text:
Regional North America United States New York Localities N New York City Queens Business and Economy Shopping
For shops and stores offering merchandise for sale in this locality.
Subcategories 2
Related categories 1
Sites 21
The Bay Terrace At Bayside, New York
Shopping Center in northern Bayside, features a Gap, Boston Market, Outback Steakhouse and many more shops and restaurants.
Bayside Florist
Full-service flower shop delivering fresh floral arrangements, plants and gift baskets. Includes worldwide wire service, catalog and on-line ordering.
C and B Books Distribution center
Offers African American books retail and club membership. Includes company profile, order form, terms, a newsletter, and links.
Complete Computer Services
Sales of Epson and compatible ink cartridges. Located in Far Rockaway.
DaCorta Hardware
Retail, commercial and industrial distributor of hardware, paint and building materials. Includes on-line shopping and directions.
Delta Signs and Flags Co.
Manufacturer of military, religious, world and U.S. state flags and accessories.
Doc Audio-Video, Inc.
Electronic repair shop for audio, video, TVs, VCRs, computers, camcorders, beepers, cameras, and fax. Factory authorized upgrades, installations, house calls. Based in Bayside.
Emilio's Ski Shop
Ski shop offering online store and ski trips.
Futon covers, frames, pillows, accessories and mattresses.
Home Furnishing
Offers retail and online sales of futons and loftbeds, includes photos and pricing.
Len Harris, Inc.
Sells everything from air conditioners and blenders to vacuum cleaners and washer/dryer units, over 9000 types of small and major home appliances and accessories. Includes tips, services, and profile.
Leonard Maggiore, Optician
Prescription and non-prescription Zeiss Scoptz shooting glasses in all Zeiss lens tints and an exclusive sharp site lens tint. Ridgewood location.
Manhattan Cabinetry
Specializes in custom built furniture and entertainment centers. Product photo gallery. Stores in Manhattan and Long Island City.
Mattress Net
Includes services and specials. Mattress facts and contact information provided.
Potter's Wheel Pottery Studio & Crafts Gallery
The Potter's Wheel, located in Kew Gardens, is both a ceramics teaching studio and an American crafts gallery. Wheel throwing and hand building courses are offered.
Queens Center Mall
Mall in Elmhurst, 70 stores, includes Macy's, JC Penney, and food court with McDonald's and Sbarro.
Singh's Sporting Goods
Cricket sporting goods in Ozone Park.
Stacey's Choice
Offers a variety of hair accessories, located in Flushing.
Studio Arts Florist
Provides delivery of fresh and artificial arrangements, plants, balloons and gifts to Forest Hills and adjacent communities. Includes catalog and worldwide order relay service.
Original Timex replacement watchbands and straps designed to fit all watch brands. Long Island City.
Wonderful Enterprise Corp.
Hair accessories include barrette, clips, pin, headband,and other.
Last update:October 22, 2016 at 16:50:23 UTC
All Languages


text:
There is no greater influence than your VOICE, and no greater impact than the
Are you Experiencing any of these as a woman CEO or Executive?
You are not closing enough sales or attracting the right clients or investors
You did not get the promotion you deserved
You are afraid of your power and your Voice reflects this
Your Performance on Stage impacts the Performance of your Business
Corporate Speaking
Magnetic & Charismatic
Your company is here to make an impact. Influence. Change the global economy. Participate in conscious capitalism. Business that is good for all. My proprietary Vocal Archetypes℠ program helps you identify…
Start Up Business
Need Investors? Close that deal?
You did it. Mustered up your courage and leveraged all of your monies. You are here and ready to grow fast. You need the big investor or a few big investors. You are a true pioneer, leader, visionary…
Management Teams
How to speak to your team.
I get it. You have a killer management team of up to five key people. You want them to play well together. Use their greatest strengths and skills and passion. Identify, clarify, and turn up your…
Individual Speakers
Personal & Business
You want to increase your reach. Your influence. You have something important to say. Grow your company fast and you know that one of the best ways to maximize your time and get in front of more people…
The one thing you need to know about me is that I am over the top in love with the power of the Voice.
"Your Voice is the key to influence, inspiration and profits"
I was always memorized and hypnotically drawn to the voices emanating from my transistor radio while swinging for hours in my backyard world creating with my own over-the-top imagination. That's what kept me alive; my music and my imagination.
Any kind of deep or rich Voice would send me over the moon and captivate me, Casey Kasem on American Top 40 Radio Show, Yul Brynner live in the King and I, and Barbra Streisand belting out People.
Those voices, that resonance, that romance…

subset: commoncrawl


text:
It was only one year spent at Florida for Bradley Beal, but he's become one of the late risers in tonight's NBA Draft. The sharpshooter is in everyone's mock draft in the top five picks that will be called out tonight in New York City. But how did he get here? Here are his top five plays of his only season in Gainesville.
*** *** ***
5. Beal freezes and sinks the floater
Speed is what makes Beal's game so dangerous, whether cutting off screens for threes or curling toward the rim. Turns out he can stop on a dime just as fast. At the 2:14 mark against Kentucky, Beal brakes going full-bore into the teeth of UK's key — shaking Marquis Teague in the process — then finishes with the nice floater.
4. Heat check from deep against Ohio State
Check the :45 mark. Do you see how utterly unafraid he is of pulling from 26 feet on a dude in an opponent's gym? That's the mark of an uber-confident guy who can pull from deep but will work to get established inside early on with drives, etc. So that deep three is really the product of the work he did even earlier but it is still just as pretty standing alone.
3. Picking apart Florida State
FSU was a damn good team this year, knocking off Duke at home among others, and yet Beal had the run of the court against the 'Noles this year. This tape includes the play at the :15 mark where his three-point stroke and hesitation pauses the defender's close out just enough to swoop right around him for the slam.
2. Slam on Alabama
Listen to the gym after this dunk: Silence. Usually there's someone who'll heckle a guy even if he was Jordan in the '92 Olympics, but there's not even that person speaking up after this huge dunk on a broken play in Tuscaloosa.
1. The throwdown on South Carolina
Even with Beal's slashing ability, arguably his best talent is still being able to drain jumpers from anywhere. Of course, we've seen his shooting earlier but his best play was another huge slam. Here he yammed on South Carolina in a ridiculous way. I wonder if they even showed new Carolina coach Frank Martin this tape from last season when he took the job.
Here's a full mixtape of Beal's ridiculous freshman year.
How high would you take him?
Follow Andrew on Twitter at @AndrewGreif.
Follow Dime on Twitter at @DimeMag.
Become a fan of Dime Magazine on Facebook HERE.


text:
4 Ways To Use Utility Trailers At Music Festivals
Attending a large music festival is a great way meet and connect with all kinds of people. A number of these festivals last for multiple days and feature large fields or lots filled with people camping throughout the whole event. If you plan on staying through a whole music festival, then it's important to be prepared and ready for multiple days of events. One way to help you at your camping spot is with a utility trailer. These small open-air trailers can hitch on the back of your vehicle and provide you with plenty of uses through the...read more
Bakcyard Wind Art: 4 Types Of Auto Parts Ideal For Crafting
Wind art is a great way to turn naturally blowing wind into natural sounds and visuals for your yard. When creating wind art, there are a variety of materials you can use to create moving objects that react with the wind. One way to get a variety of unique designs is by purchasing auto parts. Shopping for used auto parts gives you the ability to find great discounts and assemble all types of designs. Instead of starting with a blank slate, you can get a good idea of what auto parts to look for and use within your artistic creations. The...read more
Looking To Puchase A Used Semi Truck? Get Answers To The Questions You May Have Involving Financing It
Purchasing a used semi truck is a different than purchasing an automobile. When you purchase an automobile, you take out a personal auto loan. However, when you purchase a used semi truck, you are likely going to take out a commercial truck loan. If you have never done this before, you may have many questions. Getting answers to your questions will help you to better understand how the process works and what to expect when it is time to make your purchase. Here are a few frequently asked questions related to financing a used semi truck. What...read more


text:
Transparency Market Research's report sizes the Hepatitis B market and provides current information on key developments in the Hepatitis B market. In addition to discussing Hepatitis B molecules that are presently in the clinical trials phase, the report also provides an overview of molecules at the preclinical research and drug discovery stages. This report has been designed to help decision makers in the Hepatitis B drugs market to understand competitor pipeline molecules, and to identify potential areas for expansion and innovation.
The scope of this research report on the Hepatitis B market includes a product- and geography-based mapping of industry size and growth forecasts. Current and emerging challenges resulting from patent expiries of branded drugs, changes in regulatory mandates, and competition from the generic drug industry are analyzed in detail in this market research report. The Hepatitis B virus (HBV) drugs market report further assesses current therapies unmet needs in the context of current and emerging therapies.
Company profiles of leading players in the Hepatitis B market offer users valuable insights into the financial standing of major entities, their product portfolio (including pipeline products, in some cases), a SWOT analysis, and recently developments.
Overall, the objective of this report is to support players in the Hepatitis B drugs market in designing their growth strategy and appropriately allocate resources – all with the ultimate aim of finding success in their existing and planned HBV drugs markets.
The Hepatitis B virus (HBV) – also known as serum hepatitis – is classified under the hepadnaviridae family of viruses. The Hepatitis B Foundation—a global non-profit organization dedicated to the disease—states that HBV is 100 times more infectious than HIV. The infectious disease caused by the HBV is commonly referred to as Hepatitis B, and causes a severe inflammation of the liver, impairing its normal functioning. The transmission of HBV widely occurs through infected blood or the use of invasive medical equipment that is infected with HBV. Hepatitis B has a high prevalence rate across many Asian and African countries.
Though the HBV drug market features various therapeutic products indicated for the treatment of Hepatitis B, none of them have hitherto proven effective in stopping the infection. These drugs merely work by slowing down the pace of liver infection, and thus manage to curtail liver damage. As a higher number of cases continue to be reported from Asia and Africa, the Hepatitis B vaccines and drugs market is gaining traction in these regions. It is possible to prevent Hepatitis B by timely vaccination. However, once a person acquires this infection, they stand a high risk of developing lifelong chronic infection, ultimately leading to irreversible damage to the liver, and even resulting in death. Hepatitis B patients are vulnerable to further complications related to the liver, such as: hepatocellular carcinoma (liver cancer), liver failure, and liver cirrhosis. It is estimated that the number of people affected by Hepatitis B exceed 2 billion globally. Our analysts estimate the combination therapies will form a key component of the Hepatitis B market in the future.
This market research report analyzes the following geographies:
- North America
- Asia Pacific
- Europe
- Rest of the World
This report gives you access to decisive data such as:
- Market growth drivers
- Factors limiting market growth
- Current market trends
- Market structure
- Market projections for the coming years
Key highlights of this report
- Overview of key market forces propelling and restraining market growth
- Up-to-date analyses of market trends and technological improvements in the micro servers industry
- Pin-point analyses of market competition dynamics to offer you a competitive edge
- An analysis of strategies of major competitors
- An array of graphics and SWOT analysis of major industry segments
- Detailed analyses of industry trends
- A well-defined technological growth map with an impact-analysis
- Offers a clear understanding of the competitive landscape and key product segments
Note : All statements of fact, opinion, or analysis expressed in reports are those of the respective analysts. They do not necessarily reflect formal positions or views of Transparency Market Research.


text:
Positive cash flow on investment properties
Unlock the right potential from your investments
Invest less and still get high returns
What We Offer
FBC specialises in equity creation using our wealth creation strategies, which have positive cash flow yields. Providing a range of specialist services we have a solid network of investment professionals and offer progressive, expert advice and options for all aspects of cash flow positive investing. Whether your interest is foreign property investing, or you simply want to know how to invest positively, then we will assist by presenting you with RIGHT choices!
We are an experienced team of highly motivated financial advisers to assist our customers in getting the best investment options for property and a strategy to make more wealth as a secure income throughout .
With over more than 35 years of experience, our lead consultant Alsitair McCreath has been able to guide customers with working wealth acceleration and financial planning techniques.
FBC has a warm and welcoming culture and our consultants work hand in hand with our customers and try to give them an excellent service throughout their journey with us. We have appointments at a place of our customer's choice to save their time and assist them in all possible ways and to ensure their complete satisfaction.
About FBC Group
Our management team has more than 10 years experience within the US property investment and has been helping customers save more money with expert advice on right investment properties. Our experienced consultants are happy to meet with you at a time and place convenient to you. At FBC, we suggest the best investment strategies to create, establish and manage turn-key cash flow positive investments for clients in order to fund both their current and future lifestyles, whilst minimizing debt and creating a long-lasting sustainable retirement platform.
Alistair McCreath, our lead consultant has vast experience in property investment, sales and property management. He is passionate about managing all aspects of his clients' portfolio professionally ensuring profits and wealth accumulation for them.
Why Choose Us
Free Consultation at your place
- We don't work office hours and will see you at your convenience at your time and your place of choosing.
Transparent process and assistance at each step
- We set up your bank accounts and tax payer accounts along with the property documentation
- You get your money directly in your account and can spend this money anywhere int he world
- Our team of qualified professionals will help you with everything
- We stay in regular contact with emails and personal calls and operate nationwide.
knowledge and experience
- We have an office in US with dedicated resources for property management, liaison with banking specialists and tax accounting services at your disposal.
- We are not agents and we do the complete investment process in a transparent manner using valid and autoprised processes.
Our services are absolutely FREE
- We don't charge fees of any sort as we are paid directly by the banks.
At FBC Group, we ensure continuous success, return on investments and results for our clients. For a free consultation session for property investment, call 03 – 94358871 today.
Our Process
Free Consultation
Book a free consultation for a free consultation session for right strategies for investment in property and wealth acceleration strategies or for managing your financial portfolio. We will be there at a time and place convenient to you.
Discussion and Review
We will assess your circumstances and requirements to find out the best options you can choose from; and help you realize your goals of having a secure and passive ongoing income.
Team to assist you with everything
You can leave all your worries to us as we will do the running around for you and will manage the overall process from start to end. We have a dedicated team of property manager and financial assistance eager to help you with your requirements.
Spend less and earn more in your property investments
You can make a better use of your finances by making the right property investments
Book a free consultation at 03 94358871 to know how.


text:
Color: Explorer Finish
Mattress Size: Twin over full
Mattress Height: 8"
Material: Solid Pine
Dimensions: 81 x 81 x 64"H
View Student Loft Bunk Bed >>
Turning a small room into an efficient room can be tough. Building a bunk bed can be quite a task, especially when you want to create storage areas including drawers, and cabenits or include a trundle for an extra pull out bed. When you build your own bunk bed, you risk creating a safety hazard for your children for every storage space you create as it weakens the soundness of the bunk bed structure.
View Other Bunk Beds Online >>
Making a mistake in the construction of a bunk bed or loft bed could lead to severe consequences. Collapse in the frame or a bunk bed ladder may cause injuries for individuals on either bunk. Skilled, qualified engineers should be the only people contemplating a bunk bed building project; otherwise, it should be avoided completely.
An unstable bed frame is a safety hazard to children as well as parents who may be climbing a bunk bed to tuck in their child at night. The new staircase bunk beds (also called stairway bunk beds or stair stepper bunk beds) can make it much easier and safer for mom to climb up to the top bunk at night.
Another thing you may consider when contemplating building your bunk bed is the bunk beds design. You may spend a bunch of money to try and complete a well designed bunk bed with functional storage space. The materials, such as solid pine may also be expensive.
Bunk beds can be found online for about $500 and many times there are models with free or discounted shipping options. At times there are even models that come with matching furniture such as desks, dressers, mirrors, and chairs at no additional cost (as a bedroom set special.)By buying online, you may end up with a product that is much more functional, while wasting none of your time or in the end. Not only is it less expensive but you can take advantage of custom bunk bed options buy adding or removing features so that the end product will satisfy individual needs.
Distributors like Factorybunkbeds.com can help you save even more money by buying direct from the factory online. Without the costs of an additional shipment to a retailer, the bunk bed retailers overhead, and profit margin built in you can get a bunk bed at a fraction of the cost that you can from buying at a furniture store. Buy direct from the manufacturers factory and save big!
Bunk Bed Builder | Bunk Bed Builders | Bunk Bed Building | Bunk Bed Furniture | Bunk Bed and Loft Bed | Cinnamon Bunk Bed | College loft bed
Full Over Full Bunk Bed | Kids Bunk Beds | Kids Loft Beds | Merlot Bunk Bed | Modern Staircase Bunk Bed | Staircase Bunk Beds | Staircase Bunk Bed Loft
Staircase Loft Bed | Stair Stepper Bunk Bed | Twin Over Full Bunk Bed | Twin Over Twin Bunk Bed | Twin Over Twin Bunk Beds | White Kids Bunk Beds
Factory Loft Bed | Factory Loft Beds | Factory Stair Bed | Factory Stair Beds | Factory Stairway Bed | Factory Stairway Beds | Kids Furniture and Furnishing
Bunk Beds
Copyright 2010-2012 Factory Furniture LLC


text:
I saw this behaviour in the mail component, but I suspect the browser might
suffer from the same problem. Apparently, when mozilla mail connects to
"mail.whatever.com", it caches the DNS->IP resolution, as it should. Now, even
when this entry expires (from its TTL -- time to live), mozilla will not forget
the resolution, until restarted. This has 2 consequences:
1. If the IP address of mail.whatever.com changes, mozilla will not be able,
anymore, to communicate with it (that was my problem).
2. If the browser does the same, this is a memory leak, as DNS entries would
only be added to the cache, and never removed.
BTW, the TTL of the particular host I had problems with was 2 minutes. I waited
2 days to be sure mozilla would not expire the cache.
Nighltly build: 2002081122
I know we've made some changes for DNS caching, which as I understand it, is
more like a FQDN->socket binding. Did we officially decided to give behavior the
name "pinning?"
Anyhow, this is at least the second bug I've seen where it makes mail users
really unhappy.
I think we need to give some thought as to how extensive we want to make the
service change. As I said in previous security discussions, the trust problem
occurs with getting content over a state-less network connection. My concern is
that this solution has tied the hands of our connection-based protocol handlers,
like SMTP, IMAP, and POP.
With Netscape (4.x, maybe even newer versions), you could set the
network.dnsCacheExpiration to control the DNS cache time. However I'm finding
that Mozilla 1.1 ignores this preference completely, and instead seems to cache
DNS values pretty much indefinitely.
I'm sitting here waiting to see when it's going to flush out an old IP address
which I changed over 30 minutes ago (this in the browser, not the mail
component) and it is still looking for it at the old location.. I don't seem to
recall this being a problem in Mozilla 1.0, which I believe flushed cache values
within 15 or so minutes. I notice these things since I'm working on dynamic DNS
systems and this bug pretty much renders it useless.... Internet Explorer
flushed its IP address after 15 minutes and is now properly loading the page, so
this is definitely Mozilla's fault :-(
FYI my Mozilla version is:
Mozilla 1.1
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826
See security bug 149943 which implemented the "pinning" behavior. We explicitly
ignore TTL because this can be used by an attacker. For now you can "un-pin"
addresses by going offline and back on (via the file menu or the plug icon in
the status bar).
Would giving pins a finite lifetime open us up to mischief? Someone could open a
pop-under and setTimeout() the length of the lifetime (say 15 minutes), then
proceed with the attack; most people wouldn't notice.
We could add a button to the advanced HTTP Networking panel to flush the DNS
entries, would make it a little more obvious than the offline/online trick.
Frankly for most people even a lifetime of 15 minutes is too long, they'll have
shut down and restarted the browser or given up since they will have no idea
what the problem is.
Surely there must be a way to fix this security issue without COMPLETELY
disregarding the DNS protocol? While I agree that 15 minute minimum is too
long, it's not nearly as bad as "forever". E.g. if you periodically check back
with some site throughout the day (which is common) and it's IP address happens
to change, then most likely it's when you're not surfing, so the 15 minute
minimum doesn't cause too many problems.
As I understand it, the need to pin IP addresses is to avoid attacks where
Javascript/Java could be used to access "non home" IP addresses.
Can't the IP pinning be made to apply only to the Javascript/Java initiated
With DHCP and mobile laptop use growing rapidly, this is sure to cause more and
more problems.
We need some more selective mechanism.
Should we cache only stuff that is needs to be locked up, and allow other items
to time out somehow?
Or should we do a lookup anyway, then to a compare, and if the IP address has
moved, provide some choice to the user (I have a feeling this won't work...)
Bug 168566 discusses the DNS cache timeout pref (network.dnsCacheExpiration).
I'm relatively ignorant of the content aspects of these DNS spoofing bugs, so I
(sometimes) ignorantly comment that we should get rid of those things because it
is their fault. Since that is not likely, we search for combined compromises in
both areas to maintain security and network interoperability...
Several people have had problems with the pinning model, bug 151929 is another
*** Bug 158511 has been marked as a duplicate of this bug. ***
+helpwanted - ready for eng.
*** Bug 167958 has been marked as a duplicate of this bug. ***
This bug has bitten me two different ways, and is a very serious usability
problem for Mozialla.
1.) I run a server from home on my DSL line. My IP address changes
periodically, so I use a dynamic DNS service like dyndns.org. This allows me to
use the same fully-qualified domain name that always maps to my home server. It
works perfectly in every single application *except* Mozilla, which gives "Could
not connect to server" errors because it caches DNS entries forever. Shutting
down the browser works, but it makes everyone think that my server is actually
down. No other browser has this problem.
2.) Load-balanced or fail-safe corporate server farms that use round-robin DNS
are actually made *less* reliable using Mozilla's DNS caching mechanism. If one
server is overloaded, taken down, or crashes, Mozilla is unable to connect using
the old, expired DNS entry. This is one reason that some companies don't like
to use Mozilla. It makes it appear that their web servers are down, when
they're actually available all the time due to clever fail-over and DNS-based
load balancing.
These are very severe usability issues for Mozilla.
I believe that the current behavior is a standards violation. The standard for
DNS, RFC 1035 states:
- With the proper search procedures, authoritative data in zones
will always "hide", and hence take precedence over, cached
- Cached data should never be used in preference to
authoritative data, so if caching would cause this to happen
the data should not be cached.
DNS TTL information is not something that a single application should decide it
doesn't want to abide by.
There has been some discussion that the current behavior is a "security" issue.
Refusing to abide by the TTL parameter from a DNS lookup is every bit as large
of a security hole, perhaps larger. Using a cached, expired DNS lookup (such as
for those users using dynamic DNS services,) will end up sending the wrong
information to the wrong server, possibly an e-vil server.
Possible scenario:
1. My home server, using DHCP, receives a dynamic IP address of 220.127.116.11
2. I register the dynamic service myhome.dyndns.org to point to 188.8.131.52
3. User Alice visits my web site, using Mozilla, and begins a transaction.
4. My DHCP lease expires and I am given a new IP address of 220.127.116.11
5. My server detects the change and automatically registers myhome.dyndns.org
to 126.96.36.199
6. My old DHCP address, 18.104.22.168 is given to Bob Evil's computer.
7. Alice finishes filling out a web form in Mozilla and submits it. Mozilla
erroneously uses the cached IP address 18.104.22.168, and the data is incorrectly
sent to Bob Evil's computer.
This has actually happened for me. I've ended up hitting other peoples' DSL
routers (if they have no web site set up) instead of my own server with Mozilla,
even though I've registered a new IP address.
Should this be filed as a new security bug? Perhaps in the hope that this
incorrect and very dangerous behavior might get fixed sooner?
the scenario you describe does not sound as bad as the hole opened up by
honoring the DNS rules. without this pinning, it is possible for an attacker to
setup www.evil.com to resolve to an ip-address behind your firewall or any
ip-address for that matter. this could easily be used to defeat the javascript
same-origin rules, allowing an attacker to silently interogate websites behind
your firewall.
so, while i agree the situation you describe is bad. i think the case w/o
pinning is much worse.
what we need is to arrive at a compromise. we need a solution that does not
violate javascript's security model and we need a solution that works well with
dynamic ip-addresses.
(btw: not that it really solves the problem at hand, but you can toggle the
online/offline button to effectively clear the DNS cache.)
One might argue that my scenario is worse because it happens often, *even
without evil intent,* and, sadly, breaks many of the most worthwhile sites which
are doing very good jobs at load balancing and making sure they stay up all the
I've never been IP spoofed. The problem I outline happens almost daily.
> I've never been IP spoofed.
my point is that you wouldn't know if you had. at least with the way things are
right now, you can always restart the browser (or simply toggle the online/offline
switch in the browser chrome). yes, this is not very nice, and probably sucks a
lot of the time, but without this "DNS pinning" mozilla would be an open door
through your firewall. do you really want that?
I have filed bug 174590 for this security issue. For those voting for this bug
for the usability issues, I would suggest voting for the security bug as well.
*** Bug 174612 has been marked as a duplicate of this bug. ***
This problem manifests itself at http://www.techtv.com/ which sends rather
short-lived TTL information for its A record. After going for food and trying
to reload a page, I get "could not connect to server" errors. From
packet-sniffing my connection, I could see that Mozilla was trying to use an
incorrect IP address that did not match authoritative DNS data. Other browsers
worked fine.
Restarting Mozilla fixed the problem.
This bug also occured today on the extremely popular sites
http://www.amazon.com/ and http://us.imdb.com/
I believe both of these sites use Coyote Systems' Equalizer which tends to hand
out DNS records with a TTL of about 60 seconds. Verified via packet sniffer
that Mozilla was not sending to the authoritative IP address as returned by DNS.
TTL for both sites is on the order of 60 seconds at most. Repeatedly got
"could not connect to server" error. Other browsers were able to connect.
In addition, my dynamic IP address changed today and my server automatically
re-registered with dyndns.org. When I went to my home page in Mozilla, I got
someone else's FrontPage server!
I don't understand why this behavior is being called a security feature. The
responsibility for ensuring validity of DNS information lies with the resolver
stack, not with the browser. A browser should only either:
a) Cache information for the TTL as specified in RFC1035, if it implements its
own resolver
b) Use the operating system resolver and trust the data it gets from it. If
your resolver stack is compromised, you have bigger issues.
The DNS spoofing attack that would cause a problem such as the one discussed in
the bug that created this "pinning" behavior in the first place is VERY
difficult to pull off. Modern nameservers have a huge variety of controls to
prevent spoofing of this nature. The attacker would probably have to commit an
additional man-in-the-middle attack on your DNS resolver, and/or be local to
your system already, at which point their access to your resolver stack is the
least of your concerns.
This behavior causes major problems with dynamic IP addresses, as has already
been discussed, and with certain types of distributed load balancing
technologies. I would strongly recommend for the removal of this "pinning" and
a return to proper compliance with RFC1035 regarding the caching of DNS records.
Tim: it is trivial to setup a DNS server for evil.com that returns two IP
addresses for www.evil.com:
ip1 -> points to server controlled by evil.com
ip2 -> points to server behind your firewall
the exploit is simple. user happens to visit www.evil.com. server sends back a
page with some javascript on it, and then shutsdown. the page with javascript,
loads www.evil.com again into a hidden iframe (no need to delay here). the
browser will attempt to connect to www.evil.com and will find that ip1 does not
have a server at the other end, so it will naturally try ip2. this will cause a
site behind your firewall to be loaded up into a frame that the original page
loaded off of www.evil.com can read. all of this can be completely hidden to
the user.
i set this exploit up myself with very little effort.
yet, i do agree with you on one very important point. ultimately, firewalls
need to be setup correctly to prevent this kind of attack. the browser should
not have to pin IP addresses. trust me, i don't like it either, and we are
working on developing a middle ground solution.
i hope to have this bug resolved by mozilla 1.3.
If this exploit is so simple, then tell me this - how does the information get
back to the "real" evil.com? They've shut down their web server. Their
original page can't send any data back. So they've accomplished absolutely
nothing. I don't understand what the problem is here.
they can simply POST the data they have collected to some other site under
.evil.com, like for example collector.evil.com.
I'm attaching my comments, slightly revised from bug 174590.
I'm curious as to how the current "security fix" improves matters any. If the
DNS record is already compromised when you first look up a site, then this will
"pin" to the compromised address for the whole time Mozilla is running. If the
DNS server gets "uncompromised," you'll be pinned to the evil server and never
pick up the right one!
There is no reason to believe that the address returned at whatever random
moment you first did a DNS lookup of a site is inherently secure and other
subsequent times would be more insecure. The "security fix" seems valueless, as
it is based on flawed assumptions.
The timing is completely random, based on the time you first perform a DNS
lookup. There is nothing that would cause DNS entries chosen at one random time
to be more or less secure than DNS entries taken at another random time. This
is the worst type of "security fix," one that not only leads to a false sense of
security, but is simply unable to improve security, and is a violation of
standards, and opens other, more common security holes and usability problems
that don't require evil intent. The "security fix" should simply be removed as
its benefit is purely illusory.
as sean noted in http://bugzilla.mozilla.org/show_bug.cgi?id=174590#c5 the
"security" of a site (javascript included) can only be based on SSL/TLS, not DNS
> I'm curious as to how the current "security fix" improves matters any. If the
> DNS record is already compromised when you first look up a site, then this will
> "pin" to the compromised address for the whole time Mozilla is running. If the
> DNS server gets "uncompromised," you'll be pinned to the evil server and never
> pick up the right one!
Alan: I think you missed the point here... so long as we "pin" the hostname to a
particular IP address, then there is no possibility of a cross-site scripting
exploit, which is the security problem i tried to describe.
Hugh: yeah, that is a very strong argument.
I think both sides can agree that there are compelling reasons for pinning and
allowing DNS entries to refresh.
The real question is finding an implementation that can navigate both
Here's my general impression of what needs to be done:
1- The current DNS cache (permanent pinning) is going to have to go away.
This implemented at the networking level, and treats all DNS lookoups as
connection attempts to a system that has content-level trust issues.
This simply is not the case for all types of network activity that is DNS
dependent, and is probably a straight-out incorrect implementation/usage of DNS.
2- Pinning is probably going to need to be moved into some content specific
layer, above the general networking. Possibly something like having content keep
a name-ip mapped table in each content item.
This might be the same as somethinkg like "make the DNS cache indexed by URL or
content object". This sounds, potentially horrible and bloated.
3- Consideration of a "DO_NOT_DNS_CACHE" or "IGNORE_DNS_CACHE" flag for opening
connections in Necko. Probably less effective, but would allow some networking
modules to cleanly access the current DNS database rather than read potentially
stale cached data.
i read through this discussion, and i agree with most of the people in favour of
dropping the actual behavior...
me too i am developing on a box linked through ADSL to the internet and using
dyndns services.... and i had to drop the use of galeon for this, since this
behavior grew to an unbearable annoyance...
and i want to say too, that galon, despite using the mozilla engine, does not
have the disconnect/connect button, thus i have to kill the browser, to get a
refetch done, doeing this at least all 3-4h is a real pain, and when the link
goes unstable, changing ip all 5 min mozilla becomes totally useless...
just my 0.2 cent...
The standard behavior for confirming the accuracy of a hostname -> IP mapping is
to do a reverse lookup. Something like:
(inital page load):
; resolve
-> google.com. IN A ?
<- google.com. IN A 126.96.36.199
<- google.com. IN A 18.104.22.168
; check
-> 188.8.131.52.in-addr.arpa. IN PTR ?
<- 188.8.131.52.in-addr.arpa. IN PTR www.google.com. ; subdomain, accept
-> 220.127.116.11.in-addr.arpa. IN PTR ?
<- 188.8.131.52.in-addr.arpa. IN PTR www.google.com. ; subdomain, accept
(javascript phone home; not that google does this...)
-> google.com. IN A ?
<- google.com. IN A 126.96.36.199
; check
-> 126.96.36.199.in-addr.arpa. IN PTR ?
<- 220.127.116.11.in-addr.arpa. IN PTR www.google.com. ; subdomain, accept
(with google playing evil.com.)
-> google.com. IN A ?
<- google.com. IN A 192.168.65.5
; check
-> 126.96.36.199.in-addr.arpa IN PTR ?
<- 22.214.171.124.in-addr.arpa IN PTR Bohr.local ; danger! danger!
And now, we get a security warning. Notice that the IP address change was OK,
and we didn't warn about it, because the PTR record was still as subdomain (and,
in fact, the same hostname as before) but we did notice when they tried to pull
off an attack.
(If you're wondering about "why couldn't google change the
18.104.22.168.in-addr.arpa entry?" it's because they don't control that entry ---
I do.) And the RFCs do require an accurate reverse mapping. Especially if it is
a security warning (like the certificate ones) that the user can ignore, this
will break a lot less than the current fix.
yeah, i've given some consideration to a reverse mapping solution. though, what
about this hypothetical scenario:
$ host www.evil.com
www.evil.com is an alias for server.internal.net.
server.internal.net has address 192.168.1.1
$ host 192.168.1.1
18.104.22.168.in-addr.arpa domain name pointer server.internal.net.
now, we could say that we will ignore aliases, but then i suspect we would break
or at least trigger the warning on a number of legit sites. or, am i missing
something about the way DNS works?
In your hypothetical, we'd have to issue the warning: www.evil.com is not
allowed to access server.internal.net. This could be a problem for name-based
virtual hosting. (Though, DNS *does* allow multiple PTR records, so there can be
multiple names for an IP. But no one does it, and no apps support it.)
I'd suggest that Mozilla only bother doing the check (or only bother giving the
warning, whichever is easier to implement) when the host name is being used for
security purposes, like JavaScript phone home.
This at least will minimize the number of false positives. Only sites which
depend on hostname-based 'authentication' will even have a chance of seeing it,
and administrators are probably already familiar with this type of verification
due to its wide deployment.
[ Implementation wise, maybe a "trusted" flag could be added to DNS responses
passed around in Mozilla --- true if the check passes, false if not ---
and a warning could be triggered off that. I haven't read the code,
though. ]
<rant>Comment #23 is quite correct. Use of DNS 'authentication' is widely
discredited. Unfortunately, the origonating host thing came along before web
people started thinking about such issues. So, now, we pretty much get to kluge
our way around the problems it causes. This is really, truely, a standards
issue; I don't think any workaround can achieve perfection. The protocol is
flawed, we can only hope, and try not to break too much.</rant>
here's an example close to heart:
$ host g.mcom.com
g.mcom.com is an alias for g.nscp.aoltw.net.
g.nscp.aoltw.net has address 10.169.106.17
$ host 10.169.106.17
18.104.22.168.in-addr.arpa domain name pointer g.nscp.aoltw.net.
.mcom.com is the old netscape internal domain name, but since becoming part of
AOL/TW, all of our IP nodes are also listed under the domain .nscp.aoltw.net. i
find it hard to believe that our network configuration is so uncommon. in other
words, a solution that causes pages loaded from g.mcom.com to trigger warnings
would not be much of a solution.
i'm sure if i tried hard enough i could come up with a real world example of
this sort of thing. here's a good one:
$ host www.yahoo.akadns.net
www.yahoo.akadns.net has address 220.127.116.11
www.yahoo.akadns.net has address 188.8.131.52
www.yahoo.akadns.net has address 18.104.22.168
www.yahoo.akadns.net has address 188.8.131.52
www.yahoo.akadns.net has address 220.127.116.11
www.yahoo.akadns.net has address 22.214.171.124
www.yahoo.akadns.net has address 18.104.22.168
$ host 184.108.40.206
220.127.116.11.in-addr.arpa domain name pointer w4.scd.yahoo.com.
i have no idea what yahoo uses akadns.net for, but maybe it is a replicator
service... in which case, maybe this pattern is extremely common. i don't
really know. but, it does make me think that reverse DNS mapping is likely a
very error prone solution.
not that DNS pinning is so great mind you ;-)
I agree that the reverse DNS is not a viable solution.
Here are some 2-cent ideas on possible resolutions to the problem.
1 - If user is does not have a SSL connection then the Pinning should be turned
off since there is not security to begin with. See (Comment #23).
2 - If the user is using SSL and there is an IP switch could you not have a
pop-up warning come up. With the ability to turn off future notices. Also if it
was accepted then that IP to DNS mapping could be stored somewhere as a user
approved switch. So should the IP switch again for that host the user would not
be notified. I know this was also mentioned in Bug 174590 Comment #5 and it was
said that in normal circumstance user would get the pop-up. You could also look
at placing a pop-up that ask user if they want to trust that domain. If the
users trust the domain then all DNS could be trusted. This as well could be
stored as a trusted domain so the users is not prompted in the future.
I think the main idea I was trying to get across here was to disable pinning for
non-SSL connections.
Here is an idea related the firewall attack mentioned above....
You should know the proxy used to go outside the firewall. In some cases a proxy
is not used but there is still some sort of gateway going out to the Internet.
So what you would have to determine if each domain resolved is inside or outside
the users network. Then basically you don't allow cross network DNS. Meaning
that if a DNS is resolved to an IP outside the firewall then all other DNS
resolutions for that domain have to be outside the firewall as well and vice
versa. The hard part here may be trying to determine what is the internal
network and what is the Internet.
re darin's #31.
The historical problem is that DNS rules have become more flexible to follow the
growing complexity of the internet, but the standard practice has lagged.
I vaguely remember my first DNS class in 1990 -or- and FAQ from the early
ninties said "each IP address can ONLY have ONE PTR (reverse) record. Some
people even had only one A (forward) record to each IP, and used CNAMES for
everything else.
Fast forward to the new millennium, and we have virtual hosting and DNS spoofing
exploits. In some of the security meetings, there was discussion of using
reverse lookups as way of improving the level of trust for spoofable content.
We decided this was not feasible because of performance reasons and because most
network address ranges do not fully maintain their reverse tables to include
mappings of their hostnames in the forward lookups.
Whether or not mozilla ultimately implements reverse lookups, DNS administrators
really do need to get off their butts and start fixing their PTR records so they
are accurate. In many cases, people are stuck, for example my DSL provider
doesn't seem very interestd in maintaining PTR records for my systems in my
domain that live on their network.
Maybe we should implement this as a pref, defaulted off, so at least security
concious people could start to use this and rattle the cage with a small number
of key sites.
As for the performance issues, I think that is a necessary cost to being able to
trust the content, so I don't think that objection would ultimately be a reason
for not implementing reverse lookups.
re: comment #32... actually, SSL protects against the problem DNS pinning is
trying to solve. in fact, there is no reason to do pinning for SSL connections.
so, it becomes very tempting to do away with DNS pinning altogether since
anyways plaintext protocols are not secure. though there is a fine line.
*** Bug 181613 has been marked as a duplicate of this bug. ***
*** Bug 185762 has been marked as a duplicate of this bug. ***
Is this exploit only valid with respect to java script? If so, wouldn't a
reasonable solution be to force any javascript running as part of a web page to
use the same IP address that was used to load the page which loaded the script.
The "permenant" caching then would only be associated with the page and the
true DNS cache could follow the TTL data. I realize that such a solution would
require the IP address to be associated with the web page and that such
information may not be currently stored, but it seems to solve both the exploit
problem and the caching issue.
stephen: sure, something along those lines would probably be ideal. however, it
is much more complex solution, and it would need to be done very carefully.
Sorry folks... but this bug report has been opened a half year ago and there has
been still no solution built into Mozilla (though, IMHO there were a lot of very
good suggestions), but this problem makes Mozilla unusable and unless this
problem is not solved, I can't account for giving my homepage the "Designed for
Mozilla" logo and therefore can't make advertisment for Mozilla or derivates.
Please, resolve this, I don't want IE to take control of the web completely and
making people ask "What? There's an alternative to Internet Explorer?". As I
love Mozilla, I'm not very happy that I can't use it due to this bug.
please try to keep your comments constructive. this bug represents a complex
problem. yes it has sat here for a while, but the solution is not so obvious.
there are serious tradeoffs to be carefully weighed. and this is not the only
bug in mozilla that demands time from developers :(
instead of complaining, how about contributing a sound solution or a patch?
The IP will not be looked up even though TTL has expired(using Mozilla 1.3b).
I am using dyndns for my router to be available on the net since I get
disconnected every 24h and therefore my IP changes. When a disconnect happens
during the time that Mozilla is running and I have been on my page before,
Mozilla does not lookup the IP again and is trying to connect to the old IP.
Can't you just simply have Mozilla lookup the IP again when the TTL up?
andre: mozilla doesn't have any knowledge of the DNS specified TTL. but, even
if it did, honoring it would still open up the exploit this DNS pinning is meant
to protect against. if you suspect mozilla is caching a DNS entry longer than
it should, you can toggle the online/offline button to clear mozilla's DNS cache.
Going offline and then online didn't help.
It's been caching for hours after I changed my DNSes and restarted the network.
dave: what platform are you on? if you are on linux, then the problem is with
GLIBC. it caches the contents of /etc/resolv.conf per application. the
application has to manually call res_ninit, to re-read that information.
mozilla calls this function (provided you are on redhat 7.x or better) whenever
a DNS lookup fails.
I am on Linux, and making a bokus DNS query does NOT solve the problem. In fact,
none of the suggested solutions found anywhere work. What DOES work is using
another browser.
I've had this problem several times with mozilla, and I suspect I'm just going
to have to wait until mozilla "forgets" about xchat.org and any other website it
might have cached.
David, I'm sorry you're frustrated with this DNS caching problem (as are Darin
and I, because it's a sticky problem and we need to come up with a way to fix
it). I've seen your comments in related DNS bugs, and they've been useful.
It would help us to know which *version* of Linux you're running, and perhaps
specifically glibc. Older versions may have problems which we simply can't work
*** Bug 196362 has been marked as a duplicate of this bug. ***
What do other browsers such as Konqueror,Safari and IE do with respect to DNS TTL
By not honouring the concept of TTL, Mozilla is likely to be violating the
principle of least astonishment (POLA). People expect network applications to
honour DNS TTL settings (if they keep their own dns cache) or else rely on a dns
cache which does
*** Bug 199303 has been marked as a duplicate of this bug. ***
It's asinine that this isn't yet fixed. If Mozilla is to pretend to be
standards compliant, it needs to respect the standards. Mozilla is broken, not DNS.
andy: the reality is that standards for this and that are not always consistent
with one another. javascript, for example, assumes that same host name + scheme
+ port is equivalent to same server. this sort of security assumption is broken
when DNS entries change. it is a matter of the lesser of two evils here. while
the current solution is not great, it is a bad idea to dump DNS pinning without
a compelling compromise solution.
The DNS RFCs were written in the early 1980s. DNS is a stable, mature protocol
used by many secure applications. The problem here is not a conflict between
standards. The security problem is a flaw in the _Javascript_ security model,
not a flaw in the DNS system.
Best-practices engineering makes changes to the thing that's broken instead of
introducing broken behavior elsewhere to hide the real problem. If some sort of
domain name -> IP caching is necessary for the same-origin policies, that
caching should occur inside the Javascript module. It's a Javascript-specific
application security need.
There's no need whatsoever to break Mozilla's DNS system--which has lots of
negative consequences--to fix an insecure Javascript implementation.
andy: i agree, but the reality is that such a solution is non-trivial to
implement. and moreover since javascript can be embedded in HTML, it would
same DNS pinning restriction. for this reason, we felt that pinning all DNS
entries was a close approximation of this algorithm. sure, there are times when
content doesn't have any javascript, but determining that and making sure the
determination is rock solid is non-trivial. i'm not saying it can't be done...
i'm just saying that a partial solution is very often better than no solution at
Wow... As the reporter of the bug, I would have never thought it so hard to fix
such a little problem...
I, of course, agree with gerweck -- DNS is well understood, and it works fine...
Is it not possible to have javscript's model be the following: it can *only* use
IP addresses in its cache... So, the first time the DNS is resolved to an IP,
the IP, RATHER THAN THE DNS, is cached. Presto. End. Done. Finito... No attack
Is that *that* hard to implement? Or am I missing something?
It seems like it's not really that expensive to associate an IP address with
every page loaded. This seems much better than breaking email, sites with
dynamic IPs, sites with load balancing, sites supporting failover, etc.
Wouldn't a single machine word (32 bits) storing the IP address from which each
page in memory be enough? Javascript would do a security check against this
If Mozilla wants to have a real framework, it needs a working DNS
implementation. There's no way to justify leaving the DNS system broken when it
is used by other components which it breaks badly.
patches are always welcome :-/
I am not a programmer, therefore I might not be able to submit any patch ...
Sorry Darin :o)
I juste had an idea, which could maybe help designing a better solution to
replace the DNS pinning, while trying to keep the security fix.
Is there a way to know if an action is done by the user or by a script
(javascript or maybe others) ? I explain my idea.
Let's suppose ve have a site with its related IP address. If the user types in
the location bar, for example, or when the user follows a link, we could look at
Mozilla's DNS internal cache. If the record is quite old (5 min, for example),
we could send a DNS request to update the IP, if necessary.
However, if a javascript, or an automatic reload, tries to access the site, we
would look at the DNS cache *without* updating this cache. Doing so, the
javascript queries would be sent to the 1st IP address, the one cached at the
beginning, even 2 days later ...
This solution suppose the ability to differentiate an user action to an
automatic action. But, security speaking, would this yet be sufficient ?
We talk about javascript, here, but what about other technologies ? I think a
simple reload could do the same (also related to some piece of javascript). And
what about flash content, or java content ?
Another solution, more user-oriented, would be to keep the original IP
associated to the home page. When a program (java, javascript or so) wants to
connect to another IP, we could have a warning popup :
" WARNING !! This page wants to connect to server my.evil.com (192.168.12.34).
Do you allow this connection ? "
This solution though could be problematic if there is content from different
sites on a same webpage ... We could associate to the page the list of sites and
their related IP addresses, with the warning message, when this address changes ...
Actually, this bug is about a cross site scripting issue. There is indeed a
problem. Is there a security that forbids a javascript function to load a
foreign page and send it to another one ? Like automating, in the 1st load, the
fetching of our protected page and its sending to collect.evil.com ?
Finally, I think the user could have the possibility to disable the present
pinning. Indeed, many people use mozilla at home, and would not be very
concerned with this security problem. I think it is more important for corporate
people that can use an intranet. For all those personnal users, the pinning is a
problem. I think they should be able to deactivate it in order to keep a, say, 5
minutes DNS caching.
adt: nsbeta1-
I think I saw this today. I tried to access http://webboard.pinnaclesys.com
with mozilla. I got the error:
The operation timed out when attempting to contact webboard.pinnaclesys.com
I'm assuming that the website in question had changed IP addresses and mozilla
was trying to contact an old invalid one. Netscape and IE worked fine at the
URL. Once I re-started Mozilla, it too worked fine.
*** Bug 205127 has been marked as a duplicate of this bug. ***
*** Bug 207792 has been marked as a duplicate of this bug. ***
I have several friends that use DynDNS. Since each of them gets disconnected by
their ISPs after 24 hours, they have to reconnect and get new IPs. Since they
don't get disconnected the same time, it happens that I have to restart Firebird
more than once a day to be able to see their pages. I really hate this, because
I use to have a lot of tabs open most of the time. Going to
offline-browsing-mode and back to online would do also, but since Firebird
offers no "normal" way to do so, I would have to do that in the JavaScript console.
Oh and please stop that security-bla-bla. I think especially for dial-in
internet users with dynamic assigned IPs DNS pinning is more insecure as the old
Please switch back to the old behavior or provide both behaviors and let the
user decide which one he/she wants/needs. And please take action on this soon,
because it's fscking annoying. (I tend to become really impolite now, so I stop
fear not... this is going to get resolved.
*** Bug 212186 has been marked as a duplicate of this bug. ***
*** Bug 92195 has been marked as a duplicate of this bug. ***
Note that the patch in bug 205726 (nsDnsService rewrite) contains a preference
to disable DNS pinning (default remains enabled).
The patch to toggle dns pinning as an option is silly. As has been pointed out,
pinning triggers a javascript security problem equivalent to the initial concern.
There's absolutely no justification for breaking the DNS spec here. The
Javascript implementation depends on a flawed security assumption. Don't lose
sight of the fact that pinning only exists as an ugly hack that breaks other
things to gloss over the fundamental problem in JS. As the DHCP users pointed
out, it doesn't even eliminate the security hole in the first place, just makes
it harder to exploit.
There is no reason whatsoever to maintain this bad, ill-advised hack that breaks
it is a pref so site installations can control this behavior... that said, it is
very likely the default value of the pref will be to _disable_ DNS pinning.
Had this on NS 7.02 while trying to access an http page on a site which,
apparently, had changed its IP in order to fight a DNS attack. Only symptom was
a persistent "timeout" when trying to access that particular site. I did find
out (after more than 24 hours of "inaccessibility") that http call-by-number
(using 4 numbers instead of a symbolic address) cured the problem. I wouldn't
have found about turning the browser off/on if someone hadn't told me on a
Standards aren't there for nothing. Maybe some people over there prefer not to
always obey them. PLEASE don't force everyone to always disobey them.
I second (or third) the opinion that this fix is not a fix at all, and is silly
and misguided. Please, fix it correctly! It's been toooooo long, already.
rest assured, the DNS pinning will be removed in mozilla 1.5 (see bug 205726
comment #27.
I'm excited to see it go. I was a little worried when I started hearing
mumblings about turning this bug into a user-configurable option that could
result in delays.
*** Bug 214538 has been marked as a duplicate of this bug. ***
*** Bug 216103 has been marked as a duplicate of this bug. ***
*** Bug 217701 has been marked as a duplicate of this bug. ***
*** Bug 218184 has been marked as a duplicate of this bug. ***
I can see that there is a security issue that's with JavaScript. Would there be
a way to inforce that if the DNS entry is updated, the page (and it's
JavaScript) would be flagged invalid, so that the JavaScript would not be run?
Would this solve security issues? Or could you even have it so that the page
must refresh when the DNS cache is refreshed?
ok, now that the patch for bug 205726 has landed, DNS pinning is now a think of
the past. this bug is fixed (note: on the trunk only).
*** Bug 221262 has been marked as a duplicate of this bug. ***
*** Bug 223222 has been marked as a duplicate of this bug. ***
This is still broken with the following build:
Mozilla 1.6a
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6a) Gecko/20031005
My IP address changed and I registered the change with dyndns.org. "nslookup"
showed the new IP address clearly, but a packet capture showed mozilla still
trying to use the old IP address. TTL sent is only 60 seconds, but Mozilla kept
trying to use the old IP after much longer.
Only toggling online/offline mode worked.
mozilla assumes a TTL of 5 minutes. since mozilla cannot easily know that it is
actually speaking to a DNS server to resolve hosts (it just calls
gethostbyname[_r] or getaddrinfo), there is little mozilla can do to entirely
solve this problem short of disabling all DNS caching. you can set this
preference if you like to tweak mozilla's assumed TTL:
user_pref("network.dnsCacheExpiration", 60); // assume ttl = 60 seconds
please correct me if i'm wrong, but on your system, mozilla 1.6 trunk should not
be caching more than 5 minutes. if it is, then i agree that we have severe
problems still. but, if it does indeed refresh after 5 minutes or whatever you
set the pref to, then i think we can accept that this bug is fixed.
feel free to file a new bug if you believe strongly that 5 minutes is the wrong
default value for this preference. thx!
I just did a quick survey of some very popular sites to find out their TTL.
Here are some of the answers:
www.amazon.com: 60 sec
www.cnn.com: 215 sec
imdb.com: 60 sec
www.google.com: 118 sec
Mozilla's default breaks the carefully-designed load-balancing and failover of
all of these sites, and makes Mozilla a less reliable browser for any of them.
It breaks even my my site too, which responds within a minute to IP changes.
Mozilla's default timeout should be set to absolutely no more than 60 seconds,
and I'd recommend probably 30 seconds or less. This won't affect net throughput
of Mozilla much at all.
In fact, I question having any internal DNS cache in Mozilla, as it potentially
violates the DNS specifications. Having an internal cache is only useful in the
cases where a system's DNS resolving libraries are completely broken and do
absolutely no caching. Is this the case on most platforms? Any platforms?
In any case, most DNS resolution is done within the first 10 seconds or so of
accessing most pages. (Count off 10 seconds; it's a long time.) The cache
shouldn't be set any higher than it takes to download a single, average page and
its associated images.
Optimally, this cache time should never be set any longer than it takes Mozilla
to respond with a "could not connect to X" timeout message. If the cache is
less than this, reloading would almost always work. What is this, 30 seconds?
Why reinvent the wheel? If Mozilla is to cache, it must only cache for the
specified "TTL" for that particular domain. Otherwise, TTL will mean nothing to
I do *not* agree this is a different bug -- this just what I described in my
*original* bug report, which reads:
"[...] it caches the DNS->IP resolution, as it should. Now, even when this entry
expires (from its TTL -- time to live), mozilla will not forget the resolution
Thus, I am reopening the bug.
hello! you also said:
>BTW, the TTL of the particular host I had problems with was 2 minutes. I waited
>2 days to be sure mozilla would not expire the cache.
i don't think this should be a problem any longer. if you wait 2 days, you will
find that mozilla has picked up the new IP address. (in fact, you only have to
wait 5 minutes.) mozilla is not caching DNS queries forever as the summary says.
the original problem was caused by explicit DNS pinning that would last for the
lifetime of the browser session. the solution was to remove that code. it has
been removed. this bug is therefore fixed.
as i have said, mozilla has no way to determine TTL, but for performance
reasons, mozilla must maintain a minimal DNS cache. therefore, the problem is
that of choosing a reasonable default TTL for mozilla's DNS cache. i think 1
minute may be better than 5 minutes. but, this change would be a different bug.
marking FIXED. please do not reopen this bug.
please see bug 223861.
I still do not think "bug 223861"'s suggestion is any good. Mozilla's APIs
should allow it to cache DNS to the extent of TTL, which exists for that purpose.
Out of courtesy for Darin's request, I will not reopen this bug, but the
justification that this bug is fixed because "mozilla is not caching DNS queries
forever as the summary says" misses even the fact that the original summary I
reported is: "cached DNS entry fails to expire" (I knew I should have written a
more precise "fails to expire properly" -- which is still true, a year after the
bug report!)
I created bug 223866:
*** Bug 166745 has been marked as a duplicate of this bug. ***
*** Bug 250802 has been marked as a duplicate of this bug. ***


text:
Alistair Campbell's Burnley can stand proudly alongside Arsenal, Chelsea, Liverpool, Manchester United and, much, much more importantly, Blackburn. Back where they used to belong.
The days of Jimmy McIlroy and Leighton James. When football was different. Europe had barely been invented, let alone the Premier League.
Who could imagine Burnley would muscle their way in among the big city boys, following the example set by Bolton, Wigan and Rovers?
Wade Elliott might not have known it when he curled his 13th-minute winner into the top corner. And it might be a bit harsh on Sheffield United. But English football should welcome the revival of a once-great club.
The Championship play-off final itself is what the FA Cup used to be before top level football became a corporate plaything.
That dreaded C word is still in evidence due to the swathes of empty seats that ring Wembley for a day those who invest such vast sums to guarantee access on every other occasion deem not worthy of their presence.
Let them stay away if they must. They are missing a treat.
Supporters of both clubs basked in the sunshine, baiting each other in good-natured fashion, voicing their backing for the Blades or the Clarets, setting aside the £60million cheque that makes it the most lucrative game of club football anywhere on the planet in favour of more personal reasons to hope for a win.
Sheffield United of course will always be known as the fall guys in the Carlos Tevez saga, their manager Kevin Blackwell the man who could not rescue Leeds from the hell they eventually collapsed into.
All Burnley's baggage comes from much further back. Champions in 1960, established members of England's elite, relegated in 1976. They know how Newcastle feel.
It was the year of Rocky, Jimmy Carter was elected president, Jim Callaghan replaced Harold Wilson as Prime Minister, the start of Labour's slide from power, evoking more present-day thoughts of yesteryear.
Up in the small Lancashire mill town, nestling in the hills that divide their county from the white rose of Yorkshire, it was the start of a decline that almost ended in oblivion, only a last-day victory over Leyton Orient in 1987 keeping them in the Football League at all.
The climb back has been painfully slow at times, hanging around in the second tier so long it is easy to forget that flirtation with disaster.
That static existence came to an end with the arrival of Coyle from St Johnstone in November 2007, such a short time in the life of a football club, yet a space in which so much can be achieved.
A Carling Cup semi-final for a start, incorporating victories over Fulham, Chelsea - at Stamford Bridge of all places, and Arsenal before a Wembley place was cruelly snatched away thanks to two extra-time goals from Tottenham.
A decent FA Cup run, a place in the play-offs. All achieved through neat football. Not Arsene Wenger maybe but definitely no Tony Pulis.
Little wonder Coyle has been elevated to the ranks of potential Celtic manager now Gordon Strachan's first season without the title has triggered his departure from Parkhead.
All those supporters who came down the M6, not far off half the town's population, got their reward after 13 minutes.
The missing corporates may get to see greater finery when Chelsea meet Everton at the weekend. But will they get a story like Elliott's? A former non-league player with Bashley and an honest professional with Bournemouth before heading north for fame if not, by the standards of football's over-inflated wages, fortune.
Elliott's goal was good enough to grace any showpiece occasion. An energetic dart from midfield, a quick look up as the ball broke back to him off Chris McCann, and then a sublime finish, curled into the top corner with Paddy Kenny completely helpless.
Burnley had two chances to seal victory only for that old sweat Robbie Blake to be denied on both occasions.
Yet somehow, despite a succession of penalty appeals that grew louder and the reaction more frustrated, the Blades never looked like cutting through Brian Jensen's guard.
The stupid dismissal of Jamie Ward merely compounded the misery.
- More about:
- Burnley Fc
- Carlos Tevez
- Leyton Orient FC
- Security


text:
U.S. and Canadian scientists in Winnipeg, Manitoba have reported the successful testing of a vaccine for both the Marburg and Ebola viruses in Nature Medicine Magazine this Sunday. According to Steven Jones, the lead scientist behind the study"
"The data would suggest that instead of 100 percent chance of dying, they would have an 80 percent chance of survival."
This would mean that there are only another five to six years until safety tests for humans could be completed for these potential breakthroughs in medical science. This makes these vaccines about halfway through their development life-cycle of 10-15 years.
Ebola has been responsible for just under 1,300 deaths in mostly Sudan and Zaire with about a 70% chance of a violent death from severe blood loss within days of infection. Fortunately, it has not spread to more populated regions of the world with the exception of Reston, Virginia. A strain not dangerous to humans was found in a shipment of monkeys there.
The Marburg virus is considered equally as deadly in the same manner. It also has been isolated to parts of Africa, has similar effects and has an average death rate of about 80%.Powered by Sidelines


text: The First Car Alarm Was Sort Of Like A PuzzleJason Torchinsky4/11/13 3:20pm13EditPromoteGo to permalinkI'm still on a stolen-car kick here, and all the talk of theft prevention and alarms got me wondering just how long car alarm systems have been around? The first recorded car theft happened to, of all people, a Baron. He moved to create the first car alarm.


text:
Is Bera Stationery and Xerox incorrect or missing key business information? Update your Hotfrog listing today.
Contact details
Are these details correct?
Hotfrog INDIA provides information regarding Bera Stationery and Xerox in Pune Maharashtra. Bera Stationery and Xerox is located at Shop No 2, Gokul Plaza Near Bsnl Exchange, Pune Maharashtra 411014 and provides Office Supplies services. Contact them on 098234 13581.
Is Bera Stationery and Xerox in Shop No 2, Gokul Plaza Near Bsnl Exchange, Pune Maharashtra 411014 your business? Claim your listing and attract more leads by adding more content, photos and other business details.
We have more Office Supplies services in Pune Maharashtra available on Hotfrog INDIA. You can update your search for Pune Office Supplies by location, keyword or service options.
Plot No. 40, Gat No. 94, High-Cliff Industrial Estate Pune Maharashtra 412207
Usha Homoeo Clinic B2/9, Saudamini Society, Bhusari Colony, Pune Maharashtra 411038
Plot No 11 Block D1 MIDC Chinchwad Pune Maharashtra 411 019
Rainbow Plaza, 2nd floor, SrNo 1316/196, Plot no 705, Above Reliance Jewels, Opp Modern High School Shivajinagar Pune Maharashtra 411005
Small Business Hub
Sharing tips, ideas and advice to help grow your small business.
Your profile without ads
Have you considered upgrading to Hotfrog AdVantage? No competitor advertising means exclusive focus on your business. You take centre stage.
Create your free Hotfrog business profile
Follow Hotfrog on:
Share on:
Hotfrog Small Business Hub


text:
IT Sector Discovers Real Political Clout in Indiana Law Protest
NEWS ANALYSIS: The tech community is now realizing the business and political power it holds when it agrees on a position for a cause and decides to act on it.Rarely does the tech community agree on a single issue, and it's even rarer when it mobilizes for concerted action. But when it does, as it is now protesting a pending state law in Indiana, watch out. The one thing right now that just about everybody in the tech community agrees upon is that Indiana Senate Enrolled Act No. 101, which would allow state residents to hide behind their religious beliefs to discriminate against gays and lesbians, is patently unjust and a step backward in the evolution of human rights. This perceived injustice against the LGBT community, a large component of the Bay Area and IT culture, has struck a nerve. You can read the five-page Indiana document here in PDF format. We're not going to debate the merits or demerits of the bill here, nor will we discuss similar legislation coming up for sanctioning in other states. There's plenty of other analysis elsewhere on those topics. What we are discussing here is how Silicon Valley, through this event, is realizing its power potential in terms of business control and, subsequently, in influencing the thinking of large numbers of voters who pay close attention to the tech community. That undoubtedly equates to millions of people, and thus it translates into tremendous indirect political power.
Reaction Against Indiana SB101 Was Instantaneous
--The emergence of unfair and restrictive laws aimed at making it more difficult for minority citizens to register to vote;
--The continuing debate about the viability of climate change due to industrialization;
--The slow but certain crumbling of U.S. physical ecosystems, including the highways, bridges and electricity grid. We, of course, could go on. All of these noted here are directly connected to the IT industry, as well as our society at large. It's all very intriguing, and the conversation about all of this needs to continue.
Loading Comments...


text:
Turkey Confirms Military Strikes Against Syrian Forces, Warns of 'Massive Escalation' in Syria Over Next 24 Hours
Turkey confirms attacks against SAA and Kurdish forces in Syria -- and says more is coming
Its official -- even Turkey's prime minister has confirmed: Turkish forces have attacked Kurdish YPG militias in northern Syria, and have demanded the Kurds withdraw from the airbase they recently captured from "moderate" rebels.
Turkey has also confirmed strikes against the Syrian Arab Army (SAA). Ankara claims the attacks (mostly likely shelling, but it's not 100% clear) were in retaliation for mortar fire from Syrian forces. While this scenario isn't impossible, most likely Turkey is looking to provoke the Syrians into firing the first shot -- then a direct military intervention would be "justified" in the eyes of NATO/The New York Times.
Well, Turkey might just get what it wants:
Syrian Democratic Forces SDF have warned #Turkey that they will retaliate if artillery attacks continue... #Twitterkurds #Rojava— curdistani (@curdistani)
For its part, the US has allegedly asked Turkey to stop attacking Kurdish and SAA forces:
#BREAKING U.S. asks Turkey to stop the bombing of the Kurds and the forces of the regime in Syria— Al Arabiya English (@AlArabiya_Eng)
Whether the request is genuine is another story. Russia however, seems to be completely unamused by Ankara's latest shenanigans. According to sources in Damascus:
Informed regime source: #Russia has decided to close all Syrian-Turkish border crossings by force.— Shami Rap (@ScotMikey1111)
Turkey is now warning of a "massive escalation" in Syria over the next 24 hours. Make sure to check back with us regularly for updates.
If you wish you make a tax-deductible contribution of $1,000 or more, please visit our Support page for instructions
Click here for our commenting guidelines
- 18242 reads


text:
Revised January 2009.
Jay Bliss began his DJing career in his hometown of Sibiu, Romania, organizing underground raves. Over the course of a busy three years he gained much local support and was soon an integral part of Hermannstadt's underground electronic scene.
The year 2003 saw him scoop a first place prize at the first DJ Contest organised at the legendary Chill Out club, and an invitation to mix at the biggest open air event at that time in Romania, DeLa Hoya Festival. A Chill Out club residency was to follow.
After meeting Markus Homm (Freunde Tontraeger / Highgrade / Ostwind) in 2..
View the full artist profile
Track unavailable


text:
What? You mean people are selling plants they don't even have yet? What
will they think of next?
Lu Treadway wrote:
> I also ordered last fall. Cher has gotten delayed shipments from her
> supplier. If there's anything she has in stock, she'll ship it to you
> separate if you ask her to. I got about 20 plants from her last month of
> what she had, everything else is still pending.
> Lu (Atlanta, Zone 7B)
> ---------------------------------------------------------------------
> To sign-off this list, send email to firstname.lastname@example.com with the
> message text UNSUBSCRIBE HOSTA-OPEN
To sign-off this list, send email to email@example.com with the
message text UNSUBSCRIBE HOSTA-OPEN


text:
|Message view
|« Date » · « Thread »
|« Date » · « Thread »
|"David Crossley (JIRA)" <j...@apache.org>
|[jira] Resolved: (FOR-1032) validation problem when using custom DTD for XInclude support
|Thu, 07 Aug 2008 05:43:44 GMT
[ https://issues.apache.org/jira/browse/FOR-1032?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] David Crossley resolved FOR-1032. --------------------------------- Resolution: Fixed Fix Version/s: 0.9-dev I added this as an optional element to the existing document-v20 DTD rather than create a new DTD. That makes it available for forrest-0.9-dev only. If people want use it in forrest-0.8 then you need to copy $FORREST_HOME/main/webapp/resources/schema/dtd/document-v20.mod to the same place in your forrest-0.8 installation. Beware. The xml validation only happens on the top-level xml file. The fragments included via XInclude are not validated. So now people have "enough rope". > validation problem when using custom DTD for XInclude support > ------------------------------------------------------------- > > Key: FOR-1032 > URL: https://issues.apache.org/jira/browse/FOR-1032 > Project: Forrest > Issue Type: Bug > Components: XML grammars & validation > Affects Versions: 0.8 > Reporter: Brolin Empey > Assignee: David Crossley > Fix For: 0.9-dev > > Attachments: catalog.xcat, document-v20-jd.dtd, document-v20-xi.dtd, index-asf.xml > > > I am trying to use a custom DTD to add XInclude support in XDocs source files. My source file, which uses my new doctype and contains an XInclude element, does not validate. > Please see this thread for more details: > http://email@example.com/msg02812.html > The discussion is continued in another thread, so you have to follow my link to the continuing thread. > David Crossley asked me to create this issue. At his request, I am attaching the following files: > - my new DTD > - my project XML Catalog > - a cut-down example of my index.xml file (the page that does not validate) -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.
|View raw message