text:
Are you looking for Security Consultants? Hotfrog showcases more than 90 popular businesses related to Security Consultants! To find more business related to Security Consultants, use the left navigation menu.
- 13-Aug-2013
- 04-Feb-2013
October Protection provides Security Consultancy, Risk Management, Hospitality, Event and Conference Security, Static Guards (suit and tie, uniformed or plain clothes). Security Staff Solutions, Event Controllers, Doorma…
Personal Protection
Auckland, Auckland
Bob Campbell Consultancy Limited. Consultants at BCCL are independent security consultants specialising in security, risk, project management and security system design
Closed Circuit Television
Albany, Auckland
RISQ New Zealand Limited are specialist Private Investigators and Security Consultants, utilising decades of practical investigation and security expertise to produce tailored results for specific client objectives. Base…
Private Investigators
Dunedin, Otago
Southern Security are professional and experienced Security Consultants for all your business and residential alarm monitoring and installation needs. Southern Security brings the peace of mind of dealing with well estab…
Alarm InstallationSecurity GuardsAlarm ResponseSecurity Patrols
ZX Security consultants are recognised in the industry as experienced professionals who get the job done
Global International Security Consultants consists of a dedicated team of ex Military Specialists. The company operates in areas of conflict
Wellington, Wellington
Aura Information Security is one of New Zealand's leading and fastest growing information security consulting companies offering penetration testing, security architecture and secure development training Our cu…
Pinnacle Security Consultants is a New Zealand owned and operated company located in Auckland
Fear Free security consultants who provide expert training, audit and management services
Security ProfessionalsSecurity Solutions
CHRISTCHURCH, Canterbury
Burrowes& Associates Ltd is a New Zealand based Private Investigator & Security Consultant offering their services worldwide
Private InvestigatorsTracingSurveillance
MAP Datum Limited are independent security consultants offering independent security risk management services throughout New Zealand
Security Professionals
NZ's most internationally experienced Security Consultants. Professional and vastly experienced. Get a Free Security Consultation
Find a tradesman you can trust. NZ Builders, Mechanics, Painters, Plumbers... businesses rated & reviewed. Find the right person for the job at NoCowboys
Whether it be your home or commercial interests, we understand that you have enough to contend with let alone worry about the impact of crime on your family or the continuity of your business
Private InvestigatorsSecurity GuardsSurveillance
At MaXwatch security.......||In our 3rd year of operations we have been providing the best customised service to our clients at the most sensible,reasonable & fair costs...||** a highly trained security staff enables you…
Event SecuritySecurity GuardsAlarm Response
Christchurch, Canterbury
New Zealand Private Investigators and Security Consultants - David (Dave) Haslett as Director of Ronin International (NZ) Ltd offers a professional, confidential, quality investigative service with a strong customer focu…
Private InvestigatorsDetectiveSurveillance
Lateral Security is New Zealand's leading independent IT security company providing tailored Directors Nick von Dadelszen and Ratu Mason founded Lateral Security in 2008 after seeing the need for an indep…
Spreydon, Canterbury
Whether your security needs are small or large from static security to close protection our team is here for you. Below are just a few of our services, please feel free to contact us for a free consultation to find out w…
Security Guards
Private InvestigatorsTracingDetectiveBackground Checks
As a small team of professional security consultants Securify offers a completely independent approach to security consulting As we do not sell any product and are not aligned to any Telco the company provides …
KHAKI Locks are trained security experts and can supply new or second hand safes to meet your needs, or take advantage of our expert advice, free of charge if you are purchasing a safe elsewhere We understand t…
Other Categories:|Security Consultants|Security Services|Private Investigators
AKTS NZ LTD is a security consultancy company - We have the necessary skills and experience to get the job done, safely, securely and on time
We have chosen not to sell product, partner with vendors or offer technical implementation services in order to maintain a truly independent advisory role
Our unique expertise, technologies, and training services are a culmination of over twenty years of research and thousands of successful software security consulting engagements at leading public and private organiz…
Palmerston North, Manawatu-Wanganui
Educators NZ Ltd is a Retail Security Consultancy Company specialising in In-store training on Shoplifting, Employee Theft, EAS and Robbery Training. Educators provide a personal guarantee of satisfaction with the trai…
Retail Security
Taupo, Waikato
In addition to mobile patrols, static guards, event security, retail, forestry and farm security, we provide alarm monitoring, registered quality trained guards, crowd control, personal body guards and courses in se…
Retail SecurityCrowd ControlEvent Security
Hamilton, Waikato
At On Guard Security we understand that every job is different, so we provide fully customised solutions that deliver the optimum security and protection As a proudly Kiwi company which is family owned and oper…
Security SolutionsSecurity Monitoring
Hastings, Hawke's Bay
To provide our clients with the Highest level of professional protection/investigative services and security solutions in the most efficient and effective manner!
Document ServingProcess ServingRepossessionsSecurity Solutions
Document ServingProcess ServingRepossessionsPrivate Investigators
Main Security offers the highest level of service and accountability with our home and business alarm systems, alarm monitoring as well as our patrol response service throughout Kapiti and Horowhenua Main Secur…
Alarm Installation
Securitek (NZ) Limited offer the following: overt and covert cameras, surveillance, investigations, film reviewing, staff vetting, undercover operatives and security audits. Investigation and Security Licensed
Nelson, Nelson
Invercargill, Southland
Whangarei, Northland
Napier, Hawke's Bay
Can't find Security Consultants company near in NewZealand? Let us know by adding the missing business here.
Small Business Hub
Sharing tips, ideas and advice to help grow your small business.
Hotfrog AdVantage
Hotfrog AdVantage ads appear above the rest in Hotfrog feature pages. By upgrading today your ad will appear in front of potential customers before they notice your competitors.
Create your free Hotfrog business profile
Follow Hotfrog on:
Share on:
Hotfrog Small Business Hub


text:
Ian manages our event centre and delivers guidance to our Youth Management Teams.
Mick has many years experience in delivering community projects and has spent his whole working life in the private sector.
David has over 15 years experience in the Music industry performing across the UK and Europe with his Band The Longsands.

subset: commoncrawl


text:
Campanile Avignon Sud Montfavet
No prices found through our partners. Please contact the business directly or check some of our recommended alternatives.
- Room service
- Free High-Speed Internet
- Multilingual staff
- Non-smoking hotel
Photos of Campanile Avignon Sud Montfavet
Travelers also looked at:
- More recommendations
- Free High-Speed Internet
- Non-smoking hotel
- Multilingual staff
- Room service
TripAdvisor Reviews Campanile Avignon Sud Montfavet
Travel Blogs from Montfavet
Day 72 - Avignon of Popes and Palaces
... to the village. We strolled the route from our gite (rental) through town, past the church, bakeries, small shops and the mayor's office and a small open air market where we bought some fresh goat cheese. The walk took an hour.
We returned to the rental and got ready for a tour of Avignon. It took about twenty minutes to drive to the train station parking lot where we parked while we toured. We strolled to the North through town to the Palais des Papes. Avignon was the ...
Day 71 - Provence Provincial
... was a travel day, it also became a laundry day. It took a couple of hours to get caught up but we succeeded. Next it was off to Avignon supermarket for groceries for the week. We returned about 5:00 and settled in for the night. We lit a fire in the fireplace as the temperature in the old stone cottage was a bit cool. The fire, some jazz and some C�te de Rhine wine made for a lovely evening.
The Rhone Delta
In fact we by passed Marseilles the famous port city because there is no camping place there. We ended up in Istres on the Bay of Berre (south of Marseilles) and had to skirt through the town to get to the Bay. It was chaotic and we blindly trusted the GPS.
Camping Neptune proved to be a good overnight stop with water views. The fresh sea breeze was pungent with a nostril tickling seaweed smell.
We decided on ...
Bagging a Big Col. - Mt Ventoux!!
... can get over 40 degrees during the day.
We had breakfast and met Dad in Sault. We started our ascent of Mt Ventoux. Art and I were really scared as there were heaps of really noisy fast groups of motorbikes riding up and down. There was also a really loud car that went past.
People were cheering us on and clapping and calling out to us all the way. Mum drove the car and stopped lots to give us food and ...
A visit to Provence
Traveling south from the Loire Valley
After leaving the Loire a Valley, we headed southwest towards Bordeaux...a name synonymous with the greatest wines of France and the city of the same name which has undergone something of a revitalization in recent years. As per our usual; we didn't actually make it to the city and stopped short in the seaside town of La Rochelle. It sits on the Atlantic Ocean and from its outskirts, a ...


text:
Create an Animation
This project received 14 bids from talented freelancers with an average bid price of $361 USD.Get free quotes for a project like this
Project Budget$30 - $250 USD
Total Bids14
Project Description
In all movie dominates white colour. Particle looks alike a goolf ball.
script: one particle falls from top to the bottom in slow motion. After few seconds it stops in the air. Camera goes 360 degrees around the particle. Around the particle appears some parameters (3d or graphic marks). Than parameters go away, and the motion goes faster (little bit faster than in the beggining). Particle falls, touches the surface of others praticles and bounces one time. Than the view zoomes out a little bit and you can see the surface of other particles. Also other falling particles. You can slightly see rezults appearing on other falling particles. Than everything stopes for a second. Camera shoots straight from the top. The ground starts to virbate. Particles goes out of surface( to the frames of shot) and than appears logo. After a second it fades out, and appears a sentence.
Skills Required
Looking to make some money?
- Set your budget and the timeframe
- Outline your proposal
- Get paid for your work
Hire Freelancers who also bid on this project
Looking for work?
Work on projects like this and make money from home!Sign Up Now
- Forbes
- The New York Times
- Time
- Wall Street Journal
- Times Online


text:
It seems like 24 months since the show was last on, but the show has made a welcome return to FOX. The late start means FOX can show an episode a week all the way to the end, without any breaks. The wild ride will only be faster.
This day takes place 18 months after Day 3, which took place three years after Day 2, which took place 18 months after Day 1. So, we're a ways down the road in terms of timeline. Jack Bauer now works for the Secretary of Defense, James Heller, and is seeing his daughter, Audrey Rains. Their day begins with the two of them in a hotel room, discussing their relationship, and looking forward to another routine day on the Secretary's calendar. If only.
The episode began with fiery train crash. A commuter train runs into a vehicle parked on the tracks, which explodes on impact, derailing the train. Later, 32 people are said to have died. Before the crash, we see a couple of wary, armed agents of some sort protecting a McGuffin, er, a briefcase. After the derailment, a waiting figure on a motorcycle conveniently finds the person with the briefcase within seconds, dispatches him, and takes the briefcase.
The train was said to be a commuter train, and the day begins at 7 am. Yet, the train crash took place in the dark, and in a remote area. So where is this commuter train coming from, East Jackrabbit, Nevada? Heading for LA?
CTU, now headed by Erin Driscoll, monitors the crash, with the aid of the eternally sour, but crankily loveable, Chloe. Our favorite keyboard jockey has become even more sharp-tongued in the last 18 months, to the point of insubordination.
We didn't get a half-hour into the show before we had our first mention of "protocols", with several more mentions to follow. CTU loves their protocols, whatever they are. But if we ever hear CTU start running the Zion Protocols, we'll be very afraid.
At some point, a hacker friend of Chloe's is "downloading" software, when another window pops up on his computer, and we see a bunch of characters rapidly scroll. Being a software developer myself, and a longtime computer user, I immediately recognized this a sign that something ominous was happening. Erp. Yes, well, visual tricks to clue the viewer about something unusual aside, the hacker in mere seconds determines that a threat to the Internet has been launched. A coworker ominously says that the entire Internet could go down. Yes, Gentle Reader, this is how real computer work is done. We get our research and work done within seconds, and spend the rest of the day just shooting Nerf rockets at each other.
The meat of the story hinges around an apparently unhinged upper-middle class family involved in the plot to steal the briefcase. The Araz family is apparently Turkish, which is going to raise some eyebrows. Turks are not Arabs, do not speak Arabic, and generally in the ongoing Terror War have little to do with the bloodthirsty nihilists causing the problems in Iraq. So, it is a curious choice of nationality for the terrorists.
The family, headed by Navi, with his wife Dina, (hereafter known as Lady Macbeth), and their son Behrooz, are expecting the briefcase to be brought to their house, at which time Behrooz will bring it to another location. This is a plot contrivance of the first degree. The reason Behrooz has to be bring the briefcase is because Ma and Pa must "account for their whereabouts". How they will do that when they're just sitting in their kitchen is not immediately clear. Perhaps they will call a local TV station just to say yup, we're in our kitchen today.
Also, the person bringing the briefcase to the Araz adobe cannot just bring it to the final recipients themselves, because, "Navi doesn't want them to know where the people they work with are located." Huh? It's not possible to meet in a public place somewhere? Do the classic spy movie cliche of putting the briefcase down beside a table and have someone pick it up, or do a quick handoff?
No, we can't do that because the plot requires Behrooz to be involved. Why? Because Behrooz has a thing going with an infidel girl, Debbie. His parents are aware of it, and want the relationship stopped. Here's another plot hole that 24 routinely drives trucks through. This family has been planning this operation for some years now. It is of vital importance to them. If so, why is Pa still dealing with this ON THE DAY OF THE OPERATION? Why wasn't this potential security breach handled long ago?
Well, because the plot requires that L'il Debbie follow Behrooz to where he drops off the briefcase, so we can have exciting drama in the next episode about how they will handle Debbie's intrusion.
Back to the SecDef. Jack goes to CTU for a meeting with Driscoll, and we find that Driscoll fired Jack, as he was a junkie. (See last season for details.) The meeting is the excuse to get Jack back into CTU. Where, he proceeds to commit another act that in the real world would lead to a scandal of immense proportions. Think of the Abu Ghraib, and the way the media flogs that. Here, a suspect in the train bombing is brought in, and won't crack under brutal, intense, questioning. Well, maybe not so brutal. The agent just asks him things. So, Jack disables a security card, gets into the interrogation room (showing us, the viewer, that CTU security is still as good as it ever was, since it follows the Star Trek Security Manual). Jack somehow (read, conveniently. There are lots of conveniences in 24) uses the keypads on the doors to disable the keypads and prevent anyone else from getting in. Jack then shoots the guy in the knee, who then is motivated to tell Jack that the SecDef is a target of a plot. Can you imagine the hubbub in the media if it came out that someone working for the SecDef attacked a CTU agent so he could get in to shoot a suspect in the knee?
The SecDef has stopped off that house of his loser son, who is going to make some leftwing nut speech that will impress his father, and the President. There were a couple of lines in these scenes that rather surprised me. The SecDef referred to the loser son's "sixth grade Michael Moore philosophy". Other comments poked fun at the son's political beliefs. Usually it is right-wing, conservative characters on TV that are portrayed as idiots. The reversal here is welcome, and stunning.
The SecDef is kimnapped at the end of the first hour. The very end. Meaning, we get another of the tricks 24 uses to shoehorn things into these hour-an-episode constraints placed on it. The SecDef is taken as the clock ticks to 8 am. The next hour begins with cops walking through the scene. The cops got there within a minute? Not bad. The media is also doing reports from there within minutes. Not bad.
William Devane is not bad as the SecDef. I usually have a little rule, that anything with Devane in it is not going to be all that good. Here, he has some presence, and the scenes with Audrey as they are held prisoner are strong, with the glaring exception of the drippy "say we're going to be rescued" scene.
The bad guys use Magic, that much is clear. How else could they find where Chloe's hacker friend works so fast, and how they can they listen in on his cell converastions so fast? Well, without it, we wouldn't see the baddies chase this guy to a train station. Where, Jack is heading as a newly reinstated agent to meet the hacker. Why Jack? Because he won't tell where the hacker is. Again, imagine the hubbub if someone withheld this kind of information.
So, the namby-pamby agent who has Jack's old job ends up on the ground with slugs in his chest, and Jack goes chasing off after the baddies who kimnapped the hacker? Why do they want him? Because they want to know who he told about discovering the evil, but visually very arresting, thing that is happening to the Internet. Never mind that in listening in to his calls, they know that he already told CTU.
Despite the usual silliness with 24 plots, it's a crazy thrill ride that rarely slows down, and we'll be all a-twitter waiting to see what happens next.
(now, having nothing to do with the grand tradition of Count Pointercount, here are some comments from guest critic, Paul Foth)
Protocol protocols are launched. Several sockets to follow.
The sun was coming up just after the train attack, around 7:05, so this
season's taking place in either February/March or October. I'll have to
check my WeatherGuide calendar to be sure.
People are going to be confused when they see Dennis Haysbert in those
Allstate commercials during the show. "He was the President! What's he
doing insurance commercials for?"
The New Faces
Does CTU cycle through a whole new set of recruits every couple of
years? Lessee, we've got Curtis the Model, who seems to be a bit lower
on the totem pole than Tony was. He may have Tony's old title, but just
hasn't worked his way up to the same level of experience yet. When he
does, he'll have married Sarah Michelle Gavin and be all ready to
commit treason. Sarah Michelle hasn't really distinguished herself yet–other
than as an object of Chloe's scorn, which just makes her a member of
the human race–but she does look just a bit like Clowdia from last season,
who, after being shot, was resurrected with a Brooklyn accent and is
now fighting crime with Gery Senise and Milena
Kanakanackarackanackarackaredes. Then there's Edgar Eidetic Memory
Stiles, whose lack of need for a laptop (because he "memorized
everything") will surely come into play during crisis moment six
thousand seven. I've seen that actor before, but since the web site
doesn't see fit to post a cast list (because it would spoil the fun to
stop pretending that it's just a television show?), and since I'm too
lazy to check just now, I don't know his name. I like him, though. He
seems like a regular Joe.
Then there's Erin Driscoll. Or maybe that should be Aaron Driscoll. My
bet is that before the season is out, we're going to find out she was a
man until about five years ago. (Okay, maybe not. That may be going a
bit far for this show. But watch for FOX's new reality show, "Who's
Your Daddy, Er, Mommy?") It sure didn't take long for her and Jack to get
off on the wrong foot, did it? How is it that CTU gets ~anything~ done when
its managers get along well with virtually no one?
Oh, and the new Jack, Ronnie Dead Meat Lobell. The only surprise there
was that they waited until the second hour to kill him. I guess he and
Jack had to have an argument first. I bet he was wearing red boxer
shorts. (By the way, whenever Dave Letterman gives an audience member a
box of meat, it's from Lobell's Butcher. Lobell's Dead Meat. HA!)
Andrew Paige is being played by Lukas Haas, who was the little boy in
"Witness." I'm enjoying seeing him be in essentially the same situation
several years later, except that now they've killed his mom, too. Does
this mean Harrison Ford is going to be heading CTU once Driscoll gets
promoted to DIVISION? I was sorry to see his buddy Melanie get killed.
She was a cutie and a half.
I'm also enjoying the relationship between Rumsfeld Heller and Audrey.
Audrey has some real presence to her, so it's hard to tell whether
they'll kill her by the end of the season.
The Old Face
Chloe's actually looking kinda hot. I don't know if it's because of the
way she's dressing, but it looks like she's slimmed down. She's colored
her hair a bit and is wearing a little makeup. The changes aren't huge,
but they're enough to indicate that she's probably got more of a life
outside of CTU than she had last season, and that's good. I'm also glad
to hear her acid wit is still in place. She stands up to everyone,
Driscoll included, and even though she knows the computer systems there
better than anyone else, she knows she's not perfect. She's probably
the most human character in the show.
The Story
My guess is that the kidnapping of Rummy and Audrey is a decoy, or at
least will be foiled quickly. There's the business reason that they
wouldn't have hired Devane for the part if all he was going to do is
play victim the whole time. There's also story reason for it.
Whatever's in the briefcase is what's really important. I want Robert DeNiro to
show up and say over and over, "What's in the case?" a la "Ronin."
There's also the "Pulp Fiction" precedent, where we ~never~ found out
what was in the briefcase (beyond that it glowed yellow), but I don't
expect they'll go that route. The episode guide says the case is made
of titanium, so it must fold out into a fighter jet.
Another guess is that Dina is not sympathetic to whatever Mild Mannered
Navi is up to. Again, business reason: the woman who's playing her is
too well known (she was, I think, nominated for an Oscar for her
performance in "The House of Sand and Fog") to be just a thug, or a
thug's wife. She's either an agent for the good guys, or is part of
some other faction that also wants whatever is in the case. Story reason:
the look she was giving the case wasn't "at last, our plans are coming to
fruition;" it was "I've got to figure out how to steal it."
Does Little Debbie have snack cakes in her car? Let's see, what's going
to happen there? Behrooz will call her to his house, Navi will use his
subtle charm to figure out whether she saw anything, Behrooz will get
upset and klonk his dad on the head, and Behrooz and Debbie will run
away. Thereafter we will be able to refer to them as Rick and Kim. Why
teenagers? Whyyyy?
This season reestablishes right away that this isn't a technothriller
series; it's a technomagic one:
Exhibit the first: Andrew's Power of Innocence (despite the fact that
he was stealing software–kids will be kids) drawing forth the NOK
List–er, Node List–of Evil, and giving him the insight to realize
that it was a harbinger of doom for the entire Internet. All of it.
(Incidentally, I'm thinking there might be more to this major piece of
dark magic than simply putting that video of Heller on every screen in
the world. Andrew said it was going to cripple the Net, and so far all
it's done is turn it into one honkin' big Al Jazeera affiliate.)
Exhibit the second: There is a Dark Pall of Evil hanging over CTU that
no one has recognized for years. I speak of the complete inability of
any security officer to keep the building secure. These people could
probably guard the President like he was a gold bar in Fort Knox, but
as soon as they punch in at CTU central, they become gibbering lunkheads.
Exhibit the Third: Jack's ability to get through an electronic lock by
using a code that evidently hasn't been changed in a year and half and
then making that same lock impenetrable to the nation's elite
counterterrorist agents.
Exhibit the Fourth: Jack shooting Vin Diesel in the knee and then
clouding the mind of his former boss so that she lets him go.
Exhibit the Fifth: Kalil's Briefcase of Cell Phone Detection. This is
apparently built from a variation on the incantation Stephen Saunders
used to create his SkyVision RealTime Agent Detector last season.
Exhibit the Sixth: Andrew's Power of Innocence again. From the episode
guide: "8:10: Kalil calls Navi Araz with news about the person who
compromised their server [and remember, Andrew's Wild Magic did
this without Andrew even realizing it was happening]. Navi instructs
Kalil to kill that person." And yet, at the train station, after Kalil finds
Andrew, binds him, throws him in the back seat of a car and tells him
to lay down (Kalil: the grammatically incorrect terrorist), then kills a
gate guard and Dead Meat Lobell in broad daylight, Andrew is STILL ALIVE.
Exhibit the Seventh: Polygraph tests. In the real world, they're
notoriously unreliable, rarely used, and inadmissable as evidence in
trials. Here, they're as common as dysfunctional relationships.
Exhibit the Eighth: Computers. They're omniscient. Until, that is–and
this is their True Chaotic Magic–the moment of maximum crisis, at
which point they make it worse by crashing. This hasn't happened yet this
season, but look for it to figure in Eidetic Memory Stiles's Moment of Glory.
Where the show is most successful in the portrayal of its magical world
is the way in which its characters don't recognize the magic as magic.
To them, it's nothing special, in much the same way that our own
technology-driven world would appear mysterious and eldritch to the
folks at CTU.


text:
Chris Huhne, the former Liberal Democrat Cabinet minister, has said his party and Labour could form a "historic radical coalition" after the 2015 general election.
Mr Huhne dismissed speculation that Nick Clegg would not be able to forge a partnership with Labour in a hung parliament after serving as Deputy Prime Minister under David Cameron. Ed Miliband has said it would be "difficult" to form a coalition with Mr Clegg but not entirely ruled out the prospect.
The former Energy Secretary, who was given an eight-month prison sentence for perverting the course of justice after asking his former wife to take his penalty points for speeding, said there was "common ground" between the Lib Dems and Labour on housing, more green taxes, raising the personal tax allowance beyond £10,000 and foreign policy, particularly Europe.
Writing in Juncture, the journal of the IPPR think tank, Mr Huhne said: "The assumption that Nick Clegg, having consolidated a centre-right hold on the Lib Dems, is preparing to deal with the Tories next time is wrong. He is certainly safer as leader than he looked a year ago. Vince Cable did not have a good [party] conference [in September]. But it is Nick who has been making clear overtures to the left of the party."
He added: "The DNA of the Liberal Democrats is anti-Conservative…Labour and the Lib Dems' narratives on the economy are going to be fundamentally different in the run-up to the general election, but that is not fatal. It will disguise a potential common agenda around lifting living standards and reducing inequality not just of opportunity but also outcomes, which matters to the Lib Dem left."
Many Lib Dems are keen to keep open the option of a deal with Labour. Some fear that their party would be seen as an arm of the Tories if it were to form a second coalition with Mr Cameron's party. But they accept that Mr Clegg would have to be guided by the election result-and talk first to the party which won the most seats.
Mr Huhne, who was part of the Lib Dem team which negotiated with both main parties after the 2010 election, said a coalition with Labour was on the cards next time "as long as the votes fall the right way." Revealingly, he said: "As soon as it looks as if the party can only deal with one of its potential partners, its bargaining position in any negotiation is fatally weakened."
- More about:
- Liberal Democrat Party
- Nick Clegg


text:
I know that you're down,
Your scars bleed so intensley.
You've never really fitted in,
You were always different.
But hope holds you to this world.
I'm not here with you right now,
I'm not sure when I will be.
I want you to keep strong,
Our love is true and possessive.
We'll be united soon.
How does it feel to always be alone?
Do you curse and cry at night?
You're hearts slowly decaying.
The vigorous red is starting to become rancid.
You live in fear of becoming a monster.
Your insecurities are holding down on you.
It's like you're hallucinating, life becoming ill.
You're one of the lost souls,
The people who can never find a perfect home.
You are a angel sent up from hell.
You originated from heaven,
The devil took a hold of you inside.
You became your own fear.
But don't worry darling, we'll be together soon.
Soon the lost will be the found, and the hell will become the heaven.
© Copyright 2017 danic2905. All rights reserved.
Status: Finished
Genre: Poetry
Book / Romance
Poem / Poetry
Paste the link to picture in the entry below:
Paste the link to Youtube video in the following entry:
Cannot annotate a non-flat selection. Make sure your selection starts and ends within the same node.
An annotation cannot contain another annotation.
There was an error uploading your file.


text:
Jun 13, 2012
In what is turning out to be a decent week for debt issuance, Banco do Brasil (BdB) has raised $750m in subordinated Tier 2 bonds, taking advantage of a window ahead of a possible volatility in the market. The issuer upsized from a benchmark size after getting $2bn in demand for a deal thought to be motivated by reverse inquiry. The state-controlled...
To continue reading please take a free trial, subscribe or login below.
Please enter your login details below for access.
Subscribe now for unlimited access to all current and archive news, data and market analysis.
Take a free two-week trial now for the latest news, data and market analysis.
Free Trial
April 1, 2017 | Asunción, Paraguay
The 14th annual breakfast discussion will feature the most active and important sovereign borrowers ... more
May 11, 2017 | Buenos Aires, Argentina
Argentine corporate and provincial issuers are rapidly re-capitalizing as they gear ... more
May 18, 2017 | Miami, USA
Latin American banks and companies are increasingly turning to the structured ... more
May 24, 2017 | São Paulo, Brazil
Latin America's largest economy continues to navigate a deep recession and the loss ... more
June 8, 2017 | Cartagena, Colombia
LatinFinance returns to Colombia to host the region's most important capital markets and investment forum ... more
June 29, 2017 | Tokyo, Japan
The commercial relationship between Latin America and Japan runs deep ... more
Which area will be most profitable for investment banks in LatAm in 2016?
All material is subject to strictly enforced copyright terms & conditions and cannot be repurposed or reproduced. © 2016 Latin American Financial Publications Inc.


text:
The Center for Craniofacial and Related Research at the Augusta University Dental College of Georgia, in collaboration with other units of Augusta University and the University System to do perform innovative, multidisciplinary research in the diagnosis, prevention and treatment of diseases of the orofacial complex in order to improve overall health and to reduce the burden of illness in society. Multifaceted research allows expertise from many areas to synergize promoting clinical advancement and excellence. Its membership includes faculty from the Dental College of Georgia who are involved in basic, translational and clinical research of diseases of the orofacial complex.
The research center also assists in the recruitment of talented research-oriented faculty; works in conjunction with other institutional offices to locate funding sources for research; facilitate development and integration of research programs; and provide support for all aspects of research on diseases of the orofacial complex. Dental students are encouraged to gain research experience with faculty mentors and present their findings at local, state, national, and international meetings. Students may be candidates for the M.S. or PhD degree through the graduate program of the Department of Oral Biology. The center also offers a seminar series focused on research topics related to the various areas of research.


text:
Our specialty clinic is the preeminent provider of orthopedic surgery, sports medicine, physical medicine, and podiatry in Northern Utah and Southern Idaho. As the official medical provider for intercollegiate athletes at Utah State University and area high schools, our respected practitioners perform cutting-edge procedures in state-of-the-art facilities while maintaining the caring, hometown feel.
Logan Regional Orthopedics welcomes Dr. Tye Harrison (sports medicine).
We are committed to providing the highest quality of care with kindness and compassion. Learn more about the medical services we offer.
Learn about our expert providers who offer a variety of healthcare services.
Take control of your health with these helpful patient resources, including billing and insurance information, our health library, and more.
Get Care Now
Get care for low-level urgent conditions through a video chat with a provider, 24/7, on your computer or mobile device.Learn More.
View wait times and save your place in line at an Intermountain InstaCare location near you.
If this is an emergency please go to the nearest emergency room or call 911.
Intermountain Healthcare is a Utah-based, not-for-profit system of 22 hospitals, 185 clinics, a Medical Group with some 1,400 employed physicians, a health plans division called SelectHealth, and other health services. Helping people live the healthiest lives possible, Intermountain is widely recognized as a leader in clinical quality improvement and in efficient healthcare delivery.
Still not finding what you are looking for?
Copyright ©2017, Intermountain Healthcare, All rights reserved.


text:
Invaluable cannot guarantee the accuracy of translations through Google Translate and disclaims any responsibility for inaccurate translations.
Show translation options
Lot 335: A FINE TIBETIAN BUDDHA THE TRUNK GOD OF WEALTH
Fine Asian Antiques Fall Auction Day 1
by William's Auctions, LLC
29 October 2016
Flushing, NY, USALive Auction
Past Lot
Looking for the realised and estimated price?
Description: 20th Century, High: 5.5 inch×Width:3.5 inch
Condition Report: In Good Condition
Browse more items


text:
Going into training camp, the San Diego Chargers have been using cornerback Marcus Gilchrist to fill in at strong safety while Brandon Taylor rehabs a torn ACL. According to his defensive coordinator, John Pagano, Gilchrist has been doing much better than just filling in.
On an interview with Darren Smith on the Mighty 1090, Pagano says Gilchrist's "transformation to safety has been outstanding. He's going to fit into what we're trying to do"
The team hasn't had a solid strong safety since Rodney Harrison departed for New England. The Chargers drafted LSU's Taylor in last year's draft but he ultimately tore his ACL towards the end of his rookie season in his first start in a game against the New York Jets.


text:
PaRappa the Rapper
Help Parappa rap with the best of the master rappers and straight into Sunny's heart. Guaranteed you'll be singin' and dancin' along with Parappa and his pals to the most fun of mixes.
Game News
- All the PS4 Games and Demos Releasing TodayUpdated Dec 3, 2016
- Parappa, Wipeout, Crash Bandicoot Getting PS4 UpgradesUpdated Dec 3, 2016
- New PaRappa the Rapper Game LeakedUpdated Dec 2, 2016
- Rise From Your Grave! Franchises the PS4 Should ResurrectUpdated May 27, 2013
Game List Statistics
Now Playing
4 Users
Wish List
70 Users
Hot List
5 Users


text:
MS in Health Communication
Offered in collaboration with Boston University College of Communication
The online Master of Science (MS) in Health Communication program teaches students to understand the complexities of important health care issues and communicate them in a way both the media and the public can understand.
The multidisciplinary curriculum focuses on how to implement effective communication campaigns, tackle tough health care issues, and provide valuable information to the media, the public, and other critical stakeholders. Students in the program gain leadership skills in the emerging fields of health care marketing, public relations, health literacy, crisis management, and social marketing.
Geared toward professionals with a background in health care or public relations, the online Master of Science in Health Communication can be completed in as few as 18 months of part-time study. The interactive, online format includes lectures and debates, videos, interactive animation, discussion boards, and more.
All candidates for admission to the online Master of Science in Health Communication degree program must hold a bachelor's degree from a regionally accredited institution and are selected on the basis of undergraduate transcripts, academic and professional references, two personal statements, and work experience. Standardized admission tests such as the GRE are not required; English-language proficiency is. Applicants who attended a college where English is not the language of instruction must submit scores from the Test of English as a Foreign Language (TOEFL) and a video. Applications are accepted on a rolling admissions basis; courses start six times a year.
Academic Standing
Students in the MS in Health Communication program must maintain a grade point average of at least 3.0 to remain in good standing and to graduate. No grade below B– in any course may be applied toward the degree. Students with grade point averages below 3.0 will be on academic probation and must be in a position to achieve a 3.0 within the 40 required credit hours for graduation or be subject to dismissal.
Degree Requirements
The MS in Health Communication consists of 10 courses for a total of 40 credits:
- MET HC 750 The American Health Care System for Health Communicators
- MET HC 751 Introduction to Epidemiology for Health Communicators
- MET HC 752 The Biology of Disease
- MET HC 755 Contemporary Health Care Marketing
- MET HC 756 Contemporary Public Relations
- MET HC 757 Interactive Marketing Communications
- MET HC 758 Media Relations
- MET HC 759 Health Communication
- MET HC 760 Research Methods for Health Communicators
- MET HC 761 Advanced Writing for Health Communicators


text:
The Dimond Branch Library will temporarily close for remodeling from Friday, December 23 to May 2017. For more information see the announcement.
All Knit
Join our friendly volunteer facilitators to learn how to knit or improve your skills. For adults and children age 8 and up. Beginners through experts are welcome!


text:
Please Read Before You Continue: This forum is intended for discussion of LEGAL Party Pills only and for audience of legal age (18 or older) only.
If you are not interested in discussion of party pills, or if you are not of legal age, or if legal party pills are not allowed in your area, please leave now.
|Party Pills Forum » Member Profile
|Registration Date
|13 Dec 2015 05:12
|0 (0.00 per day)
|Find Topics
|Find all topics in which ThedaE82260612 has posted
|User Information
|He is called by the domain name of Avery. The job I've been occupying popular is an information processing officer and it's something I love. Her husband doesn't that will match it the way she does but what she really loves doing is ice skating and now she is intending to cash with the site. My husband and I decided to reside in New Jersey and Good every day living listed below. Go to my how does a person find out more: http://gulf-resale.com/index.php?page=user&action=pub_profile ...
Also visit my website - Ultimate Diet System


text:
Newegg.com - A great place to buy computers, computer parts, electronics, software, accessories, and DVDs online. With great prices, fast shipping, and top-rated customer service - once you know, you Newegg.
If you are reading this message, Please click this link to reload this page.(Do not use your browser's "Refresh" button). Please email us if you're running the latest version of your browser and you still see this message.
Newegg.com - Computer Parts, Laptops, Electronics, HDTVs, Digital Cameras and More!
Showing Results: Most Recent
This review is from: APEVIA WARLOCK POWER ATX-WA1100W 1100W ATX12V / EPS12V SLI Ready CrossFire Ready Active PFC Power Supply
Pros: Love the color
Cons: NoneREAD FULL REVIEW
This review is from: ENERMAX T.B. Vegas Trio UCTVT12P 120mm Blue/Red/Green LED Case Fan with Changeable Modes PWM Function
Pros: Love the colors and works great.
Cons: WOuld be nice if it had better top RPM.READ FULL REVIEW


text:
Its great to come onto a website with so much diversity that it can only broaden your horizons.For more of my stuff, if you're remotely interested: http://crannmor.zenfolio.com/
WunderPhotos Upload
Dead Tree
Uploaded by: DancinPants
Tuesday April 20, 2010
Ramona, CA (Current Weather Conditions)
Caption: Return of the clouds and the promise of rain ain't gonna help this big tree...and I'm glad coz I kinda like it as is. HDR
Model: Canon EOS DIGITAL REBEL XTi
Software: Picasa 3.0
Compression: JPEG compression
x-Resolution: 72.00
y-Resolution: 72.00
Resolution Unit: Inch
Exposure Time: 1/60 sec.
FNumber: f/5.6
ISO Speed Ratings: 100
Focal Length: 18.0 mm
Image Unique ID: b1e280f3360012d4375cc900695b61f5
Viewer Comments
You must be signed in to leave comments.
Members can leave comments, upload and share photos in our Wunder Photos section and participate on the WunderBlogs.
About DancinPants
Recent Comments for DancinPants
(59 days ago)view 17 comments »
(1641 days ago)view 3 comments »
(1680 days ago)view 14 comments »
(1687 days ago)view 8 comments »
(1691 days ago)view 23 comments »
(1762 days ago)view 31 comments »
(1767 days ago)view 7 comments »
(1822 days ago)view 19 comments »
(1832 days ago)view 2 comments »
(1855 days ago)view 9 comments »


text:
Torphins Golf Club is situated in Royal Deeside, offering some of the best views you could ever wish for when playing golf. The course is just 22 miles or so west from the City of Aberdeen.
Our 9 hole course is a short par 64 but requires accuracy and placement as opposed to long hitting. To increase the enjoyment, there are now 13 different tees playing to 10 different greens. You have to play it for yourself to make the most of the course and the panoramic views over the beautiful Deeside valley.
Reciprocal arrangement with Tarland and Lumphanan Golf Clubs - 50% discount on Green Fees
*** Fantastic Deal ***
Reduced Membership Fees
From today until the end of March 2017
Adult £90.00
Reduced Junior Rates
Pick up an application form today
Telephone our Treasurer
Graham Young
07950 362 908


text:
More Videos...
Alpine Armoring Featured in National Geographic Armored Science - Autos, Carros, SUVs Blindados
Showcasing Alpine Armoring custom armored vehicle process and protection. For more information on Alpine Armoring vehicles visit: http://www.alpineco.com/our-vehicles/
Ultra Armoring B6 Armored Suburban Testing
Live field testing of prototype Suburban, 421 shots fired, Live Well Protected.
Armoured Project Vehicle Testing
This video shows the rigorous testing that APV Ltd's 4 wheel drive armoured vehicles have undergone to achieve certification. The film was produced for APV Ltd in 2006 by Trojan Films. Please find further APV information at www.apv-gib.com
Texas Armoring Featured on National Geographic/Discovery Channel's "What's That About? 3"
What's That About? - "Spy and Security Operations" SWAT teams, top bodyguards and specialized soldiers get extreme training and some pretty cool gadgets to fulfill their dangerous duties. How do they protect diplomats under live fire and even survive roadside bombs? With bulletproof cars and advanced body armor. Watch the complete segment on Texas Armoring Corporation. Learn more at http://www.texasarmoring.com or http://www.facebook.com/texasarmoring


text:
Tag Archives: cutthroat trout
Colorado Fishing Vacations for the Fishing Enthusiasts
Ahhh…what's better than a relaxing day spent by the lake? The sun is shining and the smell of nature envelops you, and you are laid back soaking up the summer sun. This seems like one of the best fishing vacations—and … Continue reading


text:
- Hi there, welcome to Tribesmart. Log in to get started...
Le Creuset Grand Teapot, Volcanic
Guide price: £32
Last updated on 16th Sep 2014
Le Creuset Grand Teapot, Volcanic
Tea time has never been more inviting than with our beautiful Grand Teapot. It brews the perfect cups of morning or afternoon tea, keeps it hot and commands a bold presence on your table. It comes with an anti-drip spout, so spillage will be a thing of the past and the large easy-to-use handle makes pouring effortless even when the pot is full. The tall design is suitable for serving either tea or coffee.
And since no afternoon tea is complete without scones or cream cakes, go on and spoil yourself. A wonderful gift to give or receive. It is fully enamelled and easy-to-clean, with a scratch resistant surface keeping it hygienic and free from absorbing odours and flavours. It is microwave, oven, freezer and dishwasher safe and made of hard wearing stoneware to resist staining, chipping and cracking.
5 Year Guarantee.
Login or Register to add this to your wish list or favourites.
Similar to Le Creuset Grand Teapot, Volcanic
Personalized 9 oz. Rocks Glass – Mr. & Mrs. —
Excellent as table decor or as a parting gift of appreciation, this Mr. & Mrs. rocks glass is an elegant addition to any wedding. Rocking a curly-cue script in a black print, this classic glassware by Kate Aspen can be personalized with names and wedding date—making them custom to you in more ways than one. Features and facts:


text:
Is Paper Communication Technology incorrect or missing key business information? Update your Hotfrog listing today.
Contact details
Are these details correct?
Hotfrog Singapore provides information regarding Paper Communication Technology in Singapore. Paper Communication Technology is located at Sennett Estate, 17 Tai Thong Cr, Singapore 347851 and provides Wholesale services. Contact them on 6282 2088.
Is Paper Communication Technology in Sennett Estate, 17 Tai Thong Cr, Singapore 347851 your business? Claim your listing and attract more leads by adding more content, photos and other business details.
We have more Wholesale services in Singapore available on Hotfrog Singapore. You can update your search for Singapore Wholesale by location, keyword or service options.
Small Business Hub
Sharing tips, ideas and advice to help grow your small business.
Create your free Hotfrog business profile
Follow Hotfrog on:
Share on:
Hotfrog Small Business Hub


text:
9293 Olde Eight Road, Northfield, Ohio 44067
Alla Instruments are packed in plastic tubes with instructions.
|Waterproof Pocket Digital Thermometer
-58 + 392° F Resolution: 0.1° Accuracy: +/- 2°F (-4+302°F) Max/Min Function Stainless steel piercing probe.
This page does not yet have any published feedback.
Complete Home Wine Making Kits and Supplies for the Beginner and Advanced Wine Maker


text:
When your sales team is out hustling for new business, help them to make a great first impression with a sleek, personalized business card holder embossed with your company logo. Your company will be reaching clients and customers where others don't - right in the palms of their hands! Trump the competition with business card holders perfect for networking events, corporate lunches, and project meetings. Whether you need a few to hand out to prospective clients or dozens to divvy up among your employees, ePromos has the products you need create a tastefully designed product.
Promo business card holder made of 100% recycled leather and holds up to 72 cards.
Leather logo business card holder with magentic closure and laser engraveable aluminum plate
Multi-use leather logo wallet and promotional business card holder has wide 3/4" gusset, 4 pockets and ID window with thumb-slide hole for easy retrieval.
This trendy custom imprinted business card holder is a classy way to showcase a logo. Comes in a variety of colors.
Textured black and silver finish promotional business card holders with magnetic flap closure.


text:
The Budget was yet another blow to women. Lone parents and single female pensioners, already among the poorest citizens in Britain today, will suffer most from the Chancellor's harsh cuts to public spending. By 2014/5 the average household will lose public services worth 6.85 per cent of their cash income; for single female pensioners that figure is 11.7 per cent; for lone parents it is a whopping 18.5 per cent. This Budget did nothing to put that right. Even its small concessions to income-tax payers and motorists will help women less than men, since fewer women pay income tax or own cars.
While it sounds positive to reduce the regulations that small businesses are subject to, these include maternity and paternity rights. With lone parents now expected to seek work when their youngest child is five, 400,000 more will be looking for work this year. Such regulations enable workers to combine employment with caring responsibilities.
The Government's failure to produce a gender-impact assessment of its emergency budget landed it in court. But on this Budget there was no overall assessment of its effects on men and women at all, just a few comments on the equality impact of particular measures.
This Government's policies have been a disaster for women and nothing they are doing in this budget will put that right.
Susan Himmelweit
Women's Budget Group
Milton Keynes, Buckinghamshire
It would be touching to read that the Chancellor, George Osborne, is promising "to train a new generation of highly skilled workers", were it not so profoundly cynical ("Osborne pledges £200m to train unemployed young", 20 March).
The only way apprenticeships work is for young people to move in to real jobs in which their acquisition of skill is rewarded in secure wages. That means having employers sufficiently confident in future growth to be willing to take on apprentices. But Osborne's own Budget saw very little scope for growth in the period in which today's teenagers seek work. Where, for example, are the new jobs to be found in construction with the slashing of infrastructural investment?
Celia Trevelyan
Ely, Cambridgeshire
That blood-soaked US arms giant Lockheed Martin – manufacturer of cluster bombs and Trident nuclear missiles – has received a £150m contract to process the forms from today's census has angered many people. Lockheed says, "[U]nrecognised responses are sent to highly trained operators to code... a difficult and expensive process." Writing upside down foxes that scanning software.
Maya Evans
St Leonards on Sea, East Sussex
Another government, another war. How, in these times of massive debt, can we finance yet another opportunistic adventure, albeit supported by the American cowboys? The cost of the two jets flying from Norfolk on day one must, at a very conservative estimate, have cost £2m, yet schools and libraries must close, services be cut, roads left unrepaired, street lights switched off, etc. The Government may well feel morally superior in attacking Gaddafi, yet the campaign has already gone from creating a no-fly zone to attacking ground forces. The Government appears to have learnt very little from Iraq or Afghanistan or from Britain's aggressive imperialistic history.
Barry Clarke
Shepton Mallet, Somerset
America regards itself as classless ("All middle class now in this unequal land?", 20 March) Isn't the central point of Frasier the class conflict between blue-collar cop dad and effete middle-class sons? Middle-class viewers are amused by the sons' mild excesses and sympathise with them. Blue-collar viewers share the dad's scorn.
posted online
Surely the middle class are just those of working-class origins who have escaped manual work?
posted online
A welder down south will say he is middle class. A welder up north will say he is working class. The British are great at self-delusion.
posted online
Anyone who owns their home is middle class. To be working class you have to be a tenant, in a hostel or homeless. Anyone who went to private school or sends their children to private school is upper class. Simples!
posted online
If you have a garden you are middle class. I don't have a garden.
Dick Socrates
posted online
There are only two classes: the idle rich and the poor. Now, where did I put my lottery ticket?
posted online
Have your say
Letters to the Editor, Independent on Sunday, 2 Derry Street, London W8 5HF; email: firstname.lastname@example.com (with address; no attachments, please); fax: 020 7005 2627; online: independent.co.uk/dayinapage/2011/March/27
- More about:
- George Osborne
- Income Tax
- Internet
- Private Schools


text:
Dangerous Grounds: War Gin Pictures
Go behind the scenes as Todd Carmichael travels to Uganda in search of a high-end coffee bean for potential clients Dean & DeLuca to support a charity close to Todd's heart.
Todd Carmichael in UgandaTodd Carmichael has tried many times to get coffee out of Uganda, but he has never been successful. A violent and bloody past has left the people paranoid and distrustful of outsiders, frequently ripping them off or even outright robbing them. 960 1280
You Might Also Like
Todd Carmichael in the SerengetiTodd Carmichael and Hollywood drive their jeep through the Serengeti while an elephant and her kin keep a cautious eye out. 960 1280
Todd Carmichael at Four Seasons PhiladelphiaTodd talks coffee with Four Seasons Philadelphia's new food and beverage director. But before renewing Todd's contract, the youthful new manager asks Todd to find a mythical bean only bloggers and dreamers talk about. 960 1280
A view of the SerengetiA view of the Serengeti from the plane. Extending from northern Tanzania into Kenya, the Serengeti is known for its large lion population. 960 1280
Guns and Lions Pictures 12 Photos
Haiti Pictures 12 Photos
Madagascar Pictures 14 Photos


text:
It looks like you're new here. If you want to get involved, click one of these buttons!
I apologize if there already is a thread for this:
On Oculus' website, they announce that they will co-publish Eve: Valkyrie, a game designed by Oculus supporters within CCP that is "exclusively for the Rift".
Congrats, CCP; color me interested.
"To be what you are not, experience what you are not." -Saint John of the Cross
Authored 131 missions in Vendetta Online
Check it out on Steam
Youtube newb:


text:
MEGAstream Media Services
Latest Work
Latest News
Your Business Video – Get Creative!
By now I hope you are using video to promote your business. Posting your business video on your website is crucial for SEO marketing and website visitor retention. Not to mention that video helps customers virtually "kick the tires" on your products and services. Videos…
Posted in Marketing, Video, Website Tagged Business Video, Creative, Messaging, Video, video marketing Comments Off on Your Business Video – Get Creative!


text:
Want to renew your focus on Jesus during Lent? Sign up for our free Lent & Easter devotions.
92:1 Most High. This title is similar to one commonly given to Baal in Canaanite religious texts. Applying it to the God of Israel is a kind of taunt directed toward anyone tempted to worship Baal (83:18).
Starting your free trial of Bible Gateway Plus is easy. You're already logged in with your Bible Gateway account. The next step is to enter your payment information. Your credit card won't be charged until the trial period is over. You can cancel anytime during the trial period.
Click the button below to continue.
You've already claimed your free trial of Bible Gateway Plus. To subscribe at our regular subscription rate of $3.99/month, click the button below.
It looks like you're already subscribed to Bible Gateway Plus! To manage your subscription, visit your Bible Gateway account settings.
Try Bible Gateway Plus, a brand-new service that lets you experience Bible Gateway free of banner ads! It also gives you instant access to over 40 Bible study and inspirational devotional books, including the NIV Study Bible. With Bible Gateway Plus, you can experience and understand God's Word in life-changing new ways, without the distraction of ads. Try it free for 30 days—you can cancel at any time. Following your 30-day free trial, Bible Gateway Plus is only $3.99/month.
Three easy steps to start your free trial subscription to Bible Gateway Plus.


text:
This is what we like to see on "Glee" — more Noah "Puck" Puckerman.
On the Tuesday, May 11 episode of "Glee," we see that Puck (Mark Salling) has lost his mojo, which is kind of disheartening to witness. We like him ridiculously cocky and yes, even a jerk.
Well, don't worry. By the end of this clip, we see that old Puck back, and boy, we can't wait to see what comes next.
In the second clip, Rachel (Lea Michele) has also lost something when she decides to perform Miley Cyrus' "The Climb." Yeah, we thought it was an odd choice too, but once you figure out the context, it's pretty darn funny.
Did we mention this episode is called "Laryngitits"?
Follow Zap2it and Zap2itHanh on Twitter and Zap2it on Facebook for the latest movies, TV and celeb news.
'Glee' first look: Neil Patrick Harris faces off with Matthew Morrison
'Glee' Tour update: LXD will join New Directions on the road
'Glee': Matthew Morrison is anti-Britney Spears


text:
Fantastic Four
Text by Alan Davis
Format: Hardback
Normal Price: $42.99
Your Price: $38.69 AUD, inc. GST
Shipping: $7.95 per order
You Save: $4.30! (10% off normal price)
Plus...earn $1.93 in Boomerang Bucks
Availability: Available to Backorder, No Due Date for Supply
Fantastic Four by Alan Davis
Book DescriptionAlan Davis writes and pencils the final story of Marvel's first family! Even the strongest family can be torn apart by tragedy - and in the futuristic world of tomorrow, the members of the once-Fantastic Four are divided and vulnerable to opponents from their past. What events could have caused the FF to go their separate ways, and how does their disbanding set the stage for a conflict that will send shockwaves across the galaxy and beyond? This title collects "Fantastic Four: The End" numbered 1-6.
Buy Fantastic Four book by Alan Davis from Australia's Online Bookstore, Boomerang Books.
Book DetailsISBN: 9780785127741
(259mm x 168mm x 13mm)
Pages: 144
Imprint: Marvel Comics
Publisher: Marvel Comics
Publish Date: 13-Jun-2007
Country of Publication: United States
Other Editions...
Books By Author Alan Davis
Totally Awesome Hulk Vol. 2: Civil War II, Paperback (January 2017)View all books by Alan Davis
BRUCE BANNER'S fate during the 8-month gap post-SECRET WARS is revealed! Was he really cured by AMADEUS CHO? Did he survive? Has Amadeus made a disastrous miscalculation? COLLECTING: THE TOTALLY AWESOME HULK 7-12
» Have you read this book? We'd like to know what you think about it - write a review about Fantastic Four book by Alan Davis and you'll earn 50c in Boomerang Bucks loyalty dollars (you must be a member - it's free to sign up!)
Facebook Page | Twitter | Google+ | Bulletin e-Newsletter | Blog | RSS
Become a Member | Book Lists | Recently Released | Coming Soon | Fast Delivery Books
Bestselling Books: Our Current Bestsellers | Australia's Hottest 1000 Books | Bestselling Fiction | Bestselling Crime Mysteries and Thrillers | Bestselling Non Fiction Books | Bestselling Sport Books | Bestselling Gardening and Handicrafts Books | Bestselling Biographies | Bestselling Food and Drink | Bestselling History | Bestselling Travel Books | Bestselling School Textbooks & Study Guides | Bestselling Children's General Non-Fiction | Bestselling Young Adult Fiction | Bestselling Children's Fiction | Bestselling Picture Books | Top 100 US Bestsellers
For: Schools | Organisations | Libraries | Publishers | Authors | Book Clubs | Bloggers | Affiliates
About Us | Contact Us | Help Desk | Security | Privacy | Terms of Use | Copyright
Phone: 1300 36 33 32 (9am-5pm Mon-Fri AEST) - International: +61 2 9960 7998 - Online Form
Address: Boomerang Books, 878 Military Road, Mosman Junction, NSW, 2088
© 2003-2017. All Rights Reserved. Eclipse Commerce Pty Ltd - ACN: 122 110 687 - ABN: 49 122 110 687
For every $20 you spend on books, you will receive $1 in Boomerang Bucks loyalty dollars. You can use your Boomerang Bucks as a credit towards a future purchase from Boomerang Books. Note that you must be a Member (free to sign up) and that conditions do apply.


text:
Leaves fall on to the soiled ground
Autumn breeze fills the towns
Tress colors, of red to yellow
Sky filled with a cheery glow
Where old leaves fall and new ones grow
Where people shatter and then re-grow
Where relationships end and new ones start
Autumn is the place to form a new beginning
For the broken loved and odd ones out.
© Copyright 2017 ShadowAngelxXx. All rights reserved.
Status: Finished
Genre: Poetry
aww that was really good :)
loved it sooo much, keep it up
Book / Romance
Book / Fantasy
Book / Fantasy
Paste the link to picture in the entry below:
Paste the link to Youtube video in the following entry:
Cannot annotate a non-flat selection. Make sure your selection starts and ends within the same node.
An annotation cannot contain another annotation.
There was an error uploading your file.


text:
Celebs' Enviable Car Collections
trending now
10 Ridiculously Weird Things You Can Buy Online
Ad: BabyAxis
7 bollywood celebrities with royal background
Ad: CRITICSUNION
Help Mill-Worker save his son from Cancer!
Ad: Milaap
10 highest tax paying actors in Bollywood
Ad: CRITICSUNION
Help father save his premature twin babies!
Ad: Milaap
Top 10 most searched Bollywood actresses on the internet
Ad: CRITICSUNION


text:
If saving 20% is wrong, we don't want to be right. Use CHOP20
Aside from Katamari there's about 10 more references crammed in there. Some might be too subtle to make out, though.
katamari gaming video games zelda mario tetirs snail atlas mythology pop culture wolrd globe metroid againstbound
Loading more work by Hector Mansilla...
10% off
for joining the Redbubble mailing list
Receive exclusive deals and awesome artist news and content right to your inbox.
Free for your convenience.


text:
Fifteen years ago, an educationalist called Sugata Mitra placed a computer in a hole in the wall of a slum that bordered his office in Delhi. Within months, children who didn't know what a computer was, what the internet was and who could not speak English had become as computer literate as an average office secretary in the West.
To be sure that they had not been instructed by an "educated" passer-by, Mitra repeated the experiment again, this time in a remote village 300 miles outside Delhi. In the decade that followed, he repeated the experiment time and again, in


text:
Find new products and services to help you grow. Register now and you could win an Air North trip for 2 to Yukon!
Welcome! Restaurants Canada (formerly CRFA) is a growing community with a passion for hospitality. Together we're building a strong, vibrant restaurant and foodservice industry that directly employs more than one million Canadians.
Our latest survey shows labour beats out food costs as the top concern for operators. Find out what's happening in your province.
The annual and special meeting of members of Restaurants Canada takes place on Feb. 26 at 12.30 p.m. at the Enercare Centre in Toronto.
Don't get tripped up by the tax man. Use our tips to protect your business and remain compliant come tax time. (Login required.)


text:
Created attachment 519860 [details]
Bad certs (text dumps) zipped
According to mail from Comodo to the security alias "A long-term trusted partner of Comodo which has an RA function suffered an internal security breach and the attacker caused 7 certificates to be issued." The bogus certs were revoked within hours.
Unfortunately there are scenarios where the MITM can prevent the victim from contacting the OSCP responder and the certs will continue to be trusted. Given the high profile of the sites involved (including our own addons.mozilla.org) we should explicitly disable these certs if we can.
The CNs involved are
global trustee
Can they be added as untrusted to the built-in certificate store, or does that only work for signing certificates? Can we ship a CRL containing these certs?
Created attachment 519863 [details]
Bad certs (.cer) zipped
Revocation is in this CRL:
Here is the relevant section of the CRL:
openssl crl -text -inform DER -in UTN-USERFirst-Hardware.crl
Serial Number: 047ECBE9FCA55F7BD09EAE36E10CAE1E (mail.google.com)
Revocation Date: Mar 15 19:04:03 2011 GMT
Serial Number: F5C86AF36162F13A64F54F6DC9587C06 (www.google.com)
Revocation Date: Mar 15 19:04:24 2011 GMT
Serial Number: E9028B9578E415DC1A710A2B88154447 (login.skype.com)
Revocation Date: Mar 15 19:05:26 2011 GMT
Serial Number: 9239D5348F40D1695A745470E1F23F43 (addons.mozilla.org)
Revocation Date: Mar 15 20:15:20 2011 GMT
Serial Number: D7558FDAF5F1105BB213282B707729A3 (login.yahoo.com)
Revocation Date: Mar 15 20:15:26 2011 GMT
Serial Number: 392A434F0E07DF1F8AA305DE34E0C229
Revocation Date: Mar 15 20:15:38 2011 GMT
Serial Number: 3E75CED46B693021218830AE86A82A71
Revocation Date: Mar 15 20:15:47 2011 GMT
Serial Number: B0B7133ED096F9B56FAE91C874BD3AC0 (login.live.com)
Revocation Date: Mar 15 20:16:03 2011 GMT
Serial Number: D8F35F4EB7872B2DAB0692E315382FB0 (global trustee)
Revocation Date: Mar 15 20:19:04 2011 GMT
This OCSP responder, which is embedded in the certs, should also return "revoked":
The idea to explicitly add the bad certs to the roots module is a good idea, but I don't know how to make this work. I don't see a way to make a cert as "explicitly not trusted". All I know of is "no explicit trust", but this is not sufficient, as the cert will still be trusted, if it can be chained to a trusted root.
The idea to use a CRL is problematic, because:
- I don't know an easy way to preship a CRL with binary NSS, because NSS reads CRLs from the database
- the approach might require that the applications ships the CRL and imports it at runtime. I think this approach is more work than the following one.
I'd like to propose the following approach (which, in a discussion with Gerv and Dan, we're currently favoring):
- block the certs at the application level
(PSM = all mozilla apps = all SSL sockets)
- embed the certs into PSM
- extend PSM's existing code for SSL_AuthCertificateHook
- compare the server cert with our embedded blacklist
- in order to embed the blacklist, use
"issuer name" and "serial number" as the primary key to
decide about rejection
Implementation details:
I already have a tool that dumps this ID information for a given cert.
(I'm using this tool to extract the information that we need to grant the EV status to a root).
At runtime, when we arrive at the function, we have available:
- the full binary blob of the cert
- the ascii (utf8?) presentation of the issuer name
- the binary encoding of the serial number
I think it's tricky to store binary encoding into sourcecode.
It's better to use base64 encoding.
This has a minimal performance disadvante, we must convert the site's serial number from binary to base64. (But really, this little cpu overhead shouldn't be worrisome, there are many more expensive operations involved in processing certificates than this, anyway)
In theory, in order to be 100% sure we're checking the correct certificates, we ought to compare the binary encoding of the issuer name.
However, in this particular scenario, we are able to simplify, IMHO. The certificates to be blocked all use an issuer name that consists of pure ASCII characters. I propose we save CPU cycles, and do a standard string comparison for the issuer name.
When we find a match, we'll set error code SEC_ERROR_REVOKED_CERTIFICATE and abort the verification.
The user will see the existing error page "site of cert is revoked".
The user will NOT be able to override.
Created attachment 519872 [details] [diff] [review]
example patch
Demonstration patch.
This patch blocks the certificate currently being used at https://kuix.de
With this patch applied, I can't connect to the server anymore.
I will soon attach a patch that blocks all 7 problematic certs from Comodo.
I have received a test certificate from comodo for the host kuix.de
I have installed the test certificate on a SECONDARY port at my server,
Gerv has suggested, we could avoid the runtime conversion from binary-to-base64, by encoding the binary encoding of the serial numbers using hexadecimal characters \x00. Thanks to Gerv for that good idea.
I've enhanced the patch in bug 421989, and I now have a tool that prints such information, that can be easily copied to C source code.
Created attachment 519892 [details]
text dump of certificate identies
This text file contains a dump of the identifying information of 8 certs:
- the 7 affected certs
- the test certificate from the same issuer
This information could be used for review purposes.
Created attachment 519897 [details] [diff] [review]
Proposed patch (my v3)
Test instructions:
Go to a site that uses a cert from the blacklist:
ERROR, revoked
Go to a site that uses a good cert:
Site should display fine
Go to a site that was issued from a different CA:
Site should display fine
FYI, (a) and (b) use certs that were issued from the same root CA.
If (a) fails and (b) works, this proves that we correctly distinguish between separate serial numbers of the same issuer.
If (c) works, this proves that our blacklist doesn't hurt other CAs.
I would like to note, I'm confident in the encoding of this patch, because I didn't do it manually.
The sourcecode of that static list was automatically produced from the DER encoded certificates, and the code it produced for the test certificate at https://kuix.de:9449/ correctly caused it to be blocked. I think it's reasonable to conclude the code works for all certs correctly (after code review).
I've tested the patch with 4.0 (2.0), 3.6 (1.9.2) and 3.5 (1.9.1), and it worked in all versions.
1.9.1 branch requires a slightly merged patch, but only because a neighbourhood function is different.
Gerv noted that my code dumps some certificates with a leading zero, and produces thereby 17 bytes long serial numbers.
I believe this is correct, I think the binary encoding of those serial numbers is indeed 17 bytes.
When dumping such certs with NSS pp tool, it prints a leading 00:
I imported such a cert, using Firefox and cert manager, to a server tab, and then clicked "view", and it displays a 17 bytes serial number with leading 00:
And the reason why I wrote comment 11, because Gerv noticed that the text dumps we have received, all serial numbers were 16 bytes long.
I believe those text dumps were produced using openssl. It appears that openssl strips initial 00: in the human readable dump.
> The idea to use a CRL is problematic, because:
> - I don't know an easy way to preship a CRL with binary NSS, because NSS reads
CRLs from the database
NSS reads CRLs from tokens. adding a CRL to the builtins should work.
> - the approach might require that the applications ships the CRL and imports it
> - block the certs at the application level
> (PSM = all mozilla apps = all SSL sockets)
> - embed the certs into PSM
do you think this is the last time we are going to have this problem? It seems
to me if we can't block the certs in builtins, we should modify NSS so that we
Bob: should we ask Comodo to produce for us a special CRL with the seven certs in it? Their current CRL is 113k, even compressed.
Created attachment 519939 [details] [diff] [review]
Patch v4
On the NSS call, we decided speed was more important than pretty. That we'd keep this bug open for the 'pretty' fix, but the fastest way to solve this is kai's patch.
NOTE: kai's patch only turns off SSL. Since these certs are only valid for SSL, that should be sufficient for these certs.
Comment on attachment 519939 [details] [diff] [review]
Patch v4
r+ rrelyea
Adding Rob @ Comodo to CC list.
Comment on attachment 519939 [details] [diff] [review]
Patch v4
I want to chemspill this
Robin Alden at Comodo (now CCed) tells me:
- Microsoft are aware of the problem.
- Opera are looking at options; they may add the roots to their "untrusted" store. Or, because they always check revocation status, they may rely on OCSP.
- Chrome are writing a patch; there is a stable version due to ship next week, and they could add the patch to that, but they may do an even earlier release for this problem.
Comodo are also discussing the matter with law enforcement.
Can I get a summary of the risk inherent in this code, please, and what QA would need to be revalidated if we took it in an RC2?
this code path is executed each time we do a handshake with any SSL server.
However, the test starts with a simple string comparison.
If the issuer name is not matching, then all remaining code is skipped.
This alone eliminates the risk for all CAs that are not connected to this issue.
If the issuer name matches, we will compare certificate serial numbers, of the server cert, against our blacklist.
The rest of the code is skipping initial zeros, and looping through our blacklist, then a final memory comparison.
This isn't risky code, no memory allocation etc., but simple iteration, looping and comparison, and code review shows we carefully deal with boundaries. I don't see risks for side effects.
I made it easy for testing.
We received a test certificate, that I installed on a server, and that we will keep around for testing the QA candidate, and longer.
The test instructions are described in comment 8.
In my opinion, the only work that needs to be repeated, if you want to: Test that you can still connect to a variety of https/SSL sites.
If you still can connect, and are not being blocked, all is fine.
(In reply to comment #22)
> I made it easy for testing.
> We received a test certificate, that I installed on a server, and that we will
> keep around for testing the QA candidate, and longer.
That is to say: we asked Comodo to issue us another certificate from the same root the bogus ones were issued from, but for a domain Kai controls. We then added that cert's serial number to the blacklist (which is why it's 8 certificates long rather than 7). This means we don't need to set up a server using one of the compromised certs (which is impossible, as we don't have the private keys) in order to test the blocking. Instead, we can use https://kuix.de:9449/ , which is using the cert Kai obtained and we have now blacklisted.
Comment on attachment 519939 [details] [diff] [review]
Patch v4
FWIW, the patch looks good to me.
Filed bug 642503 on moving a more generic version of this blacklist functionality into NSS proper for a future version.
Hello, RC2.
I'm not familiar with this area, and don't understand the leading zeroes thing (or why the leading zeros are kept in the literal table only to be stripped out with an extra loop). But it looks okay, and low risk.
the tests from comment 8 all work fine in Fennec with this patch
(In reply to comment #27)
> I'm not familiar with this area, and don't understand the leading zeroes thing
> (or why the leading zeros are kept in the literal table only to be stripped out
> with an extra loop). But it looks okay, and low risk.
Sorry, the code in the static list was automatically created using a tool. I wanted to avoid the risk of manually tweaking it, because manual tweaking has the risk of human error. Also, if I tweaked it now, I might forget about that later, if there's ever a need to recreate or extend the list.
This filtering was a late addition, suggested during code review, to make sure we always make a correct match, regardless of leading zeros.
we are going to wait for bsmith's review
The tool I'm refering to is NSS "pp" tool, plus the patch attached to bug 421989.
It produced attachment 519892 [details] (which contains the leading zeros).
Comment on attachment 519939 [details] [diff] [review]
Patch v4
This seems reasonable to me, provided the leading 0s can be ignored (that is, that there are never serial numbers that are the same except one has more leading zeros than the other).
Is that the case?
I'm also not quite sure why the auto-generated serial numbers have leading zeros for 6 of the certs, but not the other two...
Bob would be able to explain the issue with the leading zeros better, I'll try to repeat what he said.
It depends on whether using a signed vs. an unsigned variable to the decoding of the serial number. The serial number is DER encoded. The raw encoding sometimes takes up 17 bytes, when having a 16 bytes serial number with the highest bit set.
(Don't ask me why that is, it appears to be an implementation detail/behaviour of the encoders/decoders used.)
We see a leading zero for all serial numbers that start with hex 8 or higher. No leading zero for 7 or lower.
While discussing/reviewing the patch, Bob suggested, stripping the initial zeros will always make it work.
Since Bob is the expert with properties of certificates and serial numbers, I also conclude he is sure that stripping leading zeros is fine. The answer to comment 32 is yes. Serial numbers are really numbers, not byte arrays.
Another supporting point, when the "openssl x509" tool dumps one of those certificates, and prints the serial numbers in human readable form, it strips away leading zeros, too.
The main concern now is with the logic in nsNSSBadCertHandler, namely the hitting of the following assertion:
NS_NOTREACHED("why did NSS call our bad cert handler if all looks good? Let's cancel the connection");
and the fact that nsHandleSSLError and cancel_and_failure() are not called before returning SECFailure. Kai and I are discussing it on IRC.
I believe comment 36 isn't a new scenario.
I guess when we hit a revoked cert in the wild, we'll probably get exactly the same code path as now.
The bad-cert-handler is designed to ignore any other errors that it doesn't deal with explicitly - including the "revoked" scenario. Obviously that failure reason was "forgotton" when writing the bad cert handler.
I don't see a strong reason to fix this now. But it's a very good opportunity to fix it. The only thing that should be done in addition, is ignoring and a little bit of cleanup.
So, I'm proposing this tiny addon patch. The error code, that we set in the other code, is available in this bad-cert-handler, if fetched as the first operation in the function. This is documented at http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslfnc.html#1088928
The patch fetches this status, and only if we see the "revoked" status, we'll give special treatment: Ignore and cleanup. The cleanup code "cancel_and_failure" is the same as we do in all other exit paths (except in the not-reached-assertion path that Brian discovered).
Thanks a lot for discovering this.
Created attachment 520017 [details] [diff] [review]
incremental change, not strictly necessary, but reasonable
This patch builds. I'm testing it in a moment.
No, this incremental patch does not work. we no longer get the error page.
Ok, the patch is not necessary. With this patch we prevent the "default catch all" that will display an error.
The only thing that is necessary, and should be done in a follow-up patch: Remove the "not-reached" assertion when a cert is revoked.
> Bob would be able to explain the issue with the leading zeros better,
> I'll try to repeat what he said.
Serial numbers are unsigned integers. DER INTS are all signed, so when you encode an unsigned integer with DER you need to make sure the leading bit is not zero. This CA issues serial numbers which are 16 bytes long. If the lead byte starts with a zero (0x00-0x7f) then the serial number is 16 bytes long, If the lead starts with a 1 (0x80-0xff) then a zero is added as padding.
Different uses of these values tend to decode the resulting bytes differently, so it's usually best to canonicalize the bytes before comparing them. the easiest way of doing that is to strip the leading bytes.
Comment on attachment 519939 [details] [diff] [review]
Patch v4
The patch looks sufficient to me. Like Kai said, the unusual code path with the assertion should also be tripped by a normally-revoked cert. I will file a separate bug to deal with that.
Rob: can we get 'er landed? a=beltzner for branches.
Comodo say:
We have analysed our OCSP responder logs and we see no evidence of
any of these certificates having seen traffic in the wild other than
2 hits from the attacker himself (from the already mentioned
22.214.171.124 and the almost adjacent 18.104.22.168) and also hits
from Comodo staff testing and from Microsoft, Google, and (we think)
Mozilla staff testing.
The earliest OCSP hit we see is at 15/Mar/2011:21:39:43 UTC, which
is after the latest revocation - which was at 20:19 UTC.
Waiting for builds before landing on relbranches for mozilla-2.0 and mozilla-2.1, currently testing 1.9.2 and 1.9.1.
Three out of seven builds done.
Robert, thanks for explaining the leading 0 thing!
(In reply to comment #44)
> Comodo say:
> We have analysed our OCSP responder logs and we see no evidence of
> any of these certificates having seen traffic in the wild other than
> 2 hits from the attacker himself (from the already mentioned
> 22.214.171.124 and the almost adjacent 22.214.171.124)
Does Comodo keep baseline traffic stats such that you would detect a drop in normal OCSP pings coming from the region of that IP (Tehran), or other regions in case that address is misdirection? Lack of normal OCSP traffic might be evidence of an attempt to use those certs by blackholing the OCSP responder.
But as long as you're otherwise seeing normal OCSP traffic the lack of pings for those specific certs is comforting.
I've verified the bug on Linux with the steps on comment #8 and the examples in comment #0 with the exception of "global trustee." In the RC1 I can load the page https://kuix.de:9449/ but in the RC I get a page with this error:
Secure Connection Failed
An error occurred during a connection to kuix.de:9449.
Peer's Certificate has been revoked.
(Error code: sec_error_revoked_certificate)
I've also tested around functionality in AMO, like installing and updating extensions, as well as functionality in the sites mentioned in comment #0. I've seen no problems with those.
Created attachment 520160 [details] [diff] [review]
Additional Patch - 2 more bad certs
UPDATE: The attacker also caused the bad certificate for login.yahoo.com to be reissued twice. The attached patch will blacklist these 2 additional certs.
These 2 certs were revoked at the same time the other 7 certs were revoked, but somehow we omitted to communicate the details to you. Sincere apologies.
Created attachment 520163 [details]
2 more bad certs (.cer) zipped
Rob: Can you totally utterly definitely confirm there are no more?
I note that these two certs are the two revocations in the middle of the set from the CRL, as quoted in comment 2. As that CRL is used regularly (multiple times per day), I asked Robin Alden of Comodo on the phone specifically about those two revocations - whether it was coincidence (i.e. they were unrelated), or whether there were more mis-issued certificates. He told me it was coincidence. :-|
> He told me it was coincidence. :-|
I was wrong, and apologize.
I'll let Rob give his confirmation separately.
Comment on attachment 520160 [details] [diff] [review]
Additional Patch - 2 more bad certs
I confirm this patch is correct.
My tool produced exactly the same code when dumping the additional new attached certs.
> Rob: Can you totally utterly definitely confirm there are no more?
I confirm that the Comodo Partner Account that suffered the security breach has (totally, utterly and definitely) *not* mis-issued any further certificates, and we are not aware that any other Accounts have been breached.
The "2 more bad certs" in comment 50 need to be blacklisted. After that, there are no more.
Comment on attachment 520160 [details] [diff] [review]
Additional Patch - 2 more bad certs
First and foremost: ugh.
Second, we will take this patch on:
releases/mozilla-2.0 (default and GECKO20_2011031715_RELBRANCH)
releases/mozilla-2.1 (default and GECKO21_20110317_RELBRANCH)
After we get the confirmed changeset landings, we will:
respin mozilla-central nightlies
make a Firefox 4 RC2 build3 for Windows, OSX and Linux
make a Firefox 4 RC1 build2 for Android
That's actually Firefox 4 RC1 build3 for Android
And actually Android and Maemo, but who's counting?
Changeset numbers:
mozilla-2.1 default: 63440:f4cceb1f9b59
mozilla-2.1 GECKO21_20110317_RELBRANCH: 63441:0f7aaaf20cb3
mozilla-2.0 default: 63341:afbc0b4fd618
mozilla-2.0 GECKO20_2011031715_RELBRANCH: 63342:6be9e31d01b4
mozilla-central default: 63437:55f344578932
2.0 tip: http://hg.mozilla.org/releases/mozilla-2.0/rev/afbc0b4fd618
2.0 branch: http://hg.mozilla.org/releases/mozilla-2.0/rev/6be9e31d01b4
2.1 tip: http://hg.mozilla.org/releases/mozilla-2.1/rev/f4cceb1f9b59
2.1 branch: http://hg.mozilla.org/releases/mozilla-2.1/rev/0f7aaaf20cb3
m-c tip: http://hg.mozilla.org/mozilla-central/rev/55f344578932
Comment on attachment 520160 [details] [diff] [review]
Additional Patch - 2 more bad certs
Approved for 22.214.171.124 and 22.214.171.124, a=dveditz for release-drivers
I've reverified the fix in build 3 of RC2 of Firefox 4 now.
verified FIXED in build 3 of RC1 for Fennec 4 based on the test instructions listed in comment #8:
Mozilla/5.0 (Android; Linux armv7l; rv:2.1) Gecko/20110318 Firefox/4.0b13pre Fennec/4.0 ID:20110318114419
(In reply to comment #62)
> verified FIXED in build 3 of RC1 for Fennec 4 based on the test instructions
> listed in comment #8:
> Mozilla/5.0 (Android; Linux armv7l; rv:2.1) Gecko/20110318 Firefox/4.0b13pre
> Fennec/4.0 ID:20110318114419
also double checked ssl sites for comment 0 on fennec. all good.
(In reply to comment #20)
> Robin Alden at Comodo (now CCed) tells me:
> - Microsoft are [...]
> - Opera are [...]
> - Chrome are [...]
Robin: what about Apple/Safari? Have they been informed?
Let's not forget to land the additional patch into 1.9.1 and 1.9.2
(In reply to comment #64)
> (In reply to comment #20)
> > Robin Alden at Comodo (now CCed) tells me:
> > - Microsoft are [...]
> > - Opera are [...]
> > - Chrome are [...]
> Robin: what about Apple/Safari? Have they been informed?
Yes. I had a positive response and a follow up request for more information from email@example.com.
Verified for 18.104.22.168 and 188.8.131.52 using repro steps in comment 8.
Created attachment 520887 [details] [diff] [review]
fix a leak
The patch introduced a small leak. When we detect a blacklisted cert, we exit the function early and don't clean up the cert.
The fix is to move the C++ cleanup variable further up, which I have missed when moving up the line to obtain the cert.
I filed bug 643694 to fix it. I propose to do it in the nex regular update cycle. I'm attaching the patch here, as this issue is not yet public.
Comment on attachment 520887 [details] [diff] [review]
fix a leak
As mentioned on IRC, this:
> + CERTCertificateCleaner serverCertCleaner(serverCert);
> CERTCertificate *serverCert = SSL_PeerCertificate(fd);
should be:
> CERTCertificate *serverCert = SSL_PeerCertificate(fd);
> + CERTCertificateCleaner serverCertCleaner(serverCert);
The updates (not the blog post yet) should be live for 3.6 and 3.5 users.
I reiterate my objection to Mozilla allowing the included certification authorities to outsource to third-party registration authorities.
May I ask why this bug (and the whole issue) has been kept secret for over a week? To spare my time, let me quote The Register [1] since it exactly reflects my thoughts:
The decision by Google, Microsoft, Mozilla and Comodo to keep the world in the dark for eight days comes as a slap in the face to their users.
"The attackers had all they needed," said Marsh Ray, a researcher and software developer at two-factor authentication service PhoneFactor. "Knowing which certificates have been compromised gives an immediate step people can take to secure their systems."
None of the companies would explain why they waited so long to disclose the attack.
If there is some policy due to which this was kept under the hood, then it's completely flawed and needs to be rethinked ASAP.
[1] http://www.theregister.co.uk/2011/03/23/gmail_microsoft_web_credential_forgeries/page2.html
Mozilla has made a more detailed statement about the Comodo misissuance incident:
Please continue discussion in the mozilla.dev.security.policy discussion forum:
Created attachment 522155 [details] [diff] [review]
fix for 1.8.1(.24)
backport to 220.127.116.11.
If anyone has time to take a look at it, I'd be very grateful
Comment on attachment 522155 [details] [diff] [review]
fix for 1.8.1(.24)
Looks OK to me.
Created attachment 522228 [details]
Hacker claim
Found a hacker's claim of responsibility at http://pastebin.com/74KXCaEZ
Could be BS, but there are some testable claims
- the name of the RA
- the ceo's account
- the "comodo username"
- did the RA really have a trustdll.dll
- was it C#
- did it really hardcode in their password/username?
This is all depressingly plausible. Is trustdll.dll something Comodo distributes, or was that winning idea solely the RAs? Does it really take only a name and password, and do RAs typically leave those hardcoded into internet-connected systems?
Found a similar (unverified) claim in response to a Heise article on the subject, guy claiming to be a reseller (presumably restricted by DV checks at the RA or Comodo level?) who could get around that by calling the APIs directly and bypassing the app they were given.
(In reply to comment #79)
> Created attachment 522228 [details]
> --> https://bugzilla.mozilla.org/attachment.cgi?id=522228
> Hacker claim
> Found a hacker's claim of responsibility at http://pastebin.com/74KXCaEZ
> Could be BS, but there are some testable claims
> - the name of the RA
> - the ceo's account
> - the "comodo username"
> - did the RA really have a trustdll.dll
> - was it C#
> - did it really hardcode in their password/username?
There's also http://pastebin.com/DBDqm6Km, which apparently contains the decompiled source code to trustdll.dll. This can also be tested.
Created attachment 522249 [details]
decompiled TrustDLL
(In reply to comment #80)
> There's also http://pastebin.com/DBDqm6Km, which apparently contains the
> decompiled source code to trustdll.dll. This can also be tested.
Attached (pastebins suck].
> guy claiming to be a reseller (presumably restricted by DV checks at
> the RA or Comodo level?) who could get around that by calling the APIs
> directly and bypassing the app they were given.
That claim should be easy to verify, somebody just needs to enroll as reseller and try it.
I've heard the same claims from intermediate CAs using the API.
> Hacker claim
One wonders why he didn't just post some data signed with one of the private keys he generated. He seems particularly anxious to prove he was the one who pulled this off.
Does that help? http://pastebin.com/X8znzPWH
(In reply to comment #85)
> Does that help? http://pastebin.com/X8znzPWH
Since pastebins suck, here's the content:
For some real dumbs, I bet they don't have IQ above 75, WHO STILL thinks I'm not the hacker, here is mozilla addon's certificate, check it's serial with one published on all the internet:
I really worry about you guys (people who still have doubts) even for surfing in internet, have you ever visited a doctor?
Private key for above certificate:
@ioerror, when I say you have relations with intelligence agencies and you pass traffic, I have my reasons: http://bit.ly/dK0oB5 #comodogate
Thanks to Robert Graham for pointing out that private key is encrypted with a passphrase, here is private key without passphrase, I don't want to give away my passphare:
And the private key has been verified as matching the public key attached to this bug:
So this guy either did it, or is part of the group that did it.
(In reply to comment #69)
> Created attachment 520887 [details] [diff] [review]
> fix a leak
This was landed as part of bug 644012.
Presumably comment 8 can be morphed into a test, either automated or Litmus, or both. Setting flags.
(In reply to comment #89)
> Presumably comment 8 can be morphed into a test, either automated or Litmus, or
> both. Setting flags.
Litmus testcase has been added -- please review:
(In reply to comment #90)
> (In reply to comment #89)
> > Presumably comment 8 can be morphed into a test, either automated or Litmus, or
> > both. Setting flags.
> Litmus testcase has been added -- please review:
> https://litmus.mozilla.org/show_test.cgi?id=15365
This test presupposes that https://kuix.de:9449/ will be up forever. Since the bogus test cert is keyed to that site, we cannot move the testcase to our QA server.
(In reply to comment #91)
> > Litmus testcase has been added -- please review:
> > https://litmus.mozilla.org/show_test.cgi?id=15365
> This test presupposes that https://kuix.de:9449/ will be up forever. Since the
> bogus test cert is keyed to that site, we cannot move the testcase to our QA
> server.
Correct. As far as I understand it, the purpose is to test a certificate which has been revoked by the CA. Is there a way that we can spoof a revoked certificate? If we can, then we could create a test on the QA server...
Testing is tricky.
Do you want to test the blacklist mechanism?
The test cert on kuix.de:9449 will expire soon. I'm not sure what will happen then. You might get EITHER error expired OR error revoked. Only if the error REVOKED then you can continue to use this blacklist test. If EXPIRED has higher precendece and is the error that will be reported, this test ability will be gone. You must test this probably around April 20.
If you want to test revocation mechanisms in general, that's another story, and I agree, that could be automated, but it would also require to have someone permanently operate a server with a revoked cert.
(In reply to comment #93)
> If you want to test revocation mechanisms in general, that's another story, and
> I agree, that could be automated, but it would also require to have someone
> permanently operate a server with a revoked cert.
QA has a public facing server we can use for SSL work now.
Why does this need to be a litmus test?
Kyle, it doesn't. If someone wanted to craft an automated test, that would be great in my opinion.
Yeah, we should be able to test this through automation.
(In reply to comment #97)
> Yeah, we should be able to test this through automation.
This should bear bug 617414 in mind. I don't know how SSL tests are currently performed and whether you'd need a couple more certificates from Comodo (one to blacklist and one to not) as this code is only run if the issuer name matches.
Resetting the Litmus flag to indicate that the test still exists in Litmus (and I think it should until it is replaced, or until it is no longer a valid test as per comment 93). Given that this is a security issue, surely a Litmus test is better in the interim? Let me know if I'm wrong.
ah... we have the private key for the revoked addons certificate!
the litmus test should be reworked to use the addons cert for which we have the private key. in order to do this, the testcase will need to pin <'now'> to be a fixed date (e.g. 2011-03-28), on the client system, and the host will need to be happy to serve an expired certificate (possibly by pinning the date to the same).