unfair.
You are right. In fact, the only "novelty" of this law, is that the retailers are obligated to collect the tax — and transfer the monies to NY. The sales tax itself always existed. The reason, out-of-state retailers weren't required to help the state collect it was that — for the retailers without physical presence in a state — it was deemed to be too much of a burden to follow that state's tax laws. It is the state's residents duty (widely shirked, of course) to report their out-of-state purchases to their home state, calculate and pay the appropriate taxes.
Now NY just wants to require (major) out-of-state retailers to familiarize themselves with the NYS' tax code and help it collect their taxes. I didn't think, they can enforce this requirement legally, so it would be interesting to follow...
......It's NOT FAIR. Although, I like the idea of getting away with not paying taxes and I have done it for years, it is not fair to local businesses.
You don't owe diddly squat to "local businesses" (or, to pick on another illiberal cliche, "mom and pop shops"). They exist to provide you with superior selection and/or service, and if they can't beat Amazon (or Walmart or whatever) — too bad. But if you really feel so guilty, do send them a check every time you buy something from their out-of-state competitor...
What makes them so dear to you, anyway? An incident of geography — that they happened to be located next to you? Why is the shop in your state any more deserving of your business, than the ones elsewhere? Do you also forget the old ones and make new friends, when you move — to keep your friendships "within a community"?
Which one do you want? Give the "taxes" to a corporation or to your local government where there is a small chance it might go towards something meaningful to you?
It is a no-brainer, really. To a corporation, of course. Especially, to a good one like FedEx (UPS is union-infested and DHL is government-owned)... According to the article, the State of New York is "deprived of $50mln per year". Guess, who is getting this money? New Yorkers, that's who... This is not even about getting Amazon to pay up (for something?) — it is simply to secure their cooperation in taxing New York residents.
Oh really? Even if I actually travel to Africa and personally hand out hot soup in the cities?
Yes, even then. By feeding their populace, you'll be freeing the warlords from having to concern themselves with, you know, governing the country. From providing the food, to education, to building and maintaining roads, all the way up to the monetary policy... You are likely one of the voices in the chorus condemning Bush for spending too much on Iraq "instead of helping social programs". Now imagine, if some uber-rich third party was helping our social programs, leaving Bush able to spend even more on "his wars"...
And then, of course, it would also be exceptionally stupid (and — without proper immunization — reckless) of you to spend your own time doing it, instead of hiring a local (for a minuscule fraction of your wage).
That said, you have shown enough stupidity in this thread to make me think, we'd all be better off (on balance), if you tried...
The best we have from a judge — just quoted in a different article-submission is:
It refers to itself as an Internet marketing company. Some, perhaps even a majority of people in this country, would call it a spammer.
Awesome, judge, let's leave the judging to the demos... "Community standards", anyone?
Heck, according to my Firefox (2.0.0.13, thank you very much) spell-checker, the very word "spammer" does not even exist — much less legally defined. (Well, the word "firefox" does not exist either, to be fair.)
There are few laws against the scumbags, and those that exist, are rather imperfect. The definitions boil down to the (in)famous, "I know it, when I see it," — from the earlier attempts to distinguish between pornography (obscene) and art/expression (Constitution-protected)...
Until all spammer can be persecuted for spamming itself, rather than some of them being prosecuted for other illegal activities helped by spamming, we aren't going to get very far...
The US could become a fuel exporting nation if we devote enough land to algae farming.
What about panicky "over-farming" reports like this one?
Also, vast algae-farming lakes will affect climates... I come from Kyiv, Ukraine, where weather became noticeably wetter over the decades after the huge lakes were created for giant hydro-electric stations...
Poor small companies like Google and the parent company of AdultFriendFinder.com
Some laws explicitly exclude companies with profits (or number of employees) below a certain level to allow small businesses to avoid some of the burdens.
Most laws, unfortunately, don't distinguish. What is intended to limit Google or AFF, ends up chilling everybody — including most small businesses, who never planned to abuse the customers' data in the first place, but now have to comply (and — worse — maintain proof of compliance) with yet another regulation.
Could they be in talks with, for example, the folks in charge of the education changes that will be coming with the changing of the guard from republican to democrat White House administrations?
They may well be... Teachers' Union endorsements don't come cheap.
Just yesterday, we were informed, that it may be illegal for Europeans to even use GMail, because that's exporting data "to a country that does not meet European standards for personal data protection".
What seems like a "big win for consumers" usually chills business — including (or especially) the small business — the kind without on-staff lawyers and lobbyists.
For example, I run my own mail-server — is it illegal for Europeans to contact me, because I can not (and would not) spend any time evaluating my data-protection standards for some bureaucrat?
The bigger point here is that all regulation is a headache, but public opinion, politicians, and "media" (Slashdot editors and users included) portray some regulation (which they approve of) favorably, while decrying the negative effects of the rest (without mentioning its benefits).
You mean something like parallel_sort in libstdc++, since GCC 4.3.0?
Uhm, yes, something like that... But it ought to be transparent to the caller — I just want to keep calling qsort() from my (portable) code and have it take advantage of the multiple CPUs, when available.
It should not be very hard... The algorithm begs for multi-threading — once you divide your array, you apply the same algorithm to the two parts, recursively. The parts can be sorted in parallel — this has a potential for huge performance gains implications in database servers (... ORDER BY...), etc.
A cybercriminal is a criminal, not an invading horde of huns.
There is a point, where quantity changes quality: a criminal becomes group of criminals, group turns into a gang, and gang — into a horde.
But yes, if you re-read my original posting in this thread, you'll see, that legal counter-attacks are what I'm recommending.
hackers, it shouldn't be difficult to get the local courts of their country of origin to deal with them
Foreign litigation is extremely difficult — on top of the regular hurdles associated with litigation (RIAA-cough-MPAA), you run into patriotism of the foreign country's inhabitants. It took two years to extradite three corrupt bankers from UK (a country with the closest ties to US)...
and if they're state-employed saboteurs, any damage you can cause their systems are trivially dealt with - computers are cheap.
See, here we are already discussing possible ways to retaliate... That's all the officer in the article is asking for (right now) — that we look into retaliation, rather than limit ourselves to pure battoning down of the hatches.
I don't need to buy a SAM, because my country's military (is supposed to) protect(s) me from foreign bombers. I hardly even lock my front door during the day, because my police keeps me safe from criminals. Why am I supposed to spend so much time and effort "securing" my computer?..
no actual tigers in the area and not due to the stone. Iraq has turned into a terrorist assembly line and Afganistan a vast source of opium to pay for it all.
The second sentence contradicts the first one...
As for changes at home - talk at the highest levels about how torturing people is OK, suspension of the rule of law in some cases for something a bit more Feudal and widespread hysteria awoken by things like advertising signs looks like a bit of a change.
Yes, a "bit" — hardly anything as substantial as even during the Vietnam War. Certainly far less than during WW2, which affected everyone, and even prior to which the President has allowed a foreign — not even American — secret government agency (British) to not only spy upon, not just torture, but to kill Americans suspected of collaborating with Germany (which was not officially our enemy yet). The country was quite anti-war then, and the President has promised to "never send American boys to die in foreign lands"...
Well, since the "insightful" war-artist managed to get us off-topic, let's continue. I think, you are too rash in granting him this assertion. The tactics is, in fact, working for US "recently" — in Iraq and Afghanistan. We took the war to the enemy and had no attacks on the American soil since. The assholes are fighting our military in the remote lands, while American civilians are able to continue to enjoy their lifestyles (almost) without changes.
The only sign, that the country is at war, are the yellow-stickers on bumpers. I say it worked, even if it could've been even better — some mistakes of the early stages of occupation are truly regrettable and lead to unneeded bloodshed and expense...
Oh, look, real war-artist teaching Slashdot wannabes... And failing.
Sorry, dear. Blasting the US and a not-so-hidden comparison with Nazi Germany of the 2nd World War may get you the "Insightful" moderations, but it is, in fact, off-topic and I will not bite.
The first rule of war is: don't go to war.
There is no question, whether or not to go to war with cyber-criminals — they have already gone to war with us. Every time a spam tries (successfully or not) to creep into your mailbox, every time your sshd logs a login attempt by "admin" or "fifi" — you are under attack. Way over half of the e-mail traffic is spam, and a vast number of web-servers are compromised. The war is ongoing — and we are suffering heavy losses, such as the ability to rely on e-mail — so save your preaching...
The second rule of war is if you have to go to war make yourself invulnerable before you attack.
No disagreement here. All we are discussing are the tactics — and I agree with the officer in the article, who thinks, active measures should be taken in addition to the purely defensive passive ones.
If all you do is defense, then eventually the enemy is likely to figure out, how to break you.
Attack is the best defense. You have to be able to retaliate. In "cyber" world this would mean some of the "hacking back", identifying him, putting him to jail, confiscating his computer, fining him.
This "active defense", however, is full of legal (and ethical) pitfalls and thus it is now wonder, the private companies are mostly sticking to passive defense. Private sector is also the main source of professionals for the government institutions, so those are quite conservative too.
Now we are seeing the military waking up to the problem... Indeed, if it is Ok to destroy a building, from which somebody is trying to kill you, why should we hesitate putting to jail someone trying to steal secrets and/or money?
Some asshole(s) took their dissatisfaction with the link in my sig to the University's administration... It being a university, rather than a commercial enterprise, I was merely forced to add an obvious disclaimer, that the views on the page are my own, rather than the school's...
Curiously, my request to see the complaint itself was denied on the ground, that there would be no way to preserve the anonymity of the complaining party(ies)... Any lawyers out there willing to file a FoIA-request on my behalf (the school is a government institution)?
These attempts to use the legal system and/or bureaucracy to shut the unpleasant views down are a welcome change from killing fellow country-men to make a point — as is happening in Iraq. But if anybody is hoping to score sympathy-points doing it, they are doing it all wrong...
Can you imagine driving to work one day and finding roads blocked because of a contract dispute?
Why, yes I can — the government-owned New York subway was gripped by just such a problem recently (in 2005). Millions of people were affected — getting to work was a nightmare...
In more Socialist countries (such as France) subway and other vital infrastructure is routinely shut down due to strikes (which are contract disputes between workers and employer). I was actually hit by such a strike myself — on that one week I was in Paris — and had to walk through the streets smelling of rotting garbage, because garbage collectors were on strike too — no kidding...
If people don't want to do their job for some reason, there is no way to force them. It was already illegal for New York transit to strike, but they did it anyway. For another example, when the policemen feel, they aren't treated nicely, they strike too. Although it is illegal for them to strike (obviously), you can not stop them from calling in sick (the special term is "Blue Flu"). For yet another example, flight controllers can't strike either, yet they had to make Reagan famous by striking — and disabling an even more important part of the country's (world's!) infrastructure...
* There's no standard repository for such packages on Windows and Mac. So all of the Win/Mac developers need a good place to get those libraries
So host the repository for them — you already do that anyway, if you bundle these things with your own app. But don't pessimize decent systems for the sake of Windoz (Macs have FreeBSD's ports system, BTW, so they should be fine).
* Many libraries don't come with build files for Win/Mac, and the upstream authors aren't interested.
Same as above — host the sources and the build files for these packages, but don't bundle them with your app.
* Many libraries use crappy build rules that aren't as portable as the main program
Same as above.
* Sometimes a patch or bug fix to the library is necessary for the program to run. Even if you submit it upstream, users with an earlier version installed get a broken application.
Provide a patch instead of the entire source of the 3rd party package. Be sure to reference the 3rd party's ticket-number, where your patch is being discussed. Implement a work-around if at all possible.
* Upstream authors sometimes release new versions that actually break old functionality - again, leading to a broken app. Sometimes it's better to stick with a previous known-good version.
You should try the hardest to update your application to move on to along with the changes. Falling back to the "previous known-good" is very seductive, but is wrong — the 3rd-party package will continue evolving, and you don't want to make (and subsequently maintain) your own fork. The longer you wait to catch up, the harder it will be... And you will have to maintain it, as problems — security holes in particular — arise...
You describe valid problems, but the bundling is not the solution... It is seductive, but it makes the long-run (much) worse for all concerned — including yourself...
You may think you are joking, but the maintainers of the FreeBSD's port of OpenOffice.org have in the past insisted on building their own version of gcc — just so that OO.o was built by the compiler they new as "good".
The asinine practice has since stopped, but the port named gcc-ooo is still here, and its description says:
GCC, the GNU Compiler Collection includes gcc, g++
for OpenOffice.org compilation
This port installs the various front ends as gcc-ooo, and g++-ooo
into the ${PREFIX}/bin directory.
WWW: http://gcc.gnu.org/
Slashdot Mirror
What about the rest of us? If somebody posts my car's pictures online and asks people to help them find me, the same tricks will work. It will be even quicker, because I will not even be expecting any sort of pursuit...
When police try to use these methods, we are full of "big brother" gloom. When "the mob" does it, we are cheering...
Forcing a company to know local tax codes (some goes to state, some to the city, but sometimes there are "sales-tax free" days, but only on items under $120, etc. etc.) of their every customer is what's unfair.
You are right. In fact, the only "novelty" of this law, is that the retailers are obligated to collect the tax — and transfer the monies to NY. The sales tax itself always existed. The reason, out-of-state retailers weren't required to help the state collect it was that — for the retailers without physical presence in a state — it was deemed to be too much of a burden to follow that state's tax laws. It is the state's residents duty (widely shirked, of course) to report their out-of-state purchases to their home state, calculate and pay the appropriate taxes.
Now NY just wants to require (major) out-of-state retailers to familiarize themselves with the NYS' tax code and help it collect their taxes. I didn't think, they can enforce this requirement legally, so it would be interesting to follow...
You don't owe diddly squat to "local businesses" (or, to pick on another illiberal cliche, "mom and pop shops"). They exist to provide you with superior selection and/or service, and if they can't beat Amazon (or Walmart or whatever) — too bad. But if you really feel so guilty, do send them a check every time you buy something from their out-of-state competitor...
What makes them so dear to you, anyway? An incident of geography — that they happened to be located next to you? Why is the shop in your state any more deserving of your business, than the ones elsewhere? Do you also forget the old ones and make new friends, when you move — to keep your friendships "within a community"?
It is a no-brainer, really. To a corporation, of course. Especially, to a good one like FedEx (UPS is union-infested and DHL is government-owned)... According to the article, the State of New York is "deprived of $50mln per year". Guess, who is getting this money? New Yorkers, that's who... This is not even about getting Amazon to pay up (for something?) — it is simply to secure their cooperation in taxing New York residents.
Yes, even then. By feeding their populace, you'll be freeing the warlords from having to concern themselves with, you know, governing the country. From providing the food, to education, to building and maintaining roads, all the way up to the monetary policy... You are likely one of the voices in the chorus condemning Bush for spending too much on Iraq "instead of helping social programs". Now imagine, if some uber-rich third party was helping our social programs, leaving Bush able to spend even more on "his wars"...
And then, of course, it would also be exceptionally stupid (and — without proper immunization — reckless) of you to spend your own time doing it, instead of hiring a local (for a minuscule fraction of your wage).
That said, you have shown enough stupidity in this thread to make me think, we'd all be better off (on balance), if you tried...
Terrific, judge! Let's leave it to the demos. If "some, perhaps even a majority of people" hate someone, he/she aren't entitled to their day in court.
The best we have from a judge — just quoted in a different article-submission is:
Awesome, judge, let's leave the judging to the demos... "Community standards", anyone?
Heck, according to my Firefox (2.0.0.13, thank you very much) spell-checker, the very word "spammer" does not even exist — much less legally defined. (Well, the word "firefox" does not exist either, to be fair.)
There are few laws against the scumbags, and those that exist, are rather imperfect. The definitions boil down to the (in)famous, "I know it, when I see it," — from the earlier attempts to distinguish between pornography (obscene) and art/expression (Constitution-protected)...
Until all spammer can be persecuted for spamming itself, rather than some of them being prosecuted for other illegal activities helped by spamming, we aren't going to get very far...
Who cares? It is all imaginary property anyway. Even the article's submitter does not believe in it...
What about panicky "over-farming" reports like this one?
Also, vast algae-farming lakes will affect climates... I come from Kyiv, Ukraine, where weather became noticeably wetter over the decades after the huge lakes were created for giant hydro-electric stations...
Some laws explicitly exclude companies with profits (or number of employees) below a certain level to allow small businesses to avoid some of the burdens.
Most laws, unfortunately, don't distinguish. What is intended to limit Google or AFF, ends up chilling everybody — including most small businesses, who never planned to abuse the customers' data in the first place, but now have to comply (and — worse — maintain proof of compliance) with yet another regulation.
They may well be... Teachers' Union endorsements don't come cheap.
Just yesterday, we were informed, that it may be illegal for Europeans to even use GMail, because that's exporting data "to a country that does not meet European standards for personal data protection".
What seems like a "big win for consumers" usually chills business — including (or especially) the small business — the kind without on-staff lawyers and lobbyists.
For example, I run my own mail-server — is it illegal for Europeans to contact me, because I can not (and would not) spend any time evaluating my data-protection standards for some bureaucrat?
The bigger point here is that all regulation is a headache, but public opinion, politicians, and "media" (Slashdot editors and users included) portray some regulation (which they approve of) favorably, while decrying the negative effects of the rest (without mentioning its benefits).
Uhm, maybe... Anything for C, though?
Uhm, yes, something like that... But it ought to be transparent to the caller — I just want to keep calling qsort() from my (portable) code and have it take advantage of the multiple CPUs, when available.
Even in 128Gb of memory? Even if the comparison function (qsort()'s last argument) takes a while to complete?
It should not be very hard... The algorithm begs for multi-threading — once you divide your array, you apply the same algorithm to the two parts, recursively. The parts can be sorted in parallel — this has a potential for huge performance gains implications in database servers (... ORDER BY ...), etc.
Anyone?
There is a point, where quantity changes quality: a criminal becomes group of criminals, group turns into a gang, and gang — into a horde.
But yes, if you re-read my original posting in this thread, you'll see, that legal counter-attacks are what I'm recommending.
Foreign litigation is extremely difficult — on top of the regular hurdles associated with litigation (RIAA-cough-MPAA), you run into patriotism of the foreign country's inhabitants. It took two years to extradite three corrupt bankers from UK (a country with the closest ties to US)...
See, here we are already discussing possible ways to retaliate... That's all the officer in the article is asking for (right now) — that we look into retaliation, rather than limit ourselves to pure battoning down of the hatches.
I don't need to buy a SAM, because my country's military (is supposed to) protect(s) me from foreign bombers. I hardly even lock my front door during the day, because my police keeps me safe from criminals. Why am I supposed to spend so much time and effort "securing" my computer?..
Repeating a fallacy in an obscure dialect only makes it more of a fallacy.
I don't know, what you are talking about...
The second sentence contradicts the first one...
Yes, a "bit" — hardly anything as substantial as even during the Vietnam War. Certainly far less than during WW2, which affected everyone, and even prior to which the President has allowed a foreign — not even American — secret government agency (British) to not only spy upon, not just torture, but to kill Americans suspected of collaborating with Germany (which was not officially our enemy yet). The country was quite anti-war then, and the President has promised to "never send American boys to die in foreign lands"...
Well, since the "insightful" war-artist managed to get us off-topic, let's continue. I think, you are too rash in granting him this assertion. The tactics is, in fact, working for US "recently" — in Iraq and Afghanistan. We took the war to the enemy and had no attacks on the American soil since. The assholes are fighting our military in the remote lands, while American civilians are able to continue to enjoy their lifestyles (almost) without changes.
The only sign, that the country is at war, are the yellow-stickers on bumpers. I say it worked, even if it could've been even better — some mistakes of the early stages of occupation are truly regrettable and lead to unneeded bloodshed and expense...
Oh, look, real war-artist teaching Slashdot wannabes... And failing.
Sorry, dear. Blasting the US and a not-so-hidden comparison with Nazi Germany of the 2nd World War may get you the "Insightful" moderations, but it is, in fact, off-topic and I will not bite.
There is no question, whether or not to go to war with cyber-criminals — they have already gone to war with us. Every time a spam tries (successfully or not) to creep into your mailbox, every time your sshd logs a login attempt by "admin" or "fifi" — you are under attack. Way over half of the e-mail traffic is spam, and a vast number of web-servers are compromised. The war is ongoing — and we are suffering heavy losses, such as the ability to rely on e-mail — so save your preaching...
No disagreement here. All we are discussing are the tactics — and I agree with the officer in the article, who thinks, active measures should be taken in addition to the purely defensive passive ones.
If all you do is defense, then eventually the enemy is likely to figure out, how to break you.
Attack is the best defense. You have to be able to retaliate. In "cyber" world this would mean some of the "hacking back", identifying him, putting him to jail, confiscating his computer, fining him.
This "active defense", however, is full of legal (and ethical) pitfalls and thus it is now wonder, the private companies are mostly sticking to passive defense. Private sector is also the main source of professionals for the government institutions, so those are quite conservative too.
Now we are seeing the military waking up to the problem... Indeed, if it is Ok to destroy a building, from which somebody is trying to kill you, why should we hesitate putting to jail someone trying to steal secrets and/or money?
Some asshole(s) took their dissatisfaction with the link in my sig to the University's administration... It being a university, rather than a commercial enterprise, I was merely forced to add an obvious disclaimer, that the views on the page are my own, rather than the school's...
Curiously, my request to see the complaint itself was denied on the ground, that there would be no way to preserve the anonymity of the complaining party(ies)... Any lawyers out there willing to file a FoIA-request on my behalf (the school is a government institution)?
These attempts to use the legal system and/or bureaucracy to shut the unpleasant views down are a welcome change from killing fellow country-men to make a point — as is happening in Iraq. But if anybody is hoping to score sympathy-points doing it, they are doing it all wrong...
Why, yes I can — the government-owned New York subway was gripped by just such a problem recently (in 2005). Millions of people were affected — getting to work was a nightmare...
In more Socialist countries (such as France) subway and other vital infrastructure is routinely shut down due to strikes (which are contract disputes between workers and employer). I was actually hit by such a strike myself — on that one week I was in Paris — and had to walk through the streets smelling of rotting garbage, because garbage collectors were on strike too — no kidding...
If people don't want to do their job for some reason, there is no way to force them. It was already illegal for New York transit to strike, but they did it anyway. For another example, when the policemen feel, they aren't treated nicely, they strike too. Although it is illegal for them to strike (obviously), you can not stop them from calling in sick (the special term is "Blue Flu"). For yet another example, flight controllers can't strike either, yet they had to make Reagan famous by striking — and disabling an even more important part of the country's (world's!) infrastructure...
These things will happen...
Yes, I do:
* There's no standard repository for such packages on Windows and Mac. So all of the Win/Mac developers need a good place to get those libraries So host the repository for them — you already do that anyway, if you bundle these things with your own app. But don't pessimize decent systems for the sake of Windoz (Macs have FreeBSD's ports system, BTW, so they should be fine). * Many libraries don't come with build files for Win/Mac, and the upstream authors aren't interested. Same as above — host the sources and the build files for these packages, but don't bundle them with your app. * Many libraries use crappy build rules that aren't as portable as the main program Same as above. * Sometimes a patch or bug fix to the library is necessary for the program to run. Even if you submit it upstream, users with an earlier version installed get a broken application. Provide a patch instead of the entire source of the 3rd party package. Be sure to reference the 3rd party's ticket-number, where your patch is being discussed. Implement a work-around if at all possible. * Upstream authors sometimes release new versions that actually break old functionality - again, leading to a broken app. Sometimes it's better to stick with a previous known-good version. You should try the hardest to update your application to move on to along with the changes. Falling back to the "previous known-good" is very seductive, but is wrong — the 3rd-party package will continue evolving, and you don't want to make (and subsequently maintain) your own fork. The longer you wait to catch up, the harder it will be... And you will have to maintain it, as problems — security holes in particular — arise...You describe valid problems, but the bundling is not the solution... It is seductive, but it makes the long-run (much) worse for all concerned — including yourself...
You may think you are joking, but the maintainers of the FreeBSD's port of OpenOffice.org have in the past insisted on building their own version of gcc — just so that OO.o was built by the compiler they new as "good".
The asinine practice has since stopped, but the port named gcc-ooo is still here, and its description says: