text:
This section describes all you really need to know to build a packet filter that meets your needs.
The kernel starts with three lists of rules; these lists are called
firewall chains or just chains. The three chains are
called input, output and forward. When a packet comes
in (say, through the Ethernet card) the kernel uses the input
chain to decide its fate. If it survives that step, then the kernel
decides where to send the packet next (this is called routing).
If it is destined for another machine, it consults the forward
chain. Finally, just before a packet is to go out, the kernel
consults the output
A chain is a checklist of rules. Each rule says `if the packet header looks like this, then here's what to do with the packet'. If the rule doesn't match the packet, then the next rule in the chain is consulted. Finally, if there are no more rules to consult, then the kernel looks at the chain policy to decide what to do. In a security-conscious system, this policy usually tells the kernel to reject or deny the packet.
For ASCII-art fans, this shown the complete path of a packet coming into a machine.
---------------------------------------------------------------- | ACCEPT/ lo interface | v REDIRECT _______ | --> C --> S --> ______ --> D --> ~~~~~~~~ -->|forward|----> _______ --> h a |input | e {Routing } |Chain | |output |ACCEPT e n |Chain | m {Decision} |_______| --->|Chain | c i |______| a ~~~~~~~~ | | ->|_______| k t | s | | | | | s y | q | v | | | u | v e v DENY/ | | v m | DENY/ r Local Process REJECT | | DENY/ | v REJECT a | | | REJECT | DENY d --------------------- | v e ----------------------------- DENYHere is a blow-by-blow description of each stage:
This is a test that the packet hasn't been corrupted in some way. If it has, it is denied.
There is actually one of these sanity checks before each firewall chain, but the input chain's is the most important. Some malformed packets might confuse the rule-checking code, and these are denied here (a message is printed to the syslog if this happens).
This is the first firewall chain against which the
packet will be tested. If the verdict of the chain is not DENY
or REJECT
, the packet continues on.
If the packet is a reply to a previously
masqueraded packet, it is demasqueraded, and skips straight to the
chain. If you don't use IP Masquerading, you can mentally
erase this from the diagram.
The destination field is examined by the routing code, to decide if this packet should go to a local process (see Local process below) or forwarded to a remote machine (see forward chain below).
A process running on the machine can receive packets after the Routing Decision step, and can send packets (which go through the Routing Decision step, then traverse the output chain).
If packets from a local process are destined for a local process, they will go through the output chain with interface set to `lo', then return through the input chain with interface also `lo'. The lo interface is usually called the loopback interface.
If the packet was not created by a local process, then the forward chain is checked, otherwise the packet goes to the output chain.
This chain is traversed for any packets which are attempting to pass through this machine to another.
This chain is traversed for all packets just before they are sent out.
First, check that you have the version of ipchains that this document refers to:
$ ipchains --version
ipchains 1.3.9, 17-Mar-1999
Note that I recommend 1.3.4 (which has no long options, like `--sport'), or 1.3.8 or above; these are very stable.
ipchains has a fairly detailed manual page (man ipchains
and if you need more detail on particulars, you can check out the
programming interface (man 4 ipfw
), or the file
in the 2.1.x kernel source, which is
(obviously) authoritative.
There is also an excellent quick reference card by Scott Bronson in the source package, in both A4 and US Letter PostScript(TM).
There are several different things you can do with ipchains
First the operations to manage whole chains. You start with three
built-in chains input
, output
and forward
which you can't delete.
There are several ways to manipulate rules inside a chain:
There are a few operations for masquerading, which are in
for want of a good place to put them:
The final (and perhaps the most useful) function allows you to check what would happen to a given packet if it were to traverse a given chain.
Before any ipchains commands have been run (be careful: some distributions run ipchains in their initialization scripts), there will be no rules in any of the built-in chains (`input', `forward' and `output'), and each of the chains will have a policy of ACCEPT. This is as wide-open as you can get.
This is the bread-and-butter of ipchains; manipulating rules. Most commonly, you will probably use the append (-A) and delete (-D) commands. The others (-I for insert and -R for replace) are simple extensions of these concepts.
Each rule specifies a set of conditions the packet must meet, and what to do if it meets them (a `target'). For example, you might want to deny all ICMP packets coming from the IP address 127.0.0.1. So in this case our conditions are that the protocol must be ICMP and that the source address must be 127.0.0.1. Our target is `DENY'.
127.0.0.1 is the `loopback' interface, which you will have even if you have no real network connection. You can use the `ping' program to generate such packets (it simply sends an ICMP type 8 (echo request) which all cooperative hosts should obligingly respond to with an ICMP type 0 (echo reply) packet). This makes it useful for testing.
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# ipchains -A input -s 127.0.0.1 -p icmp -j DENY
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
You can see here that the first ping succeeds (the `-c 1' tells ping to only send a single packet).
Then we append (-A) to the `input' chain, a rule specifying that for packets from 127.0.0.1 (`-s 127.0.0.1') with protocol ICMP (`-p ICMP') we should jump to DENY (`-j DENY').
Then we test our rule, using the second ping. There will be a pause before the program gives up waiting for a response that will never come.
We can delete the rule in one of two ways. Firstly, since we know that it is the only rule in the input chain, we can use a numbered delete, as in:
# ipchains -D input 1
To delete rule number 1 in the input chain.
The second way is to mirror the -A command, but replacing the -A with -D. This is useful when you have a complex chain of rules and you don't want to have to count them to figure out that it's rule 37 that you want to get rid of. In this case, we would use:
# ipchains -D input -s 127.0.0.1 -p icmp -j DENY
The syntax of -D must have exactly the same options as the -A (or -I
or -R) command. If there are multiple identical rules in the same
chain, only the first will be deleted.
We have seen the use of `-p' to specify protocol, and `-s' to specify source address, but there are other options we can use to specify packet characteristics. What follows is an exhaustive compendium.
Source (-s) and destination (-d) IP addresses can be specified in four ways. The most common way is to use the full name, such as `localhost' or `www.linuxhq.com'. The second way is to specify the IP address such as `127.0.0.1'.
The third and fourth ways allow specification of a group of IP addresses, such as `184.108.40.206/24' or `18.104.22.168/255.255.255.0'. These both specify any IP address from 22.214.171.124 to 184.108.40.206 inclusive; the digits after the `/' tell which parts of the IP address are significant. `/32' or `/255.255.255.255' is the default (match all of the IP address). To specify any IP address at all `/0' can be used, like so:
# ipchains -A input -s 0/0 -j DENY
This is rarely used, as the effect above is the same as not specifying the `-s' option at all.
Many flags, including the `-s' and `-d' flags can have their arguments preceded by `!' (pronounced `not') to match addresses NOT equal to the ones given. For example. `-s ! localhost' matches any packet not coming from localhost.
Don't forget the spaces around the `!': they really are needed.
The protocol can be specified with the `-p' flag. Protocol can be a number (if you know the numeric protocol values for IP) or a name for the special cases of `TCP', `UDP' or `ICMP'. Case doesn't matter, so `tcp' works as well as `TCP'.
The protocol name can be prefixed by a `!', to invert it, such as `-p ! TCP'.
For the special case where a protocol of TCP or UDP is specified, there can be an extra argument indicating the TCP or UDP port, or an (inclusive) range of ports (but see Handling Fragments below). A range is represented using a `:' character, such as `6000:6010', which covers 11 port numbers, from 6000 to 6010 inclusive. If the lower bound is omitted, it defaults to 0. If the upper bound is omitted, it defaults to 65535. So to specify TCP connections coming from ports under 1024, the syntax would be as `-p TCP -s 0.0.0.0/0 :1023'. Port numbers can be specified by name, eg. `www'.
Note that the port specification can be preceded by a `!', which inverts it. So to specify every TCP packet BUT a WWW packet, you would specify
-p TCP -d 0.0.0.0/0 ! www
It is important to realize that the specification
-p TCP -d ! 192.168.1.1 www
is very different from
-p TCP -d 192.168.1.1 ! www
The first specifies any TCP packet to the WWW port on any machine but 192.168.1.1. The second specifies any TCP connection to any port on 192.168.1.1 but the WWW port.
Finally, this case means not the WWW port and not 192.168.1.1:
-p TCP -d ! 192.168.1.1 ! www
ICMP also allows an optional argument, but as ICMP doesn't have ports, (ICMP has a type and a code) they have a different meaning.
You can specify them as ICMP names (use ipchains -h icmp
to list the
names) after the `-s' option, or as a numeric ICMP type and code,
where the type follows the `-s' option and the code follows the `-d'
The ICMP names are fairly long: you only need use enough letters to make the name distinct from any other.
Here is a small table of some of the most common ICMP packets:
Number Name Required by
0 echo-reply ping
3 destination-unreachable Any TCP/UDP traffic.
5 redirect routing if not running routing daemon
8 echo-request ping
11 time-exceeded traceroute
Note that the ICMP names cannot be preceeded by `!' at the moment.
DO NOT DO NOT DO NOT block all ICMP type 3 messages! (See ICMP Packets below).
The `-i' option specifies the name of an interface to match. An
interface is the physical device the packet came in on, or is going
out on. You can use the ifconfig
command to list the interfaces
which are `up' (ie. working at the moment).
The interface for incoming packets (ie. packets traversing the input
chain) is considered to be the interface they came in on. Logically,
the interface for outgoing packets (packets traversing the output
chain) is the interface they will go out on. The interface for
packets traversing the forward
chain is also the interface they will
go out on; a fairly arbitrary decision it seems to me.
It is perfectly legal to specify an interface that currently does not
exist; the rule will not match anything until the interface comes up.
This is extremely useful for dial-up PPP links (usually interface
) and the like.
As a special case, an interface name ending with a `+' will match all
interfaces (whether they currently exist or not) which begin with that
string. For example, to specify a rule which matches all PPP
interfaces, the -i ppp+
option would be used.
The interface name can be preceded by a `!' to match a packet which does NOT match the specified interface(s).
It is sometimes useful to allow TCP connections in one direction, but not the other. For example, you might want to allow connections to an external WWW server, but not connections from that server.
The naive approach would be to block TCP packets coming from the server. Unfortunately, TCP connections require packets going in both directions to work at all.
The solution is to block only the packets used to request a connection. These packets are called SYN packets (ok, technically they're packets with the SYN flag set, and the FIN and ACK flags cleared, but we call them SYN packets). By disallowing only these packets, we can stop attempted connections in their tracks.
The `-y' flag is used for this: it is only valid for rules which specify TCP as their protocol. For example, to specify TCP connection attempts from 192.168.1.1:
-p TCP -s 192.168.1.1 -y
Once again, this flag can be inverted by preceding it with a `!', which means every packet other than the connection initiation.
Sometimes a packet is too large to fit down a wire all at once. When this happens, the packet is divided into fragments, and sent as multiple packets. The other end reassembles the fragments to reconstruct the whole packet.
The problem with fragments is that some of the specifications listed above (in particular, source port, destinations port, ICMP type, ICMP code, or TCP SYN flag) require the kernel to peek at the start of the packet, which is only contained in the first fragment.
If your machine is the only connection to an external network, then
you can tell the Linux kernel to reassemble all fragments which pass
through it, by compiling the kernel with IP: always defragment
to `Y'. This sidesteps the issue neatly.
Otherwise, it is important to understand how fragments get treated by
the filtering rules. Any filtering rule that asks for information we
don't have will not match. This means that the first fragment is
treated like any other packet. Second and further fragments won't be.
Thus a rule -p TCP -s 192.168.1.1 www
(specifying a source port of
`www') will never match a fragment (other than the first fragment).
Neither will the opposite rule -p TCP -s 192.168.1.1 ! www
However, you can specify a rule specifically for second and further fragments, using the `-f' flag. Obviously, it is illegal to specify a TCP or UDP port, ICMP type, ICMP code or TCP SYN flag in such a fragment rule.
It is also legal to specify that a rule does not apply to second and further fragments, by preceding the `-f' with `!'.
Usually it is regarded as safe to let second and further fragments through, since filtering will effect the first fragment, and thus prevent reassembly on the target host, however, bugs have been known to allow crashing of machines simply by sending fragments. Your call.
Note for network-heads: malformed packets (TCP, UDP and ICMP packets too short for the firewalling code to read the ports or ICMP code and type) are treated as fragments as well. Only TCP fragments starting at position 8 are explicitly dropped by the firewall code (a message should appear in the syslog if this occurs).
As an example, the following rule will drop any fragments going to 192.168.1.1:
# ipchains -A output -f -d 192.168.1.1 -j DENY
OK, so now we know all the ways we can match a packet using a rule. If a packet matches a rule, the following things happen:
For variety, I'll address these in order of importance.
A target tells the kernel what to do with a packet that matches a rule. ipchains uses `-j' (think `jump-to') for the target specification. The target name must be less than 8 letters, and case matters: "RETURN" and "return" are completely different.
The simplest case is when there is no target specified. This type of rule (often called an `accounting' rule) is useful for simply counting a certain type of packet. Whether this rule matches or not, the kernel simply examines the next rule in the chain. For example, to count the number of packets from 192.168.1.1, we could do this:
# ipchains -A input -s 192.168.1.1
(Using `ipchains -L -v' we can see the byte and packet counters associated with each rule).
There are six special targets. The first three, ACCEPT
and DENY
are fairly simple. ACCEPT
allows the
packet through. DENY
drops the packet as if it had never been
received. REJECT
drops the packet, but (if it's not an ICMP
packet) generates an ICMP reply to the source to tell it that the
destination was unreachable.
The next one, MASQ
tells the kernel to masquerade the packet. For
this to work, your kernel needs to be compiled with IP Masquerading
enabled. For details on this, see the Masquerading-HOWTO and the
Differences between ipchains and ipfwadm. This target is only valid for packets traversing the
The other major special target is REDIRECT
which tells the kernel
to send a packet to a local port instead of wherever it was heading.
This can only be specified for rules specifying TCP or UDP as their
protocol. Optionally, a port (name or number) can be specified
following `-j REDIRECT' which will cause the packet to be redirected
to that particular port, even if it was addressed to another port.
This target is only valid for packets traversing the input
The final special target is RETURN
which is identical to falling
off the end of the chain immediately. (See
Setting Policy below).
Any other target indicates a user-defined chain (as described in Operations on an Entire Chain below). The packet will begin traversing the rules in that chain. If that chain doesn't decide the fate of the packet, then once traversal on that chain has finished, traversal resumes on the next rule in the current chain.
Time for more ASCII art. Consider two (silly) chains: input
built-in chain) and Test
(a user-defined chain).
`input' `Test' ---------------------------- ---------------------------- | Rule1: -p ICMP -j REJECT | | Rule1: -s 192.168.1.1 | |--------------------------| |--------------------------| | Rule2: -p TCP -j Test | | Rule2: -d 192.168.1.1 | |--------------------------| ---------------------------- | Rule3: -p UDP -j DENY | ----------------------------
Consider a TCP packet coming from 192.168.1.1, going to 184.108.40.206. It
enters the input
chain, and gets tested against Rule1 - no match.
Rule2 matches, and its target is Test
, so the next rule examined
is the start of Test
. Rule1 in Test
matches, but doesn't
specify a target, so the next rule is examined, Rule2. This doesn't
match, so we have reached the end of the chain. We return to the
chain, where we had just examined Rule2, so we now examine
Rule3, which doesn't match either.
So the packet path is:
v __________________________ `input' | / `Test' v ------------------------|--/ -----------------------|---- | Rule1 | /| | Rule1 | | |-----------------------|/-| |----------------------|---| | Rule2 / | | Rule2 | | |--------------------------| -----------------------v---- | Rule3 /--+___________________________/ ------------------------|--- v
See the section How to Organise Your Firewall Rules for ways to use user-defined chains effectively.
This is a side effect that matching a rule can have; you can have the matching packet logged using the `-l' flag. You will usually not want this for routine packets, but it is a useful feature if you want to look for exceptional events.
The kernel logs this information looking like:
Packet log: input DENY eth0 PROTO=17 192.168.2.1:53 192.168.1.1:1025
L=34 S=0x00 I=18 F=0x0000 T=254
This log message is designed to be terse, and contain technical information useful only to networking gurus, but it can be useful to the rest of us. It breaks down like so:
On standard Linux systems, this kernel output is captured by klogd (the kernel logging daemon) which hands it to syslogd (the system logging daemon). The `/etc/syslog.conf' controls the behaviour of syslogd, by specifying a destination for each `facility' (in our case, the facility is "kernel") and `level' (for ipchains, the level used is "info").
For example, my (Debian) /etc/syslog.conf contains two lines which match `kern.info':
kern.* -/var/log/kern.log
mail,news.none -/var/log/messages
These mean that the messags are duplicated in `/var/log/kern.log' and `/var/log/messages'. For more details, see `man syslog.conf'.
There are four seldom-used bits in the IP header, called the Type of Service (TOS) bits. They effect the way packets are treated; the four bits are "Minimum Delay", "Maximum Throughput", "Maximum Reliability" and "Minimum Cost". Only one of these bits is allowed to be set. Rob van Nieuwkerk, the author of the TOS-mangling code, puts it as follows:
Especially the "Minimum Delay" is important for me. I switch it on for "interactive" packets in my upstream (Linux) router. I'm behind a 33k6 modem link. Linux prioritizes packets in 3 queues. This way I get acceptable interactive performance while doing bulk downloads at the same time. (It could even be better if there wasn't such a big queue in the serial driver, but latency is kept down 1.5 seconds now).
Note: obviously, you have no control over incoming packets; you can only control the priority of packets leaving your box. To negotiate priorities with the other end, a protocol like RSVP (which I know nothing about, so don't ask me) must be used.
The most common use is to set telnet & ftp control connections to "Minimum Delay" and FTP data to "Maximum Throughput". This would be done as follows:
ipchains -A output -p tcp -d 0.0.0.0/0 telnet -t 0x01 0x10
ipchains -A output -p tcp -d 0.0.0.0/0 ftp -t 0x01 0x10
ipchains -A output -p tcp -s 0.0.0.0/0 ftp-data -t 0x01 0x08
The `-t' flag takes two extra parameters, both in hexadecimal. These allow complex twiddling of the TOS bits: the first mask is ANDed with the packet's current TOS, and then the second mask is XORed with it. If this is too confusing, just use the following table:
TOS Name Value Typical Uses
Minimum Delay 0x01 0x10 ftp, telnet
Maximum Throughput 0x01 0x08 ftp-data
Maximum Reliability 0x01 0x04 snmp
Minimum Cost 0x01 0x02 nntp
Andi Kleen goes on to point out the following (mildly edited for posterity):
Maybe it would be useful to add an reference to the txqueuelen parameter of ifconfig to the discussion of TOS bits. The default device queue length is tuned for ethernet cards, on modems it is too long and makes the 3 band scheduler (which queues based on TOS) work suboptimally. It is a good idea to set it to a value between 4-10 on modem or single b channel ISDN links: on bundled devices a longer queue is needed. This is a 2.0 and 2.1 problem, but in 2.1 it is a ifconfig flag (with recent nettools), while in 2.0 it requires source patches in the device drivers to change.
So, to see maximal benifits of TOS manipulation for modem PPP links, do `ifconfig $1 txqueuelen' in your /etc/ppp/ip-up script. The number to use depends on the modem speed and the amount of buffering in the modem; here's Andi setting me straight again:
The best value for a given configuration needs experiment. If the queues are too short on a router then packets will get dropped. Also of course one gets benefits even without TOS rewriting, just that TOS rewriting helps to give the benefits to non cooperating programs (but all standard linux programs are cooperating).
This allows complex and powerful interactions with Alexey Kuznetsov's new Quality of Service implementation, as well as the mark-based forwarding in later 2.1 series kernels. More news as it comes to hand. This option is ignored altogether in the 2.0 kernel series.
A very useful feature of ipchains is the ability to group related
rules into chains. You can call the chains whatever you want, as long
as the names don't clash with the built-in chains (input
and forward
) or the targets (MASQ
or RETURN
suggest avoiding upper-case labels entirely, since I may use these for
future extensions. The chain name can be up to 8 characters long.
Let's create a new chain. Because I am such an imaginative fellow,
I'll call it test
# ipchains -N test
It's that simple. Now you can put rules in it as detailed above.
Deleting a chain is simple as well.
# ipchains -X test
Why `-X'? Well, all the good letters were taken.
There are a couple of restrictions to deleting chains: they must be empty (see Flushing a Chain below) and they must not be the target of any rule. You can't delete any of the three built-in chains.
There is a simple way of emptying all rules out of a chain, using the `-F' command.
# ipchains -F forward
If you don't specify a chain, then all chains will be flushed.
You can list all the rules in a chain by using the `-L' command.
# ipchains -L input
Chain input (refcnt = 1): (policy ACCEPT)
target prot opt source destination ports
ACCEPT icmp ----- anywhere anywhere any
# ipchains -L test
Chain test (refcnt = 0):
target prot opt source destination ports
DENY icmp ----- localnet/24 anywhere any
The `refcnt' listed for test
is the number of rules which have
as their target. This must be zero (and the chain be empty)
before this chain can be deleted.
If the chain name is omitted, all chains are listed, even empty ones.
There are three options which can accompany `-L'. The `-n' (numeric)
option is very useful as it prevents ipchains
from trying to
lookup the IP addresses, which (if you are using DNS like most people)
will cause large delays if your DNS is not set up properly, or you
have filtered out DNS requests. It also causes ports to be printed
out as numbers rather than names.
The `-v' options shows you all the details of the rules, such as the the packet and byte counters, the TOS masks, the interface, and the packet mark. Otherwise these values are omitted. For example:
# ipchains -v -L input
Chain input (refcnt = 1): (policy ACCEPT)
pkts bytes target prot opt tosa tosx ifname mark source destination ports
10 840 ACCEPT icmp ----- 0xFF 0x00 lo anywhere anywhere any
Note that the packet and byte counters are printed out using the suffixes `K', `M' or `G' for 1000, 1,000,000 and 1,000,000,000 respectively. Using the `-x' (expand numbers) flag as well prints the full numbers, no matter how large they are.
It is useful to be able to reset the counters. This can be done with the `-Z' (zero counters) option. For example:
# ipchains -v -L input
Chain input (refcnt = 1): (policy ACCEPT)
pkts bytes target prot opt tosa tosx ifname mark source destination ports
10 840 ACCEPT icmp ----- 0xFF 0x00 lo anywhere anywhere any
# ipchains -Z input
# ipchains -v -L input
Chain input (refcnt = 1): (policy ACCEPT)
pkts bytes target prot opt tosa tosx ifname mark source destination ports
0 0 ACCEPT icmp ----- 0xFF 0x00 lo anywhere anywhere any
The problem with this approach is that sometimes you need to know the counter values immediately before they are reset. In the above example, some packets could pass through between the `-L' and `-Z' commands. For this reason, you can use the `-L' and `-Z' together, to reset the counters while reading them. Unfortunately, if you do this, you can't operate on a single chain: you have to list and zero all the chains at once.
# ipchains -L -v -Z
Chain input (policy ACCEPT):
pkts bytes target prot opt tosa tosx ifname mark source destination ports
10 840 ACCEPT icmp ----- 0xFF 0x00 lo anywhere anywhere any
Chain forward (refcnt = 1): (policy ACCEPT)
Chain output (refcnt = 1): (policy ACCEPT)
Chain test (refcnt = 0):
0 0 DENY icmp ----- 0xFF 0x00 ppp0 localnet/24 anywhere any
# ipchains -L -v
Chain input (policy ACCEPT):
pkts bytes target prot opt tosa tosx ifname mark source destination ports
10 840 ACCEPT icmp ----- 0xFF 0x00 lo anywhere anywhere any
Chain forward (refcnt = 1): (policy ACCEPT)
Chain output (refcnt = 1): (policy ACCEPT)
Chain test (refcnt = 0):
0 0 DENY icmp ----- 0xFF 0x00 ppp0 localnet/24 anywhere any
We glossed over what happens when a packet hits the end of a built-in
chain when we discussed how a packet walks through chains in
Specifying a Target above. In this case,
the policy of the chain determines the fate of the packet. Only
built-in chains (input
, output
and forward
) have policies,
because if a packet falls off the end of a user-defined chain,
traversal resumes at the previous chain.
The policy can be any of the first four special targets: ACCEPT
or MASQ
is only valid for the
`forward' chain.
It is also important to note that a RETURN
target in a rule in
one of the built-in chains is useful to explicitly target the chain
policy when a packet matches a rule.
There are several parameters you can tweak for IP Masquerading. They
are bundled with ipchains
because it's not worth writing a
separate tool for them (although this will change).
The IP Masquerading command is `-M', and it can be combined with `-L' to list currently masqueraded connections, or `-S' to set the masquerading parameters.
The `-L' command can be accompanied by `-n' (show numbers instead of hostnames and port names) or `-v' (show deltas in sequence numbers for masqueraded connection, just in case you care).
The `-S' command should be followed by three timeout values, each in seconds: for TCP sessions, for TCP sessions after a FIN packet, and for UDP packets. If you don't want to change one of these values, simply give a value of `0'.
The default values are listed in `/usr/src/linux/include/net/ip_masq.h', currently 15 minutes, 2 minutes and 5 minutes respectively.
The most common value to change is the first one, for FTP (see FTP Nightmares below).
Note the problems with setting timeouts listed in I can't set masquerading timeouts!.
Sometimes you want to see what happens when a certain packet enters
your machine, such as for debugging your firewall chains.
has the `-C' command to allow this, using the exact same
routines that the kernel uses to diagnose real packets.
You specify which chain to test the packet on by following the `-C'
argument with its name. Whereas the kernel always starts traversing
on the input
, output
or forward
chains, you are allowed
to begin traversing on any chain for testing purposes.
The details of the `packet' are specified using the same syntax used to specify firewall rules. In particular, a protocol (`-p'), source address (`-s'), destination address (`-d') and interface (`-i') are compulsory. If the protocol is TCP or UDP, then a single source and a single destination port must be specified, and a ICMP type and code must be specified for the ICMP protocol (unless the `-f' flag is specified to indicate a fragment rule, in which case these options are illegal).
If the protocol is TCP (and the `-f' flag is not specified), the `-y' flag may be specified, to indicate that the test packet should have the SYN bit set.
Here is an example of testing a TCP SYN packet from 192.168.1.1 port 60000 to 192.168.1.2 port www, coming in the eth0 interface, entering the `input' chain. (This is a classic incoming WWW connection initiation):
# ipchains -C input -p tcp -y -i eth0 -s 192.168.1.1 60000 -d 192.168.1.2 www
packet accepted
Sometimes a single command line can result in multiple rules being
effected. This is done in two ways. Firstly, if you specify a
hostname which resolves (using DNS) to multiple IP addresses,
will act as if you had typed multiple commands with each
combination of addresses.
So if the hostname `www.foo.com' resolves to three IP addresses, and
the hostname `www.bar.com' resolves to two IP addresses, then the
command `ipchains -A input -j reject -s www.bar.com -d www.foo.com'
would append six rules to the input
The other way to have ipchains
perform multiple actions is to use
the bidirectional flag (`-b'). This flag makes ipchains
as if you had typed the command twice, the second time with the `-s'
and `-d' arguments reversed. So, to avoid forwarding either to or
from 192.168.1.1, you could do the following:
# ipchains -b -A forward -j reject -s 192.168.1.1
Personally, I don't like the `-b' option much; if you want convenience, see Using ipchains-save below.
The -b option can be used with the insert (`-I'), delete (`-D') (but not the variation which takes a rule number), append (`-A') and check (`-C') commands.
Another useful flag is `-v' (verbose) which prints out exactly what
is doing with your commands. This is useful if you are
dealing with commands that may effect multiple rules. For example,
here we check the behaviour of fragments between 192.168.1.1 and
# ipchains -v -b -C input -p tcp -f -s 192.168.1.1 -d 192.168.1.2 -i lo
tcp opt ---f- tos 0xFF 0x00 via lo 192.168.1.1 -> 192.168.1.2 * -> *
packet accepted
tcp opt ---f- tos 0xFF 0x00 via lo 192.168.1.2 -> 192.168.1.1 * -> *
packet accepted
I have a dialup PPP connection (-i ppp0
). I grab news (-p
TCP -s news.virtual.net.au nntp
) and mail (-p TCP -s
mail.virtual.net.au pop-3
) every time I dial up. I use Debian's FTP
method to update my machine regularly (-p TCP -y -s
ftp.debian.org.au ftp-data
). I surf the web through my ISP's proxy
while this is going on (-p TCP -d proxy.virtual.net.au 8080
), but
hate the ads from doubleclick.net on the Dilbert Archive (-p TCP -y
-d 18.104.22.168/24
and -p TCP -y -d 220.127.116.11/24
I don't mind people trying to ftp to my machine while I'm online
(-p TCP -d $LOCALIP ftp
), but don't want anyone outside
pretending to have an IP address of my internal network (-s
). This is commonly called IP spoofing, and there
is a better way to protect yourself from it in the 2.1.x kernels and
above: see
How do I set up IP spoof protection?.
This setup is fairly simple, because there are currently no other boxes on my internal network.
I don't want any local process (ie. Netscape, lynx etc.) to connect to doubleclick.net:
# ipchains -A output -d 126.96.36.199/24 -j REJECT
# ipchains -A output -d 22.214.171.124/24 -j REJECT
Now I want to set priorities on various outgoing packets (there isn't
much point in doing it on incoming packets). Since I have a fair
number of these rules, it makes sense to put them all in a single
chain, called ppp-out
# ipchains -N ppp-out
# ipchains -A output -i ppp0 -j ppp-out
Minimum delay for web traffic & telnet.
# ipchains -A ppp-out -p TCP -d proxy.virtual.net.au 8080 -t 0x01 0x10
# ipchains -A ppp-out -p TCP -d 0.0.0.0/0 telnet -t 0x01 0x10
Low cost for ftp data, nntp, pop-3:
# ipchains -A ppp-out -p TCP -d 0.0.0.0/0 ftp-data -t 0x01 0x02
# ipchains -A ppp-out -p TCP -d 0.0.0.0/0 nntp -t 0x01 0x02
# ipchains -A ppp-out -p TCP -d 0.0.0.0/0 pop-3 -t 0x01 0x02
There are a few restrictions on packets coming in the ppp0 interface: let's create a chain called `ppp-in':
# ipchains -N ppp-in
# ipchains -A input -i ppp0 -j ppp-in
Now, no packets coming in ppp0
should be claiming a source
address of 192.168.1.*, so we log and deny them:
# ipchains -A ppp-in -s 192.168.1.0/24 -l -j DENY
I allow UDP packets in for DNS (I run a caching nameserver which forwards all requests to 188.8.131.52, so I expect DNS replies from them only), incoming ftp, and return ftp-data only (which should only be going to a port above 1023, and not the X11 ports around 6000).
# ipchains -A ppp-in -p UDP -s 184.108.40.206 -d $LOCALIP dns -j ACCEPT
# ipchains -A ppp-in -p TCP -s 0.0.0.0/0 ftp-data -d $LOCALIP 1024:5999 -j ACCEPT
# ipchains -A ppp-in -p TCP -s 0.0.0.0/0 ftp-data -d $LOCALIP 6010: -j ACCEPT
# ipchains -A ppp-in -p TCP -d $LOCALIP ftp -j ACCEPT
I allow TCP reply packets back in
# ipchains -A ppp-in -p TCP ! -y -j ACCEPT
Finally, local-to-local packets are OK:
# ipchains -A input -i lo -j ACCEPT
Now, my default policy on the input
chain is DENY
, so
everything else gets dropped:
# ipchains -P input DENY
NOTE: I wouldn't set up my chains in this order, as packets might get through while I'm setting up. Safest is usually to set the policy to DENY first, then insert the rules. Of course, if your rules require DNS lookups to resolve hostnames, you could be in trouble.
Setting up firewall chains just the way you want them, and then trying to remember the commands you used so you can do them next time is a pain.
So, ipchains-save
is a script which reads your current chains
setup and saves it to a file. For the moment I'll keep you in
suspense with regards to what ipchains-restore
can save a single chain, or all chains (if no chain
name is specified). The only option currently permitted is `-v' which
prints the rules (to stderr) as they are saved. The policy of the
chain is also saved for input
, output
and forward
# ipchains-save > my_firewall
Saving `input'.
Saving `output'.
Saving `forward'.
Saving `ppp-in'.
Saving `ppp-out'.
restores chains as saved with
. It can take two options: `-v' which describes
each rule as it is added, and `-f' which forces flushing of
user-defined chains if they exist, as described below.
If a user-defined chain is found in the input, ipchains-restore
checks if that chain already exists. If it does, then you will be
prompted whether the chains should be flushed (cleared of all rules)
or whether restoring this chain should be skipped. If you specified
`-f' on the command line, you will not be prompted; the chain will be
For example:
# ipchains-restore < my_firewall
Restoring `input'.
Restoring `output'.
Restoring `forward'.
Restoring `ppp-in'.
Chain `ppp-in' already exists. Skip or flush? [S/f]? s
Skipping `ppp-in'.
Restoring `ppp-out'.
Chain `ppp-out' already exists. Skip or flush? [S/f]? f
Flushing `ppp-out'.


text:
Remember our Xen 0wning Trilogy at Black Hat in summer 2008, specifically the presentation on Detecting & Preventing the Xen Hypervisor Subversions?
One of the things we were discussing there was a proposal to include an additional restriction to Intel processors that would disallow execution of usermode pages from within supervisor mode (ring0). Such a feature, we argued, apart from obviously making many ring3-to-ring0 exploits much harder, including the very Xen heap overflow exploit we presented in the slides, would also bring us closer to efficient runtime code integrity checkers for kernels and hypervisors, as discussed in the slides.
Slide #97, Detecting and Preventing Xen Hypervisor Subversions, Black Hat USA, July, 2008 |
Fast forward 3 years. On June 1st, 2011, an Intel engineer is submitting a patch for Xen to support a mysterious new processor feature called SMEP (Supervisor Mode Execution Protection). He writes the feature is not yet documented in SDM, but soon will be. In fact, the May 2011 update of Intel SDM already contains the details:
Intel SDM, vol. 3a, May 2011, source: intel.com |
Some other people spotted this feature earlier, because of another patch submitted by another Intel engineer to Linux kernel a few weeks ago. Here's a good write up by Dan Rosenberg discussing how this patch makes writing Linux kernel exploits harder, and how it's still possible to write them.
The SMEP feature still doesn't seem to be present in the processors available on the market, including the latest Sand Bridge processors, but there's no question it's coming, now that the feature made it into SDM.
It is quite rewarding to see your idea implemented in a processor... I guess this is how physicists feel when they introduce a new particle as part of a new quantum model, and later discover evidences to support the existence of this very particle in the wild...

subset: commoncrawl


text:
- Author: Moses Harris
- Date: 1840
- Medium: Hand-colored copperplate engraving
- Condition: Excellent
- Inches: 9 1/4" x 12"
- Centimeters: 23.72 x 30.77
- Product ID: 002331
From The Aurelian: or, Natural History of English Insects; namely, Moths and Butterflies. Together with the plants on which they feed and their standard names, as given and established by the Society of Aurelians. Drawn, engraved and coloured, from the natural Subjects themselves. Moses Harris (1766) 1840.
Moses Harris (1731-1785) was an English entomologist and engraver, and one of the outstanding authors of entomological literature during the 18th century (Lisney). Harris drew from live specimens, and his plates are among the most beautiful of their kind, showing dorsal and ventral views of all the subjects, together with various stages of development (egg, caterpillar, chrysalis), each with their preferred food. First published in 1766, the Aurelian went through many editions. Our plates are from an 1840 edition.


text:
Hi all,
Currently I'm reading a paper about the geometry of Grassmannians:
In there, the author regards the second fundamental form of the k-dimensional tautological bundle $\tau \rightarrow Gr:=Gr_k(\mathbb{C}^N)$ over a grassmannian given by
$H=\pi_{\tau^c} \circ \nabla^0 \in \Omega^1(Gr,Hom(\tau,\tau^c))$.
Here, $\tau^c$ denotes the complementary bundle of $\tau \subset Gr\times \mathbb{C}^N$, such that $\tau \oplus \tau^c \cong Gr \times \mathbb{C}^N$ with respect to the natural hermitian metric and $\pi_{\tau^c}$ is the projection on it. From this embedding we obtain natural connections on $\tau\rightarrow Gr$ and $\tau^c\rightarrow Gr$ by projecting the flat connection. It's easy to show that $H$ is indeed a 1-form with values in $Hom(\tau,\tau^c)$ as claimed.
In Lemma 2.1 on page 43 the author says that both the second fundamental form of $\tau\rightarrow Gr$ and $\tau^c\rightarrow Gr$ is parallel. Now at this point I have my question: As far as I know there is only one sense what parallel in this context means, namely
$(\nabla_X H)_Y\sigma:=\nabla^{\tau^c}_X(H_Y\sigma)-H_{\nabla_X Y}\sigma-H_Y\nabla^{\tau}_X\sigma=0$.
Can this be true? My first naive approach was writing the whole equation in terms of the flat connection and projections but this leads to nothing, I guess.
I wonder why none of the well known textbooks on differential geometry (of complex vector bundles) e.g. Kobayashi doesn't mention this fact if it is true. Maybe thd definition of "parallel" is not the one meant. So what could be the right one then? I would be grateful for any references.
best regards, Alex


text:
Executive Order -- Identifying and Reducing Regulatory Burdens
- - - - - - -
By the authority vested in me as President by the Constitution and the laws of the United States of America, and in order to modernize our regulatory system and to reduce unjustified regulatory burdens and costs, it is hereby ordered as follows:
Section 1. Policy. Regulations play an indispensable role in protecting public health, welfare, safety, and our environment, but they can also impose significant burdens and costs. During challenging economic times, we should be especially careful not to impose unjustified regulatory requirements. For this reason, it is particularly important for agencies to conduct retrospective analyses of existing rules to examine whether they remain justified and whether they should be modified or streamlined in light of changed circumstances, including the rise of new technologies.
Executive Order 13563 of January 18, 2011 (Improving Regulation and Regulatory Review), states that our regulatory system "must measure, and seek to improve, the actual results of regulatory requirements." To promote this goal, that Executive Order requires agencies not merely to conduct a single exercise, but to engage in "periodic review of existing significant regulations." Pursuant to section 6(b) of that Executive Order, agencies are required to develop retrospective review plans to review existing significant regulations in order to "determine whether any such regulations should be modified, streamlined, expanded, or repealed." The purpose of this requirement is to "make the agency's regulatory program more effective or less burdensome in achieving the regulatory objectives."
In response to Executive Order 13563, agencies have developed and made available for public comment retrospective review plans that identify over five hundred initiatives. A small fraction of those initiatives, already finalized or formally proposed to the public, are anticipated to eliminate billions of dollars in regulatory costs and tens of millions of hours in annual paperwork burdens. Significantly larger savings are anticipated as the plans are implemented and as action is taken on additional initiatives.
As a matter of longstanding practice and to satisfy statutory obligations, many agencies engaged in periodic review of existing regulations prior to the issuance of Executive Order 13563. But further steps should be taken, consistent with law, agency resources, and regulatory priorities, to promote public participation in retrospective review, to modernize our regulatory system, and to institutionalize regular assessment of significant regulations.
Sec. 2. Public Participation in Retrospective Review. Members of the public, including those directly and indirectly affected by regulations, as well as State, local, and tribal governments, have important information about the actual effects of existing regulations. For this reason, and consistent with Executive Order 13563, agencies shall invite, on a regular basis (to be determined by the agency head in consultation with the Office of Information and Regulatory Affairs (OIRA)), public suggestions about regulations in need of retrospective review and about appropriate modifications to such regulations. To promote an open exchange of information, retrospective analyses of regulations, including supporting data, shall be released to the public online wherever practicable.
Sec. 3. Setting Priorities. In implementing and improving their retrospective review plans, and in considering retrospective review suggestions from the public, agencies shall give priority, consistent with law, to those initiatives that will produce significant quantifiable monetary savings or significant quantifiable reductions in paperwork burdens while protecting public health, welfare, safety, and our environment. To the extent practicable and permitted by law, agencies shall also give special consideration to initiatives that would reduce unjustified regulatory burdens or simplify or harmonize regulatory requirements imposed on small businesses. Consistent with Executive Order 13563 and Executive Order 12866 of September 30, 1993 (Regulatory Planning and Review), agencies shall give consideration to the cumulative effects of their own regulations, including cumulative burdens, and shall to the extent practicable and consistent with law give priority to reforms that would make significant progress in reducing those burdens while protecting public health, welfare, safety, and our environment.
Sec. 4. Accountability. Agencies shall regularly report on the status of their retrospective review efforts to OIRA. Agency reports should describe progress, anticipated accomplishments, and proposed timelines for relevant actions, with an emphasis on the priorities described in section 3 of this order. Agencies shall submit draft reports to OIRA on September 10, 2012, and on the second Monday of January and July for each year thereafter, unless directed otherwise through subsequent guidance from OIRA. Agencies shall make final reports available to the public within a reasonable period (not to exceed three weeks from the date of submission of draft reports to OIRA).
Sec. 5. General Provisions. (a) For purposes of this order, "agency" means any authority of the United States that is an "agency" under 44 U.S.C. 3502(1), other than those considered to be independent regulatory agencies, as defined in 44 U.S.C. 3502(5).
(b) Nothing in this order shall be construed to impair or otherwise affect:
(i) the authority granted by law to a department or agency, or the head thereof; or
(ii) the functions of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals.
(c) This order shall be implemented consistent with applicable law and subject to the availability of appropriations.
(d) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.


text:
UA Academy's Class 1-A has been the focus of a substantial amount of public attention due to the multiple villain attacks they have faced over the past school year. This attention has left Class 1-A's rivals, Class 1-B, feeling quite bitter. Desiring to prove their skills, they look forward to the opportunity that has been given to them: a set of mock battles between the students of each class.
The classes are split into squads of four, each of which is tasked with capturing the other group members. The winner is the group who first secures all of the opposing team. While this sounds simple, a curveball is thrown into the mix with the inclusion of General Course Student Hitoshi Shinsou, who wishes to transfer into the Hero Course. Despite using his training with Class 1-A's homeroom teacher Shouta "Eraserhead" Aizawa to prove that he's capable of being a real hero, he is still far behind the others due to his lack of experience. However, Shinsou is determined to overcome this challenge.
Thus begins the fiery competition between Class 1-A and 1-B as each tries to prove that they are superior to the other.


text:
א וַיֵּרָא אֵלָיו ה, בְּאֵלֹנֵי מַמְרֵא; וְהוּא יֹשֵׁב פֶּתַח-הָאֹהֶל, כְּחֹם הַיּוֹם. | 1 And the LORD appeared unto him by the terebinths of Mamre, as he sat in the tent door in the heat of the day; |
וַיֵּרָא אֵלָיו ה -- Hashem appears to Avraham. On a peshat level, this conversation is not interrupted by the visit of the three men. Rather, it is the visit of the three men. However, this leads to a possibly uncomfortable theological conclusion about whether God is corporeal or, to a lesser degree, can manifest in what appears to be human form. Chazal interpret these pesukim otherwise, in which Hashem first visits, is interrupted by the arrival of the three men, and resumes his conversation with Avraham after the three angels leave. This is most likely understood by them not merely as derash but peshat as well, just as the Rishonim understood it.
Shadal says וַיֵּרָא אֵלָיו ה, via his angels, as it continues to explain. And he refers us to Rashbam and Nisivot Hashalom.
וירא אליו ה' - האיך?
שבאו אליו שלשה אנשים שהיו מלאכים, שבהרבה מקומות כשנראה המלאך קוראו בלשון שכינה, כדכתיב: כי שמי בקרבו שלוחו כמותו.
וכן: וירא מלאך ה' אליו בלבת אש מתוך הסנה. וכתוב שם: וירא ה' כי סר לראות.
One could argue with Rashbam's presentation, and say that only two were malachim and the third, central one, was Hashem.
Ibn Ezra attacks Rashbam's position, pointing out that only two malachim arrived at Sodom:
הנה קצת אמרו, כי השם ג' אנשים הוא אחד והוא ג' ולא יתפרדו. והנה שכחו ויבאו שני המלאכים סדומה
I agree. Not all three were Hashem. Two were malachim, who accompanied Hashem, and one was some deeper manifestation of Hashem's presence.
(However, to answer on behalf of those who would have all thee as a manifestation of Hashem, we can point out that
(a) any angel is a manifestation of Hashem, and angels can surely split up -- the later 'Hashem said' is the agent speaking in his Master's name.
(b) any angel can be said to be a manifestation of Hashem, and that manifestation can be in the image of three or in the image of two, as appropriate.
בְּאֵלֹנֵי מַמְרֵא -- This is in Chevron. See this pasuk:
בראשית פרק יג
- פסוק י"ח: וַיֶּאֱהַל אַבְרָם, וַיָּבֹא וַיֵּשֶׁב בְּאֵלֹנֵי מַמְרֵא--אֲשֶׁר בְּחֶבְרוֹן; וַיִּבֶן-שָׁם מִזְבֵּחַ, לַה.
וְהוּא יֹשֵׁב פֶּתַח-הָאֹהֶל -- the midrash has it that he was looking for guests, as a way of highlighting Avraham's hospitality, which certainly is stressed elsewhere in the narrative. As peshat, it introduces the lifting up of his eyes such that he sees guests in a distance.
One entrance to the tent, not four, on the level of peshat.
כְּחֹם הַיּוֹם --
See II Shmuel 4:5:
ה וַיֵּלְכוּ בְּנֵי-רִמּוֹן הַבְּאֵרֹתִי, רֵכָב וּבַעֲנָה, וַיָּבֹאוּ כְּחֹם הַיּוֹם, אֶל-בֵּית אִישׁ בֹּשֶׁת; וְהוּא שֹׁכֵב, אֵת מִשְׁכַּב הַצָּהֳרָיִם. | 5 And the sons of Rimmon the Beerothite, Rechab and Baanah, went, and came about the heat of the day to the house of Ish-bosheth, as he took his rest at noon. |
This demonstrates that כְּחֹם הַיּוֹם means about the noon. Shadal says that this is why Avraham detained the malachim, since it was time to eat lunch and difficult to travel.
Perhaps this is to show that Avraham was dozing, and this entire exchange happened as a vision.
Next pasuk:
ב וַיִּשָּׂא עֵינָיו, וַיַּרְא, וְהִנֵּה שְׁלֹשָׁה אֲנָשִׁים, נִצָּבִים עָלָיו; וַיַּרְא, וַיָּרָץ לִקְרָאתָם מִפֶּתַח הָאֹהֶל, וַיִּשְׁתַּחוּ, אָרְצָה. | 2 and he lifted up his eyes and looked, and, lo, three men stood over against him; and when he saw them, he ran to meet them from the tent door, and bowed down to the earth, |
וַיִּשָּׂא עֵינָיו -- thus, in the distance.
וַיַּרְא -- matching וַיֵּרָא אֵלָיו. This is the fulfillment and details of the preceding pasuk.
שְׁלֹשָׁה אֲנָשִׁים -- is the Torah lying to us, by calling them men? At the very least, we know that later they are malachim. And we might want to even say that one, or all of them is Hashem!
We can answer that just like dibra Torah kilshon bnei Adam, in the sense that the Torah speaks in accordance with the sometimes flawed understanding of the world, here too, also, since Avraham saw them as men, the Torah described them according to that perception. And that is not a falsehood.
According to Ralbag, the three men were neviim, namely Shem, Ever, and one other prophet. And that they are later called malachim is because prophets are messengers, or malachim, of Hashem. Indeed, Ralbag in general understands malachim to mean human prophets. If so, the Torah is explicit here that these were men.
וַיַּרְא -- although it already said this word above, the word is repeated. First, establish what he saw, at length, and then, describe his reaction to the right. Rashi takes the second instance to denote hospitality. Midrash Rabba takes one to refer to the angels and one to refer to the Shechina.
וַיָּרָץ לִקְרָאתָם מִפֶּתַח הָאֹהֶל -- zerizut for the hospitality.
ג וַיֹּאמַר: אֲדֹנָי, אִם-נָא מָצָאתִי חֵן בְּעֵינֶיךָ--אַל-נָא תַעֲבֹר, מֵעַל עַבְדֶּךָ. | 3 and said: 'My lord, if now I have found favour in thy sight, pass not away, I pray thee, from thy servant. |
אֲדֹנָי -- Ramban writes:
אדני אם נא מצאתי חן בעיניך - מצינו אותו בספרים קמוץ. והנה קראם בשם רבם באל"ף דל"ת, כי הכיר בהם שהם מלאכי עליון כאשר יקראו אלוהים ואלים ולכן השתחוה להם ארצה:
That is, we find a kametz under the nun. With a chirik, adoni, it should mean "my master". With a patach, it should mean "my masters". With a kametz, it should mean Hashem.
Ramban explains that Avraham knew at this early stage that these were angels, and therefore referred to them by the name of their master, Hashem. One must grapple with the singular of תַעֲבֹר. Ramban understands this as distributive, that he addressed every one of them as the name of their master.
Shadal claims that Avraham actually said Adoni, with a chirik (and was thus singular), but this was made kodesh based on what would eventually come out.
Rashi mentions the dual interpretations of this. Either he addressed the gadol of the malachim (and with a kametz will still be appropriate); or else, he addressed Hashem. Recall that first, Hashem appeared, and separately, these men/angels appeared. Thus, Avraham is saying to Hashem, please don't leave, but let me first take care of this mitzvah of hachnasas orechim.
There is a nice thought associated with this interpretation in Shabbat 127a, in terms of balancing bein adam laMakom and bein adam lachaveiro:
Rab Judah said in Rab's name: Hospitality to wayfarers is greater than welcoming the presence of the Shechinah, for it is written, And he said, My lord, if now I have found favour in thy sight, pass not away, etc.15 R. Eleazar said: Come and observe how the conduct of the Holy One, blessed be He, is not like that of mortals. The conduct of mortals [is such that] an inferior person cannot say to a great[er] man, Wait for me until I come to you; whereas in the case of the Holy One, blessed be He, it is written, and he said, My Lord, if now I have found, etc.Someone asked me that we know that hospitality is greater than welcoming the presence of the Shechina, based on this gemara, but how did Avraham know? The answer is that Avraham didn't know from a text, but intuited how one should act with Hashem. While some could say that Avraham knew the gemara in Shabbos because he knew all the Torah, we could say like the Rashba explained (and as we see in a midrash as well) when endorsing this idea, that Avraham intuited in his heart and kidneys how to act, even before the Torah was given.
Related to this is the story of the Chafetz Chaim (author of Mishneh Berurah) who once skipped Shalom Aleichem, and only sand it after kiddush and hamotzi. When questioned as to the propriety of this, he explained that in this case, his poor guests were very hungry, but the malachim who accompanied him home from shul were malachim, who were not hungry, and could wait a bit.
See Minchas Shai about this being kodesh vs. chol.
based on the gemara in Shevuot 35b which reads:
כל שמות האמורים בתורה באברהם קדש חוץ מזה שהוא חול שנאמר (בראשית יח) ויאמר יי' אם נא מצאתי חן בעיניך חנינא בן אחי רבי יהושע ורבי אלעזר בן עזריה משום רבי אלעזר המודעי אמרו אף זה קדש(Note the funny emendation of the pasuk in the quotation in the gemara.)
I wonder if it actually worked in the opposite direction, namely that there was an argument of whether it was Adonay as kodesh or chol among Chazal (with little to no difference in pronunciation between them, as patach vs. kametz are quite close in pronunciation, perhaps a slightly longer vowel), and given all these Rabbinic sources fixing it as kodesh, it was set with a kametz in accordance with this midrashic interpretation. If so, no need for concern with the nikkud when dealing with peshat.
Because of the difficulty of the plural and singular in this pasuk, the Samaritans falsified their Torah. They emended it to read:
Samaritan text on the left. Note how they make three words in this pasuk plural. (Shadal points this out.)
אִם-נָא מָצָאתִי חֵן בְּעֵינֶיךָ -- as if he is asking a favor, even as he offers them hospitality.
נָא -- Rashi often makes the midrashic statement that ain na ele leshon bakasha. Na in Biblical Hebrew apparently always mean "now", and means "please" only in Rabbinic Hebrew. Indeed, Onkelos consistently renders it ke'an, which is Aramaic for "now":
יח,ג וַיֹּאמַר: אֲדֹנָי, אִם-נָא מָצָאתִי חֵן בְּעֵינֶיךָ--אַל-נָא תַעֲבֹר, מֵעַל עַבְדֶּךָ. | וַאֲמַר: יְיָ, אִם כְּעַן אַשְׁכַּחִית רַחֲמִין קֳדָמָךְ--לָא כְּעַן תִּעְבַּר, מֵעַל עַבְדָּךְ. |
Next pasuk:
ד יֻקַּח-נָא מְעַט-מַיִם, וְרַחֲצוּ רַגְלֵיכֶם; וְהִשָּׁעֲנוּ, תַּחַת הָעֵץ. | 4 Let now a little water be fetched, and wash your feet, and recline yourselves under the tree. |
יֻקַּח-נָא -- the passive, let it be fetched. Rashi cites a midrash which connects this to the water that the Israelites receive via a shaliach. Baal HaTurim then draws a connection based on gematria, to reinforce this existing connection.
מְעַט-מַיִם -- again minimizing his actions. Emor meat ve'aseh harbei, as action of tzaddikim (consider the stark contrast to what he actually does) as well as a polite mode of expression.
וְרַחֲצוּ רַגְלֵיכֶם -- the only other place this occurs is by Lot meeting these malachim. We can contrast the two. Rashi contrasts these as follows:
and bathe your feet: He thought that they were Arabs, who prostrate themselves to the dust of their feet, and he was strict not to allow any idolatry into his house. But Lot, who was not strict, mentioned lodging before washing, as it is said (below 19:2): "and lodge and bathe your feet." - [from Gen. Rabbah 54:4] | ורחצו רגליכם: כסבור שהם ערביים שמשתחוים לאבק רגליהם והקפיד שלא להכניס עבודה זרה לביתו. אבל לוט שלא הקפיד, הקדים לינה לרחיצה, שנאמר (יט ב) ולינו ורחצו רגליכם: |
However, as Rashbam notes, by Lot it was evening, while here, it was earlier in the day, which is why lodging (or sleeping) was not relevant. Perhaps we can compare, though, with וְהִשָּׁעֲנוּ תַּחַת הָעֵץ. Note also that just as by Avraham, lina was not relevant, by Lot, lina was not just relevant but the most important thing to take care of, because of nightfall as well as because of the evil nature of the Sodomites.
וְהִשָּׁעֲנוּ תַּחַת הָעֵץ -- thus, providing them with shade from the חֹם הַיּוֹם.
Rav Chaim Kanievsky notes in Taama deKra that according to a midrash, this occurred on Succot. If so, since Avraham Avinu kept the entire Torah, it must be that this tree was talush, detached from the ground, and it means that he built a succah, under which they sat. And even though travelers are exempt, if there is one available without difficulty, one is obligated in Succah. And this is the meaning of the pasuk כִּי-עַל-כֵּן עֲבַרְתֶּם עַל-עַבְדְּכֶם. This cute vort fits in with Rav Kanievsky's general approach to the avos keeping the Torah. But it is obviously farfetched.


text:
Healthy Living
Newborn Reflexes: What You Need to Know
Newborn reflexes, also known as baby reflexes or infant reflexes, are normal and are crucial for a baby's survival. They are the baby's muscle reactions, involuntary movements or neurological responses to stimulation or triggers which may include sound, light, sudden movement and being stroked or touched.
Why Are Reflexes Important?
Doctors and nurses check baby reflexes to determine if a baby's brain and nervous system are functioning properly. If you notice abnormal reflexes in your child, please see a doctor as these may indicate a dysfunction in the central nervous system.
What Are the Different Types of Newborn Reflexes?
There are many different types of newborn reflexes. You will notice many of them as you interact with your baby, and they can be really cute and fun to watch. Some reflexes only occur in specific periods of the baby's development, but some can stay for years, all the way through adulthood. It's good to note though that some adults who have brain damage or who have experienced stroke may experience baby reflexes as well.
The seven most common types of newborn reflexes are as follows:
Moro Reflex
Babies usually exhibit a full Moro reflex which includes the arms, head and legs in their first 12 weeks after birth. Also called the startle reflex, Moro reflex usually occurs when a baby gets startled by a loud sound, sudden movement or intense light. As a response to the trigger, the baby suddenly lifts the arms and legs, curl them back toward the body and then throw the head back. Your baby's own cry may also startle him/her and trigger the Moro reflex.
Some babies experience an abnormal Moro reflex which only involves one side of the body. Other babies may have no Moro reflex at all. Some causes of an abnormal or absent Moro reflex may include infections, muscle weakness, injuries from childbirth, peripheral nerve damage and spastic cerebral palsy.
When Does the Startle Reflex Go Away?
The Moro or startle reflex usually lasts until the baby is about five to six months old.
Rooting Reflex
This newborn reflex begins by touching or stroking the corner of the baby's mouth or when it touches the mother's skin or nipple. When triggered, you will notice that the baby will turn his/her head and open his/her mouth to follow and "root" in the direction of the stroking. The rooting reflex helps the baby find the breast or bottle and also helps prepare him/her to suck.
When Does the Rooting Reflex Go Away?
The rooting reflex in babies usually lasts for about four months. After that, rooting becomes a voluntary response rather than a reflex.
Sucking Reflex
This type of reflex usually starts when the baby is about 32 weeks inside the mother's womb. If you're pregnant, you may see your baby sucking his/her thumbs or hands during an ultrasound. When the baby is born, the sucking reflex happens in two stages. First, when the roof of the mouth is stimulated or when you place the mother's breast or a bottle in his/her mouth, the baby will place the lips over the nipple and squeeze it between the tongue and roof of the mouth. Next, the baby will move his/her tongue to the nipple to suck and milk the breast.
Premature babies may take weeks to properly suck and swallow which is why some doctors recommend a feeding tube inserted through the nose into the stomach to help them get the nutrients they need.
When Does the Sucking Reflex Go Away?
The sucking reflex usually lasts until the baby is four months old.
Tonic Neck Reflex
Also known as a fencing reflex, the tonic neck reflex happens when the baby's head turns to one side. This is triggered when you stroke or tap the side of the baby's spine while the baby lies on his/her stomach. For instance, if the baby's head turns to the right, the right arm will stretch out and then the left arm will bend at the elbow, forming a so-called "fencing" position.
When Does the Tonic Neck Reflex Go Away?
Tonic neck reflex may last until the baby is around five to six months old.
Grasp Reflex
Stroking or touching the palm of a baby may cause the baby to automatically close his/her hands. For example, when you place your finger on the baby's palm, he/she will grasp it and hold onto your hand because of the grasp reflex.
When Does the Grasp Reflex Go Away?
The grasp reflex may last until the baby is about five to six months old.
Babinski Reflex
The Babinski reflex happens when you firmly stoke the sole of the baby's foot. The baby's big toe moves upward or toward the top of the foot and the other toe fans out.
When Does the Babinski Reflex Go Away?
The Babinski reflex usually lasts until the child is about two years old, but for some, it goes away after a year.
Stepping Reflex
This cute reflex is also called the walking or dancing reflex. Stepping reflex happens when you hold the baby upright with his/her feet touching a flat surface. You will notice that the baby will move his/her legs as if he/she is walking or trying to take steps although the baby is still too young to actually walk.
When Does the Stepping Reflex Go Away?
The stepping reflex often lasts for about two months.
What Types of Reflexes May Last Into Adulthood?
Both babies and adults may experience the following types of reflexes:
Blinking Reflex
This type of reflex happens when the eyes blink due to sudden intense light or when they are touched. -
Cough Reflex
Coughing happens as a defensive reflex to heat, acid and other foreign bodies in the airways. -
Gag Reflex
Gagging, or the gag reflex, happens when the back of the mouth or the throat is stimulated whether through choking, when it is touched, etc. -
Sneeze Reflex
A person sneezes when the nasal passages get irritated. -
Yawn Reflex
When the body requires more oxygen, yawn reflex occurs.
When to See a Pediatrician in Detroit?
Please see a pediatrician in Detroit if you have worries about your baby's development or if he/she continues to experience newborn reflexes beyond the normal period as this may be a sign of a nervous system dysfunction.
One of our pediatricians in Detroit may perform exams that can help determine if your baby experiences abnormal infant reflexes as well. If your baby was born prematurely, don't compare his or her development to that of full-term newborns. Premature babies are usually behind full-term babies in terms of development.


text:
First you should know what sort of massage the therapist does. Does he/she do Swedish massage, deep-tissue massage yet another kinds of knead? If you just require relaxing message with little pain involved then Swedish massage might just suit you perfectly for you. Deep tissue might turn into bit too intense for you. All this depends on people are looking for. So question the therapist on the various techniques she requirements. Also ask him or her, what anticipate from the massage, and then he or she can point you in finest direction about these include of massage oodles of flab ..
A good sensual massage should involve all the senses, just touch. Scented oils includes her sensation of smell in the experience and enhance all around massage act. Using massage oil can smooth the glide of your hand against her body minimize any friction that may cause pain. Some common oils which you can use are sweet almond oil, sunflower oil, avocado oil and grape seed oil.
Precautions in order that that the massage is run safely for women include telling your therapist if in order to pregnant. Tremendous certain positions that aren't advised and may be hazardous to medical of the pregnant woman and the particular. When your therapist realises of your condition, she or she possibly be able to change the plan a bit and double check that the massage is safer for you.
While the guy can tolerate an affordable bit of pressure, he still cannot handle my deepest deep tissue massage therapies. I have to ease on the pressure I use with him from hour and hour.
Auto programs that feature the massage technique that you 중랑홈타이 want – These chairs have auto programs built involving their system. This lets you push handle to carry out a certain massage technique that you'll want done in order to. The chair will then automatically perform the massage technique following preset duration, intensity and kind of massage.
Personally I have studied Thai massage in Thailand essential excellent and well known teachers. You'll be able to had their particular style along with their own unique techniques. Knowning that is without blending Thai Massage with any other modalities.
Remember generally there can be times much more positive might feel uncomfortable regarding movements and positions will be assumed. Invariably you could tell your therapist on the you knowledge. You both can help perform a better method by which shiatsu massage can be completed.
Next start the foot massage by squeezing the sole. You use your thumb and index finger to squeeze on each toe. If you move on the tip each toe, you gently pull on it outward to chill the toe joint. You are the in final summary is the other foot.


text:
The German Shorthaired Pointer is a breed that needs both mental and physical stimulation. As a natural hunter, it needs daily physical activity to prevent it from acting as a nuisance inside of the home. Within the home and around the family, the German Shorthaired Pointer is a loyal and devoted companion, but can sometimes be overly excited when around children. Due to its hunting instincts, caution must be taken around other small pets or animals, but this mannerism can be maintained through gentle training. The earlier you begin the training to curb the pup's aggression while they are young, the less aggressive they are as full grown dogs. The German Shorthaired Pointer may have the occasion to whine or bark often.
As a natural hunting dog, the German Shorthaired Pointer needs a reasonable amount of physical activity. The best form of exercise for it is a hunting, hiking, swimming, or active play session where the dog is being both physically and mentally stimulated. Swimming is a favorite pastime of the German Shorthaired Pointer and it will dive into water at any chance that it gets. The energetic breed can have these needs satisfied with about an hour of any of these physical activities each day. The German Shorthaired Pointer is capable of outdoor living in mild environments, but is better suited in a home environment with access to the outdoors and a yard as well. Maintenance of the coat is minimal, with the only occasional brushing needed.
The major health concern for the German Shorthaired Pointer is lymphedema, which involves fluid in the lymph nodes. There are several minor health concerns which include Canine Hip Dysplasia (CHD), entropion, gastric torsion, von Willebrand's Disease (vWD), pannus, Obsessive Compulsive Disorder (OCD), and hypothyroidism. Occasionally seen in the German Shorthaired Pointer is ectropion, Progressive Retinal Atrophy (PRA), and cardiomyopathy. It is suggested that to keep the breed healthy regular testing of the hips, eyes, vWD, cardiac, and thyroid is necessary. The average life span of a healthy German Shorthaired Pointer is 12 to 14 years.
The German Shorthaired Pointer gained many of its natural attributes and skills from early breeding practices during the seventeenth century. These abilities included mostly hunting instincts, such as pointing, retrieving, trailing, and game-killing abilities. Original crosses between the Spanish Pointer and Hannover Hound developed a dog that could trail and point both birds and mammals. In an effort to develop an all purpose hunting dog, the English Pointer was crossed into the breeding but not without controversy due to their dislike of being in water. Additional breeding eventually weeded out the unwanted pointer traits. The modern Shorthaired's foundation was thought to have come from their descendents the Deutsch Kurzhaars, which originally distinguished themselves at the German Derby. The German Shorthaired Pointer became recognized in Germany in the late 1800s, arrived in America in the 1920s, and became officially recognized by the AKC in 1930. The German Shorthaired Pointer remains popular today for hunters that are looking for a versatile hunting dog with all characteristics in one dog, as well as an compliant companion in the home environment.


text:
Chile is currently the world's largest producer of farmed salmon and has a burgeoning mussel culture industry that is supplying a growing world market. However, the country's marine aquaculture sector is vulnerable to Harmful Algal Blooms, which occur when some algae species producing poisons bloom rapidly in water, causing physical or biochemical damage to fish and shellfish.
Early detection of Harmful Algal Blooms (HABs) allows fish farmers to make timely key decisions in order to minimise the damage to aquaculture. To aid in this effort, a team led by Hatfield Consultants Ltd. (Hatfield), under the ESA-funded Chilean Aquaculture Project (CAP), has implemented an early warning service based on Earth Observation (EO) data, which delivers forecasts of potential HABs to aquaculture companies via a customised Internet portal.
HABs are a natural phenomenon that have increased in frequency over the last 30 years, causing millions of Euros worth of annual losses to the 360 fish farms found in the southern region of Chile. They deplete the concentration of oxygen in sea water, potentially killing larger caged fish such as salmon that cannot flee the affected area.
In the case of shellfish, such as mussels, toxins from the blooms accumulate in their body tissues and pose serious health risks for humans when consumed. For instance, in 2002 an HAB outbreak in Chile was responsible for 73 paralytic poisonings and two deaths. In 2004, more than 1500 cases of poisonings occurred resulting in an estimated 30 million Euro yearly loss. And in 2005, more than 10 000 cases were document, including one death.
Just like plants on land, algae employ green-pigmented chlorophyll for photosynthesis -- the process of turning sunlight into chemical energy. The chlorophyll collectively tints the colour of the surrounding water, providing a means of detecting these tiny organisms from space with dedicated 'ocean colour' sensors onboard satellites.
The CAP project utilises a combination of near real-time EO data, such as chlorophyll-a pigment concentration, secchi transparency, suspended matter and sea surface temperature, derived from the MERIS instrument onboard ESA's Envisat satellite and the MODIS instrument onboard NASA's Aqua satellite and in situ water monitoring to monitor the Southern Ocean off the coast of Chile.
A hydrodynamic model, established and validated through the project, is also used to characterise the water circulation patterns in the major aquaculture area in southern Chile.
Aquaculture has become a capital-intensive industry in Chile, worth nearly 1 billion Euros a year with direct and indirect benefits for employment and other industries. The aquaculture industry in Chile and internationally has expressed great interest in the products and services developed under the CAP project. In particular, the HAB early warning service has been tested by Mainstream Chile, part of the Norwegian holding company CERMAQ, a world leader in salmon production.
Mainstream Group Development Manager Francisco Puga said: "The benefits of the CAP project are directly related to the operation of our company. The environmental monitoring and HAB detection is part of our daily operation procedures. Also, historical environmental information supports our strategic decisions for farm site location.
"To obtain the amount of information covered with the EO data, alternative methods will be of considerable higher cost. With in situ measurements you cannot produce a gradient map as obtained with EO images. The value of this information is the area and resolution obtained in a single didactic image."
Last month, the CAP project was presented at the AQUA2006 event organised by the World Aquaculture Society in Florence, Italy, triggering a lot of interest for EO-based information service in the aquaculture industry.
Source : European Space Agency


text:
AvePoint is committed to making this website as accessible as possible to persons with disabilities.
Please note that although many documents and applications on this site are accessible to machine-reading devices, some legacy documents and applications are not. Our efforts to retrofit and/or upgrade non-accessible information are ongoing.
If you are experiencing difficulties accessing information or would like other information on or about this site, please contact us by emailing firstname.lastname@example.com.
Accessibility information for employment opportunities:
We value diverse experiences, backgrounds and perspectives among our employees, and see them as a competitive advantage. For additional information, please visit our AvePoint careers page.
We encourage you to request a reasonable accommodation if you are unable or limited in your ability to use or access the AvePoint careers site.
Accommodation requests can be made by emailing email@example.com.


text:
i've always been partial to fancy bite-sized appetizers that go well with a nice glass of champagne. blinis are traditional Russian buckwheat pancakes and great with caviar - lucky for me and my pocketbook though, i don't love caviar. but i DO love baby pancakes and the endless number of tasty toppings you can think of! a great snack to bring to a wine tasting party, an easy way to impress friends for the start of a dinner party or a fun kid-sized treat, blinis can go sweet or savory depending on your mood. here's a basic blini recipe and two quick toppings to get your imagination going!
Sweet or Savory Blini
makes approx. 16
6 tbs buckwheat flour
6 tbs all purpose flour
2 tsp sugar
1/4 tsp baking soda
1/4 tsp salt
1/2 cup milk
1/8 tsp lemon zest
2 eggs, separated
4 tbs unsalted butter, melted, plus more for cooking
optional: herbed goat cheese & soppresatta or lingonberry jam & creme fraiche
in a bowl, whisk together flours, sugar, baking soda and salt. add milk, egg yolks, lemon zest and cooled butter and whisk until smooth. in a separate bowl, beat egg whites with an electric mixer until stiff peaks form. fold egg whites, 1/2 at a time, into batter until incorporated.
heat a non-stick skillet over medium high heat and melt 1 tbs butter. cook 1 tbs of batter until little bubbles begin to form on top and then flip, about 1-2 minutes per side or until golden brown.


text:
I hate bullies…
When I asked "Ringo" DeLeon, President of the Texas Gang Investigators Association, why he worked in a gang unit, the 26 year veteran and Sergeant from Corpus Christi P.D. never hesitated with his reply: "I hate bullies." Short, to the point, yet prolific when given thought.
Say the word "Bully" and generally the first image that comes to mind is of a punk kid at school harassing a quiet, mild mannered kid. Bullies come in all shapes, sizes and sexes. They can be a boy or girl, young or old, man or woman, an individual or a group, from any race, and be rich or poor. Last year several incidents occurred with upper-middle-class high school girls bullying female classmates to the point that they committed suicide. They bullied because it made them feel good. Kids who enjoy bullying others are screwed up. Adults that enjoy bullying others are screwed up. That is the quick Psych 101 course synopsis.
Bullying ranges from schoolyard intimidation to spousal abuse to drug cartels' murderous acts. Yes, drug cartels are bullies, dangerous bullies, but bullies nonetheless.
So, how does this relate to gangs? Simple. Gangs are just another level of bullies that get off on violence toward others in order to achieve their goals—and they feed off of the fears of everyone they come in contact with. Power and Control: the key essence of gangs.
Do you have gang problems in your neighborhood, community, or city? The answer is 'yes', only you may not be aware of the full extent of their presence. If you answered 'no' then you either live atop a mountain in a monastery or you keep your head buried in the sand to avoid accepting reality. Some towns and cities have gang presence more than other regions, but the problem is out there and it's all too real.
There were 850 attendees at the Texas Gang Investigators Association (TGIA) conference held the week of June 23rd in San Antonio, Texas. The men and women came from local, state, and federal law enforcement agencies. Their ranks varied as much as the sizes of their departments. While some attendees were from formal, dedicated gang units, others were from patrol divisions whereby you have to be the "Jack-of-All-Trades and Master of None."
TGIA provides them with 31 continuing education hours for their state license, up to date training, and the latest intel on the evolution of gangs and cartels. The criminal world of gangs is a constantly changing environment that requires continual modification of law enforcement tactics.
TGIA honored me for the third year in a row by inviting me back to sign and sell my books, and be with my former brotherhood. It was an honor I definitely do not take lightly.
Throughout my two days at the conference I met old friends, made new friends, and happily learned I had loyal readers of my novels anxiously awaiting more. Erik Larson, the author of Lone Star Daybreak and an attendee of the conference, was present and we had a great talk about the world in general. But with each conversation held, I casually asked a question to get a general consensus: "What do you think is the main problem coming from gangs?" The basis of every answer was always related to drugs—drug cartels, drug money, drug deals, drug transport, and drug violence.
Small gangs primarily finance their growth through drug sales and consolidating territorial controls through mutually benefitting agreements with other gangs. As they grow, their operations expand into human trafficking, prostitution, robberies, fraud, home invasions, burglary, auto theft, murder and assassination contracts, alien
smuggling, extortion, and more. They recruit teenage girls through the Internet then force them into prostitution, using them locally, or trading and selling them off to other gangs across the country. Runaways are excellent targets, grabbed off the streets of major cities and most are never seen again.
How can law enforcement compete against the high flow of drug money? Cocaine alone is a $30 billion a year business. Most agencies can barely fund their principal divisions of patrol and detectives, much less specialized units such as gangs. Citizens don't realize that the majority of law enforcement agencies in America consist of 30-50 personnel at the most, if they are fortunate to have that many. And the temptation of making more money in a few hours than you will make in a year has been the downfall of many a man and woman.
Ever heard of "narcotecture?" Cartel drug kings have so much money that like the super rich oil Arabs who make everything from gold, including their commodes, the Cartel kings have special made mausoleums constructed with imported Italian Marble, gold fixtures, and air-conditioning. Air-conditioning! For a mausoleum! These incredibly ornate tombs started the term "narcotecture."
America is the largest consumer of drugs. Coke (not to be mistaken with the drinking kind) is a social drug used at every level of our society – government officials, businessmen, the entertainment industry, clergy, and on down to street level punks. Gangs can easily make $30-40k per day selling coke. Profit is turned so fast that it's ridiculous.
A kilo of coke in Columbia is $2,000. By the time it gets to users in the States, it's been cut so many times that there is easily a $100,000 profit. Combine drug money with the cash flow from other gang operations (prostitution, fraud, drug transport, and so forth), and the average citizen cannot begin to comprehend the extent of money that gangs have at their disposal.
"Everyone has a price" is the belief of gangs and cartels. Judges have been bought. Lawyers are retained by gangs. Federal agents and law enforcement at state and local levels have been caught selling out to gangs. If people in these prominent positions can be bought, then how can we expect a jobless person with a family, struggling to support them, to turn away from a high dollar offer for only a few hours work?
Unfortunately, there are still people in denial about how serious the gang problem across America is and how relationships between gangs and cartels are so heavily intertwined. America's war on drugs is only viewed as successful by government officials with little grasps on reality or are trying to keep their jobs. The Secretary of Homeland Security testified before Congress that our borders were completely safe. Talk to the dedicated men and women in law enforcement who daily risk their lives and you'll learn that fighting the drug war, stemming the flow of drugs, is similar to going to the beach and trying to hold back the waves of the ocean. You hold back part of one wave while the remainder simply flows around you.
All along the US border, ranchers live in daily fear of gang organized drug caravans coming across their land. South Texas Sheriffs have testified to the overwhelming problems their departments face with the increasing violence against families living along the border.
The gang problem only continues to grow. A majority of gangs outside of prison are controlled by gangs within our prisons. Gangs such as MS-13, who pride themselves on merciless revenge and cruel retributions, send enforcers to their upstart gangs throughout the states to teach them how to properly be members. Other words, how to be more vicious.
The times have definitely changed. The codes that criminals such as the old Mafia families lived by are long gone. Now gangs are comprised of younger, more restless thugs who view violence as the ultimate action. The drug cartels murdered 35,000 people in Juarez, Mexico in the last four years. Innocent people were killed and have disappeared. Decapitation became a cartel gang trademark. Stateside gangs wanting to be like the "big-boys," have followed suit even to the point of making 'snuff videos' of their murders.
Do the research yourself if you still believe there isn't a problem. In Houston, you can go to Stop Houston Gangs.org and view some of the gangs we have. It's nothing to be proud of, but it's reality.
Gangs are bullies. They serve no purpose in life except to further destroy our society like a cancer spreading through one's body. They make whole communities live in fear. They steal, rob, and murder innocent people. They cost taxpayers billions of dollars yearly. And they respect nothing but further violence.
What can be done about gangs? First, understand there is a problem. Support your local law enforcement by reporting suspicious activities in your neighborhoods. Talk to your neighbors and watch out for each other.
Keep your children away from gangs as best possible by talking to your kids, letting them know they are loved and encourage their education in schools. Go to
their schools and talk to administrators about school bullies. The school boards generally flat deny that any problem exists, but when you are persistent, they will act—even if it means you must go to the media about the school board. When your kids think being "gangsta" is cool, let them know what losers "gangstas" really are. And most of all, pay attention to what your kids do on the Internet. Be a parent before being their 'buddy.' Don't let your child commit suicide before you learn a problem existed.
Like "Ringo" DeLeon, I hate bullies too.
* * * *
Before I close, I wish to express my gratitude to the men and women of the Texas Gang Investigators Association for the dangerous work they daily perform on behalf of the citizens of our great state, as well as for our magnificent country. Teachers and law enforcement related personnel do not receive adequate payment for the critically important work they do, especially when compared to the frivolous mega-salaries of sports figures today.
Organizing an educational, informative conference such as the Board of T.G.I.A. does each year, is to be commended. The overall planning involved is astounding and the Board's efforts are displayed in the quality of their conference.
Thank you, Mr. Ringo DeLeon, President of T.G.I.A., Mr. Patrick Natividad, 2nd Vice President of T.G.I.A., and Mr. Paul Zamarripa, Director, Pos.1, South Region, of T.G.I.A., for your friendship, hospitality, and my further education into the world of gangs.
And special thanks go to Mrs. Janelle Zamarippa and Mrs. Natividad for our discussions and the work I observed you tirelessly perform each day for the benefit of T.G.I.A.
Glenn Starkey


text:
MIZGI Premium Velvet Hangers (Pack of 50) Heavyduty - Non Slip - Velvet Suit Hangers Gray - Gold Hooks,Space Saving Clothes Hangers (Gray)
Full Adult Standard Size- (LxWxH): 17.5"x0.2"x9" inches. Made of Top Quality ABS Plastic, Eco-friendly Gray Nylon Flocked, Luxury Gold Hook. PREMIUM VALUE PACK of 50 pcs. Swivel Gold Hooks- Hooks can be 360 degree rotated, which easy sorting of clothes no matter which direction you hang your clothes, strongly attached to our durable hanger so the hook doesn't detach or snap easily
Super Strong- MIZGI velvet hangers with 2019 NEWLY improved quality made of premium grade plastic. Rest assure that it will steadily hold even the heaviest clothes in your closet, can hold large capacity from 5kg to 8kg(11lbs to 18lbs).It is stronger and much lighter than wooden suit hangers but sturdy to hold heavy coats without getting bent
Nonslip - Supreme soft luxurious velvet flocked instead of plastic or metal leaves no crease on the pant when you fold them over.Prevents slippery or wide neck clothes from slipping off the flocked hangers, no shedding or fading on your white clothes with latest flocking technique. Great coat hangers for suits, shirts, coats, sweaters, skirts, dresses and pants etc
Double Maximize Closet Space - Designed grey velvet hangers Increases Closet space by as much as 50 percent.The slim and sleek design felt hangers works for your closet efficiently, maximizing space and adding class, helping you organize your wardrobe in the most space efficient manner
100% Satisfaction Guarantee- MIZGI is different kind of Company that prides itself in providing the absolute best customer service , if you has any questions for this boutique hangers and it is not suitable for you. Send 1 simple email to Clicking "Ask seller" and received a 100% money back. (In fact, you do not need to send back)
MIZGI brings you Luxurious Design High Quality Heavy Duty Non-Slip Velvet Hangers at an Affordable Price! Supreme Quality Combined Thicker and Stronger than Standard Velvet Hangers. These Premium Velvet Hangers (Pack of 50) Heavyweight - Non Slip - Velvet Suit Hangers Grey - Gold Hooks, Space Saving Clothes Hangers by MIZGI help you saving more than half the closet space compared to wood or plastic.
They have can hold suits and outerwear securely with its heavy duty strength.
Key Features:
* These hangers measure 17.5"x0.2"x9" inches and come in our beautifully designed box for easy transport.With Top Quality Material: ABS Plastic, Nylon Flocked, Gold Hook
* Ultra slim & lightweight design for space saving
* Non slip and luxurious velvet material
* Holds heavy winter coats easily
* Can hold large capacity from 5kg to 8kg(11lbs to 18lbs)
* Conserve a tremendous amount of precious closet space
* Swivel Gold Hooks can be 360 degree rotated
* The gentle curves Notched Shoulders of the hanger preserve the shape of your clothing, unlike regular hangers
The set makes a great gift! With this pack of 50 velvet hangers with Gold finish, Premium Velvet Hangers (Pack of 50) Heavyweight - Non Slip - Velvet Suit Hangers Gray - Gold Hooks,Space Saving Clothes Hangers by MIZGI, you can replace all your regular hangers at once. Perfect for dresses, suits, shirts, skirts, trousers & more.
NOTICE : Please be sure to purchase the right hanger color and hook color you like.
Package Includes:
50 x Velvet Hangers
"I LOVE THOSE HANGERS!!!They are readlly AWESOME! The hangers I used before leave dents in the shoulder area of my shirts and dresses, but from MIZGI absolutly don't! "
Lily Chamberlin
MIZGI Amazon ASIN B07H32N13D Home & Kitchen Storage & Organization , Clothing & Closet Storage , Clothes Hangers , Suit Hangers


text:
Please only use this news feed for posting news about UTAU voicebank releases and updates. You can use wikidot syntax to style your posts.
Edit | Files | Tags | Source | Print
Recent UTAU News
Post Icon Purge VB Directory Update
Following The Great Icon Purge of 2019 the main Voicebank Directory has been broken with many no longer hosted images. It wasn't an issue as previously the Wikidot hosted icons were a mandatory field but with the AJAX uploader that gave us so many errors kicked to the curb, we can no longer guarantee that a profile will have a proper 100x100 icon associated with it.
Axfc Uploader (Edited 9/10)
UPDATE 9/10: As of now, Axfc Uploader is back, with a broken security certificate. However, the incident from last night (and some reports that the site has been down for multiple days prior) has put into perspective how fragile of a position early UTAU voicebanks are in.
The Great Icon Purge of 2019
Many of you have been suffering through constant ajax errors over the past few months when attempting to update your UTAU pages, so this news is a good bit overdue and I apologize.
WIP UTAU Page Creation
I've added quick page creation boxes to both the front page and sidebar for Work-In-Progress UTAU pages! Please remember that if your UTAU does not currently have a released voicebank but you are working on it with the intention of a release, it counts under "WIP" and the page should be posted under the "wiputau" category instead of under the "utau" category.
Misc. Maintenance
Hey everyone! It's been a bit since the last wiki update. I'm just popping in to say that I did some basic maintenance today.
Seeking Wiki Volunteers
With the recent issue with the wiki running out of space and my review of Recent Changes logs I have noticed several common thrends that can be addressed and you as a wiki viewer can help make the UTAU.wiki a better place.
Space Free: Stop Using .BMP & Size Icons Properly
Crisis averted! After quite a bit of effort, we have freed up more than 25% of the server's file storage by simply resizing and optimizing poorly cropped icons. With the worst offender, a massive 5000x5000px file that took up 5% of our total allocation all by itself.
Storage Limit Reached
I've just been alerted that we've reached our storage limit of 300MB and no more icons can be uploaded.
New .Wiki Domain
The UTAU Wikidot team is proud to announce we have acquired the UTAU.wiki domain for use with this wiki. All the links to the old wiki articles should still work, but all new visitors should be redirected to our new domain.
Comment System And More
Update for June 16, 2014
- added Indonesia and Malaysia to countries list
- fixed how empty forms display on profiles
- added sections for Soundcloud setlist and YouTube playlist for voice samples
Private Voicebanks
Due to problems in the past with OCs, fanvocaloids, pitchloids and stolen voicebanks being passed off as "private" UTAUs, at the moment we cannot allow profiles for unreleased (noncommercial) voicebanks.
Please read the guidelines before posting.
Welcome to the New UTAU Wiki!
Myst here, posting for Yue since he's currently at work. I just wanted to welcome you all to the UTAU Wiki 2.0!


text:
Our Team
How Can We Help?
We at Grand tours want to make sure that your trip is everything you could possibly dream of. Whether you want inspiration and guidance in planning your next adventure or need help with an existing booking, our travel experts are here to help. Send us an email or give our team a call to plan your adventure or get assist with any query you encounter along the way.
Mr. Mahmoud Khasawneh
CEO / Managing Director
Land line: +962 6 5625776
Fax: +962 6 5625775
Mob: +962 798979546


text:
The roomy Aspen® model has room for up to eight adults, which is our largest non-lounge spa is the only model that includes a unique bench seat for two. This spa truly has the best of everything, including patented Fluidix® jets and illuminated grab bars. It's also the only Sundance® spa with bench seating for a side-by-side massage session. Diverse seat options are designed to harmonize with your body, right down to the jetted footwell for your overtaxed feet.
Exclusive SunScents aromatherapy-releasing, air-only jets soothe your skin and your senses. A full-body Intelli-Jet™ Seat melts away stress and strain. The customer-favorite Accu-Ssage™ Therapy Seat delivers the deepest-immersion massage experience available.


text: Watch Traffic (2000) : Full Movie Online Free An exploration of the United States of America's war on drugs from multiple perspectives. For the new head of the Office of National Drug Control Policy, the war becomes personal when he discovers his well-educated daughter is abusing cocaine within their comfortable suburban home. In Mexico, a flawed, but noble policeman agrees to testify against a powerful general in league with a cartel, and in San Diego, a drug kingpin's sheltered trophy wife must learn her husband's ruthless business after he is arrested, endangering her luxurious lifestyle.