text:
Baby couture dresses
IDEAL baby couture dresses FOR TRAVELING
Going on your trip, do not forget to pack not only sports sandals, sports t-shirts, mountain boots and windbreaker, but also baby couture dresses.
After a week of rest, you will realize that you absolutely do not have anything to go around. You will wear your sports pants, sandals and t-shirts with a backpack, but after a few days bored with baby couture dresses.
baby couture dresses are the most comfortable clothes and you can take it for travelling as well. Yeah, it is so trivial. Now I have in my suitcase at least several types of womens clothing.
For some reason, there was an opinion that baby couture dresses and travel are not compatible. But it turned out – this is most convenient.
Always look appropriate and beautiful baby couture dresses
First, it is not hot. Even with light shorts do not compare in comfort.
Secondly, you always look appropriate and beautiful – and you can walk all day around the city, and in the evening go to a restaurant and not feel sweaty tired tourist with a backpack.
Thirdly, baby couture dresses take up so little space in the suitcase. And you do not walk the same day after day.
All my dresses are placed in a medium-sized carrying case (all the things I roll into rolls and pack in several cases).
Even the shorts and skirts gradually disappeared from my wardrobe, and so my favorite overalls.
baby couture dresses is our everything.
I buy them always and everywhere. Approximately once a month I have an exacerbation – there are not enough dresses and there is nothing to wear.
And what is your ideal clothing for traveling?


text:
Harken ball bearing traveler cars with multipart purchases allow easy adjustment of loaded sails from the cockpit. Whether racing or cruising, these smooth- rolling systems pay huge dividends in sail control and are safer and faster than playing the sheet. CB wire retaining clips and composite corner keepers keep ball bearings captive when car is off the track.
547: 10 mm Torlon Ball Bearing — 25 Balls
DO NOT use Harken equipment for human suspension unless product is specifically certified and labeled for such use.
N15W24983 Bluemound Rd.
Pewaukee, WI 53072, USAMailing & Delivery InformationTel: 262.691.3320 | Fax: 262.701.5780 Email: firstname.lastname@example.com Technical Service: email@example.com our other locations

subset: commoncrawl


text:
Product Description:
The most comprehensive protection, with some of the highest protection factors ever against the full spectrum of skin-harming light: indoor and outdoor UVA, UVB, Infrared and Visible Light.
Impressive power in a weightless, anti-oxidant cream that's friendly to all skin types.
When used everyday, indoors and out, also helps lighten melasma.
Protects against melasma, sun-induced skin cancer, photo-aging, and other photo-induced damage.
Active Ingredients:Zinc Oxide, Phenylbenzimidazole Sulfonic Acid, Titanium Dioxide, Butyl Methoxydibenzoylmethane, 4-Methylbenzylidene Camphor.
Other Ingredients:Aqua/Water/Eau, Cyclopentasiloxane, PEG-10 Dimethicone, Tromethamine, Glyceryl Laurate, PVP/Hexadecene Copolymer, Hydrogen Dimethicone, Tetrasodium EDTA, Aluminum Hydroxide, *Tocopheryl Acetate, Zirconium Dioxide.
VMV Armada has been my dream sunblock since college, but it was never within my budget. The Armada linke of VMV has always been part of its bestsellers, so sales are hard to come by. Thankfully, after I started working, I chanced upon a 2-hour sale of the Armada line in a VMV boutique, so of course I had to try it.
- Offers a comprehensive indoor and outdoor light protection
- Doesn't feel greasy at all
- Dries quickly
- Didn't give me breakouts
- The zinc oxide ingredient has a whitish cast. Even if I put a small amount only, I still get a whitish cast that's why I don't like to use it when I'm not wearing makeup
- Expensive at more than P1000 (I forgot the exact price)
Will I repurchase? Maybe. The comprehensive protection is great, but the whitish cast makes it hard to work with. The price is a bit prohibitive too.


text:
It is time to present you the tenth and last external MOPS submission. It is an article by Solar Designer describing in length how to manage PHP application's users and passwords.
How to manage a PHP application's users and passwords
Alexander Peslyak
Founder and CTO
Openwall, Inc.
better known as
Solar Designer
Openwall Project leader
April 2010
Some rights reserved
Almost all large PHP applications, as well as many small ones, have a notion of user accounts, and, whether we like it or not, they typically use passwords (or at best passphrases) to authenticate the users. How do they store the passwords (to authenticate against)? Reasonable applications don't. Instead, they store password hashes. There have been many short articles, blog posts, even book chapters that try/claim to show you how to properly compute and use password hashes. Older ones will tell you to use the md5() function. Newer ones will tell you to use sha1() or hash() (SHA-256, etc.), add salting (but "forget" to add stretching, which is equally important), and use mysql_real_escape_string() on the username. Unfortunately, while some of these recommendations are steps in the right direction (although not all are), none of the articles on password security in PHP that I saw were "quite it".
Finally, some of the more recent blog posts, forum comments, and the like have started to recommend phpass, the password/passphrase hashing framework for PHP that I wrote, and which has already been integrated into many popular "web applications" including phpBB3, WordPress, and Drupal 7. Obviously, I fully agree with this recommendation. However, I was not aware of an existing step-by-step guide on integrating phpass into a PHP application, and password security is not only about password hashing anyway.
In this article/tutorial, I will guide you through the steps needed to introduce proper (in my opinion at least) user/password management into a new PHP application. I will start by briefly explaining password/passphrase hashing and how to access the database safely. Then we will proceed through several revisions of the sample program. We'll start with a very simple PHP program capable of creating new users only and having some subtle issues. We will gradually improve this program adding functionality (logging in to existing user accounts, changing user passwords, and enforcing a password policy) and "discovering" and dealing with the issues.
We will also briefly touch many related topics. Sub-headings have been chosen such that you may skip or skim over the topics you think you're already familiar with… or better read those sections anyway.
Let's get started.
Password/passphrase hashing
Decent systems/applications do not actually store users' passwords. Instead, they transform new passwords being set/changed into password hashes with cryptographic (one-way) hash functions, and they store those hashes. They should preferably use hash functions intended for password hashing. Direct/naive use of other cryptographic hash functions, such as PHP's md5(), sha1(), or hash('sha256′, …) for that matter, has dire consequences.
When a user authenticates to the application with a username and a previously-set password, the application looks up some auxiliary information (such as the hash type, the salt, and the iteration count – all of which are
described below) for the provided username, transforms the provided password into its hash, and compares this hash against the one stored for the user. If the two hashes match, authentication succeeds (otherwise it fails).
- "Why bother with password hashing when I use (or don't use) SSL (https URLs) anyway?"
(Surprisingly, this question is really being asked both ways. More often, people would make an incorrect statement that you don't need password hashing, or don't need to do it right, because you do or because you don't use SSL.)
- Password hashing, if done right, reduces the risk impact of having the hashes stolen or leaked -
an attacker will recover fewer plaintext passwords from the hashes.
Also, the cost of recovery from an incident like this may be reduced – rather than change all passwords at once, which may be costly or prohibitive to do, a system's administrator may audit the password hashes with a tool such as John the Ripper and only have the weak passwords changed. With proper password hashing and password policy enforcement in place, the majority of the passwords could be considered "strong enough" and would not need to be changed immediately even after a known and otherwise-resolved
security compromise.
The use of SSL mitigates the risk of having some plaintext passwords captured while in transit. Clearly, these risks are different. An attacker capable of capturing some of the network traffic is not necessarily capable of getting a copy of the database, and vice versa. Thus, it makes perfect sense to use one of these countermeasures – password hashing and SSL – without the other (which does not address "the other" risk then), and it also makes sense to use both of them together.
Salts are likely-unique values that are entered into a password hashing method along with the password, which results in the same password hashing into completely different hash values given different salts. Proper use of salts may defeat a number of attacks, including:
- Ability to try candidate passwords against multiple hashes at the price of one
- Use of pre-hashed lists (or the smarter "rainbow tables") of candidate passwords
- Ability to determine whether two users (or two accounts of one user) have the same or different passwords without actually having to guess one of the passwords
Salts are normally stored along with the hashes.
They are not secret.
Offline password cracking (given stolen or leaked password hashes) involves computing hashes of large numbers of candidate passwords. Thus, in order to slow those attacks down, the computational complexity of a good password hashing method must be high – but of course not too high as to render it impractical.
Typical cryptographic hash functions not intended for password hashing were designed for speed. If these are directly misused for password hashing, then offline password cracking attacks may run at speeds of many million of candidate passwords per second.
These cryptographic hash functions (or even block ciphers) – let's call them "cryptographic primitives" – may be used as building blocks to construct a decent password hashing method, which would use thousands or millions of
iterations of the underlying cryptographic primitive. This is called password (or key) stretching (or strengthening). Preferably, the number of iterations should not be hard-coded, but rather it should be configurable by an administrator for use when a new password is set (hashed), and it should be getting saved along with the hash (to allow the administrator to change the iteration count for newly set/changed passwords, yet not break support for previously-generated password hashes).
- "My web application must be fast. I can't afford to use a slow hash function!"
- Actually, you can. No one said it should be taking an entire second to compute a password hash. Is 10 milliseconds fast enough for you? Perhaps it is, but if not you can make it 1 ms or less (which is likely way below other per-request "overhead" that your application incurs anyway) and still benefit from password stretching a lot. Please note that without any stretching a cryptographic primitive could be taking as little as some microseconds or even nanoseconds to compute (at least during an offline attack, which would use an optimal implementation). If you go from one microsecond to one millisecond, which is clearly affordable, you make offline attacks (against stolen or leaked hashes) run 1000 times slower, or you effectively stretch your users' passwords or passphrases by about 10 bits of entropy each. That's significant – it is roughly equivalent to each passphrase containing one additional word, without actually adding that extra word and having the users memorize it. Besides, the password hash is typically only computed when a user logs in (or when a new user is registered or a password is changed), which occurs relatively infrequently (compared to the frequency of other requests). Subsequent requests by the logged in user will use a session ID instead.
Choice of the underlying cryptographic primitive
The choice of the underlying cryptographic primitive – such as MD5, SHA-1, SHA-256, or even Blowfish or DES (which are block ciphers, yet they may be used to construct one-way hashes) – does not matter all that much. It's the higher-level password hashing method, employing salting and stretching, that makes a difference.
- "I heard that MD5 has been "broken". Shouldn't we use SHA-1 instead?"
- It is true that MD5 has been broken as it relates to certain attacks (practical). SHA-1 has also been broken in certain other ways (mostly theoretical). However, neither break has anything to do with the uses of these functions for password hashing, especially not as building blocks in a higher-level hashing method. Thus, any possible reasons to move off MD5 or SHA-1 as underlying cryptographic primitives for password hashing "because of the break" are purely "political" rather than technical.
(It may be easier to just phase out MD5 and SHA-1 rather than differentiate their affected vs. unaffected uses.)
phpass – the password/passphrase hashing framework for PHP applications
phpass provides an easy to use abstraction layer on top of PHP's cryptographic hash functions suitable for password hashing. As of this writing, it supports three password hashing methods, including two via PHP's crypt() function – these are known in PHP as CRYPT_BLOWFISH and CRYPT_EXT_DES – and one implemented in phpass itself on top of MD5. All three employ salting, stretching, and variable iteration counts (configurable by an administrator, encoded/stored along with the hashes).
PHP 5.3.0 and above is guaranteed to support all three of these hashing methods due to code included into the PHP interpreter itself. Specific builds/installs of older versions of PHP may or may not support the CRYPT_BLOWFISH and CRYPT_EXT_DES methods – this is system-specific. For example, the Suhosin PHP security hardening patch, included into many distributions' packages of PHP, has been adding support for CRYPT_BLOWFISH for years, many operating systems – such as *BSD's, Solaris 10, SUSE Linux, ALT Linux, and indeed Openwall GNU/*/Linux – are also providing support for CRYPT_BLOWFISH via the system libraries (which PHP uses), and some operating systems – *BSD's, Openwall GNU/*/Linux – also provide support for CRYPT_EXT_DES.
The MD5-based salted and stretched hashing implemented in phpass itself is supported on all systems – starting with the ancient PHP 3. phpass provides a way for you (the application developer or administrator) to force the use of these "portable" hashes – this is a Boolean parameter to the PasswordHash
constructor function.
Unless you force the use of "portable" hashes, phpass' preferred hashing method is CRYPT_BLOWFISH, with a fallback to CRYPT_EXT_DES, and then a final fallback to the "portable" hashes. CRYPT_BLOWFISH and CRYPT_EXT_DES are preferred primarily for the efficiency of the underlying implementations (in C and on some systems in assembly), compared to phpass' own code around MD5 (in PHP, even though the underlying MD5 code is in C). This greater code efficiency allows for more extensive and thus more effective use of password stretching (higher iteration counts).
(It is assumed that an attacker would have a near-optimal implementation of any of these hashing methods anyway.)
Besides the actual hashing, phpass transparently generates random salts when a new password or passphrase is hashed, and it encodes the hash type, the salt, and the password stretching iteration count into the "hash encoding string" that it returns. When phpass authenticates a password or passphrase against a stored hash, it similarly transparently extracts and uses the hash type identifier, the salt, and the iteration count out of the "hash encoding string". Thus, you do not need to bother with salting and stretching on your own – phpass takes care of these for you.
- "What source of randomness does phpass use? Does it work on Windows?"
- You might have noticed that phpass uses /dev/urandom, which is a decent supply of randomness on modern Unix-like systems. However, phpass will transparently fallback to its own pseudo-random byte stream generator (which is based primarily on multiple measurements of the current time with up to microsecond precision) when /dev/urandom is unavailable or when it fails. Thus, yes, phpass works on Windows (as well as on Unix-like systems indeed),
Naturally, we'll use phpass for our sample program.
The database (and how to access it safely)
SQL injections
What SQL injections are
In many cases, we will need to pass pieces of untrusted user input into SQL queries. Even with our trivial database and the initial revision of our user management program (which we'll create soon), there will be untrusted user input: the username and password (or passphrase), at least before we've verified them. If we blindly embed the target username string obtained via a website form into an SQL query string, we might alter the SQL query. Since the username is under a potential attacker's control, the attacker may be able to alter our SQL query in a way such that another valid SQL query of the attacker's choice is formed. This may allow not only to circumvent our program's intended behavior (e.g., have it change another user's password with that altered query), but also to mount all sorts of attacks on the SQL server, as well as on our program (such as via query results that would suddenly become fully untrusted input as well).
How to deal with SQL injections
"- Can't we just enclose the user inputs in single quotes when embedding them in an SQL query string? Wouldn't that do the trick?"
- No. One of the input values can simply close the quotes, braces, etc., do its dirty deed, then provide additional SQL statements (or whatever) to make the rest of the original query "complete" (avoiding a syntax error). Thus, this naive approach alone does not work at all.
There are several real ways to combat SQL injections, of varying effectiveness and with different pros and cons.
Most of these can be used together for greater assurance.
- Filtering – sanitize the input values rejecting or modifying "bad" ones (preferably using a whitelist of known-safe input values rather than a blacklist of known-unsafe ones)
- Escaping – prefix any special characters (most notably the single quote character) with an escape character (preferably using the API functions specific to the target SQL server type)
- Encoding – turn any input strings into other strings consisting of safe characters only – e.g., an application may introduce '%' as its own escape character, then URL-encode all characters not from a known-safe set (the '%' character has a special meaning in certain contexts, though, so you might choose another or you might only use this technique along with escaping)
- Prepared statements – rather than form SQL query strings with inputs embedded into them (in one way or another), an application may use advanced APIs to pass SQL queries with placeholders to the SQL server and then pass the input values to the SQL server "separately"
In the sample program that we'll be writing during the rest of this article, we'll use filtering (the "rejection" kind of it) and prepared statements in such a way that if any one of these techniques fails to provide its security, the application will nevertheless remain secure.
Prepared statements with PHP and MySQL
As of this writing, PHP offers three main interfaces to MySQL: PHP's MySQL Extension (obsolete, not recommended for new projects – but still widely used), PHP's mysqli (MySQL Improved) Extension ("preferred" for new projects), and PHP Data Objects (PDO) (recommended, but not "preferred" for new projects). The last two of these support prepared statements. Both require PHP 5+. We'll use mysqli.
The separation of code and data achieved with the mysqli PHP extension, the underlying MySQL APIs that it uses, and the (relatively) new MySQL protocol revision can't be perfect – everything is sent over the same socket connection anyway – but it does appear to be way better (simpler, and hence less error-prone) than what could be achieved by escaping. Specifically, in the MySQL binary protocol, the input values are preceded by binary representations of their lengths in bytes and then are sent verbatim.
Beware: apparently, certain interfaces and older/transitional software versions emulate prepared statements on the client end, which makes them susceptible to the risks typical for SQL escaping. This is one of the reasons why we choose not to rely on prepared statements alone for security against SQL injections.
Employ the principle of least privilege
Besides avoiding SQL injections, it makes sense to mitigate any that would potentially occur anyway,
as well as possibly some other attacks carried out against or via the database. To this end, it is a good idea to have your PHP application use an SQL server account with the minimum privileges required – not an administrative account and not an account that can also access another database.
This also helps in case your PHP application is somehow fully compromised, such that the attacker gains direct access to the database with the application's access privileges, yet you care not to let this compromise directly "propagate" onto other databases that your application does not use.
For our sample program, we'll start with just one table in a brand new MySQL database. Connect to the MySQL server (such as with the command-line mysql client program) and issue the following:
use myapp;
create table users (user varchar(60), pass varchar(60));
(We will need to revise this a little bit to deal with an issue that we'll "discover" further down this article.)
The user column will hold usernames, and the pass column will hold password hashes. Currently, phpass produces hash encoding strings that are at most 60 characters long.
The sample program is born
The code snippets included in this article generally assume that you're familiar with creating HTML web pages and PHP scripts. Thus, any opening and closing tags (such as  and <?php), etc. are omitted from here, to keep the article from growing too long. However, the sample files in the archive provided with the article do include all of those essential bits.
How to create new users
First, we need to put the phpass code in place. (We will use it to hash the new password.) We place the PasswordHash.php file from the phpass distribution tarball somewhere within our web "virtual host" "document root" directory and we set proper permissions for the file to be loaded by the web server's PHP setup (typically, the Unix permission bits will need to be 600 or 644
depending on web server setup).
Then we create a subdirectory for our sample program (this is how multiple revisions of the program are included in the archive accompanying this article – in separate subdirectories). Let's call the directory demo (and set its Unix permissions to 711). We'll place two files into this directory: user-man.html (with permissions set to 644) containing the HTML form below, and user-man.php (with permissions set the same as we did for PasswordHash.php).
Let's place the following HTML form into user-man.html:
<input type="text" name="user" size="60">

<input type="password" name="pass" size="60">

<input type="submit" value="Create user">
This form asks for and submits a username and a password to the user-man.php script. Let's start writing it. First, let's include the phpass code:
To actually use phpass, we need to decide on and specify the extent of password stretching and whether we want to force the use of "portable" hashes or not (both of these matters were briefly discussed above). Let's place those constants into PHP variables:
$hash_cost_log2 = 8;
// Do we require the hashes to be portable to older systems (less secure)?
$hash_portable = FALSE;
(In a real application, these should be in a configuration file included from the actual program code files instead. Alternatively, they may be configurable via the application itself, by an administrative user.)
To obtain the submitted username and password, let's initially use:
// Should validate the username length and syntax here
$pass = $_POST['pass'];
(This is a bit problematic.
We will revise it soon.)
Now we can hash the password with:
$hash = $hasher->HashPassword($pass);
if (strlen($hash) < 20)
fail('Failed to hash new password');
This uses the fact that the shortest valid password hash encoding string that phpass can currently return is 20 characters long (this is the case for CRYPT_EXT_DES, whereas other hash types use even longer
encoding strings). fail() is a custom function that we'll use in our sample program. Let's define it (earlier in the code) as follows:
$msg = $pub;
if ($pvt !== '')
$msg .= ": $pvt";
exit("An error occurred ($msg).\n");
(This function as defined above is a bit problematic. We will revise it soon.)
Note that we don't bother producing proper HTML output in fail(). For our sample program, it is simpler to produce plain text output. Let's set the HTTP header accordingly such that the web browser does not attempt to parse our script's output as HTML:
Indeed, we need to do this before our script possibly produces any output.
(In a real PHP application, you would likely be producing HTML output instead, which requires more code and extra safety measures.)
Let's also place our database access credentials into PHP variables. For example:
$db_host = '127.0.0.1';
$db_port = 3306;
$db_user = 'mydbuser';
$db_pass = 'voulDyu0gue$s?';
$db_name = 'myapp';
Let's connect to the database using mysqli, and let's not forget to check for a possible failure:
if (mysqli_connect_errno())
fail('MySQL connect', mysqli_connect_error());
Finally, let's try to create the user by inserting the username and the password hash encoding string (which includes the salt, etc.) into the database table using the prepared statements API:
|| fail('MySQL prepare', $db->error);
$stmt->bind_param('ss', $user, $hash)
|| fail('MySQL bind_param', $db->error);
|| fail('MySQL execute', $db->error);
If we got this far, we must have successfully created the user. Let's close the database connection:
In fact, it would be nice to do this on failure as well, but that would make the code more complicated
(the cleanups to perform would vary depending on where the failure occurs). Instead, we rely on the web server setup to perform any cleanups for terminating PHP scripts, which it needs to do anyway because scripts may sometimes terminate abnormally.
So that's it. Please find the HTML file and the demo program we've just created, complete with all details and with the snippets in the proper order (unlike in this article), in the demo1 subdirectory in the accompanying archive (tar.gz, ZIP).
Let's test the program. Go to the URL for the user-man.html HTML page in a web browser, enter myuser for the username and mypass for the password. If the script completes without error, we should be able to see the new user account in the users table:
| user | pass |
| myuser | $2a$08$Lg5XF1Tt.X5TGyfb43vBBeEFZm4GTXQhKQ6SY6emkcnhAGT8KfxFS |
1 row in set (0.00 sec)
The password hash will look almost completely different, though, due to the random salt and due to the hash possibly being of a different type (if you're using PHP older than 5.3.0 and your build of PHP does not include the Suhosin patch and your operating system does not provide native support for CRYPT_BLOWFISH hashes… or if you edited the code to set $hash_portable to TRUE).
What if the user already exists?
Let's try to create the same user, with the same username, once again. Also enter the same password, just for kicks. The script succeeds again, and we get:
| user | pass |
| myuser | $2a$08$Lg5XF1Tt.X5TGyfb43vBBeEFZm4GTXQhKQ6SY6emkcnhAGT8KfxFS |
| myuser | $2a$08$7lM07FwQMm5/C8G/urT4z..MudfsS227e8oUEu6T51bNWk/RG//qe |
2 rows in set (0.00 sec)
We get a duplicate user record. We'll need to address this shortcoming. Meanwhile, notice how the hash encoding string is indeed almost entirely different, as explained above, even though the same password was supplied.
We could issue a SELECT query to see if the username is already taken before trying to create the user. However, this would involve a race condition: a simultaneous request to our script could create a user of that name after our SELECT query but before we do the INSERT. Then we would end up creating a duplicate user record anyway.
To deal with this, we need to revise our database schema such that the MySQL server would not permit duplicate usernames:
CREATE TABLE users (user varchar(60), pass varchar(60), UNIQUE (user));
Now let's repeat the experiment: create the same user twice via our web form. On our second attempt to create the user, the script fails with:
Checking the table contents, we see that only one instance of the user was created – just like we wanted. The message printed on an attempt to create a duplicate user is technical, though – not one suitable for an end user.
We'll deal with this a bit later. Meanwhile, let's focus on another aspect of it.
Avoid leaking server setup details
A portion of the error message above was produced by MySQL. On another occasion, it could possibly produce a message leaking the details of your setup – such as the database name, the database server address, and/or a full pathname to a database table file. We could want to avoid displaying this information to the user, unless we're "the user" and we're debugging. Also, those error messages may happen to contain characters that would need to be quoted if we were producing HTML output. Let's modify the fail() function to support a non-debugging mode where it would not reveal the potentially-sensitive messages. Also, let's add a comment about the "HTML issue", such that it is hopefully not overlooked if this code is actually made to produce HTML output later.
$debug = TRUE;
function fail($pub, $pvt = '')
global $debug;
$msg = $pub;
if ($debug && $pvt !== '')
$msg .= ": $pvt";
/* The $pvt debugging messages may contain characters that would need to be
* quoted if we were producing HTML output, like we would be in a real app,
* but we're using text/plain here. Also, $debug is meant to be disabled on
* a "production install" to avoid leaking server setup details. */
exit("An error occurred ($msg).\n");
Please note that similar potential leaks of server setup details typically exist in the default settings of Apache and PHP. As an application developer, our responsibility here is to provide a way to avoid those leaks – which we did by introducing the $debug setting. It is up to a server administrator (or someone installing our PHP application on a server) to decide on and configure those settings in a certain way. It is a good idea to document the issue and the settings prominently. Also, it may be desirable to use safe defaults – that is, have $debug
default to FALSE in our case. However, for our sample program we'll continue with a default of TRUE.
How to differentiate MySQL errors
We'd like to determine if the requested username is already taken – and show a user-friendly message if so. However, the attempt to add a user could fail for other reasons as well, so it would be wrong to show the same user-friendly message on all errors.
One of the approaches would be to issue a SELECT query on the username after an attempt to add the user fails. If the SELECT query returns 1 row, then the username is definitely already taken. We can implement this as follows:
$save_error = $db->error;
// Does the user already exist?
($stmt = $db->prepare('select user from users where user=?'))
|| fail('MySQL prepare', $db->error);
$stmt->bind_param('s', $user)
|| fail('MySQL bind_param', $db->error);
|| fail('MySQL execute', $db->error);
|| fail('MySQL store_result', $db->error);
if ($stmt->num_rows === 1)
fail('This username is already taken');
fail('MySQL execute', $save_error);
This works, and it might be the most reliable and portable approach, however there exists a shortcut approach: the MySQL server returns a very specific error code when the error is an attempt to create a duplicate user record. If we aren't too concerned about a possible change in MySQL's error codes in a future version of it, then we can simply check for the known error code. Even if this stops working, the only impact will be a less friendly message displayed to the user.
if ($db->errno === 1062 /* ER_DUP_ENTRY */)
fail('This username is already taken');
fail('MySQL execute', $db->error);
We will be using this shortcut approach in further revisions of the sample program.
The "Magic Quotes" issue
Magic Quotes is a deprecated feature of PHP. When enabled, which it is on many web servers, the PHP interpreter will automagically escape many inputs to PHP scripts. This may be desirable to provide some minimal security for poorly-written PHP scripts that fail to defend themselves against SQL injections, but with properly-written PHP scripts this feature may actually be more of a problem.
Specifically, unless we deal with this issue, a password containing the single quote character might or might not reach our PHP application with the character escaped. If the magic_quotes_gpc PHP setting is then toggled, or if our PHP application install is moved to another system where this setting is set differently, the password will stop working.
Thus, we need to check whether magic_quotes_gpc was set and undo its effect at least for specific inputs where this matters. Here's the code:
$val = $_POST[$var];
if (get_magic_quotes_gpc())
$val = stripslashes($val);
return $val;
We'll use this function instead of direct reads from $_POST[].
Input filtering
Let's sanitize our inputs in order to mitigate some obscure DoS attacks, as well as not to rely on our use of prepared statements alone to prevent SQL injections.
/* Sanity-check the username, don't rely on our use of prepared statements
* alone to prevent attacks on the SQL server via malicious usernames. */
if (!preg_match('/^[a-zA-Z0-9_]{1,60}$/', $user))
fail('Invalid username');
$pass = get_post_var('pass');
/* Don't let them spend more of our CPU time than we were willing to.
* Besides, bcrypt happens to use the first 72 characters only anyway. */
if (strlen($pass) > 72)
fail('The supplied password is too long');
The sample program with the improvements mentioned so far implemented is found under the demo2 subdirectory in the accompanying archive (tar.gz, ZIP).
How to authenticate existing users
Let's enhance our sample program with support for multiple operations – initially there will be two of them: creating a new user account and logging in to an existing account. We will be passing the operation code via a hidden form field. Let's add it into our existing form:
And let's add a login form:
<input type="hidden" name="op" value="login">
<input type="text" name="user" size="60">

<input type="password" name="pass" size="60">

<input type="submit" value="Log in">
Now let's start to add support into the PHP code. First, validate the operation code:
if ($op !== 'new' && $op !== 'login')
fail('Unknown request');
Then let's introduce an if statement and move our new user creation code under it:
$hash = $hasher->HashPassword($pass);
if (strlen($hash) < 20)
fail('Failed to hash new password');
($stmt = $db->prepare('insert into users (user, pass) values (?, ?)'))
|| fail('MySQL prepare', $db->error);
$stmt->bind_param('ss', $user, $hash)
|| fail('MySQL bind_param', $db->error);
if (!$stmt->execute()) {
if ($db->errno === 1062 /* ER_DUP_ENTRY */)
fail('This username is already taken');
fail('MySQL execute', $db->error);
$what = 'User created';
To perform user authentication, we'll need to obtain the user's password hash encoding string using a SELECT query for the supplied username, then use the CheckPassword() method from phpass to check the supplied password against the hash. Let's introduce an else branch with our "login" code in it:
$hash = '*'; // In case the user is not found
($stmt = $db->prepare('select pass from users where user=?'))
|| fail('MySQL prepare', $db->error);
$stmt->bind_param('s', $user)
|| fail('MySQL bind_param', $db->error);
|| fail('MySQL execute', $db->error);
|| fail('MySQL bind_result', $db->error);
if (!$stmt->fetch() && $db->errno)
fail('MySQL fetch', $db->error);
if ($hasher->CheckPassword($pass, $hash)) {
$what = 'Authentication succeeded';
} else {
$what = 'Authentication failed';
Finally, let's have our script print the authentication result:
That's all – we can now "log in" as myuser and see the "Authentication succeeded" message. If we enter a wrong password for the user or if the target username does not exist, we see "Authentication failed".
Please find this revision of the HTML file and the sample program in the demo3 subdirectory in the accompanying archive (tar.gz, ZIP).
How to change user passwords
Let's introduce the proper HTML form:
<input type="hidden" name="op" value="change">
<input type="text" name="user" size="60">

Current password:

<input type="password" name="pass" size="60">

New password:

<input type="password" name="newpass" size="60">

<input type="submit" value="Change password">
and support for the additional operation code into the PHP script:
if ($op !== 'new' && $op !== 'login' && $op !== 'change')
fail('Unknown request');
Now let's add to the user authentication branch of the existing if / else statement. When authentication fails, reset $op such that we don't take any other action:
$what = 'Authentication succeeded';
} else {
$what = 'Authentication failed';
$op = 'fail'; // Definitely not 'change'
Then add our new code:
$newpass = get_post_var('newpass');
if (strlen($newpass) > 72)
fail('The new password is too long');
$hash = $hasher->HashPassword($newpass);
if (strlen($hash) < 20)
fail('Failed to hash new password');
($stmt = $db->prepare('update users set pass=? where user=?'))
|| fail('MySQL prepare', $db->error);
$stmt->bind_param('ss', $hash, $user)
|| fail('MySQL bind_param', $db->error);
|| fail('MySQL execute', $db->error);
$what = 'Password changed';
That's it – an existing user may now get the password changed.
This revision of the HTML file and the sample program may be found in the demo4 subdirectory in the accompanying archive (tar.gz, ZIP).
In a real PHP application, you will likely also have other ways to change a user's password – by an administrative user (then authentication of the user is bypassed) or with authentication by a temporary token (for forgotten passwords). These may be implemented in a similar fashion.
How to enforce a password policy
As far as I'm aware, there's currently no decent password/passphrase strength checking module intended specifically for PHP (either written in PHP or implemented as a PHP extension). (The Crack extension in PECL, which is an interface to CrackLib, is not quite it (just like CrackLib itself is not good enough these days). There are many regexp-based recipes found on the web, but these disregard/disallow passphrases, have the policy hard-coded, and are mostly untested on real-world passwords.)
So we will be invoking the pwqcheck(1) program from the passwdqc package. This program is specifically intended for use from scripts.
Let's introduce a new PHP include file, called pwqcheck.php, defining the following function:
// pwqcheck(1) itself returns the same message on internal error
$retval = 'Bad passphrase (check failed)';
$descriptorspec = array(
0 => array('pipe', 'r'),
1 => array('pipe', 'w'));
// Leave stderr (fd 2) pointing to where it is, likely to error_log
// Replace characters that would violate the protocol
$newpass = strtr($newpass, "\n", '.');
$oldpass = strtr($oldpass, "\n", '.');
$user = strtr($user, "\n:", '..');
// Trigger a "too short" rather than "is the same" message in this special case
if (!$newpass && !$oldpass)
$oldpass = '.';
if ($args)
$args = ' ' . $args;
if (!$user)
$args = ' -2' . $args; // passwdqc 1.2.0+
$command = 'exec '; // No need to keep the shell process around on Unix
$command .= 'pwqcheck' . $args;
if (!($process = @proc_open($command, $descriptorspec, $pipes)))
return $retval;
$err = 0;
fwrite($pipes[0], "$newpass\n$oldpass\n") || $err = 1;
if ($user)
fwrite($pipes[0], "$user::::$aux:/:\n") || $err = 1;
fclose($pipes[0]) || $err = 1;
($output = stream_get_contents($pipes[1])) || $err = 1;
$status = proc_close($process);
// There must be a linefeed character at the end. Remove it.
if (substr($output, -1) === "\n")
$output = substr($output, 0, -1);
$err = 1;
if ($err === 0 && ($status === 0 || $output !== 'OK'))
$retval = $output;
return $retval;
Please note that this passes any untrusted input via the file descriptor, not via the command-line (which would be unsafe). Please refer to the pwqcheck(1) manual page included in the passwdqc package for information on the command-line options and on the "protocol" used.
The function accepts the new password or passphrase, the strength of which is to be checked. It optionally also accepts the old password or passphrase, the username, and any auxiliary user-specific information such as the user's full name and/or e-mail address (multiple items may be separated with spaces). All of this information is treated as untrusted input, and it is used for more accurate checking of the strength of the new password or passphrase.
Finally, the function optionally accepts additional arguments to pass to pwqcheck(1) via the command-line.
These may override the default password policy. Obviously, they must not be under an untrusted user's control.
The return value is the string 'OK' if the new password/passphrase passes the requirements. Otherwise the return value is a message explaining one of the reasons why the password/passphrase is rejected.
Let's make use of this in our program. Include the file and define some settings (that we'll use a bit later):
// Do we have the pwqcheck(1) program from the passwdqc package?
$use_pwqcheck = TRUE;
// We can override the default password policy
#$pwqcheck_args = 'config=/etc/passwdqc.conf';
Define a wrapper function specific to our program:
global $use_pwqcheck, $pwqcheck_args;
if ($use_pwqcheck)
return pwqcheck($newpass, $oldpass, $user, '', $pwqcheck_args);
/* Some really trivial and obviously-insufficient password strength checks -
* we ought to use the pwqcheck(1) program instead. */
$check = '';
if (strlen($newpass) < 7)
$check = 'way too short';
else if (stristr($oldpass, $newpass) ||
(strlen($oldpass) >= 4 && stristr($newpass, $oldpass)))
$check = 'is based on the old one';
else if (stristr($user, $newpass) ||
(strlen($user) >= 4 && stristr($newpass, $user)))
$check = 'is based on the username';
if ($check)
return "Bad password ($check)";
return 'OK';
Please note that this lets you experiment with very basic password strength checking (with a trivial hard-coded policy) even if you have not yet installed passwdqc.
Finally, introduce uses of the function into two places in the program – when creating a new user:
if (($check = my_pwqcheck($pass, '', $user)) !== 'OK')
and when changing a user's password:
$newpass = get_post_var('newpass');
if (strlen($newpass) > 72)
fail('The new password is too long');
if (($check = my_pwqcheck($newpass, $pass, $user)) !== 'OK')
We're done. Now let's test it – strong passwords and passphrases should be accepted, whereas weak ones should be getting rejected with various messages.
The pwqcheck.php file (with a lengthy comment in it) and this revision of the sample program are found in the
demo5 subdirectory in the accompanying archive (tar.gz, ZIP).
Future work
Someone should to create a PHP extension around passwdqc, making the functions of libpasswdqc available for use from PHP scripts.
Timing attacks
Our sample program is vulnerable to probing for valid usernames via timing attacks: its response time differs for existing vs. non-existent users.
We may try to mitigate this by always performing the password hashing step – even if the target username could not be found in the database. First, we need to define a dummy "salt" string (a portion of the hash encoding string) that we'll use for computing the dummy hashes:
* This should use the same hash type and cost parameter as we're using for
* real/new hashes. The intent is to mitigate timing attacks (probing for
* valid usernames). This is optional - the line may be commented out if you
* don't care about timing attacks enough to spend CPU time on mitigating them
* or if you can't easily determine what salt string would be appropriate. */
$dummy_salt = '$2a$08$1234567890123456789012';
Then we introduce the following code right before our call to CheckPassword():
if (isset($dummy_salt) && strlen($hash) < 20)
$hash = $dummy_salt;
Alternatively, we could use the HashPassword() method, which would generate a new salt for us, but its processing cost is not exactly the same as that of CheckPassword(), so a (smaller) timing leak would remain.
A revision of the sample program with the above changes is included in the demo6 subdirectory in the accompanying archive (tar.gz, ZIP).
Unfortunately, this does not fully eliminate timing leaks – e.g., the MySQL server's response time may differ – but those leaks are likely smaller than leaks through properly-stretched (purposely slow) password hashing. Yet it might remain possible to probe for valid usernames with a large number of timings for each potential username.
Moreover, major timing leaks will remain if your database contains hashes of mixed types or with different password stretching iteration counts.
Timing leaks are surprisingly difficult to fully deal with. Naive attempts to deal with them such as by introducing random delays (even those in excess of "the signal") do not work as well as one might expect them to. "Constant time" would do the trick, but it is difficult to achieve, especially when we consider both real and CPU time,
as well as other server resource consumption, which could also be indirectly measured by an attacker.
Other related concerns
There are many other security, usability, and implementation issues closely related to the way a web application manages its users and passwords. Discussing those issues in full detail and with sample code is beyond the scope of this article, yet it is important for you to be aware of them.
Randomly-generated passwords/passphrases
As an alternative to forcing the user to come up with a "strong-looking" password or passphrase, an application may generate and offer a random password or passphrase. (Preferably, the user should also be allowed to pick a suitable password or passphrase of their own, which is the case we've been considering so far.)
This is particularly important when new accounts are to be created by an administrator rather than by the users themselves. It would be unrealistic for the administrator to come up with sufficiently different passwords/passphrases for a large number of users, so letting a computer generate those passwords or passphrases is the only reasonable way to go.
One of the ways to implement this is by invoking the pwqgen(1) program from the passwdqc package. Unlike the pwqcheck(1) program discussed above, pwqgen does not require two-way communication via file descriptors, so you may invoke it with the simpler popen() and pclose() functions. Please be sure to check the exit status from the program. Currently, pwqgen only works on systems with /dev/urandom.
It is also possible to try to generate random passwords or passphrases in PHP code and without a dependency on /dev/urandom, but chances are that those passwords or passphrases won't in fact be as random as they might look – e.g., certain versions of Joomla running with certain versions of PHP are able to generate at most 1 million of different initial passwords, which an attacker can test against a stolen or leaked password hash in a second.
It is difficult to obtain a significant amount of cryptographically random data in pure and portable PHP code. As it has been mentioned above, phpass uses /dev/urandom with a fallback to its own pseudo-random byte stream generator. The latter is good enough for salting, but it might not be good enough for other purposes because of the limited amount of entropy that it uses as its input. Other than that, it uses a decent approach. Drupal 7 attempts to reuse a revision of the same code (derived from phpass) to generate all sorts of random tokens, not just salts, and the Drupal developers are trying to process more entropy by feeding certain PHP variables and results of certain PHP function calls into the algorithm.
It is difficult to say just how much entropy is added in this way and whether it is sufficient for a given purpose or not. Additionally, a related concern is that if not enough entropy is being processed, then it might be possible to infer the inputs to the algorithm from the stream of "random" outputs by testing likely inputs in an offline attack. So a reasonable requirement for the inputs could be that they not only are hopefully sufficiently random, but are also not security-sensitive otherwise.
Other algorithms may have additional undesirable properties – such as leaking of the inputs or/and of the internal state in a more direct way, thereby allowing for further "random" outputs to be predicted. Furthermore, if the size or entropy of the internal state is too small, then the entropy of the resulting "random" outputs will also likely be smaller than that of the inputs, and additionally the internal state itself may be inferred in an offline attack given a few "random" outputs, which would facilitate prediction of further "random" outputs.
Overall, it is easier to get this wrong than to get it right, and you're unlikely to have any assurance of having it done right.
Thus, it is preferable to use a supply of randomness provided by the OS, such as /dev/urandom.
Another option is to run and query a "randomness daemon", which would accumulate randomness over a long period of time, but this approach has been largely obsoleted by modern Unix-like systems having implemented a randomness pool in the kernel, which is what /dev/urandom is an interface to.
A PHP-specific issue with accessing an external supply of randomness, such as /dev/urandom, is PHP's lack of support for unbuffered reads. Even if your application only reads, say, 8 bytes, PHP will read an entire buffer worth of data (typically 8192 bytes). This slows things down (albeit not too badly – e.g., it might be taking around 1 millisecond to read 8192 bytes from /dev/urandom on a modern Linux box) and it wastes the precious entropy. A revision of phpass-derived code being considered for Drupal 7 attempts to partially address this by rounding up the number of bytes to read to a multiple of 4096 (considering that PHP would effectively do at least the same anyway) and by maintaining its own buffer for use in subsequent calls to the function. This helps when multiple random "numbers" need to be obtained while servicing a single request, but other than that it is only a partial workaround. It would be best to have the issue fixed in PHP itself (by introducing
optional unbuffered reads).
Resetting forgotten passwords/passphrases
Typically, there's a way for a user to reset the password (or passphrase) by having the application send a message to the user's address previously registered in the system. The message may contain the new password (randomly generated) or it may contain a password reset token. The randomness concerns apply.
Here are some questions to consider before implementing this functionality:
Is the new password or passphrase passed in this way permanent or is it temporary (with a forced change upon login and/or an expiration date)?
If a token is passed, is it expiring? How is it to be passed back to the application?
(If it is embedded in an URL, then it is likely to get logged by any web proxy servers involved and by the final web server. Manual entry or copy & paste into a form field might be a little bit safer.)
The token may be randomly generated and stored into the database. Alternatively, it may be computed as a MAC of the username, the user's address that the token is to be sent to (e-mail or the like), the current timestamp (with certain granularity – e.g., just the date, with no time of day), and maybe other system- and user-specific information, and with a secret key specific to each instance of the application. In the latter case, when a user returns to the system with a token to be validated, the correct token is simply regenerated using all the same data. If the two tokens match, the user is considered authenticated. If they don't, the check is repeated for the "previous" timestamp (just one time). Thus, these cryptographic tokens automatically expire in 1 to 2 "units of time", but there's no way to deactivate them before they expire (e.g., upon first use) unless an extra parameter (such as a password change count for the user) was included under the MAC. The secret key needs to contain enough entropy (say, 80 bits or more) to withstand offline attacks on it given a valid token, and it needs to be different for each instance of the application. Luckily, it does not need to be easy to memorize, so there's no need to use key stretching, but instead this lack of stretching needs to be compensated for by including more entropy into the key than you would include into a password.
Online password guessing
With password hashing, we've been trying to mitigate offline password cracking given stolen or leaked password hashes. However, what about online attacks – where an attacker probes candidate passwords or passphrases by trying to authenticate to our web application with them? Obviously, those attacks would generally run a lot slower than offline ones, yet they might succeed in guessing some of the weakest passwords. For example, simply probing for the password "123456″ might result in almost 1% of accounts getting compromised.
Luckily, by enforcing a password policy meant to prevent easy cracking of our password hashes, we also defeat online password guessing. Thus, if you went for this, then implementing any other measures to deal with online password guessing becomes relatively unimportant. In fact, if you're confident in your password policy, then you may use very relaxed account lockout settings or none at all in order to avoid causing problems for legitimate users.
On the other hand, if you neglected or decided not to implement password policy enforcement, if you have old passwords that pre-date the policy, or if you have potentially non-compliant passwords for any other reason (e.g., imported from another system), then it may be important to implement countermeasures against online password probing. A typical countermeasure is temporary or permanent account lockout if more than N consecutive authentication attempts fail in X time. This should be further improved to deal with attacks that don't target a
specific username – e.g., if an attacker tries just the password "123456″ against 1000 different usernames, no single user account will be locked out, yet the attacker might gain access to around 10 accounts (if all of the
usernames exist). A way to mitigate this is to apply per-connecting-address limits on authentication attempts. Yet a distributed attack, such as using a botnet, would defeat that. So enforcing a password policy is a better way to go.
Denial of Service (DoS) attacks
Almost any network service is susceptible to certain kinds of resource consumption DoS attacks. As it relates to the topic of this article, online password probing attacks discussed above may also happen to be DoS attacks, typically unintentionally. Currently, this is not common with web applications, but it does happen with other network services.
Intentional DoS attacks may find and use requests that are even more costly for the server to process – e.g., those involving expensive database queries – or they may simply use an even higher intensity stream of non-targeted requests.
- "Doesn't password stretching make my web application more susceptible to DoS attacks?"
- With reasonable settings, no. The application developer should provide a default password stretching iteration count that will not make this a problem in practice, and the system administrator may tune this setting to better match a given system's capacity and expected use pattern. For example, if a web application is not able to handle more than 50 requests per second for other reasons anyway, then having password authentication take 10 ms will not provide a significantly more attractive way of attack. In fact, since different kinds of requests consume server resources differently, perhaps the login request, which does not involve much work besides password hashing on the CPU, won't be the heaviest. Quite often, disk I/O capacity (and not CPU time) is the scarce resource.
Another potential DoS attack relevant to the topic of this article is through registration of too many user accounts, if your web application is meant to permit for users to self-register. This kind of attack is currently not common in practice – likely because other DoS attacks, which are of less relevance to this article, are more effective. To mitigate this attack, you could implement all sorts of limits – e.g., no more than N user registrations per source IP address per day, no more than M users with the same domain name portion of e-mail address – and require validation of the e-mail address by a "secure token" implemented using a MAC. before the user is added to the database.
Password policy enforcement and usability concerns
It may be inconvenient for many users to have to submit a form only to get their desired password or passphrase rejected (for not being compliant to the policy), then have to come up with another password or passphrase and resubmit.
This may be partially dealt with by summarizing the gist of the policy on the web page with the form – e.g. for passwdqc's default policy as of this writing you can use:
"A valid password should be a mix of upper and lower case letters, digits, and other characters. You can use an 8 character long password with characters from at least 3 of these 4 classes, or a 7 character long password containing characters from all the classes. An upper case letter that begins the password and a digit that ends it do not count towards the number of character classes used.
A passphrase should be of at least 3 words, 11 to 40 characters long, and contain enough different characters."
You may also offer randomly generated passwords and/or passphrases. Just do not give any static examples of passwords or phrases that would pass the check.
Another improvement could be to have the web page check the strength of the password or passphrase as the user types it – such as by submitting it to the server every few seconds via Ajax or by duplicating the most critical password strength checks in JavaScript.
Neither approach is perfect: the former would cause extra server load and the latter would not duplicate passwdqc's actual checks exactly (they are a bit too complicated to fully duplicate them in JavaScript). Yet if you're so inclined, the C function to look at is is_simple() in passwdqc_check.c. A hybrid approach may work best – only bother the server with checking passwords or passphrases that pass the JavaScript checks.
Indeed, actual policy enforcement should be taking place on the server when the form is finally submitted anyway.
Challenge/response authentication
Unfortunately, implementing this involves trade-offs, and the implementations I've seen so far are not great – they require that plaintext-equivalents of passwords or at best relatively weak password hashes be stored on the server, which is unacceptable when the number of user accounts is large (because the cost of recovery from a security compromise of the server or, say, of a backup dump becomes prohibitive).
Although storage of plaintext-equivalents on the server can be avoided, certain other issues remain (e.g., it might not be possible to implement much password stretching in this way due to the slowness of JavaScript code).
So I do not currently recommend this approach (major advances in this area would need to occur first), yet I felt that it needed to be mentioned in here.
Once a user logs in, a session needs to be created – such as by using PHP's session handling capabilities or otherwise. There are plenty of potential issues related to session management, which could be the subject of a separate article. Since this is not very closely related to user and password management, since this is such a complicated topic, and since this article is too long as it is, I am leaving this topic completely beyond the scope of this article.
This article, not including the embedded code snippets, is
Copyright (c) 2010 Alexander Peslyak.
All rights reserved.
Permission is hereby granted to reproduce and redistribute the article and its
accompanying archive in their original form (unmodified and electronic only).
Non-exclusive rights are hereby granted to SektionEins GmbH to reproduce,
distribute, and advertise the article including but not limited to on the
http://php-security.org website,
in printed and/or electronic advertisements, and in all other media.
Others interested in reproducing and/or redistributing the article other than
in its original form and/or other than electronically should contact the
copyright holder for an express permission.
No copyright to the source code snippets found in this article and to the
sample programs included in the accompanying archive is claimed, and they're
hereby placed in the public domain.
Please feel free to reuse them in your programs.
In case this attempt to disclaim copyright and place the source code snippets
and the sample programs in the public domain is deemed null and void, then the
snippets and the programs are Copyright (c) 2010 Alexander Peslyak and they're
hereby released to the general public under the following terms:
Redistribution and use in source and binary forms,
with or without modification, are permitted.
(This is heavily cut-down "BSD license", to the point of being copyright only.)


text:
Fujitsu and XBRL in Australia
Fujitsu has been working with the Australian Government on its Standard Business Reporting (SBR) since 2009. Initially Fujitsu, through SBR, designed, developed and provided the XBRL application programming interface (API) referred to as the SBR SDK XBRL API. During the period this product was available via SBR it was sub-licenced to over 100 software companies. These represented the majority of software vendors who were listed as "SBR ready" on the SBR web site.
In 2012 an updated version of the API called XBRL Messenger was released directly by Fujitsu for the SuperStream program which the Australian Government had started to rollout for superannuation. XBRL Messenger was quickly adopted by some of the largest superannuation providers in the Australian marketplace. Since release it has gone through two major releases which provide enhanced functionality and performance when compared with SDK XBRL API.
Unlike the original SDK XBRL API, XBRL Messenger is directly supported by Fujitsu. It is upwardly compatible with the SDK XBRL API and so a number of the organisations which originally used the SBR version have since licenced XBRL Messenger from Fujitsu. This not only provides them with direct support but also the enhanced features and performance of XBRL Messenger.
Fujitsu Australia Software Technology (FAST) was responsible for the design and development of both SDK XBRL API and XBRL Messenger. It continues to enhance XBRL Messenger and makes sure it is always compatible with the latest releases of SBR and SuperStream taxonomies, including the recent ATO "self-contained" taxonomies. FAST also provides, through Fujitsu Australia, support for XBRL Messenger.
For more information on XBRL Messenger please visit:
or email us at:
Fujitsu, the Fujitsu logo, Interstage and Xwand are trademarks or registered trademarks of Fujitsu Limited in Japan and other countries. All other trademarks referenced herein are the property of their respective owners.


text:
Big Rapids, Mich. - The nationally-ranked Ferris State University women's volleyball team held onto a share of first place in the Great Lakes Intercollegiate Athletic Conference (GLIAC) North Division standings with a 3-1 victory over Michigan Tech on Friday (Nov. 1) night in Houghton, Mich.
The Bulldogs opened a weekend trip to Michigan's Upper Peninsula with the 25-18, 25-22, 25-27 and 25-18 triumph at MTU's Student Development Complex Gymnasium.
With the win, Ferris State ran its conference-leading mark to 11-1 and the Bulldogs are now 18-5 overall this season. The Huskies fell to 9-15 overall and 5-7 in the GLIAC.
Ferris State hit an impressive .412 in the opening set while setting the tone for the night with the decisive game one victory. FSU followed it up with a .290 percentage in winning the second frame and the Bulldogs closed it out in the fourth set with a .359 figure.
Meanwhile, Michigan Tech was held to totals of .162 and .146 in dropping the first and fourth frames by identical 25-18 scores.
Junior hitter Courtney Rehm paced three FSU players in double-digit kills with 16 on the night. She added 15 digs in a double-double showing. Both sophomore Alexis Huntey and middle hitter Caroline Heitzman added 15 kills each while Huntey also chipped in 13 digs and Heitzman totaled three blocks.
Along with the those three, Ferris State also received a season-high 56 assists from freshman setter Stephanie Sikorski. Senior libero Brandie Merren tallied 23 digs for the Bulldogs in the win with sophomore Megan Vander Meer netting seven kills and senior Angi Kent recording six for the match.
Overall, Ferris State registered 72 digs, 61 kills, five aces and six service errors. FSU hit .308 overall for the night with only 16 attack errors on 146 total attempts.
Four Michigan Tech players totaled 10 kills or more as both Shelby Jones and Kendall Ward notched 14 each. Kienna Sharp added 13 kills and Madeline Haben had 10.
MTU was led in the back row by Jacqueline Aird's 20 digs along with 19 from Rachle Pohlod. Haben added 42 assists in directing the attack.
Michigan Tech had only a .196 attack showing for the match on 59 kills and 26 errors in 168 total attacks. The Huskies totaled 65 digs and four aces with eight service errors. Ferris State had eight team blocks to MTU's five for the match.
With the win, the Bulldogs remained tied with rival Grand Valley State atop the GLIAC North Division standings as both teams have an 11-1 league mark to date. Ferris State has presently won 14 of its last 16 outings overall this year.
The Bulldogs will wrap up their two-match weekend road swing by facing Northern Michigan on Saturday (Nov. 2) in Marquette. Match time is set for 4 p.m. (ET).
Ferris State Volleyball Holds Onto First Place In GLIAC With Victory
|Ferris State (23-1 (12-0 GLIAC))
|Michigan Tech (17-7 (8-4 GLIAC))
Big Rapids, Mich. - The nationally-ranked Ferris State University women's volleyball team held onto a share of first place in the Great Lakes Intercollegiate Athletic Conference (GLIAC) North Division standings with a 3-1 victory over Michigan Tech on Friday (Nov. 1) night in Houghton, Mich.


text:
Kinsey shares some of the latest trends for the upcoming holiday season.
What's Trending: Pinterest Holiday Trends
Sponsored By
Program: Kinsey's CornerCategories: Arts & Entertainment
Latest Videos
Mediterranean Food and Music FestivalSabrina Silva is checking out one of the best Mediterranean Food & Music Festival in the Sacramento area. Authentic Middle Eastern food, stuffed grape leaves (dolma) picked from the church vineyard, Gyros, Father's Famous Zalabyeh Donut and so much more!
PorchFest WintersWinters is hosting what is sure to be the biggest event of the year: Porch Fest! Walk down the stunning streets of the small town and enjoy music coming from porches around the area. Ashley Williams heads out to take a stroll down Main Street to preview the FREE, family friendly event.
Hot Headlines: Prince Harry's 35th BirthdayCambi has the latest news on Hot Headlines.
Ventures Outdoor Education Pt. 2Tina has more on Ventures Outdoor Education with Maddie Brown!
Lodi Grape Festival Pt. 2Alan Sanchez has more from the Lodi Grape Festival!
Teen's Tunes Weekend: 2010Tina challenges the Good Day crew to another round of Teen's Tunes.
Empowered Within EventIt's that time again for Cottage Housing's Annual Empowered Within event. It's our 3rd annual, which will be held on Sunday, September 15 at Serna Village located at McClellan. Sabrina Silva is checking it out!
Punch Bowl SocialFall is next Monday and Punch Bowl Social is updating their menu. They are showing Cambi their new options!
Lodi Grape FestivalToday may be the last day for the Lodi Grape Festival but the fun is not over in the 209. The city has invited all to celibate what they are known for, the grape that makes great local wine! Alan Sanchez is checking out what fun is to be had at the Loid Grape Festival!
More Videos
Ventures Outdoor EducationVentures Outdoor Education features outdoor art, summer day hikes and learning about the Sierra. Maddie Brown teaches kids all about nature and teaches them how to appreciate it.
Sac Open Studios Pt. 2Ashley Williams is keeping our preview of Sac Open Studios going. Today we stop by to meet artist, Heather Hogan, a local artist who will be featuring lino block printing, and watercolor, pen, collage, and assemblage.
Cameron Park Theatre season openerCameron Park has opened up an arts theater and their season opener is Tennessee Williams' Cat on a Hot Tin Roof. So, Sabrina Silva is going out there this morning to meet with the cast, showcase the new theater, and also have them perform a little something for us!
Dishin' with Tina: Rosemary's Farm to ForkThis week, Tina is checking out a place called " Rosemary's Farm to Fork."
Sac Open Studios Pt. 1Sac Open Studios is known as the largest and most prestigious artist studio tour in the region! Today Ashley Williams is rounding out the weekend's festivities with a fun preview!
Manteca Antique FaireThe Manteca Antique Fair is an Outdoor event with vendors selling Antique and Collectible merchandise such as furniture, vintage clothing , jewelry, toys and much more! Alan Sanchez is checking out the deals!
Music Minute: Backstreet Boys Surprise StudentsCambi has the music news making headlines today in your music minute!
Spartan Workout TourSpartan, the world's largest obstacle race and endurance brand, hosts a free Spartan Workout to prepare participants for its upcoming World Championship in North Lake Tahoe, Sept. 28-29! Sabrina Silva is gonna get her workout in this morning!
Elk Grove Quilt ShowThe Elk Grove Quilt Guild presents the Harvest of Quilts today at S.E.S. Hall! Ashley Williams is checking it out!
The Fast & The Furriest Fun RunToday in the City of Tracy you can be a part of a fun run with your favorite pooch. They are looking for the fast and the furriest. Alan Sanchez is live in Tracy getting the deTAILS!
Burger Battle ChampsThey were just reigned burger champs of Sacramento! Beast and Bounty, one of Sac Town's hottest new restaurants, dominated at the annual Sacramento Burger Battle taking home top honors. So of course, we had to have them join us in studio to whip up the meal that landed them the coveted burger battle belt!!!
California's Preparedness DayCalifornia's Preparedness Day is a public safety, educational, and informational event hosted each year by California Governor's Office of Emergency Services, in support of National Preparedness Month. Sabrina Silva is checking out the safety demonstrations!
Hot Headlines: Hustlers OpeningAshley has the latest news on Hot Headlines.
Free Youth Football CampFootball season is just around the corner, and Assemblymember Jim Cooper would like to invite you to join him and the San Francisco 49ers for a free Play 60 youth football camp (Ages 7-14). The hosts are finding out more about this fun event!
Denair Farm & Family Festival Pt. 2Alan Sanchez has more from this fun family event!
Leadership Sacramento's 2019 ClassLeadership Sacramento's 2019 class (LS19) recently announced that they have taken on a project to support of the most vulnerable members of the Sacramento community: youth experiencing homelessness. The hosts are finding out more about their efforts and how you can help too!
Denair Farm & Family FestivalThe Small town of Denair is celebrating the love for the farm and family. So they invited our own Outdoor Alan to check out this outdoor festival.
Emerge SummitThe Emerge Summit returns in 2019 with a full day of inspirational speeches, educational breakouts and opportunities to mix and mingle with your peers. Cambi is finding out the details.
Teen's Tunes Weekend: 1994Ashley challenges the Good Day crew to another round of Teen's Tunes.
Marchi the DuckWe fell in love with pictures of a duck who loves to wear pearls and she even has her own Instagram. Cambi is meeting meeting Marchi the duck and finding out more about her story!


text:
FAQ – Subscriptions: ArtSlant Profiles and Personal Websites
The ArtSlant Contemporary Network offers a full range of tools and services for artists, curators, art collectors, galleries, museums, art resources and art lovers.
You can Join as a free basic member, or select from our menu of paid subscriptions to further enhance your artwork and business opportunities.
Please browse the following list of our Free & Paid Subscriptions and become part of our worldwide network.
BASIC FREE MEMBERSHIP: start a basic, introductory artist Profile
Receive a Free Professional Profile | Artists, Galleries, Art Professionals
Add Your Content | Exhibits & Events, Blogs, Reviews, Forums, Comments, Recommendations
Receive our Free Weekly E-Publications | Weekly & Special Edition coverage delivered to your mailbox
PROFESSIONAL PROFILES: manage your Profile, or build a website
Standard Subscription - $5/mo | $55/year- control and manage your ArtSlant Profile!
Portfolio Subscription - $15/mo | $165/year - personal domain, professional templates and much more!
FREE GALLERY OR VENUE LISTING: for galleries, museums, and alternative art spaces
Control and manage your gallery or venue's listing on ArtSlant. Provides your website and contact info, gallery description, map, and exhibition history. Add and edit all exhibitionss entered into our system by you or others, at a moment's notice. Organize slideshows of your artists. Allow multiple staff members full editing privileges on your display.
The website will be permanently closed shortly, so please retrieve any content you wish to save.


text:
Aly & AJ Michalka: 78Violet's NYC Showcase Backstage Photos (Exclusive!)
Aly and AJ Michalka pose together backstage before their showcase at the Gramercy Theatre on Tuesday (July 9) in New York City.
The 78Violet singers gave JustJaredJr.com an exclusive all access pass to watch them prepare for their big night in the Big Apple. We watched as they prepared for the show during sound check and then hung out with them in their dressing room as they put their finishing touches to their makeup and wardrobe.
Aly and AJ even showed us their little troll figurines that they bring to all their shows for good luck!
During the concert, the girls performed a slew of their awesome new songs and then capped the evening off with the fan favorite "Potential Breakup Song." Celeb pals in the crowd included Aly's Grown Ups 2 co-star Patrick Schwarzenegger and his pal Liana Liberato, as well as her former Phil of the Future co-star Ricky Ullman.
Aly & AJ's Shout Out to Just Jared Jr. Readers!
20+ pictures inside of Aly and AJ Michalka backstage at their showcase…
Posted to: 78violet, AJ Michalka, Alyson Michalka, Exclusive


text:
To Bee Or Not To Bee
As we get closer to Valentine's day, the amount of animal puns on pastry increase exponentially. "I love ewe," "Can't bear to live without you," etc, etc.
The only problem is, many bakers don't understand puns. So, I've assembled this handy primer to help them out.
And also so we can laugh at them.
But that goes without saying.
Alright, bakers, today we're going to cover the most basic Valentine's pun there is: "Bee Mine." The trick here is to write "Bee Mine" and accompany it with a bee. Got that? Good.


text:
Wall Street Bonuses Grow and More
What's News: Wall Street bonuses grow, a fatal balloon crash in Egypt kills at least 19 tourists and a new Wall Street Journal/NBC News poll shows President Obama leading Republicans when it comes to unifying the country.
This transcript has been automatically generated and may not be 100% accurate.
... the for the shows are Wall Street this is what Samsung WSJ lifetime Thailand ... their securities firms cocaine placed twenty billion dollars in cash bonuses for twenty twelve ... that's up eight percent from a year ago ... a report by New York State Comptroller ... Thomas DiNapoli says ... the increase is this in part by the payment of deferred compensation from prior years ... the banks have also been see improvements in profitability ... and has instituted new pay incentives tied to longer term performance ... the average cash bonus on Wall Street is roughly ... one hundred and twenty one thousand nine hundred ... dollars ... and in Egypt and deadly balloon crash claimed the lives of at least nineteen foreign tourists ... Heidi air balloon flying over the ancient city of flux or caught fire and flames over one thousand feet ... the casualties included French British ... Japanese nationals and nine tourists from Hong Kong ... and by more than that to one margin Americans say President Obama is doing a better job of her offering Republicans and attempting to unify the country ... in a bipartisan way ... this according to a new Wall Street Journal NBC News poll ... the poll finds that forty eight percent of respondents see Mr Obama is trying to unify the country ... compared to twenty two percent to say that if Republicans and thirty seven percent ... who say that ... Democrats ... logon were the result of the football which will be released to nine on WS J dot com ... look you keep us in on the latest news about this rapid am What's News on WS J live ...


text:
GALLERY EDITION Caliber Series 4-26004271 Giclée Fine Art Print
GALLERY EDITION Caliber Series 4-26004271 Giclée Fine Art Print
from 900.00
Gallery Edition giclée print created in collaboration with Raise the Caliber. Printed on archival metallic glossy photo paper using vibrant water-based inks. Print will have an added 2" white border. All prints are printed in-house and inspected with care before shipping.
Print Size:
26" x 16" | Edition of 10 | $900
Framing Details:
Black or White frame (+300)
Face: 5/8" wide
Depth: 1-1/16"
Outside Frame Dimension: 21-1/4" x 31-1/4"
Note: Prints are made to order. Please allow 1 week for unframed items and 2-3 weeks for framed items to ship.
Additional shipping costs for the framed artwork is included in the framing price. Framed artwork is shipped via FedEx Ground, large items are shipped via FedEx Freight.
Frame Style:
Add To Cart


text:
A Burlington restaurant is closing. Yella Bird Kitchen, at 3243 S. Church St. in Burlington, served its last meal Sunday.
The restaurant opened in January and owners said it just wasn�t getting enough business to stay open.
Yella Bird Kitchen posted on its Facebook page Friday that it intends to pursue other avenues, such as catering or boxed meals and pastries, and will update its local fans via the social media site when any decisions are made.
Check out �Yella Bird Kitchen� on Facebook to stay updated.
GEEKS PLUS, A BURLINGTON computer and network support company, has moved to a different office suite in the Savannah West shopping center.
The store is now at 1145-E Saint Marks Church Road, and is open 9 a.m. to 7 p.m. Monday through Friday and 9 a.m. to 4 p.m. Saturday. Geeks Plus offers small business support, from installation of servers, workstations, and printers, to networking and cable management. The store also offers residential services such as computer diagnostics, network setup, malware and virus removal, and data backup and recovery.
Call (336) 506-6639, visit www.geeksplus.com, and check out the �GeeksPlus� page on Facebook.
A NEW DOLLAR GENERAL opened at 1031 South Williamson Ave. in Burlington on Saturday.
The new store provides both national and private brands of food, housewares, cleaning supplies, basic apparel, health and beauty care and seasonal items. Hours are 8 a.m. to 9 p.m. all seven days of the week. Call (336) 586-9755.
BURLINGTON KRAV MAGA has also moved to a new location in the Savannah West Shopping Center, and has doubled its size.
The center�s new address is 1147-A St. Marks Church Road in Burlington. The center offers fitness classes, including kickboxing, yoga, pilates, and kettle bell, and self-defense and fighting classes such as Krav Maga and a weapons defense class. To sign up for classes call (336) 270-3005 or visit www.BurlingtonKravMaga.com. Check out �Burlington Krav Maga� on Facebook.
SHAGGY CHIC CANINE SPA just opened at 352 Harden St. Suite B in Burlington.
An experienced dog and cat groomer, Lee Safrit is a graduate of Nanhall Professional School of Grooming, member of the International Professional Groomers, Inc., and a member of the Professional Cat Groomers Association of America. Grooms by appointment only. Call (336) 524-4642.
Got an item for Open and Shut? Contact Times-News reporter Molly McGowan at email@example.com or editor Madison Taylor at email@example.com.


text:
One of the bullet point announcements during Bertrand Serlet's talk about Apple's software innovations in Leopard and Snow Leopard was the immediate release of the final version of Safari 4. The browser has been in beta since February of 2009 and introduced a number of user interface changes that proved to be highly contentious.
The most polarizing of these was the decision to place browsing tabs pointing upwards and invading the title bar area. This, plus the decision to remove the loading progress bar, set off the Safari userbase, but some of those tweaks have now been changed.
With the final version of Safari 4, Apple has changed both of these, opting for middle-ground compromises. On the tab situation, Apple has merely updated the visual appearance slightly and returned the tabs to their original home beneath the bookmarks bar. Many people find this arrangement much easier to digest, as it again draws a better distinction between the coordination needed to move the whole window or reorganize you tabs.
On a less-discussed point, Apple has changed the location of the option to leave the tab bar on at all times. You can now tweak this behavior via the View menu (Show/Hide Tab Bar).
The second big change is to the loading progress indicators. In the betas, Apple opted to remove the progress bar that loaded behind the address text box, and instead chose to move to a spinning indicator on the tabs themselves. In the final version, this is replaced by a loading widget attached to the right half of the address bar. This version is much more visible compared to the spinners on tabs, as they would sometimes appear to get lost in the color contrast of the spinner itself and the background color of their tab. The new indicator you see above to the right is much more obvious, but still lacks the precision of letting the user know exactly what percentage of the page has already loaded.
Along with this loading indicator, Apple has reinstated the "stop" button, which was absent from the betas. Prior to version four, Safari had included an "innovative" dual-purpose stop/reload button that changed context depending on the state of the browser. When that was removed from the fourth version, many users were confused. Apple still included a reload button, positioned to the right side of the location bar, but it was now in a weird spot and non-configurable by standard Cocoa toolbar processes. The new progress loading indicator, however, displays in this same area and adds in a small button marked with an "X" which can be used to stop the loading of a page.
Conveniently, this is in the exact same location as the reload button. In a sense, the original functionality has been revived, albeit in a slightly less configurable or user-friendly fashion.
On future fronts, Safari 4 has been tweaked to offer a few additional features for users of 10.6 Snow Leopard, launching in September. Bertrand Serlet gave a short demo on a new feature dubbed "Crash Resistance." This is a feature seen in a browsers like Google Chrome which run browser plug-ins like Flash in their own process.
This means that if a plug-in (Flash for example) misbehaves and crashes, your browser will not crash as a result. The only effect will be that the small area where the plug-in was loading will turn white and contain a brick plug-in icon. Bertrand mentioned that browser plug-ins were, by themselves, the single largest instigator of crashes in OS X.
The final update that Snow Leopard users will see is additional performance gains in Safari. One of the big updates in 10.6 is that many of Apple's applications will be running in full 64-bit mode which will allow them to access more memory, and in certain circumstances do certain types of calculations a lot faster. Serlet quoted a full 50 percent improvement in JavaScript speed (as judged by the Webkit project's SunSpider benchmark) over the 32-bit version of Safari 4 when run in 10.6 and 64-bit mode.


text:
DOE A to Z: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z #
Directions to the Bergen County Office
New Jersey Department of Education
One Bergen County Plaza
3rd Floor - Room 350
Hackensack, NJ 07601
Visitors may enter parking garage for One Bergen County Plaza via Hudson Street. Guard will direct to the proper area. Handicapped parking is on the piazza in front of main lobby entrance to One Bergen County Plaza. If parking lot is full you maybe directed to the Justice Center lot.
From Route 4 East or 4 West - Exit at Hackensack Avenue. Hackensack Avenue becomes River Street. From River Street make a right onto Kansas Street (COSTCO will be on the left). At the light, turn right onto Hudson Street and make first right into Bergen County Plaza.
From Route 17 North - Exit at Polifly Road. Four lights later, make a right onto Essex Street. cross over RR tracks. *Go past light at State Street, the road curves and splits. Bear right onto Hudson Street and make your first left into Bergen County Plaza.
From Route 17 South - Exit at Essex Street (Maywood-Paterson). Make left at the stop sign onto Essex Street. Stay on Essex Street, past Hackensack University Medical Center and over RR tracks. Proceed as above from 17 North*.
From Route 80 West - Exit at # 66 (Hudson Street, Hackensack, Little Ferry). Go to light. Make a left onto Hudson Street. As Hudson Street starts to curve, see Court House ahead, One Bergen County Plaza will be on your right. Just after the building make a right turn into Bergen County Plaza.
From Route 80 East - Exit at # 65 (Green Street, South Hackensack). At end of ramp, make right and proceed to light. Turn right onto Green Street and proceed to end. Turn right onto Essex Street. See Court House ahead. Road curves and splits. Bear right onto Hudson Street and make your first left into Bergen County Plaza.
From Garden State Parkway: Use Exit 159 to Route I-80 Eastbound. Continue as described above from 80 East.
From New Jersey Turnpike: Continue North to I-80 Westbound (signs for Dover and Paterson) and follow directions above for 80 West.


text:
Bilingual thoughts on life, language, learning, and all things Latina.
Monday, March 2, 2009
Extendiendo, creciendo
Ideally, a blog should have one focus. You may have noticed this one has a few. I started this project with the intent of sharing my poetic attempts and original short stories. Then it occurred to me that it would be a place to exchange ideas with educators, people like me who live a life of swimming against the current while pushing kids ahead. My vision for this blog grew, as I thought I would also touch on issues of bilingualism, multiculturalism, and reflect on what it means to be a Latina, a professional, a working mother, and an optimist, in an environment that shifts between rejection and affirmation.
I will celebrate this blog's 1st anniversary on March 30th. When I started this project, I was stressed by it, even somewhat obsessed, and thought, "What have I gotten myself in to?" On several occasions I considered abandoning it. I suppose I was overwhelmed with work, or even doubted I had anything important to say. I also suffered long bouts of staring at the screen without typing anything – the infamous "writer's block." Once, I almost let it go after someone dear to me asked, "Why do you even do it?"
Luckily, here I am still, enjoying all the directions in which Reach for More has extended. As the author of this blog, I have stretched in many ways. It makes me be and do more.
Thank you for visiting this blog, and don't forget to leave a comment letting me know you were here. I would love for this blog's reach to grow even more. Please share it with others, display my link on your page, or subscribe.
5 comments:
- John Spencer said...
I've enjoyed your blog and I'm glad you didn't give up. Congrats on your one year blogoversary!
- March 2, 2009 at 7:07 PM
- Saii said...
I was here!!
i always always read
- March 2, 2009 at 7:33 PM
- Jennifer said...
Happy slightly early anniversary! I think having more than one focus makes a blog more interesting. For me, my blog's focus has changed over time, too, (though I do slip back sometimes) which keeps me on my toes!
- March 4, 2009 at 9:43 AM
Believe me, your blog not only reaches me, it reaches out to me. I really enjoy your work!!!
- March 6, 2009 at 4:01 PM
- TeacherDee said...
I haven't been hear in a while, but now that the school year is getting a little easier, I'll be around a little more. I always did love your blog back when I was reading regularly. You have a way with words. Congratulations on making it a success!
- March 9, 2009 at 11:52 PM


text:
Nov. 27 ( Bloomberg) -- Paul Ceglia was indicted on charges he faked evidence to support his claims that he signed a contract with Facebook Inc. Chief Executive Officer Mark Zuckerberg giving him a multibillion-dollar share in the world's biggest social network,
Ceglia was arrested and charged last month in a criminal complaint with one count each of wire fraud and mail fraud, and was accused of the same crimes by a New York federal grand jury, according to an indictment released yesterday by U.S. Attorney Preet Bharara in Manhattan.
Ceglia, 39, doctored a legitimate 2003 contract with Zuckerberg, in which the future CEO agreed to perform coding work for Ceglia's website, into a phony contract "in which Zuckerberg agreed to provide Ceglia with at least a 50 percent interest in Facebook," according to the indictment.
Prosecutors say Ceglia also fabricated e-mails and destroyed evidence in the case.
The indictment is necessary to bring the western New York man's case to trial. Each of the charges carries a maximum sentence of 20 years in prison. Ceglia pleaded not guilty last month. He is set to appear in Manhattan federal court on Nov. 28.
Ceglia sued Zuckerberg and Facebook in 2010, claiming 84 percent of the company. He later reduced his demand to half of Zuckerberg's Facebook holdings. Facebook, based in Menlo Park, California, said from the start that Ceglia's claim was fraudulent.
Ceglia's lawyer, Dean Boland of Lakewood, Ohio, didn't immediately respond yesterday to a voice-mail message seeking comment on the criminal charges.
The contract case is Ceglia v. Zuckerberg, 10-cv-00569, U.S. District Court, Western District of New York (Buffalo). The criminal case is U.S. v. Ceglia, 12-mj-2842, U.S. District Court, Southern District of New York (Manhattan).
Related News and Information: Facebook coverage: FB USCNTop legal news: TLAWBloomberg legal resources: BLAW
--Editors: Fred Strasser, Peter Blumberg
To contact the reporter on this story: Bob Van Voris in New York at firstname.lastname@example.com
To contact the editor responsible for this story: Michael Hytha at firstname.lastname@example.com


text:
Laval Earth from Clarke & Clarke
All our products have a range of customisable options.
Please note : Any product exceeding the fabric width will require a join.
This product is made to measure and have a variety of options. To find more information on an option click the ? next to the selection.
Free Delivery on all orders to UK Mainland - today only!
We do deliver to other non UK mainland destinations and into Europe.
Please see our delivery information page for further details.
Notes on curtain fullness or gathering
Once you have entered your curtain pole or rail width, we will calculate the amount of fabric required for your curtains. Some headings require more fullness or gathering than others so these headings will require more fabric which is reflected in the price of the curtains.
The guide below shows the fullness factor - minimum amount of fullness or gathering used for each curtain heading.
All curtains are made in increments of 1/2 widths
Pencil Pleat 1.75
Pinch Pleat 2.25
Wave Pleat 2.0
Tab Top 1.5
Eyelet 1.5
Unfortunately this particular product doesn't yet have any reviews. However, you can still see all our other reviews by clicking on the Feefo rating above. Alternatively, why not take a look at our other products available in this fabric.
We are proud that Custom Curtains is a Gold Trusted Merchant at Feefo, our independent feedback provider.
Please read the information below to ensure you measure correctly for your curtains. It is worth taking extra care when taking measurements and we advise the use of a metal tape to ensure you measure with accuracy. Please take your measurements in CM only.
We always advise that you measure the curtain track or pole width, not the window.
If you are fitting a new track or pole this should extend 15cm to 20cm either side of the window. This will allow the curtains to be stacked either side of the window.
Measure the length of the pole between the finials (decorative ends).
Measure the length of the rail. If you have a rail with an overlap in the centre, measure the length of the rail and add the length of the overlap to this measurement.
The length of your curtains will depend on your preference. Typical length measurements are as follows.
A: Full length which is approximately 1.5 to 3cm above floor level.
B: Above radiator typically 1 to 3cm above the radiator.
C: Below the window sill typically around 15cm.
Measure from the top of the track or bottom of the curtain rings for a curtain pole to the desired length of your curtains.
For Tab Top or eyelet curtains you should take your measurements from the very top of the pole.
Not measured in cm? click here to convert
Including free UK Mainland delivery!
Single Pulled To Left
Single Pulled to Right
Pair of Curtains
Eyelet curtains with a selection of eyelets to choose from.
Tab Top
Tab top heading.
Wave Pleat
Wave pleated heading.
Pinch Pleat
Pinch pleated heading.
Pencil Pleat
Pencil pleated heading.
66mm Oxy Black
66mm Antique Brass
66mm Bright Gunmetal
66mm Plain Brass
66mm Chrome
66mm Satin Nickel
40mm Oxy Black
40mm Antique Brass
40mm Plain Brass
40mm Bright Gunmetal
40mm Chrome
40mm Satin Nickel
No Lining
Your curtain will have no lining.
Thermal Lining
Our ivory coloured thermal lining retains heat in your home, making your rooms more energy efficient.
Our ivory coloured interlining is padded to make your furnishings appear even more sumptuous. Includes the benefits of thermal lining.
White Blackout Lining
Fully lined with white blackout lining.Stops more sunlight than standard lining, darkens room. Ideal for childrens bedrooms and for night workers. Free Upgrade.
Ivory Blackout Lining
Significantly blocks out sunlight, making this ideal for children's bedrooms and night workers. Free Upgrade.
Premium Lining
Fully lined with our ivory coloured polycotton lining.
Piped Tieback
Tiebacks have piped edging in same fabric
No Tieback
No Tiebacks Required
Plain Tieback
Tiebacks have plain edges.
If you are approved for a credit limit with PayPal Credit and use it for future purchases, the interest rate for those purchases will not be higher than the standard variable rate, and may be lower if you access offers.
Representative Example: Purchase rate: 19.9% p.a. Representative: 19.9% APR (variable). Assumed Credit Limit: £1,200.
Subject to Status. Terms and Conditions apply.
There are also other products available in this fabric.