text:
16 Year Old Prodigy On Jay Z's New Album
16 Year Old Prodigy On Jay Z's New Album
She had already been producing beats from age 9 and won Canada's Battle of the Beatmakers in 2012 but featuring on Jay Z's new album 'Magna Carta Holy Grail' was pretty major step up for Ebona Oshunrinde. Speaking to MTV she said:
"I was at home one day looking for reggae samples for a while and I finally found this one that was crazy,"
"And I took it and I cut it up and I put it in the software FL Studio. I started building around it, adding 808s and the more I built, the more I knew what I wanted. After that, I knew I wanted to send it to Travi$ Scott."
Having a little look around the wunderkind's studio we can see some choice bits of gear including:
So even with a fairly minimal setup you can still produce tracks like this...

subset: commoncrawl


text:
Look for the green spanner at your local authorised bridgestone Select Auto Service store.
We can complete your scheduled log book service.
We won't stop until we're sure your brakes will stop you.
We'll take care of all your vehicle servicing.
Safety is paramount to everything we do.
With our packaged price servicing, we have all your needs covered.
It's important to keep your suspension system maintained.
Prolong the life of your tyre investment.
Looking for wheels & rims?
We've got you covered.
Providing total tyre supply and service for commercial fleet operators of passenger, light truck, truck and bus fleets.
Choose from the nearest stores or search by Suburb or Postcode to find a Bridgestone store.
With over 300 stores across Australia in Bridgestone's retail network there's sure to be a Bridgestone store near you.
Find your nearest Bridgestone dealer stocking Ironman 4x4 products.
Check out what our customers are saying about their Bridgestone experiences.
When you're weighing up the options of purchasing a franchise, one very important consideration is the power of the brand you're buying into.
When you buy 3 Bridgestone Ecopia, Potenza, Turanza Serenity Plus or Supercat tyres, you'll get the 4th tyre FREE!*
Offer ends 30 November while stocks last. *Conditions apply.
Helps you to get the most from your investment. Our expert maintenance and care will maximise the life of your next tyres.
It's never been easier to shop with 0% Interest Payment Plans.
Connect to your nearest store
At Bridgestone, we believe it's our responsibility to help ensure a healthy environment for current and future generations.
TGiat elecabo restota invendem ex erit id magnis coris ut molorem oluptat emporro verum es digenimin pa el is ium dis molor apitetur a dolore enihic to vendaectatur aut dolor sum incid qui aut verist aut quunt que prentem. Ic tention serumqui con nobitia quost, nulles aut ommodite velendi ostibus aut perupta que magnat.


text:
|Outside Columbarium
Similar to a mausoleum, a private or public structure that holds coffins, a columbarium is a structure that has niches or vaults to hold urns that contain cremains (cremated remains).
|Six-sided Columbarium
It may consist of a wall or ground structure built of stone, brick, granite, or marble. Or, it may be in a building where coffins and urns are placed in a comfortable environment with areas of reflection for family members to use when visiting.
|Roman Columbarium
|Roman Columba
Columbariums were first used by the Romans. The ashes of loved ones were put in ornate urns and placed in sacred underground chambers, which were decorated with frescos and mosaics. The word columbarium is from the Latin term columba which means, "dwelling place of the dove." A columba originally meant a sectional housing structure for doves and pigeons, what is now called a dovecote.
|Interior Columbarium
For hundreds of years, churches were the main places where columbariums were found. Many Catholic churches have columbariums located in them. The most favored locations for religious columbariums are within the church, or in church cemeteries.
|Resurrection Mausoleum & Columbarium
|Pickle Studio
One such columbarium is in the Midwest. The Resurrection Mausoleum and Columbarium in Justice, Illinois, was constructed in 1969. The Conrad Pickel Studio of Vero Beach, Florida, began work on the stained glass windows in the early 1960's. Over 22,000 square feet of faceted glass were used in the designs.
|Inside Resurrection
|Outside Resurrection
This site has become a major architectural landmark and its faceted glass walls are the largest glass installation in the world.
The Resurrection Mausoleum and Columbarium is located at 7201 Archer Avenue in the Chicago suburb of Justice. For more information phone (708) 449-6100 or visit http://www.catholiccemeterieschicago.org
|Buddhist Columbarium
Since ancient times, Buddhism has also allowed the ashes of the deceased to be placed in urns and deposited in columbariums. These structures may be attached to a Buddhist temple.
|Exterior Columbariium
|Mausoleum & Columbarium in Indianapolis
Now, public cemeteries and mausoleums have also added columbariums to their options. A columbarium may be a freestanding unit, or part of a large, public mausoleum.
|Inside Marble Niches
The structure may consist of an outdoor wall containing niches. Or may be inside a building constructed just for this purpose.
|For Urns & Caskets
Columbariums are also located in public mausoleums, built in walls, along side the vaults for coffins.
The cremation urns or boxes are usually a specific size and are placed inside the lined columbarium niche. The door is then closed and locked.
|Garden Wall Columbarium
Columbariums allow family members another option when burial of a loved one may be too costly, or too far removed from where they are. This lets the family "move" a loved one with them, if the need arises, yet still provides a special place where family and friends can remember and memorialize their loved one.
|Interior Columbarium
A columbarium does not require an in-earth burial, but instead, allows for the interment of a loved one in a structure, away from the elements. Most columbariums have seating available for the comfort of those who come to visit, and reflect. As our world becomes more populated, you will see the need for more columbariums. Will they eventually replace in-ground cemeteries? Only time will tell…
~ Joy


text:
Spurs-Rockets Preview
With Tony Parker back, the San Antonio Spurs appear to be in
much better shape as they continue their quest for the top seed in
the Western Conference.
Parker has also been a big reason why the Spurs have an
opportunity to wrap up their first four-game season sweep of the
Houston Rockets since 2005-06 on Sunday night.
Following his eight-game absence because of a sprained left
ankle, Parker finished with 22 points – including six in overtime –
to lead the Spurs to a 104-97 victory over Utah on Friday.
Parker was averaging 27.0 points on 53.4 percent and 7.9 assists
in eight games prior to his injury against the Kings on March
"The game got tight at the end in regulation and then in
overtime, and he was Tony Parker," said coach Gregg Popovich. "Like
I said, up until the time he got hurt, there wasn't a point guard
in the league playing better than Tony Parker."
The Spurs (53-16) are trying to hold off Oklahoma City for the
top spot in the West and begin a challenging portion of their
schedule on Sunday with five straight games against teams with
winning records.
Parker should be able to get the Spurs off to strong start as he
looks to carry them to a fifth straight win against the Rockets. He
recorded his first career triple-double with 27 points, 12 assists
and 12 rebounds in a 134-126 overtime victory in Houston on Dec. 10
and had 31 points and 10 assists in a 122-116 home win on Dec.
Parker also led the way with 17 points and seven assists in a
114-92 victory in San Antonio on Dec. 7.
Tim Duncan is playing like his old self heading into this
contest, averaging 25.5 points and 15.0 rebounds in his last
The Spurs have scored 123.3 per game – 18.9 above their season
average – and shot 54.7 percent from the field in the three
Houston, though, has been playing better defensively over its
season-long seven-game homestand. While the Rockets have allowed
102.4 points per game at home on the season, they've given up just
92.0 over their last five at the Toyota Center.
Houston claimed its 10th win in 12 home games with a 116-78
victory over Cleveland on Friday. The Rockets held the Cavaliers to
53 points over the final three quarters and 36.0 percent shooting
for the game.
Harden led the way with 20 points, Thomas Robinson had 15 off
the bench and Omer Asik added 13 and 11 rebounds for the Rockets,
who shot 57.1 percent.
"That was a big win for us, and now we've got an even bigger one
coming up Sunday," said forward Chandler Parsons, who also added
13 points.
Houston (38-31), which is battling Golden State for the sixth
seed in the West, opens a difficult stretch of its own with the
Spurs, Indiana, Memphis and the Los Angeles Clippers in its next
four games.
While Harden missed the meeting in Houston with a sprained right
ankle, he's totaled 62 points on 20-of-38 shooting in his two games
against the Spurs.
Jeremy Lin stepped up in Harden's absence and matched his career
high with 38 points in that December loss, but will have to bounce
back after tying his season low with four points on Friday.
The Rockets have averaged 111.3 points against the Spurs and a
league-best 110.1 on their home floor this season.


text: Pfew... it's a long time ago since I logged in on your site. A lot has happened since then. At the FIRA European Championship 2003 we became the fourth place. Then we went to the ICT Knowledge Congres where we were one of the top attractions. And a mont ago we went to the FIRA World Championship 2003 in Vienna. More news can be found on my new website. Ask me everything you want!


text:
20% off original gifts for original people. Use TODAYONLY
Do you Love To Cycle around Britain? I Do!
bike bradley wiggins britain british flag union jack bikes queen england english scotland wales bicycle national pride jubilee cycle cycling bicycles fixie fixed gear vintage retro racing race old tour messenger france team sky amsterdam lance armstrong cool grunge brompton sports vector raleigh schwinn wheels frame carbon fiber
отличная работа !!!
Thanks! I had to translate the message to understand it! Thanks
Awesome bike illustration!
Thanks for your comment!
Nice work!
Thanks! Did you see the one with the Australian flag? http://www.redbubble.com/people/andyscullion/wo...
Yeah I seen it. I'm from the UK though, just been living in OZ for the last 9 years! Great illustrations keep it up!
Thanks, i've had a quick look at yours and it looks great! Would you recommend the move to Oz?
Yeah defo give it a try if you get the chance. I live in Melbourne and it's a great city! Cheers
love it, great piece :-)
Thanks very much!
Cool! Good luck to Team GB today on the time trials… :D
Thanks! i've jsut had a quick look at your work, its great! i'm a fan! I see you sell on zazzle – which is better for sales redbubble or zazzle? Thanks
Thank you, very kind. :) Will Bubble mail you… the rest.
great work :)
Loading more work by Andy Scullion...
10% off
for joining the Redbubble mailing list
Receive exclusive deals and awesome artist news and content right to your inbox.
Free for your convenience.


text:
With online dating, Facebook, and a plethora of other high tech tools allowing us to connect, our love lives have quite literally gone digital. And judging from the number of live weddings and virtual "dinner dates" with celebs on Ustream, we're noticing the trend over here too. While we certainly don't condone virtual meetings in place of real live dates this Valentines day, maybe a quick live Valentine's day message to a friend who lives far away will be a little bit more original than a greeting card…
And just to show you that a live message on Ustream can be romantic, check out some of these lovelorn messages from different Ustreamers. We dare you not to fall in love 😉
Trey Songz puckers up for his fans… c'mon admit it, you totally kissed your computer screen. [clear here]
Austin Mahone serenades his "Mahomies" with his devastatingly romantic rendition of "Let Me Love You." [clear here]
Share a romantic dinner with Lil' Twist and Lil' Wayne. [clear here]
Ocho Cinco goes on a live date for his reality show, "The Ultimate Catch." [clear here]
Victoria's Secret Models talk Valentine's Day plans.
Finally, if your Valentine's Day is going to call for a breakup, you might want to hire Nicki Minaj to do it for you…


text:
Paying Cash For Your Birth Control? Here's How to Save
Thirty percent of women who use contraception in the United States use oral contraceptives. Add to this women who use birth control pills for other medical conditions (polycystic ovary syndrome, heavy menstrual periods, ovarian cysts, etc) and imagine the number of women who may now be forced to pay cash for these medications.
On June 30th the Supreme Court decided that for-profit companies cannot be compelled to provide insurance coverage for contraception if doing so violates the religious beliefs of the company's owners. See More


text:
DHS Secretary Janet Napolitano Tours Damage
Janet Napolitano, secretary of the U.S. Department of Homeland Security, toured the storm-damaged Cosey Beach section of East Haven Monday morning joined by an entourage of U.S. Senators and representatives, state legislators, mayors and FEMA officials. In this photo Napolitano, 2nd from left, walks along the beach with, left to right, East Haven Mayor April Capone, US Senator Richard Blumenthal, US Senator Joseph Lieberman , US Rep. Rosa DeLauro and Gov. Dannel Malloy, right. The secretary pledged the Federal government's help.
STEPHEN DUNN, Hartford Courant
Copyright © 2018, Hartford Courant


text:
Heat-Away™ 640 is a single-part, 100% solids, copper-filled, thermally conductive, silicone grease used in heat transfer applications from –60 to 550 ºF (-51 to 288 ºC). Heat-Away™ 640 is formulated as a thick paste that will not flow after application and the viscosity remains stable over the entire temperature range. The thermal conductivity is 4.68 W/m-K.
Heat-Away™ 640 is used to improve the thermal transfer between heaters and process vessels and various heat sinks used in heat exchangers in electrical and electronic applications. Heat-Away™ 640 is supplied in standard pint, quart, gallon and five gallon containers from stock.
Please contact Aremco's Technical Sales Department for more information about this advanced thermally conductive grease.


text:
Facebook has, until recently, been a place where you shout about what you are doing; whereby friends will invariably reply by shouting back:"I did this" or "I did that". However, with everyone wanting a piece of the BlackBerry BBM pie and Apple about to launch its own messaging service - iMessage - Facebook now wants you to use its social network as the place of choice when it comes to arranging that visit to the cinema or, more likely, the pub.
Facebook Messenger
- Format
- iOS
- Price
- Free
- Where
- iTunes
For iPhone customers the Facebook Messenger app is only available in the US iTunes store, and as yet is not available in the UK. That's likely to change of course, and playing with the US version we've seen nothing location specific to imply that it won't be coming to the UK. Still, at the time of writing, that's why you can't find it in the UK iTunes store if you look. It appears to be the same with the Android version too.
The app has been designed for the iPhone and the iPhone's 3.5-inch screen. It will work on the iPad, but it's not iPad friendly, which is disappointing - Facebook clearly didn't believe that you'd wanted to use the Apple tablet to message people.
Punch in your login details, and you're connected. The app runs in the background and you can opt to have notifications either turned on or off, to alert you when you do in fact get a message.
Taking the settings one step further you can set individual rules for conversations in question or all conversations in general.
Those rules are really about the alerts you get and it's a nice touch that they are time-specific, as well as just "yes to alerts" or "no to alerts".
That means you can say - "Alerts off for 1 hour" or "Alerts off until 8:00am". Sadly you can't change these timing options.
The boring settings out of the way, what of the messaging side of things? Signing in gives you a list of all the messages you've ever had with anyone on the main website Facebook Messenger. It's rather scary to know that the site has kept all these messages all this time (we were shown ones from over a year ago), but it does mean that you can pick up where you left off - "yes we really are over."
Clicking on the "compose message" icon gives you the message page and the ability to decide who to message. Start typing a friends name and the app automatically pulls in a list of people that match that letter/word from your Facebook contacts. Typing "Rich", for example, showed me that I had four friends called Richard and clicking on the right one brought that contact into the "To" box.
A quick message later and we were talking just like we would on the messaging service on Facebook - or BBM and iMessage (iOS 5) for that matter. A look at the Facebook website and the conversation has been recorded there too, giving you a fluid chat experience.
Aside from chat messages you can send your location, which the other person can then use to find you in the pub, as the app automatically loads in Google maps (which you have zooming control over). We expect it to be a handy feature.
With notifications on the iPhone about to get better thanks to iOS5 and an always-on status, this catapults Facebook into the messaging game 100 per cent.
Some will question why you need a dedicated messaging app, but having used it for the morning it's clear to see why. Facebook is trying to get you from just shouting about what you are doing, to becoming a service that allows you to arrange and organise what you are doing - that means more people using the service more of the time.
It also means that once you've arranged where to meet chances are you'll then use the full Facebook app to share what you did with your friends - thereby completing the circle.
The beauty is, unlike other messaging services, all your friends are likely to be there already.


text:
"The EEOC Consent Decree not only rights the wrongs against me, it also helps level the playing field for other disabled workers," said charging party David Mateski at the Chicago District Office.
EEOC Consent Decree with Printing Giant Requires Anti-Discrimination Policy for Temporary Employees and Training
CHICAGO - Judge Matthew Kennelly of the United States District Court for the Northern District of Illinois has entered a $150,000 Consent Decree resolving a case brought by the U.S. Equal Employment Opportunity Commission (EEOC) under Title I of the Americans with Disabilities Act of 1990 (ADA) against R.R. Donnelley & Sons (R.R. Donnelley), the commercial printing giant, on behalf of David Mateski, a paraplegic graphics technician who uses a wheel chair and who was filling a temporary position for the company.
The case arose after Mateski, who is a graduate of Southern Illinois University with a Bachelor's Degree in Commercial Graphics and an Associates Degree in Commercial Graphics Design, was hired through a temporary agency for a temporary position in the on-line services division at R.R. Donnelley in December of 1997. A few hours after Mateski arrived for his first day of work at the company's Elgin, Illinois, facility on January 8, 1998, he encountered a rare incontinence problem and was permitted to return home to deal with it. That afternoon, his R.R. Donnelley supervisor called the temporary agency and told the agency that Mateski could not come back to work. Mateski filed a Charge of Discrimination with the EEOC and the federal agency found reasonable cause to believe that R.R Donnelley had discriminated against Mateski because of his disability. After the EEOC's efforts to conciliate the case proved unsuccessful, the agency filed suit.
Pre-trial discovery in the case revealed that, although the company had written policies prohibiting disability discrimination, R.R. Donnelley had not trained the managers at its Elgin, Illinois, facility where Mateski worked.
In addition to providing for $150,000 in monetary relief to Mateski, the Consent Decree requires R.R. Donnelley to train all managers at the Elgin facility about disability discrimination and to ensure that all of the human resources personnel throughout its 31,000 employee operation have received such training. The Consent Decree also mandates that the company's anti-disability discrimination policies make specific mention of temporary employees, who may be unaware that they are entitled to the same protection from discrimination as permanent employees.
EEOC's Chicago Regional Attorney John C. Hendrickson explained, "This Consent Decree is an important one. It involves a major metropolitan Chicago area employer, it provides for a large award of monetary relief which is appropriate in this case, it makes clear that employers must train their personnel staff on implementing policies against discrimination, and it drives home the point that temporary employees are covered by federal law just like other employees."
Hendrickson continued, "EEOC had a very strong case here. What happened to Mr. Mateski was clearly wrong, and we were prepared to prove that at trial. EEOC expected a six-figure verdict, so we're pleased to have secured that and other relief on a faster track. We are also pleased that the Consent Decree as entered by the Court reflects the strength of our case and does not include any language supporting a denial of liability by R.R. Donnelley."
David Mateski, the charging party, said, "This was a job I really wanted and knew I could do. I knew what had happened to me was because of discrimination just as soon as it happened, and I decided not to let it pass. I'm glad I filed the charge with EEOC and I'm glad EEOC stuck with the case. The EEOC Consent Decree not only rights the wrong against me, it also helps to level the playing field for other disabled workers at Donnelley, and I'm proud of that."
The case was filed by the EEOC in the federal district court for the Northern District of Illinois in Chicago on June 6, 2001, and captioned EEOC v. R.R. Donnelley & Sons Company, Inc. The case number is 01 C 4218. The Consent Decree was signed by the Judge on December 13, 2002.
John Rowe, Director of the EEOC's Chicago District Office, said: "In addition to providing substantial monetary relief to Mr. Mateski, this settlement accomplishes something important for all R.R. Donnelley employees by providing for training and policy changes that will have a long-term positive impact on their workplace."
EEOC's Chicago Supervisory Trial Attorney Noelle Brennan concurred, noting that, "The Consent Decree assures that Donnelley will remain committed to equal opportunity for disabled employees whether in temporary or permanent positions."
"The settlement of this case reflects the commitment of both the EEOC and R.R. Donnelley to working together to achieve a result that benefits the workforce of as a whole," said EEOC's Chicago Trial Attorney Deborah Hamilton. "Something good came out of a gross error by the company."
Title I of the ADA prohibits private employers, state and local governments, employment agencies and labor unions from discriminating against qualified individuals with disabilities in job application procedures, hiring, discharge, advancement, compensation, job training and other terms and conditions of employment.
EEOC is the federal agency charged with the administration, interpretation and enforcement of Title VII of the Civil Rights Act of 1964, as amended, which prohibits employment discrimination based on race, color, religion, sex, pregnancy or national origin. The EEOC is also responsible for enforcing the Age Discrimination in Employment Act of 1967, as amended; the Equal Pay Act of 1963; and the Americans with Disabilities Act of 1990, which prohibits discrimination based on disability. More information about the EEOC and the laws it enforces can also be found online at http://www.eeoc.gov.
This page was last modified on December 16, 2002.
Return to Home Page


text:
Post game | 16-7 OU
Aaron Colvin with his mom after the game.
Blake Bell walking off the field into the tunnel.
Coach Stoops hands out game balls.
Post game prayer.
Coach Stoops shakes hands with WVU's coach after the game.
4th Quarter | 3:15 | 16-7 OU
The Belldozer
4th Quarter | 15:00 | 13-7 OU
4th Quarter about to begin!
3rd Quarter | 6:34 | 13-7 OU
Gabe Lynn celebrates his interception.
3rd Quarter | 9:16 | 13-7 OU
Brennan Clay running free from the WVU defense.
3rd Quarter | 12:24 | 13-7 OU
Defense running off after a stop.
2nd Quarter | :25 | 13-7 OU
Coach Norvell talks with Trevor Knight right before half.
2nd Quarter | 1:15 | 10-7 OU
Defense looks on.
2nd Quarter | 10:31 | 10-7 OU
Jordan Phillips recovers a fumble.
2nd Quarter | 13:35 | 10-7 OU
Team huddled around Trey Franks.
Trey Millard after scoring a touchdown.
1st Quarter | :30 | 7-3 WVU
Corey Nelson
1st Quarter | 11:30 | 0-0
Coach Mike Stoops talks to his D.
6:06 pm | Kick-Off
Running out of the tunnel
Play Like A Champion Today!
We are underway!
5:55 pm | 5m to Kick-Off
Pregame prayer
5:40 pm | 20m to Kick-Off
Almost time for kickoff!
Gabe Lynn
Sterling Shepard
Coach Stoops interacts with players as they stretch.
Sooners huddled at midfield.
5:02 pm | 58m to Kick-Off
Pregame warmups are underway!
Trey Millard and Bronson Irwin head out for warmups.
Coming out of the tunnel.
Trevor Knight
Running backs
Gabe Ikard focused on the game.
4:33 pm | 1h27m to Kick-Off
Sooners are preparing for kickoff.
Players getting taped.
Coach Boulware and Michael Hunnicutt.
Players stretching in the locker room.
Jordan Wade
Sooners preparing to take the field for warmups.
4:12 pm | 1h48m to Kick-Off
Bronson Irwin arrives at the stadium.
Brennan Clay
3:48 pm | 2h12m to Kick-Off
Tyrus Thompson and Robert Hollis loading the bus.
Sooners loading the bus to the stadium.
2:23 pm | 3h37m to Kick-Off
Sooners load up on thier pre-game meal.
2:10 pm | 3h50m to Kick-Off
Herbert Cooper of People's Church talks with the Sooners about dreaming big and keeping eyes on the dream despite adversity.
1:51 pm | 4h15m to Kick-Off
Sooners are beginning to stretch before the game while Coach Stoops overlooks.
1:38 pm | 4h28m to Kick-Off
Grissom shoots some hoops before the game.
1:00 pm | 5h6m to Kick-Off
It's snack time for the Sooners.
12:27 pm | 5h39m to Kick-Off
The Sooners are leaving walkthrough and heading back to the hotel.
12:13 pm | 5h53m to Kick-Off
The Sooners conduct walkthrough before the West Virginia game.
11:33 am | 6h33m to Kick-Off
Jalen Saunders and Jaz Reynolds in the locker room, and the defense with Mike Stoops continuing to study for tonight's test.
11:18 am | 6h48m to Kick-Off
Shannon, Colvin and Millard in the locker room.
11:11 am | 6h55m to Kick-Off
The Sooners gather in the locker room to catch a bit of the Miami-Florida game, and Jay Boulware takes special teams through some pregame information.
11:05 am | 7h01m to Kick-Off
The Sooners arrive at the Switzer Center for meetings and walk-through.
10:43 am | 7h23m to Kick-Off
Aaron Colvin boards the team bus from walk-through.
10:17 am | 7h49m to Kick-Off
Corey Nelson (top), Rashod Favors and the rest of the Sooners are grabbing breakfast at the team hotel.


text:
Watch The ::God Is Imaginary Videos On YouTube ::
Total Members Voted: 44
0 Members and 1 Guest are viewing this topic.
No. Absolutely not. In fact, I abhor torture. Even if I had someone like Hitler's fate in my hands, I might advocate death, but not torture.
Religions need books because they don't have gods.
Note that according to Paul and a large number of Christians, salvation is contingent ONLY on accepting Jesus as your savior
That is the problem with us. We have gone so far from self accountability that we dislocate our sense of moral obligation from the life we are living. Counting on "the blood" to absolve all faults. It makes it too easy to be a scumbag who attends church every week, flushing the weeks murders, rapes, pillages, abuses..etc in to oblivion.
Paul regularly, in almost every letter he writes, says those who continue to practice them will not taste the Kingdom of God
Quote from: muchlove on March 04, 2013, 05:47:17 PM Paul regularly, in almost every letter he writes, says those who continue to practice them will not taste the Kingdom of GodYou miss the point that there has to be a carrot of everlasting life in order for them to operate as a morally acceptable human being on this earth. Fail.
Now, Muchlove, we're speaking lately of "bad" Christians that accept Jesus and always go to church as a fail. Of course we need to define bad - how 'bout one rape, learning "good" deeds later? The levels of good and bad with the level of accepting Christ becomes ludicrous. In the view of christianity, it must come down to only the acceptance of the father, the son, and the holy spirit. Christians will be the first to say they continue to sin, and still have forgiven human failing, correct?
Honestly I wouldnt even make someone, for an hour, read that thread where Wayne is talking for like 40 pages. THAT is torture.


text:
Not everyone is upset with the Detroit Lions' Ndamukong Suh these days. The Bears' Amobi Okoye joined Suh -- who was ejected from Thursday's game against the Green Bay Packers for stomping on an opposing player -- during his night out in Chicago Friday.
Suh and Okoye had dinner at Chicago Cut Steakhouse and ordered the porterhouse steak and the bone-in rib eye steak, respectively.
Afterward, the two defensive tackles were spotted at Paris Club's upstairs lounge, Studio Paris. The NFL reportedly may force Suh to take anger management classes due to Thursday's incident, but I hear the Defensive Rookie of the Year was "nothing but nice" to Paris Club staff and patrons.
Heads up: Billy Corgan missed the debut of Resistance Pro on Friday due to the Smashing Pumpkins' tour in Europe, but he will be on hand when his independent wrestling promotion returns to Excalibur January 13.
On the record: "Most of these kidnapping cases don't turn out like mine. It makes you realize how amazing my story is and how lucky I am." - Northwestern football player Doug Bartels talks to the Tribune about getting kidnapped at 14 months old.
About this week: Oscar winner Forest Whitaker and Amobi Okoye will co-host the GEANCO Foundation's Health and Hope for Africa Concert Gala Saturday at the Museum of Science and Industry. … Former talk show host Regis Philbin will sign copies of his book, "How I Got This Way," at Wentz Concert Hall in Naperville Thursday. … The Bears' Lance Briggs will appear at Challenger Comics Saturday to accept comic book and graphic novel donations for his Briggs4Kidz Foundation and to promote his new comic book, "Seraph."
Sightings: Former "Friday Night Lights" star Zach Gilford and girlfriend Kiele Sanchez, who briefly played Nikki Fernandez on "Lost," dined at People Lounge in Wicker Park Wednesday. Filter lead singer Richard Patrick ate there Saturday. ... Rapper/producer Jermaine Dupri had dinner at Karyn's on Green in Greektown Friday while in town to DJ at Tantrik. … "American Idol" finalist Casey Abrams shopped at Trunk Club November 21. "Went to the coolest store ever and got some sweet threads," Abrams tweeted. "@TrunkClub supplied me some awesome stuff." … TNA wrestler Tara (real name Lisa Marie Varon) had lunch at Omega Restaurant & Bakery in Niles Sunday. "I highly recommend the Sweet and Sour Cabbage soup," Tara tweeted. ... Former "24" actress Marisol Nichols shopped at Sofia boutique in the Gold Coast Wednesday.
Twitter @aboutluisgomez


text:
Tapered Name Doilies
(1 reviews)
How do you like this product?
Share your thoughts with the Annie's community.
December 24, 2013
I love these beautiful heirloom style name doilies. I've looked at & collected many filet style patterns & although there are many out there, none but these really capture the grace & charm of these. I may like parts of other, more complex designs but these are perfect as is. Simple enough to work up quickly, yet with the understated elegance of a bygone era. And, although done in size 20 crochet thread-don't be intimidated. Once you're comfortable working with size 10 threads, there's little difference. You can also try one out in size 10 to get the feel of it, it'll just turn out a bit larger. Enjoy the stitching, and all the compliments when you're finished.


text:
Armedia Teams with Alfresco to Deliver Open Source Enterprise Content Management Seminar
Alfresco CTO John Newton to Drive Discussion on CMIS and the Future of Open Source ECM
London, UK & Atlanta, Ga. – May 27, 2009 – Alfresco Software Inc., the leader in open source enterprise content management (ECM), and ECM consulting and software company Armedia today announced that Alfresco CTO John Newton will be delivering the keynote address to kick off Armedia's one-day Open Source ECM Seminar, to be held June 9, 2009 at the Delta Airlines headquarters in Atlanta, Ga.
Tweet this: Alfresco News: #Alfresco CTO @johnnewton to Keynote Armedia's Open Source ECM Seminar http://bit.ly/11ovMY
In addition to providing content management products and services to customers across a number of industries, including finance, health care, transportation, technology and education, Armedia has established a unique focus and expertise in the government sector and maintains a strong foothold in the southeast region of the U.S. The company first partnered with Alfresco in 2007 and has strongly supported its efforts in driving open source ECM adoption.
"Our partnership with Alfresco has been critical to the growth of our business for the past several years, as the company provides the industry's best enterprise-scale open source ECM solution that is increasingly in demand and ideal for a range of customers, from smaller start-ups to global conglomerates," said Jim Nasr, CEO, Armedia. "We are very pleased our seminar will be highlighted by a presentation from Alfresco CTO John Newton, a true innovator and pioneer in both the ECM and open source industries who can provide attendees with not only a 'state of the industry,' but a glimpse into what lies ahead."
The Open Source ECM Seminar will include technology demonstrations and case studies detailing how Alfresco is different from Documentum™ and SharePoint™ and reveal the latest in document management, web content management and web 2.0 style collaboration. In addition, Newton's address will focus on Content Management Interoperability Services (CMIS), the proposed standard for content management, which is set to become as critical as SQL.
"Armedia has established itself as a key driver of technology and services in the ECM space, and its commitment to Alfresco has helped us continue to expand our integrations and deliver on the promise of open source in a number of new industries," said Newton. "This seminar is just another example of Armedia's dedication to its customers and to the open source community, and we look forward to working with them to educate customers about how open source and CMIS will become the foundation for building a new generation of content collaboration and social computing applications."
About Armedia, LLC
Armedia is a content management technology firm focused on enabling organizations to achieve success by maximizing the value of their content. Armedia's mission is to provide world-class solutions for clients to automate the creation, capture, organization and presentation of their intellectual assets. Armedia has offices in Georgia, Washington DC, Texas, and Florida. Armedia is a Veteran Owned 8(a)/SBD certified firm. For more information, please visit www.armedia.com.


text:
This is the second in a series of articles featured in "The Sky Is Not the Limit," a special tabloid produced for the University of Hawaiʻi Innovation Initiative. The full tabloid can be viewed in its entirety on the Honolulu Star-Advertiser website.
Research as an industry: The economic contribution of HI²
The University of Hawaiʻi is an excellent university, and its research is an important part of its contribution to Hawaiʻi's economy. The University of Hawaiʻi system includes 10 campuses and dozens of educational, training and research centers across the state.
UH Mānoa is one of the top research universities in the world. The 2012 Academic Ranking of World Universities places UH Mānoa among the top 54 to 67 schools in the United States, a category shared with the University of Virginia and ahead of Oregon State University, the University of Oregon and Notre Dame. UH Mānoa has also been very successful at securing lucrative federal research grants. A National Science Foundation report ranked UH Mānoa 51st among 689 public and private universities in federal R&D expenditures for fiscal year 2009. By comparison, the University of California Berkeley ranked 40th. This success comes from excellent faculty and staff at UH conducting cutting-edge research, advancing the frontiers of knowledge and being entrepreneurial in their quest for research funding. To not only remain competitive, but also to surpass other top schools, UH will need to continue to expand its research programs, and attract significantly more research funding.
The Hawaiʻi Innovation Initiative (HI²) is an effort led by University of Hawaiʻi President M.R.C. Greenwood to more than double the UH system's extramural (outside) research funding from the current level of less than $500 million to an ambitious $1 billion per year by 2022. To meet the HI² goals, the university will need to identify its strengths in fields of study that are well funded—particularly by federal agencies—and to attract top faculty who are adept at securing extramural resources in these areas. To that end, the university plans to hire or develop 50 top scientists over the next decade.
Hawaiʻi should be encouraged by the success that other regions have experienced. In many ways similar to modern-day Hawaiʻi, San Diego in the 1960s was viewed as isolated, ill positioned for industry growth, and restricted by a narrow economy, composed primarily of real estate, tourism and the military. Using UC San Diego as a leverage point proved to be a sound strategy; today San Diego boasts a gross regional product of $175 billion and a population of 3 million people. Approximately 14 percent of San Diego's economy is currently attributed to the research and technology industries, compared to only 3 percent in Hawaiʻi. The goal of HI² is to expand the research and technology portion of Hawaiʻi's economic pie over the next decade by strengthening areas of proven excellence (astronomy and space sciences, ocean and earth sciences, health sciences), enhancing emerging strengths (clean energy, new agriculture, cancer research, pharmacology) and building up new areas (informatics and cyber infrastructure, diabetes and obesity research).
Building on Proven Areas of Excellence, Targeting Emerging Sectors
The University of Hawaiʻi system has already made significant strides nurturing world-class research, especially in the areas of astronomy and space sciences, ocean and earth sciences, and health sciences. To get an idea of what a world-class principal investigator (PI) means, consider the current research-funding situation. Eleven PIs across four fields account for 30 percent of the UH system's extramural funding. Over the past two years, four fields have generated $248 million in research funding—$65 million (six PIs in energy), $62 million (13 PIs in ocean sciences), $55 million (11 PIs in biomedical sciences), and $66 million (three PIs in cyber infrastructure). Recruiting additional research leaders can therefore have a disproportionately large effect on overall funding levels. If this is true for existing areas of strength, similar potential exists in emerging areas of federal funding.
Technology Transfer
Technology transfer is an important way in which university research spills over into the broader economy. UH has struggled to effect high rates of technology transfer. An important goal of HI² is to advance the licensing and commercialization of UH research. There are several examples of research initiatives ripe for commercialization. For example, UH plans to be the first university in the world with dedicated rocket launch capability for satellites that are constructed and operated by its students and faculty. The Hawaiʻi Institute of Geophysics and Planetology, a research unit within UH Mānoa, receives approximately $15 million a year and plans to launch these satellites from the island of Kauaʻi next fall. The Institute already partners with optics labs on instrumentation, data analysis and software development, creating tremendous potential here for related technology transfer. In the College of Engineering, corrosion research for the U.S. Navy and advanced tsunami research have the potential to be commercialized and patented through accelerated technology transfer. Within the highly productive Institute for Astronomy, applied research currently accounts for only 10 percent of its $20-million to $30-million budget, and none of it is currently being commercialized.
Return on Investment: An Economic Analysis of HI²
While it is costly to recruit highly productive research scholars, the premise of HI² is that this investment will both pay for itself and produce increased economic activity in the form of extramural research expenditures, jobs, technology transfer and harder-to-quantify social benefits. The table here displays the net present value (NPV) and internal rate of return (IRR) for HI² under various assumptions about growth in extramural funds and the success of researchers. The baseline scenario assumes that each new PI costs $233,000/year plus a onetime startup cost of $1.2 million in laboratory equipment, research assistance and similar expenses. The incremental benefit from such hires is calculated as the difference between the total expected grant volume with and without HI², over and above the benefits accrued in past years. Based on the historical growth of federal R&D funds, we assume that the total existing grant volume will grow at a rate of 4 percent per year, and each new HI² PI will bring in an additional $1.5 million in annual extramural funds. These assumptions about PI costs and productivity are similar to some of UH Mānoa's recent high-profile recruits.
In the baseline scenario, the total grant volume grows to $737.6 million by FY2022, the NPV of HI² is $250.4 million, more than 13,000 jobs are attributed to the UH system's total research expenditures and the IRR for HI² is 96 percent. This is clearly an exceptional return on investment, and will result in more than 5,000 new jobs statewide.
Under our baseline assumptions, UH will not reach the ambitious goal of $1 billion of research funding in the 10-year period we considered. Reaching that goal is largely dependent on how successful PIs are in conducting research and in attracting extramural funds. Over the past five fiscal years, the top five PIs in the UH system have averaged almost $17 million per year in extramural funding. If UH is able to recruit 10 top research faculty that achieve this level of success, while the remaining 40 faculty in the HI² plan meet our baseline assumptions, then the target of $1 billion in funding can be reached in just over 10 years. Obviously, the success of HI² PIs and the actual growth of research funds are highly uncertain. The table "Economic Return Scenarios for HI²" displays several more-conservative scenarios. These scenarios result in lower, but still impressive, rates of return on investment.
Beyond the large, positive expected return on investment—as high as 96 percent in the best-case scenario—other benefits include thousands of new jobs created in the state, new discoveries, and the development of new support businesses
and opportunities. These additional benefits generate a win-win outcome for both UH and the state. Research activity requires support staff, equipment and materials, which, in turn, boost local businesses. Simultaneously, new businesses are nurtured by the Hawaiʻi research economy, and additional growth may result from technology transfer. In this way, the research industry amplifies investment into broader statewide benefits.
— This piece was contributed by the University of Hawaiʻi Economic Research Organization. UHERO principal investigators: Inna Cintina (assistant specialist), Kimberly Burnett (associate specialist), and Carl Bonham (UHERO executive director and professor of economics. Research assistance by: Christopher Wada (post-doctoral researcher), James Jones (economic research specialist), Atsushi Shibata (graduate research assistant), Ben Trevino (database manager), and Natalie Schack (graphic design support).


text:
It's time to open the SQL Server grab bag! This week I want to share a few informative tidbits related to SQL Server. Enjoy!
Have you ever really wanted to tell someone at Microsoft about the great new feature you'd like to see in SQL Server that would make it a killer product? (Not that it isn't already a killer product, of course!) Microsoft maintains a public email address at [email protected] for this purpose. I doubt that someone will respond directly to your email, but Microsoft swears these requests don't get dumped into a big black hole.
?Habla SQL? As a Most Valuable Professional (MVP) on the Microsoft newsgroups and a contributing editor for SQL Server Magazine, I receive tons of questions through email from around the world. Some questions are written in the mother tongue of the person looking for help. Usually, I can't help because I only speak English, which is why I find the Web site interesting. The site has a basic SQL Server 7.0 course written in Spanish. If you're aware of other Web sites that provide SQL Server information for non-English-speaking SQL Server professionals, send the URLs to me, and I promise to mention them in a future SQL Server Magazine UPDATE.
Microsoft recently launched the Microsoft Developer Network (MSDN) Online SQL Server Developer Center. Initially, I planned to share some of the best tips from the main page to whet your appetite, but I couldn't decide which tips were best because all the information was great. Of course, it's an indisputable fact that SQL Server Magazine is the most amazing and valuable collection of SQL Server information anywhere in the universe. With that said, the SQL Server Developer Center is definitely a URL for your favorites list.
Have you had a chance to browse the contents of SQL Server Insider? This is a monthly forum that queries internal Microsoft SQL Server experts about different aspects of the product. Recent topics include:
- The TerraServer Project Is Proving Ground for SQL Server 7.0 (http://www.microsoft.com/sql/productinfo/productinfo/insiderterraserver.htm)
- Two SQL Server Licensing Models Provide More Options (http://www.microsoft.com/sql/productinfo/productinfo/insiderlicensing.htm)
- English Query Helps Eliminate Report Creation Complexity (http://www.microsoft.com/sql/productinfo/insiderenglishquery.htm)
- Simplicity Is The New Watchword for SQL Server 7.0 (http://www.microsoft.com/sql/productinfo/insidersimplicity.htm)
- SQL Server 7.0 Security Melds With Microsoft Windows NT (http://www.microsoft.com/sql/productinfo/insidersecurity.htm)


text:
José Padilla is a Spanish voice actor who dubs Fozzie Bear into Castilian Spanish, for every project. He also twice dubbed Pepe the King Prawn, along with Dr. Phil Van Neuter in Muppets from Space and solo in It's a Very Merry Muppet Christmas Movie, and Pip from Bear in the Big Blue House (El Oso de la Casa Azul), amongst others.
Since 1995, Padilla has been the Castilian voice of Mickey Mouse. Other animation roles include Officer Barbrady and Terrence on South Park and several roles on The Simpsons, including Groundskeeper Willie, Principal Skinner, and the coyote from Homer's insanity pepper-fuled spiritual quest. Live action dub credits include Richard Belzer in Bonfire of the Vanities, Frank Sinatra in the re-dub of Suddenly, Patrick Duffy on Dallas, and Niles on Frasier.


text:
SHA-1 and DB IntegrityApril 24, 2005
Applying cryptographic functions for fun and profit.
I've got two books sitting on my desk, PHP and MySQL for Dynamic Web Sites by Larry Ullman which is absolutely fantastic for bringing yourself up to speed if you already have rudimentary programming skills in other languages (though it could stand for an update), and the PHP Cookbook, an O'Reilly book which (so far) seems like a good reference for getting beyond the basics.
So, any guess on what I've been working with lately? I've been running this site on a pretty basic PHP foundation for a while now, and by basic I mean aside from some PHP includes, passing a couple of variables from page to page, and a slightly more complex spaghetti mess of a comment preview page, there's not much PHP to be found here.
Relational databases, on the other hand, are an entirely new ball of wax. I've worked with people who use them. I've studied the flowcharts. I've formatted the data coming out of them. But I've never had to get my hands dirty before and actually make those connections myself. It's been an interesting learning process as I've put together an application I've needed for a while, which really is the best way to learn. Reading a book and not applying the knowledge immediately is a good way to ensure you don't retain it, I find. Anyway, on to the point of this article, which otherwise probably would have appeared out of left field if not for the above.
This is a particular problem I've run into. Up until recently, all user interaction with the database was limited to adding records. Aside from sloppy code, there were no real security risks to speak of. The new functionality I wanted to build would expose records for editing by the user, which is obviously problematic if the wrong people get access to them.
So the editing interface should be hidden behind a layer of verification. There are a few ways of going about this, a login form being the most obvious. Generating a username/password doesn't make much sense in this context though; the ideal solution would be just a simple text link to get back into the interface and retrieve the data, which requires a unique querystring. Luckily, the data they had previously submitted provides ample doses of uniqueness, so generating one isn't a problem. But this is also where the dilemma comes to light.
Let's assume the unique data in this case is their name. So 'Jane Smith' is told to re-enter the application with a URI like so:
Simple enough. Except guessing a different
returnID value isn't exactly difficult, so some records may potentially be exposed to the wrong people. Not good.
So it seemed the most effective way to fix this lay in using a cryptographic hash function like MD5 or SHA-1. (And yes, both have been broken by now, but collisions seem pretty much irrelevant when the hashes exist in a one-to-one relationship with only a few thousand records.) By running the name through the
sha1 function:
$hash = sha1("janesmith");
We get a value that makes guessing pretty much impossible:
But we're not quite done yet. The last step is actually verifying the hash once the user returns, and this poses a choice between two equally not-very-good options. First, we can check the hash against those of each record calculated on the fly:
$hash = $_GET['returnID'];
$query = "SELECT name FROM table";
$result = @mysql_query ($query);
if ($result) {
while ($row = mysql_fetch_array($result, MYSQL_NUM)) {
if ($hash == sha1($row[0])) $successfulReturn = true;
There's probably better syntax for that loop, but you get the idea. Presumably, though, this won't scale very well. I didn't bother testing, but I could easily imagine a few thousand dynamically-calculated SHA-1 hashes bogging down the server in a hurry.
So instead, storing a pre-calculated hash value for each record seems like a good way to ease up the load. Each new record inserted gets a value in the hash column, encoded with the
sha1 function of course. Verifying is now as easy as a straight up string compare:
$hash = $_GET['returnID'];
$query = "SELECT record_id FROM table WHERE hash='$hash'";
$result = @mysql_query ($query);
Due to SHA-1 hashes being 40 bytes, there are minor storage space issues, but considering 10,000 records only add up to 4MB, it's not worth obsessing over. It bothers me to have that dead weight for a somewhat minor function, but it's the best I came up with. I'd be curious to compare notes with anyone else who's grappled with similar problems — is SHA-1 overkill? Is there an easier way to do it that I've overlooked?
You could use DB functions. Something like: "…where sha1(name) = '$hash'". Saves you an entire column.
Also, you might want to check in $_GET["ReturnID"], to make sure it is an SHA1 hash and not additional SQL commands. A regular expression in PHP would do it.
Maybe you're already doing such a thing, but you only want your hash values stored in a single, user table. Just usernames, hashes and a record ID. Then you could just use the record ID as a foreign key to your data table. That way you don't have a bunch of 40-byte hashes that would become quite redundant in your data table.
I have no clue what your DB structure is, so what I just proposed could make no sense and also be completely irrelavent to your sccenario :)
You could also just hash up the record ID so that it can't be messed with for web form purposes, then just get the hash value (if you have a key/value pair) which would be the record ID. Then you wouldn't have any hashes actually stored in the database.
I think that you're overlooking the fact that anybody in the world can calculate a hash of "janesmith" & use it as a request ID. No matter how random the string looks, breaking this requires only one more step than guessing a username. You'd better concatenate it against some random data. But in that case you may as well just generate some random data to use as a request it.
Why don't you take the first part of the hash? For example, the first half, that way you'll have to store only half of the data.
IMHO, You should require the users to provide both a username and a password. The password is hashed once prior to being inserted in the DB when the user creates an account.
Test for a matching pair (username, hashed_password) to grant authentication.
Whichever way you choose to do this, the system is only as secure as the database is. Dave over at IloveJackDaniels.com as a nice article covering the security aspects http://www.ilovejackdaniels.com/php/writing-secure-php/
"Also, you might want to check in $_GET["ReturnID"], to make sure it is an SHA1 hash and not additional SQL commands."
Yep, for security's sake, I've done just that:
if ((strlen($hash) == 40) && (eregi('([a-f0-9]){40}', $hash))) {
do stuff;
"Maybe you're already doing such a thing, but you only want your hash values stored in a single, user table."
I probably do. I haven't actually done it that way, but I get the nagging feeling I should.
"I think that you're overlooking the fact that anybody in the world can calculate a hash of "janesmith" & use it as a request ID."
Nope. That was just an example, I'm using more obscure data then that. Yes, all you need to deduce is the source data, granted — but that's like saying to login to my Hotmail account, all you need to do is deduce my password. Any process is reversible in theory, it's the difficulty in practice that makes it tough.
"Why don't you take the first part of the hash? For example, the first half, that way you'll have to store only half of the data."
Not sure what that gets me other than a couple fewer wasted bytes.
Have you considered using a HMAC instead of storing the hashes?
If you hash something unique together with a secret and then put the unique thing and the hash in the query string, you can verify that the URL was generated by your script by doing the hash over again, and comparing with the one the client sent in.
Adding records to a database should be limited to those you want to allow to add records. If not, someone could easily run a denial of service attack by filling up any tables with numerical, auto incrementing primary keys. And that's just the start. If you haven't taint-checked your input, you could be allowing attackers to run arbitrary SQL commands.
To the problem at hand: if I were you, I'd store that information in a PHP session. Create a PHP session with the username in it, and use the session instead of a custom function.
Unhelpful PS: I hate PHP.
Oh! That PHP book is really great! The Oreilly reference book is kind of pointless since there is php.net.
Just a stupid question, how do you communicate the link in the first place?
If I were a user of your application and I didn't bookmark the link (or save the email), how do I get back in ?
"Adding records to a database should be limited to those you want to allow to add records."
The users don't actually write SQL you know, they're filling out forms and my PHP handles the rest. Or is this what you mean? Arbitrary users shouldn't be filling out forms? Kind of hard to build an application that way.
"How do you communicate the link in the first place?"
Email. It's a one-time only thing. If they don't save the email, they have to re-submit the previous data. (Trust me, I want it this way.)
Its so funny when I saw this post because I have just finished Ullmans book and it was the best one I found on php. The best thing was that it was cheap…the companion site rocks too.
What led me here was I picked up your zen of css design book today…funny how the world turns… I already have my backend built and now working on the design and it seems you have gone the other way! Right on!
I'm in the midst of releasing a free blogging site featuring its own backend site management and database system. This way people can use my designs without knowing a lick of html,css,database,etc. and customize it to their liking.
Maybe I missed something, but it really sounds like you're going about this using "security through obscurity". While it's a great mantra for security pedantics to chant, it actually does have some real-world applicability.
Just as an example, what if someone managing these records clicks an external link to another site? The other site now has a referrer log of the hash used to get into managing that record.
You should be able to have anyone find out the URL (querystring included) of a management page without being worried about them getting in if they are not supposed to.
I'm having a hard time trying to figure out exactly what you want to do. Which makes a little harder to offer a solution. :)
So, let me get this straight… you want to send an e-mail to a user with a URL that uniquely identifies that person. There would be no login and any time they want to access this special URL just for them, they just click on the link. Is that correct? If so, then it seems like an MD5 of SHA-1 hash should be sent to the user AND stored in the database. That way, your SQL and subsequent PHP become very straightforward as you only need to check if the record exists. Looping through all records to perform a hash is certainly a more time-consuming process. The only difference between sending the hash and sending the user's name is guessability.
Wow, someone mentioned SQL-injection by the second comment. I was thinking of that as I was reading the article…
As a coder first and designer second, I'm really amazed at the wealth of knowledge in the php.net documentation. Highly detailed explanations of all the core commands, plus heaps of user-submitted commentary.
With regards to the situation you're describing, I can't completely picture it, but perhaps you could avoid having all these edit hashes just sitting there indefinitely? How about if the author wants to edit something, they click a button which emails then a new login-url (hash server time) which is then only valid for half an hour… something like that. This way the hashes are tied to user sessions, rather than to individual records.
"Just as an example, what if someone managing these records clicks an external link to another site?"
In a general sense, you're absolutely right — a URL that allows editing of database records without further qualification is a bad idea.
It just occured to me that it would probably help to explain that this particular interface is time limited. It's only ever triggered if an error occurs. It's a way of saying, hey, you screwed up, fix your data. When the user fixes it, a flag is set and the link dies. You can no longer edit the data with the original link.
If this feature were to encompass wider activities, I'd certainly consider a login. But because it's very limited in scope, and only a handful of users will ever have this kind of exposure to the management interface, and ultimately the link expires anyway, it seems like a reasonable solution.
Ah, with that explanation then I'd go with Mike's (c:16) solution. Have the hashes set to expire.
What David Barrett was trying to say, is that users *can* use SQL injection techniques to harm your database. If you do not do some kind of find/replace to get rid of harmful characters, a user could write their way out of the data value and into your SQL statement.
While SQL Injection is well beyond the scope of this discussion, it's easy to fix and there is quite a lot of information about it out there.
From the looks of it, you may have opened a can of worms here. Everybody with any database experience is going to tell you what you *need* to do ;)
"Perhaps you could avoid having all these edit hashes just sitting there indefinitely?"
I think I've accomplished this too, in a more round-about way. The script actually checks two separate variables before ever displaying the edit interface; one is the hash, the other is a status variable that is only set when the original error notification email went out. So if both are true, then display the form.
Ultimately, it's my belief that by doing it like this, it's impossible (or at least not possible in the context we're considering now) to compromise data other than any error data sitting in the queue. Since this will usually be a small number of records, and it's bad data anyway, I'm not overly worried about it. Have I covered all my bases?
Of the two approaches you detail in this entry, the second one is probably preferable, since it doesn't require looping over the entire database in your script. (It would be better to let MySQL handle that sort of thing.) You should not be concerned about the space taken up by the hashes, at least as the common method of storing passwords would have it – you probably know that in most applications, passwords are stored in some kind of hashed or obfuscated form, in case someone who shouldn't should gain access to them.
I was about to second the comment about instead programming more and doing a username/password sort of thing, but if you're not concerned about people snapping up your referrers or users having problems getting the hashes correct, and the page they authenticate isn't used for all that much or for all that long, then this is probably the way to go. Anything else introduces complexity you might not need.
This approach, using a 'token' for security, is used elsewhere, where more complex security isn't possible – the Basecamp project management application does this to create 'private' RSS feeds.
"If you do not do some kind of find/replace to get rid of harmful characters, a user could write their way out of the data value and into your SQL statement."
Then this is true of any form data that eventually forms part of an SQL query, right?
I just got to that chapter. :D
A comment was raised stating that anyone could "calculate" the SHA1 of "janesmith" but, I don't know if it helps, I have heard of a method whereby you "salt" the hash. Salt is a piece of text that is kept secret. The salt is added to the string such as "janesmith" + "salt" = "janesmithsalt". Although it may be possible in some circumstances to guess "janesmith" from the context, the salt would be virtually random (it is consistent all of the time but itself appears to be random). Therefore, the "hacker" would need not only "janesmith" but also the salt. I am certain that there are good resources out there that explain this process better than I have.
"I have heard of a method whereby you "salt" the hash"
Yep, I definitely could have taken that route for extra security. I could mix and match their data too, for that matter. name + age, birth year + street address + last name, etc. etc.
I'm not so worried about the actual source data in this case since it's unique and non-obvious enough. But salt would definitely be the way to go were that not the case.
For those interested in the security implications of SQL injection, this is an excellent read:
PHP's default behaviour is to automatically 'escape' any single quotes that arrive through $_POST or $_GET. However, between encoding characters and multiple-encoding and Lord knows what else, the safest thing is exactly what you've got: Only allow what you're expecting, rather than filtering what you consider dangerous.
Typically, 99% of webform fields shouldn't have anything going into them except letters, numbers, whitespace, and a very limited set of punctuation (don't give 'em the ampersand or semicolon or backslash unless you're sure they'll need them for legitimate data).
Re: SQL Injection…
I don't know if I would condone limiting the number of available characters, there will undoubtedly arise a situation where a visitor will want to use said character for legitimate reasons.
Just delimit the characters you need to and forget about it. This should be performed on every single free-form text field that is inserted into the database.
Since I'm from a SQL Server/Access background, the character to watch for is the single quote ( ' ). All you do is replace it with two single quotes in a row ( " )when it comes time to insert/update data. It's simple and doesn't limit the visitor, since not allowing a single quote would be mean.
That should be two single quotes in a row, not one double quote. Just to clarify.
BTW, what's up with the "Remember me" feature? It never seems to work for me.
3/4 of the way through the article I linked, it talks about doubling quotes, and how that's not secure at all.
I'd typed up a fancy little comment explaining it, but some combination of the quotes and escaping threw MT's Perl script, and I got a bunch of errors trying to preview it. Anyhow, it's there in the article.
(Sorry to hijack the conversation, Dave…)
Thanks Mike, didn't realize that you could escape the single quote with a backslash (guess I'm a naive fool, as the article says). I've never heard of using the backslash as a delimiter in SQL Server/Access, maybe that technique only applies to MySQL.
I would use a username or userid, in combination with part of a hash.
$salt = 'some extra padding, difficult to guess';
$string = md5($username . $salt);
$string = substr($string,5,5);
Which gives a 5 character long part of an md5 hash.
Get the records from a database where userid == $userid and secretString == $string.
Hope this helps. ;-)
Jarra, you don't need to store the "secret string". Here's what I do to get RSS links off of my webapp that go to feeds for a logged-in user (so that the permissions and preferences of the web app also apply to the RSS feeds):
When I want to sent out a pre-authenticated link (that is, I want someone who comes in using that link to be treated as logged in as a user without having to specify username or password), I append two things: a username and a hash. These are sent as the query parameters auth-user and auth-code. The hash is calculated by concatenating the URL (up to and including the auth-user parameter, but before appending anything about the hash), and a secret key (a bunch of random data that never leaves the server). The hash is appended as a query parameter, leading to a URL like http://app.example.com/rss?auth-user=magnus&auth-code=123eba3c12
When my webapp receives a link with the auth-user and auth-code parameters set, it first strips off the auth-code part, and then appends the secret key, and hashes that. If the hash is equal to the value that was sent in as auth-code, then the link must have been generated by my server (since nothing else has access to the secret key). I therefore trust it, and log the user in as the user specified by auth-user. Since the username was part of the URL that was hashed, users cannot replace the username without the hash being invalidated.
This method can of course be extended to include expiry times, functionality subsets and what-not, all apended as auth-* parameters that are added before hashing - so all the information of how the link may be used is in plain-text, and none of it can change without the link being invalidated.
You don't need to use a hash function here. You're just treating the hash output as random data. If what you want is simply a unique, hard-to-guess identifier, then just use a bunch of random data (if you're on UNIX, the 'uuidgen' program is an easy way to do this). You can store it in the database like you're storing the hash output now.
You would use a hash if you wanted someone else to be able to compute the same hash value using the same source data. For example, pretend you and your friend both had a copy of some secret data, and you wanted to be sure they matched. You don't want to send the secret data itself over insecure channels, but if you sent the hash instead and the hashes matched, you could be reasonably sure that you have the same data.
So can we now edit our comments?
I shudder every time I see inline SQL like in your example. Please, oh please, use stored procedures, otherwise you are plain asking for SQL injection attacks etc.
There is absolutely no, I repeat, no excuse for including inline SQL in code in this day and age.
@Magnus: Yes, it would indeed be a better way to do it like that.
(Just woke up when I posted my comment ;-p )
I just re-read the article, and for the sake of completeness, I'd like to add the way I did these things in the past, too.
In a webapp where we e-mailed out links to users where they could track support questions, we had a table that mapped randomly generated values to the ID of the support question. The links we sent out only contained the random value in the query section, and we purged the table now and then. No need for any hashes or other clever tricks.
This is, I believe, the standard way of doing these things, and I'd be surprised if the usual form sign-up schemes used anythingelse when doing email address verification.
If I'd do it over again, I'd use the auth-user+auth-code way (as described above), though.
I don't know if I am the only one who noticed this but what if a malicious user provided bad data on purpose, just to gain access to the backend? Then the user would have a valid login (temporary, true, but he/she could do it as many times as needed) and access to the DB. Then there would be lots of bad things that could be done, most minor of which is SQL injection. You can easily take care of injection, however other problems inherent with database access are not so easy to take care of.
This is, however, a prickly problem and I don't believe there is an actual solution… The only thing you could really do is use the php-generated text-as-image method so that when the user clicks the link he has to enter the text he sees in the image to get access. This prevents hammering and bots, which is at least half of the problem.
This does not stop a determined user, but then again, nothing does.
Dave, you can also use the microtime() function to help randomize the value. That way, you won't have to worry about 2 users getting the same string. Combining it with the salt method is even better.
Preventing attackers from getting a valid session is the main purpose for having these checks. With sufficiently large values for the authentication data (be it a random number, a hash, or something else), these attacks can be made impossible.
To find out how large numbers you need, multiply your severer bandwidth with the duration that a sustained attack can be expected to last, and divide by the size of the smallest possible request that would make the server tell whether the attack worked or not. Then make that number a few times larger, and you have the max.
For instance, if you have a 100Mb/s link, and the smallest possible HTTP requests that would get your authorization scheme to reply is 24 bytes and an attack may go unnoticed for a week, then you need numbers up to 45 000 000 000 (<2^36) times a safety factor. So, a 40-bit value (e.g. 10 hex digits) would probably suffice.
Sorry, the example was wrong. The value is for a 24-hour attack.
The salt has to be quite random, and should be protected as much as possible. It can't be anything related to other user information, although you can use the other information on top of that, such as email address, to ensure uniqueness. Don't lose your secret salt or all your sent links will be unrecoverable duds.
Don't forget to separate your values with a delimiter, for example jane:doe:email@example.com:saltyramdomstring to avoid edge cases where two similar names/email addresses, etc, could merge together to equal the same string for different users.
You don't have to store this information in the database, since it can be calculated on the fly, however the process of creating an SHA1 hash is quite CPU-intensive (try making 100,000 of them real fast). So depending how well you want to scale both on the email send event and the click through handler, you might want to go ahead and store the hash.
In case it wasn't clear, the same random salt string is used for every record typically. Think of it as a randomly generated password used for all your hashes.
small note: Consider changing the regular expression to ^[a-f0-9]{40}$. the caret and dollar sign require the beginning and end of the string. Otherwise you are only verifying that a 40 char sequence is IN the given string.
"a few thousand dynamically-calculated SHA-1 hashes bogging down the server"
I don't really believe that… SHA1-ing a string as short as "janesmith". Even my old 3.5MHz 8-bit MSX computer can do that 300 times per second. On current 32-bit gigahertz machines, I can't imagine it will be an issue.
Concerning storing your hashes inside the database: I've always thought that since storage inevitably gets bigger and cheaper, storing the results of system intensive processes is always favourable to recalculating them on the fly, when building a scaling application.
Magnus: An easier scheme would be to simply log every failed attempt, timestamp it, and save the source IP (don't bother with browser signature – that's too easy to spoof).
Then when a new login attempt comes through, you can check to see if there's been more than, say, 5 failures from that IP in the last 12 hours. If so, deny them access.
It's hard to provide further commentary without specific knowledge of what the task being accomplished is (sure does sound like comment editing, which Mr. Brill already has working), but there's lots of good ideas in this discussion thread.
Tim: I agree with your position on this. Small redundancies in the data is far better than dynamic calculations on every query – that's whole theory behind caching. For a completely over-simplified look at the issue, ask if you'd rather pay to double your storage space or your computational power?
If you only have 10.000 records would it not be possible to just use half or even a smaller part of returned the SHA string without adding too much risk of getting similar hash codes.
I'm not sure why you're bothing to store what is basically session data into the database, just so your users can return and chug happily away at their data. Why not just create a cookie with the session_* functions in PHP and authenticate based on those cookies?
Mike Purvis:
I don't think logging IP addresses is viable since many ISPs use proxies. For example, AOL (shudder!) and university computer labs. You would possibly lockout legitimate users.
It's rather ironic for me to come across this article, since I am also tackling similar issues. Here's something I came across which is a good read whether or not it's helpful with your problem:
Jon, you can absolutely use less than the standard 160 bits. Since there is no need to protect against birthday paradox attacks, 10.000 times a safey factor would be enough to prevent both collisions and random guessing.
You can safely truncate the hash to something manageable. As per the calculation above, 40 bits should be enough for most uses.
Bruce, Mark: I'd advocate prepared statements over stored procedures since there's larger support for them. Basically, rather than executing a single string 'The Query', you call a prepare function which gets the query ready to go, but for every place where there's a variable you need to insert, you just fill in a placeholder. Then when it's time to actually run the query, you give the DB engine an array of values to populate the empty holes with.
Anit: You'd only be logging *failed* entrances as a way of clamping down on brute-force attacks. Sure, someone who knew what they were doing could go through proxies to mix it up a little, but as a first step it's a start.
Elliott: I think it's so that they can come back and edit something after a period of time has passed. (similar to the way craigslist operates)
dave, your approach is susceptible to man-in-the-middle attacks. a proxy could intercept your request, authenticate on behalf of the user, and do all sorts of nastiness. SSL is the usual solution to this problem.
i think for your application, the one-time-password and SSL would be a good combination. it all depends on what kinds of threats you're willing to implement countermeasures for. :)
40 bytes considering 10,000 records are almost 400 KB, not 4 MB.
Mike, what do you mean by stored procedures over inline SQL? I've never heard of stored procedures, so I'm curious.
I see what you're getting at here Dave, editable comments. I am
wondering if that's what you're really up to or if you are working on
some other project?
You may want to check out the editable comments feature over at my site:
Once you submit a comment, you will notice a link by your name that
says "Edit Comment". You can only edit your comment one time, then the
link is gone forever (sounds like the same approach your are taking).
I'm using session variables to store the data, that way I don't have
to worry about people hacking the URL to edit somebody else's comment
or something to that effect.
What do you think?
I have no idea why that comment turned out so weird looking, I certainly didn't type it that way. If only you had editable comments :)
"Adding records to a database should be limited to those you want to allow to add records."
Dave Shea:
The users don't actually write SQL you know, they're filling out forms and my PHP handles the rest. Or is this what you mean? Arbitrary users shouldn't be filling out forms? Kind of hard to build an application that way.
What I'm saying is this: you have an application running that allows people to add records to a database, by filling out a form.
By reading your desription of the application, I get the impression that if you just know the URL of the app, you can get to this form and through this add records. It wasn't clear if this was a public app or not.*
If you're running a public app, this is fine. Right now, I'm adding a record to the comment table of your database. There's still security implications to worry about, ones that you can't just ignore. If MovableType was poorly written, then someone could type some fragments of SQL into your comments form and run an SQL injection attack. Seriously muck with your site.
Even if the app is public, and only allows the adding of records, you STILL need to consider security. Taint check that input. Assume that each field contains a SQL injection attack. Assume that there's a script out there trying to fill your database with crap (like a spambot would) as fast as your webserver can handle it. Find the holes in your defenses and plug them.
If the app isn't supposed to be public, you should make sure it isn't public.
When I said you should limit who should be allowed to add records: say you have a group of users who you want to be able to add records to the database. Now, I'm pretty sure I'm not in this group. Therefore, you probably don't want me adding stuff to your database… and if it's not a public app, I shouldn't be able to.
You linked to an article on writing secure PHP. Point number 1 is the most important lesson you can learn. Legitimate users may not be writing SQL, but that doesn't mean other people aren't :)
* Perhaps mistakenly, I assumed you were talking about a private app.
I'm more into server side dev than client side (and that's the reason why I read your blog, to improve my poor skills). What I can tell you is that your app, as you described it above, is highly unsecure. As it was stated above, if I can guess the name of one of your users, it's easy to calculate a few hashes for this name (md5 and sha1 being the most popular) and use the result in the query string.
If people are going to manipulate personal data, you don't have many options: you'll end up with an auth system based on session and/or cookie management.
Here is an excellent link to get the basic idea of such an auth system (you will need to understand the basic of OOP though):
I highly recommend the reading of the two volumes of the PHP anthology to anyone willing to improve his/her skills.
George Shlossnagle, in his book "Advanced PHP Programming", has also some excellent thoughts on authentication (even though it's more complicated to understand, as the title let you guess).
If you don't feel like reinventing the wheel, PEAR has some already built auth system that are excellent (even though installing PEAR can be a pain in the neck).
Good luck Dave.
I've come across problems similar to this before. The argument of storing the hash in the table or calculating it each time keeps cropping up, but most of the time I can rely on the fact I know approximately how many people will be using the application at one time so I know that the server can cope (closed systems).
I can't see a way of getting around either storing the hash or calculating it each time and I'd strongly recommend against PHP's built-in session management, I can't see how this would solve the problem either as it would just shift the data to the servers hard drive instead of the database.
It's better to use built-in routines than writing your own. Much as I dislike PHP as a language, there's no point in reinventing the wheel.
If PHP sessions offer you everything you need, you should use that instead of coming up with your own way of doings things, because chances are you'll do a worse job than the language developers.
This method of not logging in leaves you with no choice other then for the client to either have a completely random hash stored and given to them secretly, or just using a password for their link. If you give them a password feild then they can do requestId=mypassword , because if sombody is trying to get data from a certain person, i'm sure it woulden't be hard to find things like street addresses, and it would be very easy to just use their name, chances are they already know it.
someone said that PHP automatically escapes $_GET and $_POST, this is only true if magic_quotes_runtime is set to 1.
that's like saying php is immune to SQL injection, which is certanly isn't. simply escaping certain characters isn't going to stop SQL injection.
From my understanding, some of the best practices, in no particular order, used to prevent SQL Injection are:
(a) Type-caste input variables
(b) Use regex to filter data
(c) Single-quote all variables in sql statements
(d) Escape quotes using mysql_real_escape_string (php version > 4.3) for input strings
e) Best to turn off all 3 magic_quotes settings in php.ini or at runtime since quotes are not the only thing coders should be escaping
(f) Log anything out of the ordinary
None of these steps by themselves can prevent SQL Injection. By this method, you can avoid using addslashes and stripslashes since they are not as robust as the alternatives. If I've missed anything or need to be corrected, feel free to correct or update this.
Sorry, "type-caste"ing is available to Untouchables as well.
*correction: type-cast input variables
I couldn't post this normally so I put it up on my server.
PHP Security Consortium has put together a great read about PHP security. You can find it here:


text:
Friday, February 10, 2012
Grading the 2012 Los Angeles Dodgers off-season
To Baltimore: LHP Dana Eveland
To Los Angeles: LHP Jarret Martin, OF/IF Tyler Henson
- This was a surprising move, as Eveland was arbitration-eligible and the Dodgers had other plans for the starting rotation. Eveland was nothing more than roster fodder, so for the Dodgers to get anything for him -- especially young players -- was rather amazing.
Grade: B
Andre Ethier - 1 year, $10.95M (avoided arbitration)
- Ethier signed a contract to avoid arbitration -- a contract some thought was a little cheaper than expected. I thought he'd get $12-plus million contract, but coming off knee surgery, he got a little less than that. It's a good number (a tradeable number if necessary) who seems poised to have a comeback season.
Grade: B+
Tony Gwynn - 2 years, $2 million (avoided arbitration)
- I actually really like this deal, as Gwynn is a defensive specialist and good base-stealer. He's the perfect guy for the Dodgers to have coming off the bench. To get him for a million bucks a year, despite the limited resources, is a great deal.
Grade: A
Matt Kemp - 8 years, $160 million
- Yes.
Grade: A+
Clayton Kershaw - 2 years, $19 million (avoided arbitration)
- Yes, part deux.
Grade: A+
James Loney - 1 year, $6.375 million (avoided arbitration)
- This deal is in line with what a lot of people thought he'd get, but it's a bit much for a guy who didn't do much until the last two months of the season. The Dodgers took too long to get into the Prince Fielder bidding that they had to tender Loney a contract. Unless he breaks out in a big way, this could be his last season as a Dodger.
Grade: C-
Mike MacDougal - 1 year, $650,000 ($350,000 buyout)
- I understood MacDougal on minor-league deal last year, but to give a guy with a shiny ERA a million bucks guaranteed is suspect. I don't think there's any way he matches last season's performance.
Grade: D+
Juan Rivera - 1 year, $4.5 million
- When I was drafting my off-season plan, I actually had the Dodgers re-signing Rivera on a 1-year, $4 million deal. At the time, it didn't look so bad. Now, it's terrible, especially since he'll be taking valuable playing time away from Jerry Sands. He was solid for the Dodgers after they acquired him in July, but the re-signing wasn't necessary. At least it's just a 1-year contract.
Grade: C-
Free agent signings
Chris Capuano - 2 years, $10 million
- For the price, this is actually not a horrible signing. The fact that it prevented the Dodgers from re-signing Hiroki Kuroda, however, makes this a poor signing.
Grade: C-
Todd Coffey - 1 year, $1.3 million
- Coffey is a solid reliever and isn't making a lot, but it was a totally unnecessary signing. If there's any one position the Dodgers have quality and surplus at, it's right-handed relief pitchers. This also came after re-signing MacDougal. If I had to choose between the two, I'd choose Coffey easily.
Grade: D
Mark Ellis - 2 years, $8.75 million
- I'm actually not opposed to this deal, as middle infielders -- for whatever reason -- got paid this off-season. Ellis is a great defender at second base -- something the Dodgers haven't had since Alex Cora in 2004. His bat has taken a dive, though. Despite that, he could be the team's No. 2 hitter. Hitting in front of Kemp could benefit him greatly.
Grade: C+
Jerry Hairston - 2 years, $6 million
- The Dodgers needed a utility player, but did they really need to $2.25 million on one this off-season? This was a luxury signing for a team that doesn't have a lot of money to blow on utility players (at least, not right now).
Grade: C
Aaron Harang - 2 years, $12 million
- Like the Capuano deal, this isn't a bad deal. The fact that the Dodgers chose these two instead of Kuroda doesn't sit well with me. If Harang can pitch like he did last season or like he did for a few years with the Reds, this could actually be a decent deal.
Grade: C
Adam Kennedy - 1 year, $800,000
- This is the Dodgers' worst signing of the off-season. There are a hundred different players who could do what Kennedy will do -- and probably do it for cheaper (and possibly better).
Grade: F
Matt Treanor - 1 year, $1 million
- We know Ned Colletti likes his veteran catchers and giving a guy $1 million to be the team's backup catcher is questionable. Treanor has no stick whatsoever, so don't expect anything from him at the plate.
Grade: D
The Dodgers' off-season started off great, inking Kemp to a long-term deal was priority No. 1. The off-season could have been bookend by nabbing Fielder, but Victor Martinez and his torn ACL prevented that. The Dodgers made a bunch of mediocre signings that could have been made later in the off-season for cheaper. Hopefully off-seasons for the foreseeable future will be a lot more interesting and productive than this.
Grade: C-
4 comments:
- AnonymousFebruary 10, 2012 at 3:36 PM
I don't see anyting...*anything*...positive in signing Harang or Capuano, especially if it cost us Kuroda. They didn't wait too long on Fielder, unless you thought he'd sign for the 7 years if they had moved earlier. I think they offered 7 years a while ago, but he wanted 10 years. And they should have given him that. Too bad for both. There would be euphoria in LA with Fielder in and McCourt out.ReplyDelete
I don't mind the two pitchers, but choosing one or both of them instead of Kuroda is downright stupid.ReplyDelete
If the Dodgers had truly moved earlier on Fielder, he might have signed for seven years. If they expressed interest in him before Martinez tore his ACL, he could very well be a Dodger. The market for him wasn't as big as some expect (Boras and Fielder included).
- AnonymousFebruary 11, 2012 at 5:10 PM
Yes, they obviously should have moved before Martinez got hurt. I think they should have offered 7 years and $150 million early on. Maybe they did. Maybe Boras wanted to wait it out. In any case, I really wanted the Dodgers to sign Fielder, and this isn't said out of frustration, but 10 years is probably too long for a guy with his weight issues. He could easily break down...*seriously* break down...about 5-6 years from now.ReplyDelete
Oh yeah, I wouldn't have gone near 10 years. I think I originally said seven with options would be my max.ReplyDelete


text:
Valley City picks Nevada man as new police chief
Valley City has chosen Fred Thompson, a just-retired captain with the Henderson, Nev., police department as new police chief, administrator David Schelkoph announced Wednesday afternoon.
Thompson will begin his new position the first week of June.
Current acting police chief Mark McDonald, VCPD Sgt. Doug Kiefert, Fred Thompson, Patricia Nowak and Ryan Evans were finalists for the job, and went through in-person interviews from May 8 to Tuesday.
In a release, Schelkoph said, "We started with 39 applicants, whittled it down to 10 phone interviews, and finally brought in five applicants for 'face to face' interrogations."
Said Schelkoph, "Thompson is a 29-year veteran of the Henderson Nevada Police department. He has extensive management experience with a tremendous training background in law enforcement. Thompson currently holds a B. A. in public Administration-Law enforcement from Nevada State College and an Associates degree in Criminal Justice. To date Thompson has over 5000 hours of training received and over 1000 hours of instruction given. He is married to his wife Colleen, has 4 children, and 7 grandchildren. Please join me in welcoming Mr. Thompson as our new Police Chief."
Thompson was visiting Valley City Thursday.
He, wife Colleen Thompson and his youngest son, Erik, will be moving to Valley City, he said.
"I was offered the job Tuesday and I accepted immediately," Thompson said.
Thompson said he just turned in his retirement from the Henderson Police Department two months ago, and as a result, was able to start the new job quickly.
"I was thinking of retiring, and felt my skill set" would be an asset to Valley City, Thompson said.
Thompson said he has yet to make arrangements for housing in Valley City.
Schelkoph said the announcement was held off until Wednesday "to make sure our local applicants (McDonald and Kiefert) were notified."
Thompson said he has met department officers, and they "seem to be dedicated police officers – I appreciate the hospitality I was shown by them."
On Valley City's hiring committee were Mayor Bob Werkhoven, Commissioner Jon Wagar, City Auditor Avis Richter, City Attorney J. Russell Myhre and Schelkoph.
According to Thompson's biography on the Henderson, Nev., police department website, Thompson was born in New Brunswick, New Jersey, and moved to the Las Vegas valley in 1981.
He started his law enforcement career in New Jersey as a reserve officer with the Milltown Police Department where he served for five years. Upon moving to the Vegas Valley, he worked for two years as a reserve officer for the North Las Vegas Police Department. Captain Thompson joined the Henderson Police Department as an officer in 1983. He was promoted to sergeant in 1991 and served in several capacities including being the department's first SWAT sergeant. He was also HPD's first accreditation manager running the department's initial CALEA accreditation process. He was promoted to lieutenant in March 2001 and served as the Homeland Security lieutenant from 2006 to 2008. He was promoted to captain in September 2009 and is currently assigned to criminal investigations.
Thompson has an associate of applied science in criminal justice from the College of Southern Nevada, a bachelor of arts in public administration – criminal justice from Nevada State College, and graduated from the FBI National Police Academy in 2006.


text:
West Coast Firm Showing Gas Rail in Louisville
October 31, 2012 by Sherman Goldenberg · Comments Off on West Coast Firm Showing Gas Rail in Louisville
Union Gap, Wash.-based Jones & Sons Chassis is in development of what the company calls the "next generation" of front-engine gas chassis design, with the work in progress scheduled for an unveiling at the Recreation Vehicle Industry Association's (RVIA) 50th Annual National RV Trade Show, Nov. 27-29 in Louisville, Ky.
Gary Jones, who founded the company in 2005, tells RVBUSINESS.com that this new platform is specifically designed and engineered for the RV body builder and will be available in a standard stripped-chassis format or in a coach-ready version in which a great deal of componentry like outriggers, leveling jacks and generators are already in place for the body builder.
"We can't release any specifics prior to the trade show," said Jones, who declined to elaborate on drive train details on his new gas chassis project, which has been in the works since February. "But it sure has been fun to work on."
The chassis will be "competitively priced with significant product improvements" and is intended as an innovative alternative to Ford, Workhorse and Freightliner units, said Jones, adding that his company is targeting the entry-level segment of the Class A gas market with chassis measuring "up to 30 feet" in length.
Jones & Sons Chassis' veteran staff members have previously worked on a wide array of proprietary chassis for companies such as Fleetwood Enterprises Inc., Safari Motor Coaches Inc., Country Coach Inc., Western Recreational Vehicles Inc. as well as Tiffin Motorhomes Inc.'s Power Glide Custom Chassis program, which supports Tiffin's Allegro Breeze, Allegro Bus and Phaeton luxury lines.