text:
Securing Sendmail with TLS
One of the most common uses of network systems is for e-mail-based communications. As such, a great deal of attention has been given to securing e-mail systems. However, most of this focus has been in two areas: security at the message level, using PGP or S/MIME, and confidentiality in the authentication process for mail retrieval, i.e., using APOP or SSL-based IMAP. This still leaves mail server-to-server traversal vulnerable to several attacks.
The introduction of basic cryptography into a mail server-to-server session alleviates most of these risks. Mail transport agents (MTA) and software such as Sendmail or Postfix can be augmented to handle their communications over transaction layer security (TLS) channels. This provides for a number of services, including confidentiality, integrity protection and strong authentication.
This article will introduce the features and use of SMTP over TLS as defined in RFC 2487, as well as illustrate their setup in the Sendmail package. We will cover cryptography basics, though not delve into the mathematics of cryptosystems and simple mail transfer protocol (SMTP) and extended simple mail transfer protocol (ESMTP) basics.
We will outline the basic components of cryptography, which will be useful for understanding the setup and benefits of using TLS in ESMTP transactions. Further information on cryptography is available from the references listed in the Resources section below.
Private key cryptography, or symmetrical cryptography, utilizes a shared secret, the key, for both encryption and decryption of a message. Input data is mathematically processed using the algorithm and the key to produce the ciphertext output, which must be decrypted to be understood by the recipient. Commonly found private key algorithms include DES, Blowfish, AES and IDEA.
Public key algorithms utilize two mathematically related keys to separate the processes of encryption and decryption. By utilizing functions that are easy to perform in one direction, but difficult to do in the reverse, the two keys provide for a high level of security if large enough numbers are used. The relationship between the two keys allows for a variety of appealing functionality, including confidentiality and authentication. Commonly used public key algorithms include RSA, El Gamal and Diffie-Hellman.
Hash algorithms are a set of one-way functions that take a variable length input and, after mathematical processing, produce a fixed length output. The transformations of the data produce a fingerprint of the input, and small changes to the input appear as large scale changes in the output. Popular hash algorithms include SHA-1, MD5 and RIPEMD.
These three components are used by the TLS cryptosystems to provide for a variety of services: integrity checking, authentication and confidentiality. During the establishment of a TLS session, public key cryptography is used to exchange a session key used in a private key algorithm. These public keys can also be used for authentication of the server and, if desired, the client. This is then used to provide session-level encryption and provide confidentiality for the entire session. Lastly, hash algorithms are used for integrity checking to ensure that the data has not been tampered with during transmission. TLS is closely related to SSL, and it is the IETF standards version.
Having outlined the basics of cryptography, including public key and symmetrical cryptography, let's now take a brief look at what we are talking about when we say "certificates". These are vital to SSL and TLS setup, and it's important to understand their principles.
In a nutshell, a certificate is nothing more than a collection of identifying information about a client or a server. It contains descriptive fields, such as the name of an organization and its location, as well as cryptographic information, such as keys and signatures.
Recall that the private key of an asymmetrical keypair can be used to sign material, that, when decrypted with the public key, establishes the signature. This can be used to offer proof of identity. Public key infrastructures (PKI) use a hierarchy of trust for validation of identities, extended by signing certificates and keys. This is in comparison to the web of trust used in PGP, which has no central authority.
The central authority in a PKI issues what is called a certificate authority, or CA, a definitive certificate containing their information and their public key. This CA can be used to sign other certificates by signing the public key of a requesting body, such as your server, with their private key, as described in the preceding paragraph. Since the CA is recognized by all of the involved parties as authoritative, the trust in identity is therefore transitive. "I trust the CA, and the CA says that is you, so it must be true."
Certificates can also be revoked due to expiration or compromise of their security. To do this, the issuing body issues a certificate revocation list (CRL) identifying the certificate to be invalidated. This also has to be trusted, and strong proof is also provided through trust mechanisms.
Certificates can come in a few formats, though we usually deal with them in PEM format. PEM encoding is nothing more than an ASCII text representation of the binary data in ASN.1 format. The X.509 standard defines the distinguished name (DN) format used in these certificates. This information contains several pieces of identifying information to accompany the cryptographic keys:
"common name" (CN) being certified
"organization" (O) associated
"organizational unit" (OU), such as a department within this organization
"city or locality" (L) where this organization is located
"state or province" (SP) where this city is located
"country" (C) is ISO format (such as US)
The DN is therefore the combination of this information. The PEM encoded certificate contains this information along with the DN of the issuer, the validity period of the certificate, various administration information, such as a serial number of the certificate, and any other needed information, such as Netscape specific tags.
These certificates are then used to establish the identity and trustworthiness of the presenter, such as a server or a client. This is used to authenticate the connecting party and take appropriate action, such as allowing a connection to proceed, allowing for mail relaying or entrance into a network.
SMTP is the basic protocol spoken by Internet e-mail servers. ESMTP is a set of extensions to the protocol to allow for enhanced features, and it is a superset of the SMTP protocol. In their basic form, however, they are fairly similar.
At the opening of a session, the greeting determines the session type, SMTP or ESMTP. For an SMTP session, the greeting is HELO (/hostname/), where /(hostname)/ is the name of the client machine connecting. To chose an ESMTP session, enter EHLO (/hostname/), and you are presented with a set of options:
<<< 220 mail.company.com ESMTP Sendmail ready for love at Tue, 15 May 2001 16:10:36 -0400 >>> EHLO mail <<< 250-mail.company.com Hello jose@localhost [127.0.0.1], pleased to meet you <<< 250-8BITMIME <<< 250-SIZE 72000000 <<< 250-DSN <<< 250-ONEX <<< 250-XUSR <<< 250 HELP
Unless various ESMTP options are chosen, the MTA then designates the origin of the mail and the recipient (or list of recipients), then begins the data transmission. After completion of the message body delivery, the session is closed. The angled braces indicate the direction of the transmission, either server to client or client to server.
When the MTA supports TLS security, one additional option is presented in the list from the ESMTP notification:
This is the server's indication that it is capable of handling TLS sessions. The client then sends the same command, STARTTLS, to the server and the session is negotiated. Secure ESMTP transactions occur over the same channel as normal SMTP connections, port 25/TCP, which means you don't have to open new holes in your firewall. You can control if connecting MTA systems must, can or must not use STARTTLS in their connections, even down to the specific mail server level.
Secure ESMTP connections utilize TLS almost immediately. After the greeting, when the server presents STARTTLS as an option, the client initiates the TLS setup by issuing the command STARTTLS.
We will illustrate how to set up a TLS capable SMTP server using Sendmail 8.12 beta. Since version 8.11, Sendmail has been capable of natively using TLS security when it was compiled. This was, in fact, the major difference between versions 8.10 and 8.11. When compiled to support TLS transactions, it is often referred to as "Sendmail Secure Switch". It is also commercially available in this configuration (see Resources).
We will be using Sendmail 8.12beta17, the current version as of this writing. Note that if you would like to use 8.11.5 (the current release version), you will also need to obtain and install the sfio library, and even then version sfio1999. For either version, 8.11 or 8.12, we will use the OpenSSL library for our cryptographic routines.
Compiling Sendmail to use TLS security is pretty straight forward. First, make sure that you have OpenSSL installed. The current version is 0.9.6a, which has a number of security and performance fixes. We will assume the default installation location, /usr/local/ssl. You should be comfortable with building, configuring and installing Sendmail normally.
The following are additions to the file sendmail-8.12.0.Beta17/devtools/OS/Linux:
define(`confSTDIO_TYPE', `portable') APPENDDEF(`conf_sendmail_ENVDEF', `-DSTARTTLS') APPENDDEF(`conf_sendmail_LIBS', `-lssl -lcrypto')
These directives are processed by the Build script to define parameters used in building the Sendmail package. While the Sendmail binary is being built, you should see the -DSTARTTLS directive sent to the compiler.
We also need to edit the configuration file for the build process. The Makefile calls the script sendmail-8.12.0.Beta17/devtools/bin/Build, a master configuration and compilation script. We need to teach it where to look for our cryptographic header files and libraries. We will edit these values, which appear near the top:
libdirs="-L/usr/local/ssl/lib" incdirs="-I/usr/local/ssl/include" libsrch="-L/usr/local/ssl/lib" libpath="-L/usr/local/ssl/lib"
At this point you can build the Sendmail package as you would normally. In the top level directory type make. Install it as you would normally.
Sendmail is controlled by a set of configuration files. While they are complex, they are easily set up using the M4 macro scripts, the accompanying .mc files. The following additions to your .mc file (usually found in sendmail-8.12.0.Beta17/cf/cf/generic-linux.mc) should get you stated using STARTTLS in the configuration file:
define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')dnl define(`confCACERT_PATH', `CERT_DIR')dnl define(`confCACERT', `CERT_DIR/CAcert.pem')dnl define(`confSERVER_CERT', `CERT_DIR/MYcert.pem')dnl define(`confSERVER_KEY', `CERT_DIR/MYkey.pem')dnl define(`confCLIENT_CERT', `CERT_DIR/cert.pem')dnl define(`confCLIENT_KEY', `CERT_DIR/MYkey.pem')dnl
We will be using the /etc/mail/certs directory to store our certificates, and the server will use the same certificates both as a client and as a server (when sending and receiving mail, respectively, to another MTA).
Having made these additions, you can run make in the directory that contains the configuration files, sendmail-8.12.0.Beta17/cf/cf, to build the new .cf files. Be sure to install this new configuration file.
Generating certificates and keys is readily done with OpenSSL accessory programs. We will modify the CA.pl script a bit in two places to prevent our certificates from being DES-encrypted. This new script, which we will call CA1.pl, has the following differences (in "patch" format):
# diff -ur /usr/bin/CA.pl /usr/bin/CA1.pl --- /usr/bin/CA.pl Fri Sep 1 19:51:57 2000 +++ /usr/bin/CA1.pl Sat May 26 11:31:18 2001 @@ -57,12 +57,12 @@ exit 0; } elsif (/^-newcert$/) { # create a certificate - system ("$REQ -new -x509 -keyout newreq.pem -out newreq.pem $DAYS"); + system ("$REQ -new -x509 -nodes -keyout newreq.pem -out newreq.pem $DAYS"); $RET=$?; print "Certificate (and private key) is in newreq.pem\n" } elsif (/^-newreq$/) { # create a certificate request - system ("$REQ -new -keyout newreq.pem -out newreq.pem $DAYS"); + system ("$REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS"); $RET=$?; print "Request (and private key) is in newreq.pem\n"; } elsif (/^-newca$/) {
The -nodes option to the certificate generation is the change, otherwise Sendmail will complain it cannot load the (encrypted) key at startup:
May 19 05:42:59 linux sendmail[12018]: starting daemon (8.12.0.Beta17): SMTP May 19 05:42:59 linux sendmail[12018]: STARTTLS=server, error: SSL_CTX_use_PrivateKey_file(/etc/mail/certs/MYkey.pem) failed
Now we will begin the generation of our own certificate authority (CA), generate a client certificate and use this CA to sign it.
$ CA1.pl -newca
Answer the questions presented to you, such as your organization, your location and your name. Choose a decent passphrase for the CA certificate so no one can abuse your CA and sign any certificate. Copy the CA file, which is in demoCA/cacert.pem, to /etc/mail/certs/CAcert.pem, as we have it configured in the above Sendmail configuration file.
Now we generate the server's private key, which we will want signed by this CA:
$ CA1.pl -newreq
This will generate a private key and certificate request that we want our CA to sign (ourselves really). This is a more sane and flexible method to use when compared to self-signed certificates. We can recycle the CA for other certificates and not have to install multiple CAs, only one for each group. The private key will be in the file newreq.pem. Copy this file to /etc/mail/certs/MYkey.pem, based on the naming scheme we used above in our .mc configuration.
Then we use our CA certificate to sign this request:
$ CA1.pl -sign
This will generate the third component of our server's configuration, the signed public certificate. This will be in the file newcert.pem, which we copy to /etc/mail/certs/MYcert.pem.
Sendmail is, understandably, quite picky about using tight permissions on those files, so remove group and world readability for them:
chmod -R go-rwx /etc/mail/certs
The private keys and the CA file amount to the keys to our cryptographic kingdom, and we don't want just anyone being able to see them.
To test the installation, start up Sendmail in dæmon mode (*sendmail -bd*) and begin a manual ESMTP session to the server:
$ telnet localhost 25 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 mail.example.net ESMTP Sendmail 8.11.1/8.11.1; Sat, 19 May 2001 08:04:04 -0400 EHLO localhost 250-mail.example.net Hello IDENT:firstname.lastname@example.com, pleased to meet you 250-ENHANCEDSTATUSCODES 250-EXPN 250-VERB 250-8BITMIME 250-SIZE 250-DSN 250-ONEX 250-ETRN 250-XUSR 250-STARTTLS 250-DELIVERBY 250 HELP
While you could, at this time, issue the command *STARTTLS*, and the server would respond with a reply like 220 2.0.0 Ready to start TLS, you probably could not negotiate a secure connection by hand.
A simple test to perform is to point an SSL-compatible e-mail client, such as the Netscape Communicator mail client, at this new Sendmail server. Chose to attempt a secure connection if possible and send a mail message through this server. After accepting the new site certificate, a log line like the following should appear in your Sendmail logs:
May 19 23:09:24 linux sendmail[914]: STARTTLS=server, relay=IDENT:firstname.lastname@example.com, version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128
This tells you that the server is capable of negotiating a TLS session with a client, indicating a successful installation.
The most obvious use of a cryptographically enabled Sendmail installation is for confidentiality of the electronic mail transaction and the integrity checking provided by the cipher suite. Everything between the two mail servers is encrypted, including the sender and recipient addresses. TLS also allows for authentication of either or both systems in the transaction.
One excellent use of public key cryptography is for strong authentication. We can use this authentication to selectively relay clients, including other mail servers and mobile clients like laptops. However, there have been some problems getting the Outlook mail client working using certificate-based authentication. The Netscape mail client in the communicator package, however, can do successful STARTTLS negotiation. Note that your clients will have to generate certificates and have them signed (for trust validation) by a CA you also trust, if you configure your server to do client certificate checking.
The use of the access map (usually held in /etc/mail/access), which is normally used to determine connections and relaying, can also be extended to give server level control for the use of TLS. Two new entries are available for TLS options: VERIFY, which contains the status of the level of verification (held in the macro {verify}; and ENCR, the strength of the encryption in the macro {cipher_bits}. VERIFY can also accept the argument for {cipher_bits}. Here are a few example entries that illustrate these features, and the role based granularity as well:
Force strong (112 bit) encryption for communications for this server:
server1.example.net ENCR:112
For a TLS client, force string verification depths to at least 80 bits:
TLS_Clt:desktop.example:net VERIFY:80
Much more complicated access maps are possible, and error conditions (such as permanent or temporary, PERM+ or TEMP+) can be set on the basis of various criteria. This allows you fine-grained control over the types of connections you can allow. Documentation is emerging for these features, and the newsgroup comp.mail.sendmail is also a great place to get questions answered.
Note that it is unwise to force all SMTP clients to use TLS, as it is not yet widespread. The RFC document notes that publicly referenced SMTP servers, such as the MX servers for a domain, must not refuse non-TLS connections. However, restricted access SMTP servers, such as those for a corporate intranet, can use TLS as an access control mechanism.
While all of this work may seem to be a total security solution for e-mail, it cannot totally secure your e-mail system.
One often forgotten limitation of using TLS on your mail servers is the payload of the mail message and the resulting security there. Many virus and worm files are now distributed using electronic mail. While the mail maybe encrypted and the servers authenticated, the payload will still be malicious. Using a good content protection program on the desktop will be of great value even with TLS at the MTA level.
Because Sendmail with TLS only can authenticate at the server level, true end-to-end authentication of the mail message cannot be performed with only the use of Sendmail Secure Switch. By including the use of S/MIME or PGP e-mail and trustworthy key hierarchies, full confidentiality and integrity can be accomplished from end-to-end of the mail message path.
Furthermore, if a mail message traverses more than the starting and ending servers, there is no way to control interactions between the additional mail servers, which may use non-secure connections. This introduces a point of vulnerability in the chain.
Additionally, SMTP over TLS is not yet widely implemented. The standard, in fact, doesn't force it, leaving it only as an option, though specific sites can configure their servers to force it for specific clients. As such, it is difficult to see the widespread use of SMTP using TLS, despite the fact that the standard is over two years old.
Lastly, interopability problems can creep in. On UNIX systems, the major mail dæmons, including Sendmail, QMail and Postfix, all work quite well with TLS enabled, but various commercial MTAs seem to have problems integrating with Sendmail. Exchange had some problems which Microsoft was working to patch; which may be available by now, as versions have changed since this was first noted. As such, some testing should be performed if you are going to use TLS in a heterogeneous environment.
RFC 2487, "SMTP Service Extension for Secure SMTP over TLS"
RFC 1869, "SMTP Service Extensions"
RFC 2246, "The TLS Protocol Version 1.0"
See IETF for RFC documents.
Claus' STARTTLS docs
Sendmail, source and documentation
Sendmail Secure Switch, commercial version
SSL and TLS Essentials by Stephen Thomas
Jose Nazario is a biochemistry graduate student nearing the completion of his PhD. Side projects include Linux and other UNIX variants, software and security related matters, and hobbies outside of the office include fly fishing and photography.


text:
The severe thunderstorm that drenched Geelong just after 5.30pm on Wednesday dumped more than 50 millimetres of rain in an hour, delaying the start of a NAB Challenge AFL match.
The downpour, which caused localised flash flooding, arrived just hours before St Kilda and the Western Bulldogs' were due to play at Simonds Stadium.
Ground staff were left scrambling in an attempt to ready the ground for a 7.10pm start, after what was described as ''a mini flood''.
Bureau of Meteorology senior forecaster Scott Williams said the intense thunder storm arrived without warning.
He said it appeared to develop above Geelong in about 10 minutes and was so high that the radars failed to detect it.
He said in his 30 years at the Bureau, he had never seen anything like it.
''I don't think I've seen a classic one like this,'' he said.
''It's pretty rare in Victoria to get one of these … instead of curling anti-clockwise, it came in clockwise and with height.''
@mmmhotbreakfast this was the local Woolworths last night (not taken by me) in Newcomb #deluge#storm#flashfloodpic.twitter爱杭州同城论坛m/7dY1Sy1krD— Fairls (@fairls) February 19, 2014
Mr Williams said 54 millimetres of rain was recorded at Geelong racecourse between 5pm and 6pm, with the majority falling between 5.20pm and 5.53pm.
After dumping down on Geelong, the storm moved towards Ocean Grove by 6.30pm before heading out to Queenscliff and out over the bay.
Mr Williams said Bureau staff were monitoring it, in case it gained severity as it approached Mornington Peninsula.
The Geelong thunderstorm was one of two cells which accompanied the cool change.
The other event hit a less populated area around Ballan, near Bacchus Marsh.
Melbourne meanwhile experienced light rain with the cool change, which will last the rest of the working week.
Bureau of Meteorology data showed rain fell in the city and northern suburbs, the fourth time rain had been recorded in Melbourne this month.
About 2 millimetres of rain in the CBD and 3-5 millimetres in the suburbs by Wednesday afternoon.
Showers and cool weather are forecast for the rest of the week, with Thursday and Friday set to reach a maximum of just 20 degrees.
There is also a chance of thunderstorms in the early hours of Thursday morning, with southern areas such as Geelong most likely to be affected.
The weekend forecast is for clear and warm conditions, with a top of 23 degrees on Saturday and 27 degrees on Sunday.
with Adeshola Ore

subset: commoncrawl


text:
Fold3.com is excited to announce that they have begun adding the following new titles to the site, covering 5 wars and 130 years of U.S. military history:
War of 1812 Pension FilesFree
Records in the War of 1812 Pension Files reveal details of each soldier's service and family.
Mexican War Service Records
From 1846 to 1848, the war with Mexico determined the southwest border of the U.S. as we know it today. The Mexican War Service Records launch Fold3's commitment to bringing records of this strategic war to our members.
Confederate Casualty Reports
From skirmishes to major battles, documents within the Confederate Casualty Reports describe a unit's role in the conflict and detail casualties, from killed to missing to "slightly" wounded.
World War I Officer Experience Reports
The World War I Officer Experience Reports reveal intriguing accounts by engineers in the American Expeditionary Forces (AEF).
WWII "Old Man's Draft" Registration Cards
In 1942, men between the ages of 45 and 64 were required to register for the draft in order to create an inventory of those who could provide essential skills to the home front during World War II. The "Old Man's Draft" Cards are the result, complete with addresses, dates, and physical descriptions of each registrant.
Watch for more to come as these titles continue to grow and others are added to Fold3.com.


text:
With a year left on the city's exclusive agreement with AEG to work toward bringing professional football back to Los Angeles, a city panel on Tuesday said it wanted to continue efforts beyond that if no team has decided to relocate to Southern California.
"Our first choice is Los Angeles, but if it's anywhere in the region, we will support it," said Councilman Tom LaBonge, who wrote the resolution and has been an active proponent of several missions to bring back pro football.
LaBonge wrote a personal letter to NFL Commissioner Roger Goodell and each of the owners, asking them to consider placing one or two teams in Los Angeles.
"A metropolitan area of our size can support two teams," LaBonge wrote. "We can all agree that the NFL must return to this city."
However, there has been no commitment by the NFL to a specific site, with new locations mentioned frequently. "We continue to closely monitor all stadium developments in the Los Angeles area," NFL spokesman Brian McCarthy said.
AEG has until Oct. 18, 2014, to try to bring a team into its proposed Farmers Field stadium at L.A. Live.
After that, the city can move ahead with its own plans to expand the Convention Center — for which AEG is to serve as operators under a contract being completed now — as well as support other moves to obtain a team.
Other football sites said to be under consideration are Dodger Stadium, Hollywood Park and one in the City of Industry with developer Ed Roski.
LaBonge said each of the sites has benefits as well as drawbacks, but his interest is in seeing football back in the L.A. area.
In the past, Los Angeles has been used as a bargaining chip by teams as they seek improvements in their stadiums or contracts with local jurisdictions.


text:
An eclectic gallery with a museum atmosphere, Rare Things offers designer jewelry, antiques, decorative arts and fine collectibles. The adventurous traveler to out-of-the-way Creede will be rewarded with sophisticated shopping, theatre and dining fare. Resting below dramatic cliffs near the headwaters of the Rio Grande, this colorful mining town is a playground for visitors of all ages and interests.
Established in 1974, Rare Things Gallery thrives in an unlikely business environment by offering an unusually vast and varied inventory. Within the 3000 square foot showroom, niches hold hand carved furniture and home accessories, ledges are filled with gems and minerals from every continent, and antique showcases display classic and unique jewelry and artifacts. Textured walls are layered with paintings, pastels and photography from local artists and customers often comment on the "incredible displays" that present hand blown glass, pottery, woodwork and sculptural art.
Featured in Rare Things Gallery is the work of owner/designer Jennifer Inge. Her excellent eye for design, fine metal working, stone setting, and above all, a constant demand for quality, are evident throughout the gallery. The Inge Horsehair Jewelry Collection is classic and timeless in style, and is appreciated by horse-lovers as custom mementos of equine friends.
The mystique that is Rare Things is an adventure you don't want to miss! The easygoing ambiance invites lingering for hours, and a knowledgeable staff brings to life the histories and allure of this global collection. Rare Things Gallery is a unique destination well worth the scenic drive!


text:
Ok guys, I should've told you about this a long time ago, but I kept putting it off. So a month or 2 ago my family and I went vacationing in Wales. We stayed at some friends' house, and they (at least the dad and the son) were big fans of lego. I slept in a room filled with lego star wars, including the Death Star. And then I found a box full of classic castle knights like forestmen, wolfpack, black falcon, etc. It was awesome! I told the dad how cool I thought it was, and he said he actually had the yellow castle(YES, YOU HEARD ME, FOLKS. THE 375 Castle ) and had just taken it apart to make some room for some guests a few weeks ago. He said if I could find the pieces , I could rebuild it. So I dumped out their chest of bricks(unfortunately there were a bunch of : blech blech clone bricks blech blech : mixed in. So with some online instructions, I finally managed to get it rebuilt! It wasn't perfect, there were a couple of parts missing or broken that I had to replace, but I did the best I could. My dad got photos and posted them to his Google +, so here's the link to them. https://lh5.googleusercontent.com/-u_Xe ... .53.51.jpg
https://lh3.googleusercontent.com/-BgdF ... .56.00.jpg


text:
On May 24, Washington state entered a driver license reciprocity agreement with the country of South Korea. The agreement was signed by Licensing Director Liz Luce and South Korean Consul General Young-wan Song at a ceremony attended by Governor Chris Gregoire.
The agreement recognizes that, based on similar driver license testing procedures, drivers from both places are similarly qualified to drive. Director Luce said this creates an opportunity to streamline a process.
"When a licensed driver from our state is planning on moving to South Korea for a few years, the last thing they want to worry about is retaking their driver license tests, Luce said. "Now, they won't have to."
Likewise, South Korean citizens with driver licenses who come to live in our state will be allowed to get a Washington license without retaking driving tests here.
Gov. Gregoire pointed out that South Korea is our state's fourth largest export market and said this agreement will strengthen our state's bond with this important international partner. Washington state has similar driver license reciprocity agreements with British Columbia and Germany.


text:
Columbia Police to Hold Intruder Training Sessions
Related Story
COLUMBIA - The Columbia Police Department announced plans Thursday to host free training sessions on how to respond to an active shooter or intruder in a home, school, or business. The sessions will take place in February and are in response to recent gun violence throughout the country.
Sgt. Joe Bernhard told KOMU 8 News the department discussed hosting such sessions ever since the movie theater shooting in Aurora, Colo. due to requests from the public. He explained those requests then increased following the school shooting at Sandy Hook Elementary in Newtown, Conn.
According to the police department, the majority of requests came from schools and local businesses.
The training deals with the process of planning for and reacting to an armed intruder. Sgt. Bernhard said the two-hour sessions will focus on the decision making a person may have to employ in a crisis involving a shooter threatening to target people in the building.
The sessions will mainly focus on mental strategy and how to pro-actively prepare for the possibility of a shooting, but Bernhard said there will be a few demonstrations on how to physically fight off a shooter.
The first two training sessions will take place on Saturday February 2. The sessions will be from 9:30 a.m. to 11:30 a.m. and from 1:30 p.m. to 3:30 p.m. at the Columbia Police Department Training Center located at 5001 Meyer Industrial Drive.
In order to accommodate a large number of requests for the training, each can accommodate up to 80 persons.
Bernhard told KOMU 8 News he has already had numerous people sign up for the event.
If you are interested in attending, contact Sgt. Joe Bernhard of the Public Relations Unit at 573-441-5470 or firstname.lastname@example.com.


text:
Results 1 to 3 of 3
Thread: Taxing and Taxes
Taxing and Taxes
I will not give all my reasons to support getting the Government out of our billfold because of space limitation. I am just an individual with a bunch of ideas but would be open to further detail or discussion.
This is one of the strongest arguments in favor of letting the rich keep their earnings. The operating term here is earnings, not wealth by fraud.
This newsletter is addressed to those who are involved in business and in investments. Both of these areas create jobs.
The socialists concept of soaking the rich is self defeating because it takes investment money out of circulation.
Who knows what the best design is going to be. Henry Ford started with the Tin Lizzie and the country grew from there. Their latest model is a far cry from those first models. Also look at the Wright Brothers. What we have today has moved far from Kitty Hawk.
Our vast power grid is a long ways from the young Nicola Tesla who wondered why an alternating current motor could not be built. It was common knowledge at that time it woudl not be pssible but it was. When Tesla grasped the concept he had the key to a new universe.
There is one thing in common with all of this. Each idea and every discovery was the product of one mind at a time. None of this was a government project where the bureaucrat has a completely different motive that cannot conceive these technological wonders. Not every one of Tesla's projects worked but they still cost money. That is why we need the rich to finance these goofy ideas. Some of them work like MicroSoft.
I see the hybrid as an excellent choice for stop and go traffic and traffic congestion. You do not need to consume power waiting for the red light or for congested traffic to clear out. This would do more than any other advance to clear city pollution from idling motors.
Progress is going to be made by individuals, not companies and certainly not government. There is a lot to the foundation backing these thoughts but we need to get our priorities right as to what we need from our government and what we definitely don't need but already have. Remember, to soak the rich is to drown the poor.
Sponsored Links Remove Advertisements
Taxing and Taxes
i wouldn't be surprised if small comunities jump on hybrids for basic run around town vehicles. this will happen without government intervention.
other countries see the value & demand for hybrids more then the USA companies. honda & toyota for starters, ford already in catch up mode. chevy & others simply watching?
you'll see taxi's & small delivery couriers getting hybrids. payback is fast.
Taxing and Taxes
I'm not sure what triggered this anti-government rant. The Internet is the first example that comes to mind of an incredible technology that came about because of government leadership and government funding. The interstate highway system is pretty useful, too, and that wasn't developed by private enterprise. And it took forty years for a private company to put a man into space. I'm no socialist, but let's give credit where credit is due!


text:
A Coed Milk and Cookies-Themed Baby Shower
Sip and See: A "Milkaholic" Coed Baby Shower
Sip and See: A "Milkaholic" Coed Baby Shower
Milk and cookies for all! Lots of expectant couples prefer to celebrate with a coed baby shower to include the soon-to-be-dad and other male friends and family members. Planning a coed shower can be a little tricky — since you still want the party to revolve around baby while managing to please all of your guests. Check out this modern bash with a milk and cookies theme for some refreshing ideas if you're hosting or planning a coed shower of your own. It'll make a "milkaholic" out you!
Source: Carrie Sellman of Half Baked


text:
Family Owned Since 1945
Turrentine-Jackson-Morrow is the premier provider of funeral services in North Texas, with seven conveniently located funeral homes and three beautiful memorial parks. We are recognized as the preferred provider of cremation services, offering comprehensive services for every level of need. As a locally owned family business that has served North Texas for over 70 years, we have a single goal: to ensure that families who visit us receive the highest quality of professionalism and service, with compassion and care that are unsurpassed.
Those we love don't go away. They walk beside us every day unseen, unheard but always near, still loved.- Unknown


text:
UPDATE 22 January 2013: The Connect10 competition is back with a new set of artists – find out more here!
So, this new Connect10 project. It's part of Museums at Night – but what does it mean for you and your venue?
Connect10 is a new national competition for cultural venues to win an artist to appear at a meet-the-artist event during Museums at Night 2012. One of ten well-known contemporary artists could be on the way to your venue on the weekend of 18th – 20th May 2012.
How does it work?
You devise an event idea or theme that you think would demonstrate a strong connection between one of the artists taking part and your venue. If your idea is accepted you go through as one of the venues taking part in the competition – up to a maximum of 30. Each artist will end up with either two or three venues vying for them.
Once voting begins, your venue will need to use every communication method available to get as many people as possible to vote for your venue/event/artist combination. The one with the most votes wins!
The prize
Every one of the maximum 30 venues taking part in the competition will receive a bursary towards the running costs of a Museums at Night event. The venues which win will receive £500 towards the cost of holding their event. Even the venues that don't win an artist will get £100 to put on an event: perhaps featuring a local artist or with a completely different theme.
Culture24 will confirm the artists taking part in the run-up to Christmas, with all ten confirmed by the New Year. During this period we will release more information to venues about how to take part, the terms and conditions, and resources to support you while you're devising events.
We will accept event ideas in January through a simple online form. The competition will go live in early February. Voting will take place throughout February and close in early March leaving plenty of time for each venue to liaise with their artist about their Museums at Night event in May.
Why take part in this exciting new project?
Exciting artists
We're not going to give away too much yet but we are leaving no stone unturned to bring you the most engaging contemporary artists to take part in Connect10. This is a unique opportunity to bring an inspiring artist to your town.
Audience development
The competition element provides a valuable opportunity for audience development and advocacy work in your local area, galvanising support and mobilising new fans to go online and vote for your venue to win.
This is your chance to really use Twitter, Facebook and all the other social networking mediums to work hard for your venue. Creating a genuine buzz around the event you are planning will make it more likely that you will win.
Cash support
Each venue will receive a bursary to put towards the event. Each artist will also be paid, and all their travel, accommodation and food expenses will be covered by Culture24.
A special event
An exciting contemporary artist with connections to your venue or your collections will create a special evening event exclusively for Museums at Night, at no cost to you. This is a chance to delight your Museums at Night audience with an ingenious new event you might not otherwise be able to offer.
Museums at Night
Museums at Night is an annual good news story: the only public-facing UK-wide campaign promoting the work of the arts and heritage sector. Whether or not you've run Museums at Night events in previous years, we warmly invite you to bid for a Connect10 artist, engage with Culture24 and benefit from the resources and publicity on offer as we shine a positive spotlight on the work of the sector.
By the time Museums at Night weekend comes around, you can guarantee an engaged audience who are keen to enjoy whatever event you put on.
You can expect full PR and marketing support from Culture24. Our independent PR agency will help you to get local coverage of your participation in the competition and of your Museums at Night event. Plus we will maximise any opportunity we get to profile the competition on national TV, radio, print and online.
As part of your bid, you'll undertake to improve your venue's entry in Culture24's DDE database. This will ensure your venue and the programming and services you offer are easier to find online, attracting more visitors.
You're interested – what do you do now?
Start a discussion within colleagues at your venue about the kind of event you could put on. Make sure the marketing and events people in your organisation all know about this exciting opportunity. Once you see an artist confirmed who you'd like to bring to your venue, start devising an event.
Look out on www.WeAreCulture24.org.uk and here on the blog for further resources to support your event plan. If you have any questions about the competition please get in touch with us: we'd love to hear from you!
Rosie Clarke: 01273 623336 or firstname.lastname@example.com
Nick Stockman: 01273 623279 or email@example.com
Click here to download a printable PDF version of the Connect10 information for venues


text:
Simas Toleikis has a new post to his blog looking at a feature that'll be included in PHP 5.4 - something developers have been wanting for a long time - traits.
As a long-time internals.php mailing list reader I am going to tell you a small secret – the first alpha release for PHP 5.4 should be just around the corner. This release is packed with some welcome new language features, usual bug fixes followed by some performance and memory management improvements. One of the noteworthy language additions are Traits – a brand new horizontal code reuse mechanism.
He explains traits as a better way to do the "kind-of" inheritance that PHP does now with parent and child classes, making it easier to reuse functionality from classes even though they don't share the same parent. With the "use" keyword (not to be confused with the "use" keyword in namespaces) you can include common functionality into class methods and even accommodate for naming conflicts and requirements.


text:
'The Pentax K-S2 is an attractive option for photographers who don't put an emphasis on video capture.'
'The company may not have the clout of Canon or Nikon, but this camera deserves to win Pentax a few new fans.'
'Lots of fine-tuning options for a prosumer model. '
'a broad feature set'
'Disappointing video features'
'The built-in pop-up flash worked well indoors, with no red-eye and adequate overall exposure. '
It's tough, fast and powerful, and Pentax's new DSLR is aimed at adventurers
A bit like a bigger version of the Pentax K-3
'Ultimately the K-S1 is a very capable camera that, ironically, is let down by some of the very aspects intended to make it stand out. '
'The K-S1 is also noticeably heavier, which exacerbates my difficulties holding it comfortably, but if you have small hands, you may actually prefer the size of the K-S1.'
'Images become distinctly scrappy at the highest ISOs.'
'Not very user-friendly.'
'For those looking for an ultra small compact system camera, the Pentax QS-1 is a reasonable option, especially if you've got some kind of affinity to the Pentax brand. '
It's the world's smallest compact system camera, but is that enough?
Same camera in a new body
Excellent high ISO image quality, Shoots at 8.1fps
Delivers great performance, weather-resistant build quality
Will the weatherproof K-3 be enough to tempt consumers away from Nikon and Canon?
Pros: Price, rugged build quality.
Weather-sealed body that's unique in its price class
Large pentaprism viewfinder, Weather-sealed design
Still image quality remains excellent
Very good still image quality, Eye-Fi wireless compatibility
Interesting set of shooting features
Large pentaprism viewfinder, 5fps burst shooting
Delivers a lot of features and performance
Strong features compared to rivals
Very small, Bright rear LCD, Sharp kit lens
Looks great and is a lot of fun
Good image quality, although not consistent
Truly compact system camera and easily pocketable lenses
ReviewGist helps you find the best products to buy by making sense of online reviews.
We are currently aggregating 376,500 reviews
covering over 29,474 products.
© 2020 ReviewGist.com. All Rights Reserved.


text:
As Parkinson's disease progresses, a person's motor skills are impacted resulting in a variety of symptoms including tremors, stiffness and problems with balance. These symptoms can make it difficult to complete everyday tasks. At Home Instead Senior Care, we encourage our CAREGivers to "Do With, Not For" as long as it is safely possible and encourage clients to maintain their independence while preserving their dignity. Whether identifying potential safety concerns or recommending more nutritious meal choices, our CAREGivers will work side by side with clients and their families to enhance quality of life and preserve independence.
Our highly trained caregivers provide both physical and emotional support including:
For more information on how a Home Instead Senior Care CAREGiver can provide assistance to your loved one living with Parkinson's disease, call (705) 243-5697.
We can tailor a home care arrangement to fit both your family's lifestyle and budget.
Reap rewards beyond measure -- and get paid, too.
When you need Parkinson's Care at home, look to Home Instead Senior Care®
Home Instead offers free monthly newsletters with tips and advice for caregivers of elderly loved ones. (Privacy Policy)


text:
Based on the parliamentary hearings and the submitted evidence received, the panel released its findings as:
Read the press release about the report's shocking findings.
Recommendations and our campaign
As a result of the shocking findings this inquiry uncovered, as well as our research and years of work providing direct assistance to young asylum-seekers, refugees and their families, we began the End Forced Destitution campaign.
The campaign's goal is for the government to adopt recommendations made in the inquiry's report.
Get involved in our campaign.
The inquiry collected written evidence on specific questions from a range of perspectives. They also conducted three oral evidence sessions.
Learn more about the:
Learn more and take action
- Tell your MP we need to improve the support for families seeking asylum
- Download the inquiry's report (full text, executive summary)
- Read the press release concerning the inquiry's report
- Read about our work with young refugees and migrants


text:
I found this info on another forum and found it quite useful for posts that contain the photobucket ransom ware picture replacements. If the user still has their images on photobucket there are addon's for Firefox and I believe Chrome to view the post with pictures as intended. Neat little workaround to get some valuable posts saved for future reference.
Here is the link I used to install the FF plugun I am using. https://addons.mozilla.org/en-US/fir...otobucket-fix/
Keep in mind that some users deleted their photos from PB in retaliation so those will not work of course.


text:
Article content
Britney Spears is cleaning house - just hours after announcing her departure from The X Factor she has confirmed reports suggesting her romance with agent-turned-boyfriend Jason Trawick is over.
Sources recently told HollyScoop.com that Trawick has been keen to end the couple's engagement for weeks, but agreed to wait until his fiancee's stint on the TV talent show had run its course.
And as rumours about the state of the romance swirled on Friday, the pop superstar decided to make a clean break for it and go public with the sad news.
A statement from Spears reads: "Jason and I have decided to call off our engagement. I'll always adore him and we will remain great friends."
Meanwhile, a spokesman for the couple adds, "Britney Spears and Jason Trawick have mutually agreed to end their one-year engagement... They came to the difficult decision to go their separate ways while continuing to remain friends."
And even Trawick has issued a comment, stating, "As this chapter ends for us a new one begins. I love and cherish her and her boys and we will be close forever."
The break-up news comes as Trawick's name is about to be removed from the conservatorship he shares with Britney's father, Jamie Spears. That is likely to be made official this weekend. Lawyers for all parties in the matter met in court on Friday.
tap here to see other videos from our team.


text:
As part of our social distancing promise we've reduced the number of tables available, we recommend you book ahead of visiting to guarantee availability.
We're helping NHS Test and Trace in their effort to stop the spread of Covid-19. If asked to do so, we will provide NHS Test and Trace with your name and contact details, together with the date and time of your visit. Please see our privacy notice here for more details, including information about your data protection rights.
To retain social distancing it is important that you comply with UK government and local area restrictions on the number of households/extended households that can meet together indoors
Please note: We will close online bookings up to 2 hours before our lunch or evening session begins. If you would like to book a table for today, please call the pub directly on 01252 511840 to check availability.
Please read the following information ahead of your visit.
Please arrive at the time of your booking and our 'pub safe host' will greet you.
The host will show you to your socially distanced table and then place the menu down onto the table for each guest.
You will be able to order from the table using Order & Pay, available by downloading the Greene King app. Due to social distancing we are limiting the number of customers who can order at the bar. Food and drink will be brought to your table by a member of our team. Find out more here.
Our toilets will operate social distancing by allowing one person in at a time with regular hygiene checks. This is for the safety of you our customers and our teams.
We look forward to you joining us and should you have any questions about how we intend to keep you safe then please read more about our pub safe promises here.


text:
This is from my Black and White Photography Class. I chose Vice as a theme to tie this series together as well as using a similar light source and smoke effect in each photo. Some of the Vices are more obvious than others. Use your imagination and it should all make sense.
4 of 12 "Skull Bottle" Digital Photo by Marcus Coltrin


text:
Here's your sneaky peaky...
Thanks to wonderful Stampin' Up! Demonstrators like Kaysha (Creations on Paper),
Andrea Wolford, and Jessica Urrutia who post fun ideas for us to use
When you sign up for this class please let me know if you want to make the Boy Bunny Easter Box or the Girl Bunny Easter Box. The $12.00 cost of the class only includes one of those plus the other Easter Box and the Treat Holder.
Thanks For Stopping By!
Have a Blessed Day!!
ChristiPin It Now!


text:
I am a physician-scientist who has established a human translational research group that fosters the development of both laboratory immunologists, and clinical translational researchers. Allogeneic hematopoietic cell transplantation (alloHCT) cures blood cancer via beneficial graft-v-tumor immunity. Our overall research goal is to augment GVT while preventing dertimental graft versus host disease (GVHD). The Miklos lab pioneered protein microarray technologies to disciiver clinically relevant allogeneic antibodies, especially those targeting H-Y antigens following sex mismatched transplantation. Our discovery that allogeneic HY antibodies develop in association with chronic GVHD revealed a critical B cell role in chronic GVHD pathogenesis and our clinical trials established cGVHD therapeutic benefits using anti-B cell drugs rituximab and ibrutinib. We developed high-throughput sequencing of the B and T cell immune receptor thereby enabling: 1) lymphoid disease quantification, 2) detailed B and T cell donor reconstitution kinetics, and 3) clonal analysis of antigen specific responses following allo-HCT.
Immunotherapy is revolutionizing cancer treatment and as the Stanford Clinical Cancer Cell Therapy program develops and evaluates the most promising cutting-edge cell therapies for cancer patients on a variety of clinical trials. Chimeric Antigen T Cell (CAR-T) therapy targets the patient's T lymphocytes to attack their cancer by infecting their own T cells to express chimeric antigen receptor (CAR) proteins that target and kill cancer cell expressing surface proteins. Thus far, the most successful CAR-T have targeted B cell antigen CD19, and ongoing trials are treating patients with relapsed/refractory Diffuse Large B Cell Lymphoma (DLBCL) using this CAR19 therapy.
Clinical Focus
- Cancer > Blood and Marrow Transplant
- Cancer > Hematology
- Chimeric Antigen Receptor Therapy (CAR-T)
- Blood and Marrow Transplantation
- Graft vs Host Disease
- Lymphoma
- Leukemia
- Multiple Myeloma
- Hematology/Oncology
Academic Appointments
Associate Professor - Med Center Line, Medicine - Blood & Marrow Transplantation
Member, Stanford Cancer Institute
Administrative Appointments
Clinical Director Cancer Cell Therapy, Stanford University (2016 - Present)
Medical Director of Stanford Cellular Therapeutics and Transplantation Laboratory, Stanford University (2011 - 2016)
Honors & Awards
Phi Betta Kappa, University of Notre Dame (1987)
Alpha Omega Alpha, Yale Medical School (1995)
Predoctoral Fellow, Howard Hughes Medical Institute (1989-1993)
Medical Scientist Training Fellow, NIH (1993-1995)
Clinical Investigator Training Program Scholar, Harvard Medical School (2001-2003)
Professional Education
Board Certification: American Board of Internal Medicine, Hematology (2002)
Medical Education: Yale University Office of the Registrar (1995) CT
Fellowship: Dana Farber Cancer Institute Hematology Oncology Fellowship (2001) MA
Residency: Brigham and Women's Hospital Harvard Medical School (1998) MA
Internship: Brigham and Women's Hospital Harvard Medical School (1996) MA
B.S., University of Notre Dame (1987)
M.D., Yale University Medical School (1995)
Ph.D., Yale University, Genetics (1995)


text:
Former gridiron great O.J. Simpson will serve at least nine years in prison for his role in an armed confrontation with sports memorabilia dealers in a Las Vegas hotel in 2007.
Simpson was sentenced to a maximum of 33 years with the possibility of parole after nine. Before the sentence, he offered a rambling, emotional apology in which he told District Judge Jackie Glass, his voice shaking, that he was sorry for his actions but believed he did nothing wrong. Glass, however, brushed his apology aside, saying his actions amounted to "much more than stupidity," and calling him both arrogant and ignorant.
"Earlier in this case, at a bail hearing, I said to Mr. Simpson, I didn't know if he was arrogant, ignorant or both," Glass said. "During the trial and through this proceeding, I got the answer, and it was both." Read full article »
CNN's Paul Vercammen contributed to this report.
All About O.J. Simpson • Nicole Brown Simpson