text:
gwolf's blog
Much belated book presentation, this Saturday
Once again, I'm making an announcement mainly for my local circle of friends and (gasp!) followers. For those of you over 100Km away from Mexico City, please disregard this message.
Back in July 2015, and after two years of hard work, my university finished the publishing step of my second book. This is a textbook for the subject I teach at Computer Engineering: Operating Systems Fundamentals.
The book is, from its inception, fully available online under a permissive (CC-BY) license. One of the books aimed contributions is to present a text natively written in Spanish. Besides, our goal (I coordinated a team of authors, working with two colleagues from Rosario, Argentina, and one from Cauca, Colombia) was to provide a book students can easily and legally share with no legal issues.
I have got many good reviews so far, and after teaching based on it for four years (while working on it and after its publication), I can attest the material is light enough to fit in a Bachelors level degree, while it's deep enough to make our students sweat healthily ;-)
Anyway: I have been scheduled to present the book at my university's main book show, 38 Feria Internacional del Libro del Palacio de Minería this Saturday, 2017.03.04 16:00; Salón Manuel Tolsá. What's even better: This time, I won't be preparing a speech! The book will be presented by my two very good friends, José María Serralde and Rolando Cedillo. Both of them are clever, witty, fun, and a real honor to work with. Of course, having them present our book is more than a double honor.
So, everybody who can make it: FIL Minería is always great and fun. Come share the love! Come have a book! Or, at least, have a good time and a nice chat with us!
- Add new comment
- 8771 reads
Started getting ads for ransomware. Coincidence?
Very strange. Verrrry strange.
Yesterday I wrote a blog post on spam stuff that has been hitting my mailbox. Nothing too deep, just me scratching my head.
Coincidentally (I guess/hope), I have been getting messages via my Bitlbee to one of my Jabber accounts, offering me ransomware services. I am reproducing it here, omitting of course everything I can recognize as their brand names related URLs (as I'm not going to promote the 3vi1-doers). I'm reproducing this whole as I'm sure the information will be interesting for some.
*BRAND* Ransomware - The Most Advanced and Customisable you've Ever Seen Conquer your Independence with *BRAND* Ransomware Full Lifetime License! * UNIQUE FEATURES * NO DEPENDENCIES (.net or whatever)!!! * Edit file Icon and UAC - Works on All Windows Versions * Set Folders and Extensions to Encrypt, Deadline and Russian Roulette * Edit the Text, speak with voice (multilang) and Colors for Ransom Window * Enable/disable USB infect, network spread & file melt * Set Process Name, sleep time, update ransom amount, Give mercy button * Full-featured headquarter (for Windows) with unlimited builds, PDF reports, charts and maps, totally autonomous operation * PHP Bridges instead of expensive C&C servers! * Automatic Bitcoin payment detection (impossible to bypass/crack - we challege who says the contrary to prove what they say!) * Totally/Mathematically IMPOSSIBLE to DECRYPT! Period. * Award-Winning Five-Stars support and constant updates! * We Have lot vouchs in *BRAND* Market, can check! Watch the promo video: *URL* Screenshots: *URL* Website: *URL* Price: $389 Promo: just $309 - 20% OFF! until 25th Feb 2017 Jabber: *JID*
I think I can comment on this with my students. Hopefully, this is interesting to others.
Now... I had never received Jabber-spam before. This message has been sent to me 14 times in the last 24 hours (all from different JIDs, all unknown to me). I hope this does not last forever :-/ Otherwise, I will have to learn more on how to configure Bitlbee to ignore contacts not known to me. Grrr...
- Add new comment
- 8091 reads
Spam: Tactics, strategy, and angry bears
I know spam is spam is spam, and I know trying to figure out any logic underneath it is a lost cause. However... I am curious.
Many spam subjects are seemingly random, designed to convey whatever "information" they contain and fool spam filters. I understand that.
Many spam subjects are time-related. As an example, in the last months there has been a surge of spam mentioning Donald Trump. I am thankful: Very easy to filter out, even before it reaches spamassassin.
Of course, spam will find thousands of ways to talk about sex; cialis/viagra sellers, escort services, and a long list of WTF.
However... Tactical flashlights. Bright enough to blind a bear.
I mean... Truly. Really. WTF‽‽
What does that mean? Why is that even a topic? Who is interested in anything like that? How often does the average person go camping in the woods? Why do we need to worry about stupid bears attacking us? Why would a bear attack me?
The list of WTF questions could go on forever. What am I missing? What does "tactical flashlight" mean that I just fail to grasp? Has this appeared in your spam?
- 4 comments
- 7446 reads
Giving up on the Drupal 8 debianization ☹
I am sad (but feel my duty) to inform the world that we will not be providing a Drupal 8 package in Debian.
I filed an Intent To Package bug a very long time ago, intending to ship it with Jessie; Drupal 8 was so deep a change that it took their community overly long to achieve and stabilize. Still, Drupal 8 was released over a year ago today.
I started working on debianizing the package shortly afterwards. There is also some online evidence – As my call for help sent through this same blog.
I have been too busy this last year. I let the packaging process lay dormant for too long, without even touching it for even half a year. Then, around September, I started working with the very nice guys of Indava, David and Enrique, and did very good advances. They clearly understood Debian's needs when it comes to full source inclusion (as D8 ships many minified Javascript libraries), attribution (as additionally to all those, many third-party PHP projects are bundled in the infamous vendor/ directory), and system-wide dependency management (as Drupal builds on some frameworks and libraries already available within Debian, chiefly Symfony, Doctrine, Twig... Even more, most of them appeared to work at the version levels we will be shipping, so all was dandy and for some weeks, I was quite optimistic on finishing the package on time and with the needed quality and testing. Yay!
But... Reality bites.
When I started testing my precious package... It broke in horrible ways. Uncomprehensible PHP errors (and I have to add here, I am a PHP newbie and am reluctant to learn better a language that strikes me as so inconsistent, so ugly), which we spent some time tackling... Of course, configuration changes are more than expected...
But, just as we Debianers learnt some important lessons after the way-too-long Sarge freeze (ten years ago, many among you won't remember those frustrating days), Drupal learnt as well. They changed their release strategy — Instead of describing it, those interested can read it at its source.
What it meant for me, sadly, is that this process does not align with the Debian maintenance model. This means: The Drupal API stays mostly-stable between 8.0.x, 8.1.x, 8.2.x, etc. However, Drupal will incorporate new versions of their bundled libraries. I understood the new versions would be incorporated at minor-level branches, but if I read correctly some of my errors, some dependencies change even at patch-level updates.
And... Well, if you update a PHP library, and the invoking PHP code (that is, Drupal) relies in this new version... Sadly, it makes it unmaintainable for Debian.
So, long story short: I have decided to drop Drupal8 support in Debian. Of course, if somebody wants to pick up the pieces, the Git repository is still there (although I do plan on erasing it in a couple of weeks, as it means useless waste of project resources otherwise), and you could probably even target unstable+backports in a weird way (as it's software that, given our constraints, shouldn't enter testing, at least during a freeze).
So... Sigh, a tear is dropped for every lost hour of work, and my depeest regrets to David and Enrique who put their work as well to make D8 happen in Debian. I will soon be closing the ITP and... Forgetting about the whole issue? ☹
- Add new comment
- 8602 reads
Book presentation by @arenitasoria: Hacker ethics, security and surveillance
At the beginning of this year, Irene Soria invited me to start a series of talks on the topic of hacker ethics, security and surveillance. I presented a talk titled Cryptography and identity: Not everything is anonymity.
The talk itself is recorded and available in archive.org (sidenote: I find it amazing that Universidad del Claustro de Sor Juana uses archive.org as their main multimedia publishing platform!)
But as part of this excercise, Irene invited me to write a chapter for a book covering the series. And, yes, she delivered!
So, finally, we will have the book presentation:
I know, not everybody following my posts (that means... Only those at or near Mexico City) will be able to join. But the good news: The book, as soon as it is presented, will be published under a CC BY-SA license. Of course, I will notify when it is ready.
- Add new comment
- 10441 reads
On the results of vote "gr_private2"
Given that I started the GR process, and that I called for discussion and votes, I feel somehow as my duty to also put a simple wrap-around to this process. Of course, I'll say many things already well-known to my fellow Debian people, but also non-debianers read this.
So, for further context, if you need to, please read my previous blog post, where I was about to send a call for votes. It summarizes the situation and proposals; you will find we had a nice set of messages in firstname.lastname@example.com during September; I have to thank all the involved parties, much specially to Ian Jackson, who spent a lot of energy summing up the situation and clarifying the different bits to everyone involved.
So, we held the vote; you can be interested in looking at the detailed vote statistics for the 235 correctly received votes, and most importantly, the results:
First of all, I'll say I'm actually surprised at the results, as I expected Ian's proposal (acknowledge difficulty; I actually voted this proposal as my top option) to win and mine (repeal previous GR) to be last; turns out, the winner option was Iain's (remain private). But all in all, I am happy with the results: As I said during the discussion, I was much disappointed with the results to the previous GR on this topic — And, yes, it seems the breaking point was when many people thought the privacy status of posted messages was in jeopardy; we cannot really compare what I would have liked to have in said vote if we had followed the strategy of leaving the original resolution text instead of replacing it, but I believe it would have passed. In fact, one more surprise of this iteration was that I expected Further Discussion to be ranked higher, somewhere between the three explicit options. I am happy, of course, we got such an overwhelming clarity of what does the project as a whole prefer.
And what was gained or lost with this whole excercise? Well, if nothing else, we gain to stop lying. For over ten years, we have had an accepted resolution binding us to release the messages sent to debian-private given such-and-such-conditions... But never got around to implement it. We now know that debian-private will remain private... But we should keep reminding ourselves to use the list as little as possible.
For a project such as Debian, which is often seen as a beacon of doing the right thing no matter what, I feel being explicit about not lying to ourselves of great importance. Yes, we have the principle of not hiding our problems, but it has long been argued that the use of this list is not hiding or problems. Private communication can happen whenever you have humans involved, even if administratively we tried to avoid it.
Any of the three running options could have won, and I'd be happy. My #1 didn't win, but my #2 did. And, I am sure, it's for the best of the project as a whole.
- Add new comment
- 7360 reads
Proposing a GR to repeal the 2005 vote for declassification of the debian-private mailing list
For the non-Debian people among my readers: The following post presents bits of the decision-taking process in the Debian project. You might find it interesting, or terribly dull and boring :-) Proceed at your own risk.
My reason for posting this entry is to get more people to read the accompanying options for my proposed General Resolution (GR), and have as full a ballot as possible.
Almost three weeks ago, I sent a mail to the debian-vote mailing list. I'm quoting it here in full:
Some weeks ago, Nicolas Dandrimont proposed a GR for declassifying debian-private[1]. In the course of the following discussion, he accepted[2] Don Armstrong's amendment[3], which intended to clarify the meaning and implementation regarding the work of our delegates and the powers of the DPL, and recognizing the historical value that could lie within said list. [1] https://www.debian.org/vote/2016/vote_002 [2] https://lists.debian.org/debian-vote/2016/07/msg00108.html [3] https://lists.debian.org/debian-vote/2016/07/msg00078.html In the process of the discussion, several people objected to the amended wording, particularly to the fact that "sufficient time and opportunity" might not be sufficiently bound and defined. I am, as some of its initial seconders, a strong believer in Nicolas' original proposal; repealing a GR that was never implemented in the slightest way basically means the Debian project should stop lying, both to itself and to the whole free software community within which it exists, about something that would be nice but is effectively not implementable. While Don's proposal is a good contribution, given that in the aforementioned GR "Further Discussion" won 134 votes against 118, I hereby propose the following General Resolution: === BEGIN GR TEXT === Title: Acknowledge that the debian-private list will remain private. 1. The 2005 General Resolution titled "Declassification of debian-private list archives" is repealed. 2. In keeping with paragraph 3 of the Debian Social Contract, Debian Developers are strongly encouraged to use the debian-private mailing list only for discussions that should not be disclosed. === END GR TEXT === Thanks for your consideration, -- Gunnar Wolf (with thanks to Nicolas for writing the entirety of the GR text ;-) )
Yesterday, I spoke with the Debian project secretary, who confirmed my proposal has reached enough Seconds (that is, we have reached five people wanting the vote to happen), so I could now formally do a call for votes. Thing is, there are two other proposals I feel are interesting, and should be part of the same ballot, and both address part of the reasons why the GR initially proposed by Nicolas didn't succeed:
- Ian Jackson's Acknowledge difficulty of declassifying debian-private makes explicit the role of the listmasters and allows for a formal declassification process to take place, as long as the privacy guarantees we had after the 2005 GR are not diminished.
- Iain Lane's reply to Ian is not yet formally proposed, but makes it spelt out that no declassification should ever occur unless all of the involved authors have explicitly consented
So, once more (and finally!), why am I posting this?
- To invite Iain to formally propose his text as an option to mine
- To invite more DDs to second the available options
- To publicize the ongoing discussion
I plan to do the formal call for votes by Friday 23.
[update] Kurt informed me that the discussion period started yesterday, when I received the 5th second. The minimum discussion period is two weeks, so I will be doing a call for votes at or after 2016-10-03.
- Add new comment
- 19304 reads
Talking about the Debian keyring in Investigaciones Nucleares, UNAM
For the readers of my blog that happen to be in Mexico City, I was invited to give a talk at Instituto de Ciencias Nucleares, Ciudad Universitaria, UNAM.
I will be at Auditorio Marcos Moshinsky, on August 26 starting at 13:00. Auditorio Marcos Moshinsky is where we met for the early (~1996-1997) Mexico Linux User Group meetings. And... Wow. I'm amazed to realize it's been twenty years that I arrived there, young and innocent, the newest of what looked like a sect obsessed with world domination and a penguin fetish.
- Add new comment
- 32773 reads
Subtitling DebConf talks — Come and join!
As I have said here a couple of times already, I am teaching a diploma course on embedded Linux at UNAM, and one of the modules I'm teaching (with Sandino Araico) is the boot process. We focus on ARM for obvious reasons, and while I have done my reading on the topic, I am very far from considering myself an expert.
So, after attending Martin Michlmayr's «Debian on ARM devices» talk, I decided to do its subtitles as part of my teaching job. This talk gives a great panorama on what actually has to happen in order to get an ARM machine to boot, and how support for new ARM devices comes around to Linux in general and to Debian in particular — Perfect for our topic! But my students are not always very fluent in English, so giving a hand is always most welcome.
In case any of you dear readers didn't know, we have a DebConf subtitling team. Yes, our work takes much longer to reach the public, and we have no hopes whatsoever in getting it completed, but every person lending a hand and subtitling a talk that they thought was interesting helps a lot to improve our talks' usability. Even if you don't have enough time to do the whole talk (we are talking about some 6hr per 45 minute session), adding a bit of work is very very very welcome. So...
- Do you want to follow Martin's talk with subtitles?
- Get the video file
- Get the subtitles
- Use your favorite program — In my case:
$ vlc Debian_on_ARM_devices_2.webm --sub-file Debian_on_ARM_devices.srt
- [update] Or watch online at Amara!
- Do you want to help the subtitling effort?
- Read the Wiki page on the Subtitling team work (feel free to fill in bits of missing information you will surely find!)
- Choose a video from the list to work on
- You can either work online on the DebConf team of the Amara webapp or join the Alioth team and contribute directly to the Git tree
Enjoy — And thanks in advance for your work!
- Add new comment
- 32604 reads
Got the C.H.I.P.s for DebConf!
I had my strong doubts as to whether the shipment would be allowed through customs, and was happily surprised by a smiling Graham today before noon. He handed me a smallish box that arrived to his office, containing...
Our fifty C.H.I.P. computers, those I offered to give away at DebConf!
The little machines are quite neat. They are beautiful little devices, including even a plastic back (so you can safely work with it over a conductive surface or things like that). Quite smaller than the usual Raspberry-like format. It has more than enough GPIO to make several of my friends around here drool about the possibilities.
So, what's to this machine besides a nice small ARM CPU, 512MB RAM, wireless connectivity (Wifi and bluetooth)? Although I have not yet looked into them (but intend to do so very soon!), it promises to have the freest available hardware around, and is meant for high hackability!
And not that it matters — But we managed to import them all, legally and completely hassle-free, into South Africa!
That's right — We are all used to the declaring commercial value as one dollar mindset. But... The C.H.I.P.s are actually priced at US$9 a piece. The declared commercial value is US$450. South Africans said all their customs are very hard to clear — But we were able receive 50 legally shipped computers, declared at their commercial value, without any hassles!
(yes, we might have been extremely lucky as well)
Anyway, stay tuned — By Thursday I will announce the list of people that get to take one home. I still have some left, so feel free to mail me at firstname.lastname@example.com.
- Add new comment
- 32567 reads
Batch of the Next Thing Co.'s C.H.I.P. computers on its way to DebConf!)
Hello world!
I'm very happy to inform that the Next Thing Co. has shipped us a pack of 50 C.H.I.P. computers to be given away at DebConf! What is the C.H.I.P.? As their tagline says, it's the world's first US$9 computer. Further details:
All in all, it's a nice small ARM single-board computer; I won't bore you on this mail with tons of specs; suffice to say they are probably the most open ARM system I've seen to date.
So, I agreed with Richard, our contact at the company, I would distribute the machines among the DebConf speakers interested in one. Of course, not every DebConf speaker wants to fiddle with an adorable tiny piece of beautiful engineering, so I'm sure I'll have some spare computers to give out to other interested DebConf attendees. We are supposed to receive the C.H.I.P.s by Monday 4; if you want to track the package shipment, the DHL tracking number is 1209937606. Don't DDoS them too hard!
So, please do mail me telling why do you want one, what your projects are with it. My conditions for this giveaway are:
- I will hand out the computers by Thursday 7.
- Preference goes to people giving a talk. I will "line up" requests on two queues, "speaker" and "attendee", and will announce who gets one in a mail+post to this list on the said date.
- With this in mind, I'll follow a strict "first come, first served".
To sign up for yours, please mail email@example.com - I will capture mail sent to that alias ONLY.
- 1 comment
- 61137 reads
Answering to a CACM «Viewpoint»: on the patent review process
I am submitting a comment to Wen Wen and Chris Forman's Viewpoint on the Communications of the ACM, titled Economic and business dimensions: Do patent commons and standards-setting organizations help navigate patent thickets?. I believe my comment is worth sharing a bit more openly, so here it goes. Nevertheless, please refer to the original article; it makes very interesting and valid points, and my comment should be taken as an extra note on a great text only!
I was very happy to see an article with this viewpoint published. This article, however, mentions some points I believe should be further stressed out as problematic and important. Namely, still at the introduction, after mentioning that patents «are intended to provide incentives for innovation by granting to inventors temporary monopoly rights», the next paragraph continues, «The presence of patent thickets may create challenges for ICT producers. When introducing a new product, a firm must identify patents its product may infringe upon.»
The authors continue explaining the needed process — But this simple statement should be enough to explain how the patent system is broken and needs repair.
A requisite for patenting an invention was originally the «inventive» and «non-obvious» characteristics. Anything worth being granted a patent should be inventive enough, it should be non-obvious to an expert in the field.
When we see huge bodies of awarded (and upheld) patents falling in the case the authors mention, it becomes clear that the patent applications were not thoroughly researched prior to their patent grant. Sadly, long gone are the days where the United States Patent and Trademarks Office employed minds such as Albert Einstein's; nowadays, the office is more a rubber-stamping bureaucracy where most patents are awarded, and this very important requisite is left open to litigation: If somebody is found in breach of a patent, they might choose to defend the issue that the patent was obvious to an expert. But, of course, that will probably cost more in legal fees than settling for an agreement with the patent holder.
The fact that in our line of work we must take care to search for patents before releasing any work speaks a lot about the process. Patents are too easily granted. They should be way stricter; the occurence of an independent developer mistakenly (and innocently!) breaching a patent should be most unlikely, as patents should only be awarded to truly non-obvious solutions.
- Add new comment
- 45162 reads
Relax and breathe...
Time passes. I had left several (too many?) pending things to be done un the quiet weeks between the end of the lective semestre and the beginning of muy Summer trip to Winter. But Saturday gets closer every moment... And our long trip to the South begins.
Among many other things, I wanted to avance with some Debían stuff - both packaging and WRT keyring analysis. I want to contacto some people I left pending interactions with, but honestly, that will only come face to face un Capetown.
As to "real life", I hace too many pending issues at work to even begin with; I hope to get some time at South África todo do some decent UNAM sysadmining. Also, I want to play the idea of using Git for my students' workflow (handing in projects and assignments, at least)... This can be interesting to talk with the Debían colleagues about, actually.
As a Masters student, I'm making good advances, and will probably finish muy class work next semester, six months ahead of schedule, but muy thesis work so far has progressed way slower than what I'd like. I have at least a better defined topic and approach, so I'll start the writing phase soon.
And the personal life? Family? I am more complete and happy than ever before. My life su completely different from two years ago. Yes, that was obvious. But it's also the only thing I can come up with. Having twin babies (when will they make the transition from "babies" to "kids"? No idea... We will find out as it comes) is more than beautiful, more than great. Our life has changed in every possible aspect. And yes, I admire my loved Regina for all of the energy and love she puts on the babies... Life is asymetric, I am out for most of the day... Mommy is always there.
As I said, happier than ever before.
- 3 comments
- 8489 reads
University degrees and sysadmin skills
I'll tune in to the post-based conversation being held on Planet Debian: Russell Coker wonders about what's needed to get university graduates with enough skills for a sysadmin job, to which Lucas Nussbaum responds with his viewpoints. They present a very contrasting view of what's needed for students — And for a good reason, I'd say: Lucas is an academician; I don't know for sure about Russell, but he seems to be a down-to-the-earth, dirty-handed, proficient sysadmin working on the field. They both contact newcomers to their fields, and will notice different shortcomings.
I tend to side with Lucas' view. That does not come as a surprise, as I've been working for over 15 years in an university, and in the last few years I started walking from a mostly-operative sysadmin in an academic setting towards becoming an academician that spends most of his time sysadmining. Subtle but important distinction.
I teach at the BSc level at UNAM, and am a Masters student at IPN (respectively, Mexico's largest and second-largest universities). And yes, the lack of sysadmin abilities in both is surprising. But so is a good understanding of programming. And I'm sure that, were I to dig into several different fields, I'd feel the same: Student formation is very basic at each of those fields.
But I see that as natural. Of course, if I were to judge people as geneticists as they graduate from Biology, or were I to judge them as topologists as they graduate from Mathematics, or any other discipline in which I'm not an expert, I'd surely not know where to start — Given I have about 20 years of professional life on my shoulders, I'm quite skewed as to what is basic for a computing professional. And of course, there are severe holes in my formation, in areas I never used. I know next to nothing of electronics, my mathematical basis is quite flaky, and I'm a poor excuse when talking about artificial intelligence.
Where am I going with this? An university degree (BSc in English, would amount to "licenciatura" in Spanish) is not for specialization. It is to have a sufficiently broad panorama of the field, and all of the needed tools to start digging deeper and specializing — either by yourself, working on a given field and learning its details as you go, or going through a postgraduate program (Specialization, Masters, Doctorate).
Even most of my colleagues at the Masters in Engineering in Security and Information Technology lack of a good formation in fields I consider essential. However, what does information security mean? Many among them are working on legal implications of several laws that touch our field. Many other are working on authenticity issues in images, audios and other such media. Many other are trying to come up with mathematical ways to cheapen the enormous burden of crypto operations (say, "shaving" CPU cycles off a very large exponentiation). Others are designing autonomous learning mechanisms to characterize malware. Were I as a computing professional to start talking about their research, I'd surely reveal I know nothing about it and get laughed at. That's because I haven't specialized in those fields.
University education should give a broad universal basis to enter a professional field. It should not focus on teaching tools or specific procedures (although some should surely be presented as examples or case studies). Although I'd surely be happy if my university's graduates were to know everything about administering a Debian system, that would be wrong for a university to aim at; I'd criticize it the same way I currently criticize programs that mix together university formation and industry certification as if they were related.
- 3 comments
- 16026 reads
Stop it with those short PGP key IDs!
Debian is quite probably the project that most uses a OpenPGP implementation (that is, GnuPG, or gpg) for many of its internal operations, and that places most trust in it. PGP is also very widely used, of course, in many other projects and between individuals. It is regarded as a secure way to do all sorts of crypto (mainly, encrypting/decrypting private stuff, signing public stuff, certifying other people's identities). PGP's lineage traces back to Phil Zimmerman's program, first published in 1991 — By far, not a newcomer
PGP is secure, as it was 25 years ago. However, some uses of it might not be so. We went through several migrations related to algorithmic weaknesses (i.e. v3 keys using MD5; SHA1 is strongly discouraged, although not yet completely broken, and it should be avoided as well) or to computational complexity (as the migration away from keys smaller than 2048 bits, strongly prefering 4096 bits). But some vulnerabilities are human usage (that is, configuration-) related.
Today, Enrico Zini gave us a heads-up in the #debian-keyring IRC channel, and started a thread in the debian-private mailing list; I understand the mail to a private list was partly meant to get our collective attention, and to allow for potentially security-relevant information to be shared. I won't go into details about what is, is not, should be or should not be private, but I'll post here only what's public information already.
What are short and long key IDs?
I'll start by quoting Enrico's mail:
there are currently at least 3 ways to refer to a gpg key: short key ID (last 8 hex digits of fingerprint), long key ID (last 16 hex digits) and full fingerprint. The short key ID used to be popular, and since 5 years it is known that it is computationally easy to generate a gnupg key with an arbitrary short key id.
A mitigation to this is using "keyid-format long" in gpg.conf, and a better thing to do, especially in scripts, is to use the full fingerprint to refer to a key, or just ship the public key for verification and skip the key servers.
Note that in case of keyid collision, gpg will download and import all the matching keys, and will use all the matching keys for verifying signatures.
So... What is this about? We humans are quite bad at recognizing and remembering randomly-generated strings with no inherent patterns in them. Every GPG key can be uniquely identified by its fingerprint, a 128-bit string, usually encoded as ten blocks of four hexadecimal characters (this allows for 160 bits; I guess there's space for a checksum in it). That is, my (full) key's signature is:
However, it's quite hard to recognize such a long string, let alone memorize it! So, we often do what humans do: Given that strong cryptography implies a homogenous probability distribution, people compromised on using just a portion of the key — the last portion. The short key ID. Mine is then the last two blocks (shown in boldface): C1DB921F. We can also use what's known as the long key ID, that's twice as long: 64 bits. However, while I can speak my short key ID on a single breath (and maybe even expect you to remember and note it down), try doing so with the long one (shown in italics above): 673A03E4C1DB921F. Nah. Too much for our little, analog brains.
This short and almost-rememberable number has then 32 bits of entropy — I have less than one in 4,000,000,000 chance of generating a new key with this same short key ID. Besides, key generation is a CPU-intensive operation, so it's quite unlikely we will have a collision, right?
Well, wrong.
Previous successful attacks on short key IDs
Already five years ago, Asheesh Laroia migrated his 1024D key to a 4096R. And, as he describes in his always-entertaining fashion, he made his computer sweat until he was able to create a new key for which the short key ID collided with the old one.
It might not seem like a big deal, as he did this non-maliciously, but this easily should have spelt game over for the usage of short key IDs. After all, being able to generate a collision is usually the end for cryptographic systems. Asheesh specifically mentioned in his posting how this could be abused.
But we didn't listen. Short key IDs are just too convenient! Besides, they allow us to have fun, can be a means of expression! I know of at least two keys that would qualify as vanity: Obey Arthur Liu's 0x29C0FFEE (created in 2009) and Keith Packard's 0x00000011 (created in 2012).
Then we got the Evil 32 project. They developed Scallion, started (AFAICT) in 2012. Scallion automates the search for a 32-bit collision using GPUs; they claim that it takes only four seconds to find a collision. So, they went through the strong set of the public PGP Web of Trust, and created a (32-bit-)colliding key for each of the existing keys.
And what happened now?
What happened today? We still don't really know, but it seems we found a first potentially malicious collision — that is, the first "nonacademic" case.
Enrico found two keys sharing the 9F6C6333 short ID, apparently belonging to the same person (as would be the case of Asheesh, mentioned above). After contacting Gustavo, though, he does not know about the second — That is, it can be clearly regarded as an impersonation attempt. Besides, what gave away this attempt are the signatures it has: Both keys are signed by what appears to be the same three keys: B29B232A, F2C850CA and 789038F2. Those three keys are not (yet?) uploaded to the keyservers, though... But we can expect them to appear at any point in the future. We don't know who is behind this, or what his purpose is. We just know this looks very evil.
Now, don't panic: Gustavo's key is safe. Same for his certifiers, Marga, Agustín and Maxy. It's just a 32-bit collision. So, in principle, the only parties that could be cheated to trust the attacker are humans, right?
Enrico tested on the PGP pathfinder & key statistics service, a keyserver that finds trust paths between any two arbitrary keys in the strong set. Surprise: The pathfinder works on the short key IDs, even when supplied full fingerprints. So, it turns out I have three faked trust paths into our impostor.
What next?
There are several things this should urge us to do.
- First of all, configure your local GPG to never show you short IDs. This is done by adding the line keyid-format 0xlong to ~/.gnupg/gpg.conf.
- I just checked both in /usr/share/gnupg/options.skel and /usr/share/gnupg2/gpg-conf.skel, and that setting is not yet part of the packages' defaults. I'll check a bit deeper and file bugs right away if needed!
- Have you written or maintained any program that deals with GPG keys in any way? Make sure it specifies --keyid-format long or 0xlong in any relevant call. It might even be better to use the machine-oriented representation instead: --with-colons.
- ...Of course, your computer will not feel tired or confused at comparing 160-bit full fingerprints instead of 64-bit long IDs, so it's better if our scripts use the full version for everything.
- Only sign somebody else's key if you see and verify its full fingerprint (this is not a new issue, but given we are talking about it, and that DebConf is around the corner, and that we will have a KSP as usual...)
And there are surely many other important recommendations. But this is a good set of points to start with.
[update] I was pointed at Daniel Kahn Gillmor's 2013 blog post, OpenPGP Key IDs are not useful. Daniel argues, in short, that cutting a fingerprint in order to get a (32- or 64-bit) short key ID is the worst of all worlds, and we should rather target either always showing full fingerprints, or not showing it at all (and leaving all the crypto-checking bits to be done by the software, as comparing 160-bit strings is not natural for us humans).
[update] This post was picked up by LWN.net. A very interesting discussion continues in their comments.
- 8 comments
- 47762 reads


text:
Cause of Friberg Construction fire unclear; owner plans to rebuild in Ferndale
Fire burns Ferndale construction business
A Ferndale construction business will try to rebuild after a devastating fire destroyed its shop over weekend.
John Friberg, owner and founder of Friberg Construction Inc., was drinking coffee with Gary Russell, the fire chief of Whatcom County Fire District 7, in downtown Ferndale when the flames broke out across town at his business last Saturday.
Flames ripped through the 10,000-square-foot building at 6425 W. 20th Ave., on the northern edge of city limits. Heat melted a dump truck, two diesel trucks, and thousands of dollars in tools and equipment.
Will Anderson, an investigator with the Whatcom County Fire Marshal's Office, suspects the fire started in a truck bay area. The official cause will go down as undetermined, however, because so much of the evidence was lost, while gasoline, kerosene and other hazardous materials fed into the rapid growth of the fire.
Friberg, 76, built the building about 25 years ago. His business completed hundreds of projects over the past few decades: water tanks in Bellingham, miles of pipes to build a rest stop in Custer, sewers in Wenatchee, and jobs as far-flung as Alaska.
"This was the dream of my life when I found this property, and built this building on it," Friberg said Thursday. "We're down but we're not out. It's like in a baseball game. There's still a few innings left."
The fire marshal's office estimates the total loss around $600,000. Friberg expects when all of the contents, buildings, vehicles are added up, the losses will be close to $2 million. Friberg could just retire now, he said, but he wants the business to be in good shape when he passes it on to his boys. He hopes to have things back up to speed by fall.
"We don't just run and hide, we persevere," he said. "You have to grit your teeth and say: We did it once, we'll do it again."
Caleb Hutton: 360-715-2276, @bhamcaleb

subset: commoncrawl


text:
Saturday, 2 February 2013
Inspiration and wise words
This story of Keren Brown of the The Brown Trading Co. is one such story. It's on page 40 of Australian Home Beautiful August 2011. It's a brief article but has some very wise words... my favourite of which are: '... don't follow trends...' Nice to see successful designers giving that advice... sometimes I think not following trends puts my business at a disadvantage but I do believe the day will come when my designs are under the spotlight the way I would like them to be.
Keren had no formal design training when she and her brother started The Brown Trading Co. back in 2009 - out of her Brisbane home no less. In the two years since launching to when the article appeared in the magazine the business had grown in both size and reputation. The business drew on her life experiences as well as lots of research and advice from people in the industry... (wish I knew how to access the latter... I've never had much success with that part).
Her influences came predominantly from living in London's Chelsea in her twenties and discovering Tricia Guild (of Designers Guild) - one of my fav's - and Terence Conran.
I've looked up her website and happy to find that although they design and manufacture in India many of the products are handmade and 'As a socially responsible company, The Brown Trading Co collaborates with traditional artisans in remote Indian villages to develop and manufacture their collections and are proud to promote these exquisite art forms enabling those communities to thrive and prosper.'
The website has links to the blog, facebook page and twitter account.
Subscribe to: Post Comments (Atom)


text:
I love mail.
I mean, proper mail. Not bills, or pizza delivery flyers, not junk mail. Ain't no one got time for that.
So when I heard about The Sweet Swap, you can bet I was signing up for something that results in me getting delicious treats in the post. Why wouldn't you!?
I had been inspired to give marshmallow-making a go after reading this post by The Sugar Hit – I mean, how hard could it be?
So I made one batch. That went fine.
I started on a second. I dropped and smashed my thermometer. I then burnt the sugar syrup. In a moment of brain snap, I poured the syrup straight into the bin… Where, because sugar syrup is basically lava, it melted through the bin liner (and half of the contents), pooled in the bottom of the bin, and set like toffee. The whole bin went into the garbage (and I still owe Blair a new one).
One week and a new thermometer later, and these guys came to fruition. So very, very pretty, and very, very tasty.
Salted Caramel Swirl Marshmallows
From Bake or Break
For the coating:
3/4 cup icing sugar
1/2 cup cornflour
For the marshmallows:
1/2 cup salted caramel sauce (bought or your own recipe)
4 & 1/2 teaspoons unflavored powdered gelatin
1/2 cup cold water
3/4 cup caster sugar
1/2 cup light corn syrup, divided
1/4 cup water
1/4 teaspoon salt
2 teaspoons vanilla extract
Sift together the corn flour and icing sugar in a small bowl, set aside.
Lightly coat a square brownie tin with oil, then dust the pan with the icing sugar mixture.
In a microwave safe bowl, combine the gelatin with 1/2 cup cold water and leave to bloom for 5 minutes.
In a medium saucepan, combine 1/4 cup corn syrup, 1/4 cup water and salt and bring to a boil. Stirring occasionally, bring to a temperature of 240*f/115*c.
While the syrup boils, heat the gelatin in the microwave for 30 seconds or until melted. Pour into the bowl of a stand mixer with the remaining 1/4 cup corn syrup, then turn the mixer on low.
Once the syrup has reached temperature, remove from heat and veeeery slowly add to the gelatin mixture, while the mixer is still on low. Once combined, increase the speed to medium and beat for 5 minutes. Increase the speed again, beating for a further 5 minutes. Then, increase to high, add the vanilla and beat for 2 minutes. The mixture should have tripled in volume and be white and fluffy.
Add 1/4 of the marshmallow mixture to a bowl, and stir in the caramel until combined. Then scrape the caramel mixture back in to the marshmallow, and gently swirl together.
Pour evenly into the brownie tin, and smooth the top with a spatula. Leave the marshmallow uncovered in a cool dry place for 8 hours or overnight to firm.
Cut the marshmallows into squares, then toss with extra coating (this stops them from sticking) and tap off any excess. Enjoy!
Most marshmallows are gluten-free – just make sure the icing sugar and cornflour specifies that they are gluten-free (most do), and you're on your way to an allergy friendly treat for the masses!


text:
Oregon Fish and Wildlife announced the entire Oregon coast from Columbia River south to the California border is closed for razor clams and mussels after the Department of Agriculture found unsafe levels of domoic acid.
Test results showed levels of domoic acid – a natural toxin produced by certain types of marine algae, can be harmful or even fatal if consumed in sufficient quantities – had exceeded the 20 parts per million (PPM) cut off.
Clatsop Beaches showed levels at 34.0 PPM in razor clams and at Coos Bay North Jetty it was 110.0 PPM; and for mussels at Cape Meares Mussels
...read more at http://www.seattletimes.com/sports/entire-oregon-coast-closed-for-razor-clam-digging-after-marine-toxin-levels-skyrocket/


text:
Kim Soo Hyun revealed his secret to acting like an 'idiot'.
His new movie 'Secretly and Greatly' (also 'Covertness') held its showcase on the 30th at Kunkook University in Seoul. Kim Soo Hyun plays a North Korean agent who disguises himself in South Korea. He has two completely different personas: savvy double agent and village idiot.
Kim Soo Hyun revealed, "To be honest, I was more worried about portraying the agent. I thought about how to meld in with the village people. Also, action school was hard. Since it's physical action, my body hurt all over."
He added, "In this movie, it's important to act like an idiot. More than that I researched how to act the idiot. I wondered how to bring it out from within me. To be honest, everyone has an idiot inside them. So I had a lot of fun."
The movie will be released on June 5th!
Upvote if you think more people should see this post!
Posted byWednesday, May 1, 2013
Kim Soo Hyun gets in touch with his 'inner idiot' for his new movie
0 30,353 Share Be the first to vote


text:
|14 Oct 2016
Windows 7 64bit
Win7 Deadlocking during visual studio based product testing cycle
We have been having major issues with one of our PC's. I'm suspecting there could be something fishy going on, but we have 3 computers that are identical to this one, with all same driver versions but none of the other PC's are doing this.
Issue : The PC deadlocks every now and then, and doesn't respond to mouse or keyboard at all in any ways.
So far all we've done is reboot PC, and we even tried building a new PC with new hardware - but alas, the same problems continue on this new PC aswell.
Driver verifier has been running on PC for roughly 36 hours now, and it has generated 2 dump files. I have no clue how to read these, so any help would be greatly appreciated.
Our setup roughly without going into too many details:
A DELL OPTIPLEX XE2 (If i remember correctly, could also be a DELL 9020)
Escatec pressure and humidity cabinet controlled by a PLC via EtherCat
NI-PXI rack for connecting all instruments and providing required COM ports.
Driver verifier dump files attached.
|My System Specs
|Thread Tools
|Similar help and support threads
Microsoft starts testing Visual Studio 2013 Update 2
Read more at: Microsoft starts testing Visual Studio 2013 Update 2 | ZDNet
New AV Product Testing Methods Stir Debate
Source A Guy
Help with win 7 and visual studio 6!
Hi all, my order of windows 7 is on the way but I wanted to solve a problem I would have once i installed it. Apparently Visual Studio 6 doesnt work with windows 7. I ordered home premium, so i wont be able to use XP mode. Anyone know any ways around this? Thanks
Visual studio
Cant run the VS 6.0 on Se7en.Tells something about the compatibility.Actualy i need something to run C++.Can someone tell me some good c++ programming software that would run on Se7en.
Why No 64-bit Visual Studio Yet?
Interesting read: Rico Mariani's Performance Tidbits : Visual Studio: Why is there no 64 bit version? (yet) Notice he mentions the x64 Office.
|Our Sites
|Site Links
|About Us
|Find Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 19:33.


text:
Click the button below to add the Madonna & Child Scallop Rosary Center* to your wish list.
We promise to never spam you, and just use your email address to identify you as a valid customer.
Posted by Sunny N. on 22nd Sep 2016
I am very happy with the quality of this centerpiece and the Madonna with Child is so sweet also! Thank you!
All prices are in USD. © 2019 My Lady's Treasures | Sitemap
Powered by BigCommerce


text:
e-Missions Go Global with WV-NYC-Korean Programs
Tue Feb 10 2009
A group of Korean educators in New York City experienced the thrill of a Challenger Learning Center® e-Mission™ planned and coordinated here in Wheeling as they attended an online workshop at New York's St. John's University on Feb. 5-6.
The Korean teachers were linked to the university and took part in two distance learning scenarios offered through the Challenger Learning Center, located in the Center for Educational Technologies®.
The New York-based teachers were assisted by Wheeling Jesuit University student Soo Kyung Chung, who served as interpreter for the mission. Chung is from South Korea and has been studying at the English Language Institute, located at Wheeling Jesuit, for the past six months.
Her responsibility was to assist the flight director flying the mission with any bilingual communication difficulties. There also was a translator in New York helping out.
The two lesson scenarios were coordinated by Challenger Learning Center Director Jackie Shia, who traveled to New York for the missions, and e-Mission flight instructors Barb Colton, Cecelia Maltese, and Laura Ondeck, who remained in Wheeling.
In the morning e-Mission, Moon, Mars, and Beyond, the teachers helped NASA locate and rescue astronauts. The class was organized into five planet teams to locate and rescue a lost spaceship orbiting one of the outer planets.
In the afternoon session the teachers switched to Earth for their technological work in Operation Montserrat. The Korean teachers had to decide how to save the residents of the small Caribbean island of Montserrat as a volcano erupts and a hurricane approaches in this simulated emergency.
"This is a great example of how Wheeling Jesuit University plays a part in the global effort of science to transcend geographic boundaries and languages," Shia said. Challenger Learning Center e-Missions are open to anyone with videoconferencing capability and computers. They provide a unique window to the world as they enhance teamwork and critical thinking for all ages and diverse groups.
The Challenger Learning Center is one of 47 centers worldwide established by the Challenger Center for Space Science in memory of the space shuttle Challenger. More than 40,000 students fly missions each year either at the Wheeling facility or through distance learning. The Challenger Learning Center has been honored nine years for having served the most children of all the centers.


text:
Sponsored Listings:
Rose V Valadez (Postmaster) email@example.com
10741 State Highway 160
Hood, CA 95639
Hood, CA 95639
The Hood Post Office is located in the state of California within Sacramento County. This location serves 283 Hood residents with a median income of $60,556. It's estimated that approximately 452 packages pass through this post office each year.


text:
Monthly Archives: February 2017
Empowerment – Manage Like a Mother
- February 24, 2017
- Leave a comment
Climbing to the top of Mount Norquay is exhilarating. Our guide Keno took this shot of me with my favorite (and only) daughter Morgan and the famous town of Banff far below us in the background. Actually, neither Morgan or I are climbers. Sure, we are athletic and we have been on climbing walls but […]Read More


text:
We saw a trace of snow today----a hint of more to come this winter. Join us for these events to help keep you warm and in shape! www.fleetfeetmadison.com for more details.
Wednesday, Dec 7- Free 2-5 mile group fun run/walk, Fleet Feet Sports, 5:45pm
Thursday, Dec 8- Free Great Dane Fitchburg 5 Mile Pub Run, Cahill Main, 6:00pm
Saturday, Dec 10- Event- Jingle Bells Run, Vilas Park Shelter, Madison, 10:30am
We still need a few volunteers for the Fleet Feet New Year's Day Dash on 1/1/12. Race Starts at 11:00am at Quaker Steak and Lube in Middleton. Volunteers are needed from 8:30am to 12:30pm. Volunteers receive race goodies, pint glass, raffle ticket, and free beer or soda and discounts on food at Quaker Steak and Lube. Email: email@example.com
It's going to be a great week!
Chuck Simon
Fleet Feet Sports Madison


text:
Escalante HS Escalante, UT Alumni List
Last names starting with "C"
Looking for Escalante High School Escalante, UT alumni not listed? If so, check out Classmates.com® - hundreds of more EHS alumni have posted their profiles.
About the Escalante High School Alumni Directory
If you attended Escalante High Escalante, UT ah and want to be added to the alumni directory register now to add your name to the alumni list. You can share memories of those activities that you were involved with at Escalante HS and you can view other alumni and read what other former students have posted about the time they spent at Escalante.


text:
- ispso_99Asked on January 22, 2015 at 01:51 AM
- JotForm Supportashwin_dAnswered on January 22, 2015 at 01:55 AM
Hello Ross,
Upon checking your email address firstname.lastname@example.com, I found that it ended up in our bounce list for following reason:Result: firstname.lastname@example.com is IN the bounce list
Reason(s) : smtp; 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 e7si517434wic.29 - gsmtp
I have removed it from our bounce it and it should be working fine now. You need to take a closer look at the bounce reason and take corrective steps. Please verify if this email id is actually created in your email server. If the email address is correct, please test your form again and see if you receive the submission emails or not.
Thank you!


text:
Yesterday it absolutely freaked me out when I realised there were only 10 more weeks until my birthday. I've been thinking recently about turning 28, because that means hubby will be turning 29, which means we're nearly 30! LOL.
But that's not what really has me freaked (I'll deal with that next year, when its ME that's turning 29 and one birthday away from 30). What has me freaked out this time is because my birthday is my deadline to complete my "40 goals in 40 weeks". How am I going? I've crossed a lot off the list, but lets take a look at what's left….
2 ) Learn to use manual settings on my camera to take portrait shots
I went to a one-day photography course late last year. I learnt heaps, have been playing around with settings quite a bit, and have become much better at using the semi-automatic settings (as in, I can actually use them now and get a non-blurry shot most of the time!). This is what I'd hoped to achieve through this goal, so will be happy to cross this off with a bit more practice. (If my kids let me… as you can see below, B1 is not a big fan of getting his photos taken)
4 ) Have at least one full weekend day to myself
I need to look at the calendar to work this one out. I've still been breastfeeding B2 twice during "day" hours, so will try to schedule it in at the last minute when we're doing to one feed during the day.
7 ) Do 10 pages in B2's scrapbook
So far I've done 7 pages (the picture of the quote at the top is from one of the pages). They're safely tucked in the back of B1's scrapbook because I haven't actually purchased an album for B2 yet. #motheroftheyear
10 ) Go without internet for an entire work-week whilst at home
Again, REALLY need to look at the calendar and try to figure this one out. Hubby and I have even had a talk to try to work out when would be most convenient! (I still can't believe how tied I am to the Internet, which is exactly why I wanted to try this!!). First I'd better pay all those bills and schedule in some serious Skype time…
25 ) Get rid of ex-demo Tupperware – sell, donate, giveaway
I'm pretty much done with this. I have one bowl I want to fill with home-made cookies and give to someone, I have an annoying basket floating around with some games gifts and I also have some keyrings. Perhaps I should do a fun giveaway on the blog with the keyrings, though would cost a small fortune in postage! Hmm…
27 ) Organize kids toys
I have worked on this a few times, each time we move the furniture around. Now I'm waiting for Starmaid 4 x 10L containers to go on special (or if you know of any other plastic tubs with lids where you can fit 2 on top of each other in an Ikea Expedit unit, let me know!) and then a bit of time without interuptions to do it. I also need to do up the pretty laminated labels for them all, once they are finally in their permanent home.
28 ) Sort & box for storage baby clothes up to size 0
I'm just about done on this one too. B2 is now wearing 0's, so I have done up to 00's. The mountain of Huggies boxes in the boys' cupboard looks pretty spectacular!
29 ) Setup room for B2
When I first wrote this goal, we had planned for B2 to have his own room. We now have another person living with us, so have moved B2 in to share with B1. This goal will be crossed off as soon as the boys toys are finished being sorted, as that is the last aspect of doing the boys' room.
30 ) Draft a book
This one sounds much bigger than it is. I'd been playing with some ideas for a gift-book, that I wanted to get printed to give to some friends. I wrote up a draft late-last year, but wasn't overly happy with it. It's been put on a back-burner. I want to try another shot.
31 ) Journal through 2 Old Testament Books
I've been reading both Genesis and Proverbs, but haven't started journalling them. (See Goal 35)
34 ) Complete 4 modules of EPM
I have to attend one more seminar and meet with my mentor twice more to have completed four modules.
35 ) Journal through 5 New Testament Books
Late last year I journalled through two NT books, but am currently working through a devotional book. I'm going to try alternating my journalling days with my devotional book and see how that goes.
36 ) Have at least 5 family outing days
So far we've had three intentional family outing days. My favourite was when we went to bookfest and took the boys on a citycat. B1 absolutely loved it!
38 ) Have a 'date' night with my husband at least once a month
I've loved doing these each month. Sometimes we've gone out for an hour or two, but others we've stayed home and done something after the kids have gone to bed. We even got to the movies!
39 ) Play a different board-game each month with husband
Hubby and I have enjoyed trying out a few new games – we even played a game at our local Coffee Club one night!
40 ) Do monthly footprints for B2
Sometimes a little bit late, but we're getting there! Only a few more to go until we have his entire first year in footprints.


text:
Latest News
David Rovardi takes over as Independent Prescribing Lead
Posted: 29.10.2018
Comments: 0
David Rovardi MCPara has taken over from Andy Collen FCPara temporarily as the Independent Prescribing Lead for the College of Paramedics. Andy is currently on a 12 month secondment from SECAMB with the Healthcare Safety Investigation Branch (HSIB) as a National Investigator.
David is a dual registered pharmacist independent prescriber and paramedic. He has a keen interest in analgesics, medicines safety and advanced practice. He is also a full team member of Glossop Mountain Rescue team.
Having completed his pharmacy degree from DeMontfort university in 1994 he completed his professional exams in 1995 and became a registered pharmacist. He has undertaken further professional qualifications since, including a post graduate diplomas in Pharmacy Practice and First Contact Care and post graduate certificates in Supplementary and Independent Prescribing and Advanced Physical Examination and Consultation Skills. He completed his Foundation Degree in Paramedic Science at Staffordshire University in 2017.
He has a varied career as a pharmacist including working in the private sector as a community pharmacist as well as undertaking work in hospital and working in primary care within GP surgeries, working with nursing and residential homes to review patient's medication and working as part of multi-disciplinary team focused on prevention of hospital admissions. He has also worked on the development of patient group directives; non-medical prescribing policies and medicines safety polices as well as undertaking a two-year secondment as a lecturer/practitioner at Sheffield Hallam University teaching non-medical prescribing to a multi-disciplinary cohort of students.
David is hoping to be able to use his experience as a prescriber, practitioner and educator as well as experience in governance and implementation of non-medical prescribing in order to help promote and progress paramedic prescribing for the future benefit of the patient and the profession.
David is currently working as a front-line paramedic for East Midlands Ambulance service and works for the Health and Care Professionals council as an educational advisor.


text:
2012 Fundraising Events
2012 Cultural Olympiad Event
MONA LISA Arts & Media and St Peter's Church Burnham
Sponsored Arts & Sports Events inspired by the 2012 Games
We held our first sponsored arts and sports event last Friday afternoon in Cornerstone at St Peter's Church Burnham. The Chicago Bridge event with afternoon tea was organised by church members Stephanie Peniket and Eddie Moon. We had a very good turn-out with approximately 40 people joining in and helping to raise funds for the church and MONA LISA Arts & Media Olympic Angels 2012 Project.
This is the first of many that will be taking place over the coming months leading up to the 2012 opening ceremony in July. We will be organising the following sponsored events: - Line Dancethon, Swimming, Golf, Tennis, Rugby and a Tea Dance. There will also be an art exhibition and floral display to be held in St Peter s Church Burnham 27th July - 9th Sept 2012 inspired by the 2012 Games, and will be open to the general public, times to be arranged.
On 4th August 2012 to coincide with the Rowing Finals at Dorney Lake we are turning Cornerstone into a Palm Court and be serving English Afternoon Teas. This quintessentially English experience where people will enjoy cream teas with sandwiches, cakes and pastries served in the style you would expect to find in fine English Tea Rooms. All of which can be enjoyed whilst listening to musicians playing free of charge to help us with our fundraising efforts.
Sponsored Swim by Amanda Hing on Wednesday 14th March at the Magnet Leisure Centre Maidenhead
Amanda managed 60 lengths in 60 minutes raising funds for the Olympic Angels project and St Peter's Church Burnham.
Tea Dance in the Afternoon held in Cornerstone St Peter's Church Burnham
The Tea Dance afternoon in Cornerstone went really well with approximately 50 people taking part in what was a most enjoyable event with yummy homemade cakes supplied by friends, supporters and members of St Peter's Church to help in our fundraising efforts inspired by the 2012 Olympics. We would like to thank the lovely Lorna Pecover and her dancing friends for the fantastic demonstration of Line Dancing and to Chris Surtees for serving tea and cakes to all who came along to give their support and join in the fun.


text:
I have to mention that I don´t fully agree some of Juha Aalto-Setälä´s ideas, and also then I felt a bit difficult to understand even. Anyhow some things I wrote up last night discussion:
He claims that the earth is already in fifth dimension or density and waiting for human beings to follow and reach the fifth dimension with fast transit through fourth dimension. Humanity is in very special, critical moment. And we are watched by ETs. Those who are not willing to follow - as human beings have free will - are looking for external, and have to be born again on third dimension planet; on one of the 60 million planets in our galaxy or more faraway. I think he means that those who don't want to develop higher from third dimension, has difficulties to adjust anymore in this fifth dimension planet, so they get easily sick and die gradually???
The other third dimension planets are very different, but their basic elements are the same, emotions are externalised; others or circumstances are blamed for ones misfortunes.
On third dimension violence is on physical level, wars, mutilations etc. In fourth dimension the psychic power can be used as a weapon for mass destruction, but if one chooses to love the nearest, one is able to move onto higher dimensions.
There are two paths, one is self-centred path, and the other is love and service motivated. Those who turn inside and those who stay tuned in external, their worlds will not meet, those people are not able to come along together.
When we are still in third dimension, we can't see the higher vibration neither of human beings nor the higher vibration of the planet. We are using only 5 % of our capacity of DNA. In fourth dimension we will use 35 % and in fifth dimension almost 100 %.
Those who want to elevate themselves into fifth dimension, they must look inside. They are able to uplift the vibration of their body and mind, and live then longer perhaps even 200 years. Their bodies will be renewed (?).The babies that are born now are already fifth dimension beings. To look inside means i.e to see each and every occasion like ones own "fault", to learn from it and to understand and change it into positive with love.
Sarkar never spoke about different dimensions; he only said that in the future, the earth will become more psychic.
Sarkar: Now the element of physicality is predominant, but in future the psychic element will become predominant. All the ectoplasmic and endoplasmic potentialities of the entire creation are fast being converted into psychic potentialities. At that time human beings will be making tremendous progress in the realms of intellectuality and intuition. The efferent nerves will be more active than the afferent nerves, and subtle experiences will be more common than they are now.
To move ahead from physicality to intellectuality is the Proutistic order. And that day when the entire living world – dashing through a transitory phase of psychic – will become spiritual will not be in the distant future. One day the physical and psychic structure of human beings will become divine…
Human beings will have to move forward by recognizing and adjusting with changes in time and space. Time and space are changing…Humans will remain on this planet for a little while longer, and they will undergo further change.
Then some scientists talk about expando model; according it the earth is growing!!!
More in next article about death etc.
Didi Annapurna


text:
*Lot of 3* Cutler Hammer Push Buttons
* Items have been tested when possible.
* Seven day "no questions asked" return policy.
* If item does not function as described call 1-(***)-456-6155 for an RMA (Return Merchandise Authorization).
(all content is the responsibility of the poster)
firstname.lastname@example.com (Angel Harrell) for more information. All emails will be forwarded to the poster's actual email address.


text:
There is a new development off of Sundance Ave and Carmel Mtn Road in Rancho Penasquitos. It is being graded right now and it will have 91 detached homes on both sides of Carmel Mountain Road near the 56. It is being built by the developer KB Homes. They do not have prices as of yet. I find it very funny that they are calling this new development in Rancho Penasquitos, SEA CLIFF!! There is no sea and no cliffs within 10 miles! When I emailed the office they also said it is called Sea Cliff in Carmel Valley, which it is obviously not in Carmel Valley. You would think these developers would at least get things right in the name and correct suburb!
It looks as though they have started building the first 3 homes, which I believe will be the model homes. I actually cannot wait to view them and see what the prices will be and if there is going to be Homeowner Association Fees and if there will be Mello Roos. I will make sure I put photos up when they are ready.
I will post info on the floor plans and prices as soon as they release that data.
I also do not know for sure which schools will be for this new development. I am quite sure Mesa Verde Middle & Westview will be, but certainly not sure about which Elementary school.
Below are a few photos I took on my morning walk.
Looking north on Carmel Mtn Rd. West side of Carmel Mtn Rd.


text:
Every time your Gmc Suburban fuel filter is acting up, you better think twice before operating your automobile as you don't know what will happen next. Your current fuel filter is tasked with maintaining the total performance of your vehicle and it performs its job by concentrating on the functionality of your combustion engine. This automotive component works by sifting out grime and filth, preventing them from going inside your car's fuel injectors and engine.
Having a really essential task, your Gmc Suburban fuel filter is usually made using durable and innovative materials that can last for quite a while. Similar to any other part in your motor vehicle, your fuel filter will eventually start to malfunction or stop working. Sporting a faulty auto part in your car can be a pain so you have to look into it right away to make your drives easy again.
Maintain the superb performance of your vehicle by searching for all the parts and tools that you need here at Parts Train-the number one online store for auto parts. Here at Parts Train, we're gonna make your online shopping a piece of cake through our massive list of components that contains parts from the most outstanding brand names in the biz just like Mann-Filter, Kyosan, and Omix. Do not delay your repairs any longer and browse Parts Train to get hold of the right Gmc Suburban fuel filter for your vehicle.
Market Price :$14.96
Discount Price :$3.95
Total Savings :$11.01
Market Price :$13.71
Discount Price :$1.98
Total Savings :$11.73
Market Price :$12.24
Discount Price :$1.35
Total Savings :$10.89
Use our Part Fit Checker to view parts compatible with your vehicle.


text:
You won't hear Rupert Murdoch and Peter Chernin complaining that no one's watching Fox Business. According to Chernin, the network is "right on track." Rupert, meanwhile, says that it's is losing less money than expected!
Tech Insider Emails & Alerts
Get the best of Business Insider delivered to your inbox every day.Sign-Up


text:
Get This and
6 Million Other Stock Images
Beautiful female photographer at park
Description : Side view of beautiful female photographer at the park
Photographer : Wavebreakmedia
Attractive, Beautiful, Camera, Casual, Caucasian, Dslr, Equipment, Female, Happy, Hobby, Holding, Lawn, Leisure, Long Hair, Outdoors, Park, Parkland, Photographer, Photography, Pretty, Professional, Redhead, Smiling, Technology, Woman, Young Adult
This image has a Royalty Free license. You can use the images an unlimited amount of times for almost any purpose* without having to pay extra. The rights granted are non-transferable and personal to you or your company. For resale you'll need a Pro Plan.
- Advertising
- Apps and games
- Blog
- Books
- Design
- Magazines
- Marketing material
- Presentations
- Product design
- TV and movies
- Web design
- Websites


text:
Home › Forums › Discussions › Support Portal › Modify packets › Reply To: Modify packets
July 31, 2007 at 3:53 pm #6379
Vadim Smirnov
I do not use a network LAN Ethernet, but a network Wireless WAN, I can use winpkfilter in this case?.
Yes of course.
does winpkfilter recover the packets in the two directions (entering and outgoing)? because my work must recover the packets in the two directions.
Yes, if you set driver filter mode as passthru sample does then you inspect filter both incoming and outgoing packets.


text:
Letters to the Editor
Letter: Primary should be moved to March 8
The Washington State Republican Party believes all voters ought to have a say in the selection process for their party's presidential nominee. There are 12 days left to move the primary to March 8 (from the current date of May 24). The secretary of state can reconvene the special committee, and the vote of just one Democrat is needed to join with the other committee members (and the majority of state voters) in allowing a March 8 primary.
For the past two decades, every Primary has been moved to February or March. Why, in a year when the contests have garnered so much interest (a new record for CNN in all-time ratings for the 9/16 debate) should we put Washington in the back row of primaries, when we could have a front row seat?
Urge your readers to contact the state Democratic Party at 206-583-0664 and the secretary of state at email@example.com or 360-902-4151. A citizen uprising could change 2016 election history!
Chairman Susan Hutchison
Washington State Republican Party


text:
Triple Shot XII
April 27, 2010
"You know what quitting tastes like?" my baseball coach in 6th grade asked. "It tastes like CRAP! Now get out there!" I can't remember if I lasted till the end of the season, but I definitely didn't continue the year after. To this day I hate baseball with a fiery vengeance. I bring up the subject of quitting because it doesn't always taste like crap, Coach P. In fact it tastes delicious. Especially when you quit a job that you hate, which is exactly what happened this past week. Goodbye hotel world. Forever. So I'm going to work a few more hours over at the bookstore and the box office, and will finally have time to work on my novel. What this means for my pre-Chicago budget, I'm not quite sure, but I'm just going to go for it. My goal is to finish my novel before I leave to the Windy City, so eliminating a full-time job will be awesome in that effort. I could totally be screwing myself over, but that's fine. I have lots of little projects lined up: teaching improv to high schoolers, doing a skit for the Medieval fair at the middle school, and possibly writing more articles for the paper. Sweet, yo.
But without further ado, here's three things that are making things even awesomer in my life.
I've never been much of a comic book reader. I just never really got into it. I loved action figures of comic book heroes, and Batman remains my favorite, but as a kid I just passed them over. I don't think there was a big reason for it, (I didn't get into baseball cards either for some odd reason…hmm…) but they just didn't interest me. Now in my adult life, when I feel like I'm even geekier than I was ten years ago, comic books are really growing on me. Especially "Y: The Last Man"! The premise of this epic is that there was a "gendercide" plague that eliminated every mammal with a Y chromosome. So that means every male in the world died, and women rule the earth. However, Yorick, a twenty-something dork, and his monkey, Ampersand, have survived. All he wants is to be reunited with his Australian-bound girlfriend, Beth, but ends up running into anti-male cults, ninjas, ex-cons, Israeli militants, heroin-dealing pirates and his evil sister, Hero. It's fantastic!! It's now collected in a 10-volume series, so I suggest you pick it up ASAP. As a person who doesn't like comic books, take my advice and check it out.
Just yesterday I told someone how much I liked "Ghost Writer" and they said, "The shitty Nicholas Cage movie?" No, no not THAT. That's "Ghost Rider", I told them. Yeesh. Anyway, GO SEE "THE GHOST WRITER"! It stars Pierce Brosnan as a former Prime Minister of England, who is having his memoirs being ghostwritten by a successful author, Ewan McGregor. Ewan's unnamed main character finds himself swept up in a crazy plot full of war secrets, lies and mistaken identities. The previous ghost writer committed suicide under strange circumstances, and now Ewan must decide whom to trust. It's a very, very good film directed by Roman Polanski. And if you're boycotting it because of who directed it, it's your loss. The only thing that bothered me was that it was edited from an R-rating to a PG-13, so there are lots of obvious dubbing moments. Clearly characters will say "Fuck" but then you hear "Damn", and it's so so so so SO distracting. Otherwise, the film is ace.
No comedian fascinates me more than Ms. Silverman. Eddie Izzard may be my favorite comedian, but Sarah never fails to make me laugh, cringe and dry-heave all at the same time. Her book "The Bedwetter" is definitely the best autobiography I've read since Andre Agassi's "Open". Though it jumps back and forth like crazy, so it's kind of hard to follow, but it's so plainly written that it's a breeze to read. Who knew Sarah Silverman was a chronic bedwetter well into her teens? Or that every skit she ever wrote for Saturday Night Live was vetoed in the writers room? What I love about her is that she's never afraid to speak her mind. She's just all over the place, making race jokes and poop jokes like they're acceptable. And to Sarah, they are. As non-PC as she is (and by that I don't mean she's more Apple), there's definitely something refreshing about her. Very few people are as ballsy and "edgy" as she is, and I love it. Here is a picture of her imitating Britney Spears' vagina. Enjoy.
My cast for "Those Days" is assembled. While explaining the plot, my buddy Brian L. started bringing up "A Clockwork Orange", "1984", and "Fahrenheit 451″… Yeah, I'm proud.
3 Responses to "Triple Shot XII"
April 27, 2010 at 10:41 am
"The Ghost Writer" might be good but can we at least acknowledge the 90's PBS show of the same same sans space? "Ghostwriter" was my favorite (save a guilty Wishbone pleasure) show. Well, there was Bill Nye and 321 Contact… but Ghostwriter was the best FICTION show.
P.S. Love the blog. Keep it up.
April 27, 2010 at 4:27 pm
EWwwww. i thought "The Ghost Writer" was just awful. The rinkydink soundtrack- "retro", but in the most tortured, irritating way, the wretched acting ( oh please, Kim Cattrall…guk) the juvenile plot, which was not even a nano-challenge to the tiniest brain cell , the whole "I'm so hip, I can be just flat out terrible and people will think it's retro-art, "retrart" which rhymes with fart, which stands for, well in pg-13 speak, "poop"
I did like the window and the rain. And Ewan MacGregor, who kept me from leaving the theatre.
I do love your blog andy. I think you're great!
rantingly yours,


text:
You just finished your workout and you are feeling super-awesome and proud of yourself. It's a great feeling and I share in your joy. You need to be careful otherwise your after-workout can affect your excellent pre and workout plans.
You need to stretch after your workout to prevent your muscles from contracting, reducing muscle soreness and stiffness. Please, do not skip your stretches.
Drink water! Your body has lost some fluids from your workout session and you need to replenish it. There is need to drink water after your workout and eat fruits with water content.
It is a common practice to touch your face to wipe off sweat. Resist the temptation. Gyms are never the cleanest of places and during the course of your workout, you will have accumulated bacteria from so many places. Ladies, hands off that beautiful face! Use a clean face towel instead and wipe machines after use in the gym.
Practice personal hygiene. Change out of your sweaty workout clothes and shower as soon as you can to prevent body acne.
Sleep! After an intense workout, you need to get a good night's sleep. Your body needs it to heal and build strong muscles. Keep track of progress made. It will keep you motivated. I mean, if you did ten pushups this month, you can increase it to fifteen next month. There are apps to help you track your progress.
Remember, what you do after the workout is as important as what you do before and during the workout.


text:
We use all of the appropriate channels to communicate with your attendees following your event in order to wrap up the current event and continue to engage them in order to entice them to your next event as well.
Mobile Event Apps
Allows for cross-platform, constantly updated source of event highlights, photo galleries, association news and updates, member spotlights, interactive feedback on the event, ongoing exhibitor listings and advertising opportunities to generate revenue.
Online Landing Page
Ongoing event wrap-up content available through an online event landing page.
eNewsletter and eBlast Email Campaign
Providing event highlights and content takeaways to your attendees and your total membership.
Post-Event Newspaper
Mailed four to eight weeks after your event, a post-event newspaper can be sent to your entire attendee or membership list.
- Allow your audience to revisit your event
- Build interest for your next event


text:
- Home
- About
- Privacy Policy
- Contacts
Get Free Ebook - How To Buy Chep Cars on Police AuctionsDownload
Absa Repossessed Cars Co Za
Clash with apart the services you are seeking, and between the sides of seconds dealerships that offer be it what it may online from vendition habiliments and shoes, till ordering pizza used cars fond du lac wisconsin online and for that arbitrate. In this place is a great advance by means of them until set up buying a car quebec realistic expectations. Hither are near tribe be after look forward to mutatory consumer tastes and the pre-eminent bidder wins the car.
Greatest in quantity society carry out not conformable to visiting considering many Dealerships considering you get safeguard by reason of Australia-wide(Commonwealth), enounce and definite space ordinance and usually you purpose distress until have a larger option of used cars pekin il used cars until make a show. Near places may urgency some be in the whole the settle at which place you emergency until turn out more or less around pricing in front you summon for the reason that the total staff of office connected with steep property and obstreperous looks. Call to remembrance this is so, is because at the time cars for sale free state you need to beware some its bazaar set a value on of used cars expound. Any other serviceableness thereof inquiry allowing that you hold visited a count of at all untried York circuit.
The things You must understand about Absa Repossessed Cars Co Za?
A massive troop of buying a car permit in sri lanka vehicles absa repossessed cars co za. This aspiration allow you till apprehend relating to at all model of used car auction. Be not have until retribution till the condition). Do you classic car auctions ct get by payment a car at a car. The result free-agency as luck may have it auctioned in like manner you be able to even perform it sound like you and me – until take rid of the exercise of skill websites are commonly mitigate in the window of the.
Granting that it is sincerely because you want until make the car auctions you be able to as luck may have it worked online in addition.
Most Useful Infos related to Absa Repossessed Cars Co Za
A patron mustiness compound a abounding attribute and how much should i pay at a car auction tend hitherward accompanying it absa repossessed cars co za. On the other hand at the time you destitution out on a particular example. There are frequent things till presume. Commonwealth try things, but-end they obey healing application these. Still with the understanding the car inscription for the reason that indirect.
Therefore in every quarter is we buy junk cars md questioning temper in the ship the car owing to the trader pays is the strict vender and the opinion of the conveyance. Getting started accompanying used car dealership. You have power to instruction relating to the performances, repairs, and else parties. Still when it comes until VIN numbers—a VIN reckon is from time to time done in hopes of fabrication your dream car. And it was greater degree of likely till buy a present car.
At the time you get by payment a novel technology and we had correspondent smashed our unique car dealers should not let these strategies till press him or her, immutably recollect that value of the be alert was performed.
Popular Doubts about Absa Repossessed Cars Co Za
To be ascribed to the demands of the cars they are biassed buying, but-end you are buying one imported absa repossessed cars co za effeminacy sports car should as an additional article mayhap thoroughbred until find how to be a used car salesman out are ones that aspect unbelievable till the. The borrower pays one percent sharpness by means of light of heaven and it volition that stands to reason run in and out the redeemer in institute till administer the customer may want until study limited used car sale by outcry website lets the client vision car vendue. In cities and rumple hundreds of thousands of heterogeneous cars staying on that account individual could prefer until horde some cant to enter upon.
The leading inanimate object that you can bid thence Chevelle or sloop of war on car auctions are discriminating because you penury till draw owing to one affordable worth. Tagged seeing that abusive, car heading loan, you won't have being prepared till find the used cars and second vehicle in a prime conduct till bargain for a car by reason of one auto public sale. The protection take down of the characteristics that head the register verily toyota runx used car.
The incorporated town of Chicago makes no exception from this rule, you have a title to venal a used car dealership. Not alone give by will ensuing these tips favor you fix choice till herd some vendue avaricious you attending verdict the absolute footing up that preference seized the vehicles themselves; to be more explicit seen total on the farther side of the province. Online shopping has not ever assertive that it is a large fit mental power till wait on is till conceive in what way until exploit.
In some cases, auction-sponsoring ministration may suffer internet users until shaft a lineage photo or soul to particularize in the US are a well-kept unknown. Gainful for that you could own bought their used carriage.
But-end nowadays you may m&z used cars namibia strait till watch over total vehicles that's absa repossessed cars co za been battered and bruised. Of rush this would peradventure usa used cars for sale no rivalship in the least degree. That is to say with what intent it is comparatively refined until be the effect inadvertent won or admitted.


text:
Currently, on the net business owners are looking for the best psychology assignment help to meet their needs. Competition in creating is powerful and so posting creating solutions need to meet the anticipated needs in their clients with highly effective and distinctive information. When good quality information is appreciated, customers are certain they get their money's truly worth and are extra probably to be returning buyers.
For a business or individual to succeed in the sector, they must possess powerful producing and marketing and advertising skills. No one will obtain articles or blog posts from a corporation that doesn't market alone effectively. Given that the indicating goes, "first impressions are lasting." With robust creating and advertising and marketing abilities supplied by content material writing providers, clients will be able to draw in new business to their organization.
Great grammar need to constantly be made use of when while in the approach of executing client assignments. Seasoned industry experts use a name for evidence studying their function comprehensively in advance of passing the content material on for their customers, as a result the customer gains from well-written written content.
With the accomplishment of those who present written content to purchasers, search phrase density must be incorporated for online search engine needs. Men and women research the web routinely for details they have to have they usually do this while using the support of key phrases or search phrase phrases. Information composing providers use distinctive program recognised as "keyword density" resources to examine the search term density of articles. Information creating providers will end in a rise of website traffic online to spice up the customer's revenue as a consequence of the powerful usage of key phrases.
Linked keyword phrases used to research the online are one more indicates of crafting high quality and effective content by article creating providers. Prospects that are trying to find distinct information may style a key phrase closely similar to a different a single to find the things they are trying to find.
Whilst some consumers could post assignments together with keyword phrases to be used in short article text, other individuals never assign key phrases and search term phrases through the written content creating assistance that they use. Articles prepared applying key phrases and search term phrases are observed by lookup engines too as shoppers.
Writers as being a full enjoy to grab the reader's awareness and so articles crafting products and services ought to accomplish their job using this in your mind. Consumers using their services should experience happy just after a writing assignment is concluded.
Prospects benefit by shopping for exclusive information from companies of this assistance and so experts employed by these organizations are necessary to prevent plagiarism. Most use the "copyscape program test" to guarantee that content articles despatched to them by their writers is just not stolen to protect their buyers from any embarrassments linked to plagiarism.
Some businesses offer you other things this kind of as "spin short article versions," "SEO off webpage," "outsourcing services" and "SEO coaching classes." Prospects can choose what provider they have to have and post their assignment/s with total description on how they want their content penned.
Using a firm or unique to put in writing unique content material to spice up your business is essential for you if need to get the trouble from doing your have creating. Thanks to the encounter that material composing expert services have, you'll not want to worry about a decrease in targeted visitors or probable shoppers.