text:
No one respected the game of baseball more than Carlton Fisk did.
Just ask Deion Sanders.
During a game at Yankee Stadium in 1990, Sanders sauntered up to the plate and proceeded to draw a dollar sign in the dirt with his bat.
Fisk, a veteran catcher with the White Sox at the time, seethed, and when Sanders hit a pop up to the infield and didn't run, Fisk barked, "Run the ball out."
The flamboyant two-sport star didn't acknowledge Fisk, but when he came to the plate later in the game and drew another dollar sign in the dirt, the catching legend had had enough.
"There's a right way and a wrong way to play this game," Fisk yelled at Sanders. "And you're playing this frickin' game wrong and you know something? It offends old guys like me. And if you don't start playing this game right, I'm going to kick your ass right here."
(To listen to Fisk tell the full story, follow this link.)
It was in his role as a gritty guardian of the game that Fisk earned respect from teammates, opponents and fans.
"I admired his work ethic," said Steve Pont, who owns the top Fisk Basic Set on the PSA Set Registry. "He would continuously get hurt or suffer some pains and he'd be back out on the field. I just loved the way he played. He was always tough and I love the way he gave it to someone who would treat the game the way Deion Sanders did."
George Richardson, who owned the registry's top Basic Fisk Set from 2005 to 2010, admires Fisk for similar reasons.
"I like the way he played the game," he said.
Over the years, Fisk has credited his father for his hard-nosed approach. Born in Vermont but raised in New Hampshire, Fisk attended the University of New Hampshire on a basketball scholarship with dreams of becoming a power forward for the Boston Celtics. But at just 6-foot-2, he realized his prospects for a professional career were better on the diamond.
Selected fourth overall by the Red Sox in the 1967 amateur draft, Pudge wouldn't become the club's regular catcher until 1972, when he hit .293 and belted 22 homers to earn American League Rookie of the Year honors.
In June 1974, his career appeared to be over when he tore several knee ligaments in a home plate collision with Leon Lee. Following reconstructive surgery, doctors told Fisk that he'd never play again. But the stubborn New Hampshire native would prove them wrong, returning in 1975 to hit a career-high .331 and cement a permanent place in World Series lore.
In one of the most memorable moments in baseball history, the determined catcher socked a long drive down the left field line off of Reds' hurler Pat Darcy in the 12th inning of Game 6 of the 1975 Fall Classic. Replays show Fisk furiously trying to wave the ball fair. The ball, of course, would ricochet off the foul ball for a game-winning homer.
"One of the earliest games that I remember was in the 1975 World Series. I was born in 1966 so I was just a little kid then and I remember waking up during Game 6 to see the home run," said Pont.
Richardson shares similar recollections.
"I was a catcher when I was growing up. I was 13 when Fisk hit the home run," he said. "I can remember sitting in the living room with my parents begging them to let me stay up to watch the game because it ended well past midnight."
Fisk would play five more seasons in Beantown, before signing with the White Sox in 1981. In the Windy City, he would lead the White Sox to the post-season in 1983 and devote himself to a new weightlifting regimen that would help him wallop a career-high 37 home runs in 1985.
In all, Fisk would connect for 351 homers as a catcher, a record until Mike Piazza surpassed it in 2004. For his efforts, the 11-time all-star was elected to the National Baseball Hall of Fame in 2000.
With Fisk's track record, it's not surprising that a growing legion of collectors are pursuing his PSA Set Registry Sets: Basic (83 items), Master (430 items), Basic Topps (22 items) and Master Topps (117 items).
Fisk's most coveted card is his 1972 Topps rookie (#79) – a single that he appears on with fellow Red Sox "Rookie Stars" Cecil Cooper and Mike Garman.
"The centering is usually off on the rookie card," noted Richardson, who owns a PSA MINT 9 example.
Of the 3,145 rookies submitted, there have been three PSA GEM-MT 10s and 108 PSA 9s. One PSA 10 sold for $10,665.50 in a Memory Lane auction in April 2009.
Manufactured in Canada in significantly smaller quantities than the Topps card, Fisk's O-Pee-Chee rookie (#79) can be distinguished from the Topps single by the French and English text on the card back. Just 107 have been submitted and there have been two PSA 10s and three PSA 9s. One PSA 9 garnered $710 on eBay in September 2008.
Showcasing a horizontal layout, the 1974 Topps single (#105) is one of the most popular Fisk cards amongst collectors.
"The 1974 card is a gorgeous card because Fisk is bending down to take a throw from the outfield and getting ready to block the plate," noted Pont.
"I like the 1974 card because it has an action photo," said Richardson. "I think if you go back and you look at the cards from '72, '73 and '74, there aren't a lot of action photos. I think the Fisk card was one of the first ones."
Just one PSA 10, 1974 Topps Fisk has been uncovered.
Another coveted issue is the 1974 Topps Deckle Edge single. One of the most desirable Topps Test sets of the past 40 years, this offering boasts 72 cards that were reportedly released in packs in Massachusetts and Brooklyn. Measuring 2-7/8" by 5", these pasteboards showcase black and white player photos and distinctive scalloped borders. These cards can be found with gray or white backs. Despite being considerably more scarce, the white backs generally don't command a premium. A PSA 9, 1974 Topps Deckle Edge Fisk fetched $650 on eBay in February 2011.
One of most difficult Fisk items to track down for the Master Set is his 1977 Venezuelan League Sticker (#141). Part of a 50-card subset featuring reproductions of regular 1977 Topps cards, this Fisk single measures 2-3/8" by 3-1/8" and was printed on flimsy stock. These cards were also frequently glued into albums, making them all-but-impossible to find in top condition. Just eight have been sent in to PSA and a PSA VG-EX 4 has been the highest grade recorded.
Demand for these hard-to-find Fisk cards continues to be strong. And though his Cooperstown plaque showcases him in a Red Sox cap, Fisk is equally beloved in Chicago. The catching legend is one of only eight players to have his uniform number retired by two teams.
"Today, whenever he's at Fenway, he still gets an ovation from Red Sox fans that's second to none, and I'm sure White Sox fans would do that too," said Pont. "The fans still respect how he played the game."
Please feel free to contact Kevin Glew at [email protected] if you have any additional information or comments. A special thanks to Dan Larkin for providing pictures for this article. Please note that the Population Report figures quoted and Set Registry rankings reported are those as of August 2011.
|Toughest regular issue 1970s Topps Carlton Fisk cards to find in PSA MINT 9 or better
|Total # of Submissions
|Total # of Submissions
in PSA 9 or Better
|% of Submissions
in PSA 9 or Better
|1972 Topps #79
|1974 Topps #105
|1973 Topps #193
|1976 Topps #365
|1975 Topps #80
|1977 Topps #640
|1978 Topps #270
|1979 Topps #680
|*Based on PSA Population Report statistics as of August 2011


text:
Here is a photo treatment done by my friend George Verge.
"Do you get a lot of requests? No"That is hilarious!
For example, when I was 18, I am very sure that I knew everything.Since then, I don't know as much, but my Mom thinks I know more.Go figure.
Otherwise, not much is on the horizon-- fans of Mister Vapor might enjoy the cdr coming out on Eg0Cide Records in a few weeks. . . "Songs Of The Deep Woods".

subset: commoncrawl


text:
|Frequently Asked Questions
We answer e-mails almost every day, and answer many questions time and time again. Please see most of the common questions that we answer in the faq. If your question is not answered here, please contact us!
What is the comparison between the juicer models as to the noise level while they are in use for normal juicing?
The noise levels are as follows:
Home | Juicers | Wheatgrass Juicers | Citrus Juicers | Blenders | Water Purifiers


text:
British Blend Double Menthol E-Liquid
Price: £1.99
Full Description
UK Made "British Blend" E-Liquid
Strength: Choose from 0mg, 3mg, 6mg, 12mg or 18mg
Flavour: As displayed above.
Bottle Size: 10ml
British Blend PG/VG Mix Ratios:
18mg/ml - 60(PG) / 40(VG) - good throat hit / good vapour (Red Label)
12mg/ml - 50(PG) / 50(VG) - mild throat hit / great vapour (Blue Label)
6mg/ml – 45(PG) / 55(VG) – slight throat hit / excellent vapour (Green Label)
3mg/ml - 40(PG) / 60(VG) - very slight throat hit / massive vapour (Purple Label)
0mg/ml - 40(PG) / 60(VG) - no throat hit / massive vapour (White Label)
All UK orders over £30 Will qualify for FREE NEXT WORKING DAY SHIPPING.
NEXT WORKING DAY courier £3.99 (NI, Highlands, and Scottish Islands may take longer) Orders placed after 3pm will be despatched on the next working day!
Working days are Monday to Friday. Orders placed Before 3PM on Friday will be delivered on Monday, except where premium 'Saturday Delivery' is selected and paid for. Orders placed after 3PM on a Friday, on a Saturday or on a Sunday will be despatched on Monday, and should be delivered on Tuesday.
We can now ship to Jersey and Guernsey. The cost is £17.99. However this will be offset somewhat by the fact that customers in the Channel Islands DO NOT pay VAT on our goods. The prices without the 20% VAT will be shown once you log into an account registered to a Channel Island address.
If you place a small order that doesn't contain E-Liquid, we reserve the right to send some orders out via Royal Mail 1st class signed.
PLEASE NOTE: Whilst we do use a Next Day courier, this is not a guaranteed service. 99% of parcels, to mainland England, do arrive on the next 'working' day, however sometimes parcels take longer. Particularly if the delivery address is not in England. Also around public holidays, the courier may need extra time to clear back logs. Please order in advance, and allow plenty of time for delivery to cover any risk. If your parcel has not arrived after 5 working days, then please feel free to get in touch with us.


text:
Monsanto has petitioned EPA to eliminate the structured non-Bt refuge requirement for farmers in Texas, the Mid-South and the Southeast when they grow the company's Bollgard II cotton technology.
Currently, growers have two refuge options when they plant transgenic Bt (Bollgard or Bollgard II) cotton: Option 1 requires a 20 percent or greater refuge of non-Bt cotton and Option 2 calls for a 5 percent non-Bt refuge that cannot be treated with insecticides for bollworm or tobacco budworm. (If the 5 percent refuge is embedded, it can only be treated if the associated Bt cotton is treated at the same time.)
Both options were designed to provide a source of susceptible bollworm/tobacco moths that can mate with moths that might become resistant to the single Bt gene in Bollgard cotton.
The requirements were suggested by a scientific advisory panel convened by EPA in the mid-1990s to develop strategies to prevent the development of resistance in bollworm and tobacco budworm to the technology.
But Monsanto researchers and some university scientists are saying that the non-Bt cotton refuge acres required to prevent target pests from developing resistance over time are not necessary in the two-gene system of the Bollgard II technology.
The issue, researchers say, is not that they don't need susceptible insects; it's that susceptible insects may come from a large number of alternate crop and native host plants. Scientists have known bollworms can complete larval development on a number of plants, including corn, soybeans and grain sorghum. But they thought the number of hosts for tobacco budworm was limited — until now.
"We have good data from North Carolina and Georgia that show tobacco budworm can be found living on a number of crops and other plants," says J.R. Bradley, professor of entomology at North Carolina State University. "I've even found them on my wife's petunias in my backyard here in Raleigh."
North Carolina and Georgia are two of the six cotton-producing states where Monsanto and cooperating university scientists conducted studies over the last four years to determine the host range for bollworm and tobacco budworm. The tests, which used carbon isotope (C-3/C-4 assays) and gossypol analyses to determine the insects' larval food sources, were expanded to include southeast Texas in 2005.
"We've done two years of studies with bollworm, and we pretty well understand that bollworms (a) have a lot of hosts throughout the season and (b) they're flying significant distances all season long so there is significant mixing from these alternate hosts," said Walt Mullins, Monsanto's technical manager for Bollgard and Bollgard II.
"We have solid reasons to believe there will be contributions on the bollworm side from hosts such as soybeans, peanuts, weedy hosts, corn, sorghum. All are contributing to the overall population, and we've been able to measure that, primarily with C-3/C-4 analyses."
The missing piece of the puzzle has been the tobacco budworm. Most scientists have assumed tobacco budworms would be mostly found in cotton and tobacco, especially during July, August and September when susceptible insects are needed to mate with resistant individuals to prevent resistance development.
But the tests in North Carolina and Georgia showed that minimally 80 to 90 percent of the tobacco budworms found in those states were "non-cotton" moths; that is, they had fed as larvae on plants other than cotton.
"We found significant numbers of tobacco budworm moths in the study, but they were largely non-cotton moths all season long," said Mullins. "We anticipated a certain degree of that based on tobacco as a host. But peanuts are also a fairly good host for tobacco budworms along with soybeans and the diversity of other, weedy hosts for that area.
"But what we were really amazed at was how much the cotton's contribution to moth production was getting drowned out by everything else that was going on. We knew there would be some non-cotton produced tobacco budworms, but we were really surprised at the magnitude of that number."
In the Mid-South and southeast Texas, where growers tend to plant fewer crops besides cotton, the percentages of non-cotton tobacco budworm moths weren't as high. Monsanto conducted the tests in Arkansas, Louisiana, Mississippi and Tennessee in 2004 and added southeast Texas in 2005.
"Southeast Texas is where we saw some of the first pyrethroid resistance in tobacco budworm, and we decided we should include that region in the sampling as well," said Mullins.
In what he called the "worst-case scenario," university and Monsanto researchers saw no less than 10 percent of the moths that were non-cotton moths in any location all season long. The lowest numbers were found in southeast Texas and the lower Delta states.
"That means if you have 100 moths in the comparison at least 10 of those moths came from some other host than cotton," said Mullins, "and, more typically, in Mississippi and northeast Arkansas it would be closer to 40 to 50 percent."
Applying statistical analysis to those numbers means that you could be dealing with numbers of non-cotton moths as high as 10 percent or as low as 1 percent — if you want to be conservative, says Mullins.
From the time Bt cotton was introduced in 1996, entomologists have been using computer models to try to predict how soon and under what conditions tobacco budworms or bollworms could theoretically develop resistance to the single Bacillus thuringiensis or Bt gene contained in Bollgard cotton.
The primary motivation for developing Bollgard II, which contains two different Bt genes, was to enhance the resistance management value of the Bt product, according to Mullins. "It was broadly believed that if you put two genes in the plant that worked differently on the insect, you would reduce the probability of resistant insects surviving both genes and significantly decreasing the effective life of the product.
"If we're talking only 1 percent of the tobacco budworm moths in the lower Delta being non-cotton moths, the model would suggest that the percent of the effective natural refuge that would be required based on the strength of the two-gene system would be less 0.1 of a percent," he said.
"We are proposing that when you look at the amount of refuge necessary for a two-gene product, even in the worst case scenario in our data, that we still have significantly more refuge than what would be required to maintain efficacy of Bollgard II for an extended period of time."
Bradley says entomologists on the East Coast have long believed that cotton producers in the region had ample natural refuge or alternate hosts to provide susceptible tobacco budworm moths for mating with resistant months.
"But we told Monsanto we would not get into the public arena on this until they developed a data base that provided evidence of what was actually happening in the field," he said. "Now we have the data base."
Long considered one of the leading experts on insect pests in cotton, Bradley says the refuge requirement is more than just a theoretical issue for producers. "The fact is that the refuge costs us money — us being the grower," he said. "And if there is no biological need for it, why burden farmers when they need to be doing everything they can to stay in business?"
Roger Leonard, research entomologist with the LSU AgCenter who conducted much of the bollworm/tobacco budworm host study in Louisiana, says he's not ready to weigh into the natural refuge debate just yet.
"I'm on the fence at this point, and I'm willing to listen and review all the data," he said. "I recognize the considerable differences in the ecology of these insects among the cotton production regions, and I want to look at all the data more closely before I start expressing opinions.
"I believe the good news is that there are populations of these insects coming from somewhere other than cotton, and, even if we disagree with some of the findings, some level of these pests are being produced on plants other than cotton.
"I also support recommendations that would increase cotton acreage planted to Bollgard II cultivars. The two genes in Bollgard II provide a broader spectrum of pest control, offer better insect resistance management or IRM qualities and can further reduce oversprays with conventional insecticides."
Mullins said the package Monsanto has submitted to EPA petitions the agency for a natural refuge option for all Bollgard II cotton from Texas east.
"You get west of Texas and you get into pink bollworm area," he said. "They're basically in an eradication mode with the pink bollworm, and these data were generated specifically for bollworm and tobacco budworm."
In February, Monsanto will conduct a series of meetings with university researchers and Extension entomologists, consultants and growers to make them more aware of what the company is proposing.
"We want to provide them with the opportunity to make comments either in support of or opposition to the proposal. We expect EPA to appoint a scientific advisory panel to review the proposal in the spring or early summer, and we want everyone to be fully informed so we can have as broad a discussion as possible."
Both Bollgard and Bollgard II technologies are scheduled to be re-registered in September, and EPA could announce a decision on Monsanto's proposal that coincides with the re-registration decision.
Regardless of when the decision is made, growers must continue to follow EPA's guidelines on Bollgard and Bollgard II. "This in no way means that we are backing away from our commitment to be in compliance with the current refuge requirement for Bollgard and Bollgard II," says Mullins.
Monsanto anticipates that the refuge requirements for Bollgard will remain unchanged. "We will have to work through how we handle that interim period when we still have Bollgard and Bollgard II in the marketplace and appropriately address refuge requirements for both products."
Leonard says he welcomes the meetings, which will be held on a state-by-state basis in the Delta region. "We need to have some frank discussions," he said. "Some of our consultants are skeptical about the information, and we need to thoroughly review the data to be certain we don't do anything that would eliminate this technology as an IPM tool.
"This is the most effective technology that has ever been developed for our producers to manage caterpillar pests in cotton. In the absence of Bt cotton, cotton producers in the Mid-South would suffer dramatic increases in production costs for insect pest management. This is a significant issue that must be considered carefully by the entire U.S. cotton industry. At this point, I'm not sure the public realizes how important this decision could be."
e-mail: email@example.com


text:
Welcome to Abbot's Hospital
"Arguably the finest historic building in Guildford"
The Hospital of the Blessed Trinity or Abbot's Hospital as it is better known today was founded in 1619 by George Abbot, Archbishop of Canterbury as a gift "out of my love to the place of my birth". It was not Abbot's intention to provide a "hospital" in the modern sense of the word but a place of shelter for the elderly poor of the town - 12 single men and 8 single women - under the care of a resident Master. Nearly 400 years after the first residents moved in, Abbot's Hospital continues to offer town centre accommodation within a sociable and supportive environment for local elderly people..
A magnificent Jacobean building listed Grade 1, Abbot's Hospital is opposite Holy Trinity Church where George Abbot is buried and is just yards away from Abbot's memorial statue at the junction of Upper High Street.
Abbot's Hospital can be visited as part of a tour programme and rooms are available for hire as a venue for receptions or corporate events..


text:
The Graduate Certificate in Spiritual Direction is designed for those actively seeking to serve as spiritual directors. The program builds upon their spiritual and practical gifts. Applicants need to demonstrate experience of a call from others for this ministry, a commitment to discerning this call, and a response to the call by developing proper skills needed for spiritual direction.
The program will better equip ministers in their ability to walk the spiritual journey with those seeking guidance. It is open to ministers serving in a variety of pastoral settings. The certificate is not a license for practicing spiritual direction, but is evidence of training in this area.
Certificate students will engage in supervised practice of spiritual direction that provides guidance and stimulates growth in their own spirituality and in the ability to provide spiritual direction. They will explore theoretical and practical issues in spiritual direction in the context of an integrative practicum.
Students learn to identify and interpret biblical themes of spirituality as models for Christian maturity; integrate an understanding of Christian life with a holistic vision of spirituality; foster a theological understanding of faith, grace and personal response to God's spirit; ground the ministry in the community's pastoral life; engage in supervised practice of spiritual direction to develop and refine their skills; and identify issues of spiritual direction in integrative seminars with peers.
Graduate credits earned for the certificate may be applied to our Master of Arts in Pastoral Studies degree.
It is possible for students to complete the certificate in one calendar year (from June to June). Course work can be completed in the classroom, online synchronously, or online asynchronously. The first and fourth practica are on campus.
The required on campus coursework is distributed as follows:
All Spiritual Direction Students
Foundations of Spirituality
The application includes two brief essays, letters of recommendation, transcripts, Miller Analogy Test, and a telephone phone interview with the director of the program. Please apply here. Financial aid is available.
To discuss the program in light of your background and interests, contact us by phone at 314.256.8806 or 800.977.3869; Email: firstname.lastname@example.com.


text:
MANSFIELD, Conn. – A total of six meet and one program record fell at the Eastern Connecticut State University Invitational Friday afternoon. Eclipsing the program mark in the discus throw was freshman Taylor Smith (Burlington, Mass.), who shattered the record which was set in 1986.
With her throw of 129-01 feet, Smith not only broke All-American Debbie D-Etremont's record, but she also set the meet record on her way to a first place finish to lead all throwers.
Hulerie McGuffie (Lynn, Mass.) claimed the meet record on her way to a new personal best in the 100 meter dash with a time of 12.32 seconds. Renee O'Brien (Stoneham, Mass.) posted a second place finish in the 100 and set a new personal best with her time of 12.62 seconds.
Anisha Trappier (Taunton, Mass.) claimed another meet record as she crossed the finish line with a time of 25.24 seconds. The women's 4x100 and 4x400 meter relay teams also set new ECSU meet records. The 4x1 posted a time of 48.82 seconds, while the 4x4 recorded a time of 4:00.99.
On the men's side Carl Joseph (Brockton, Mass.) earned another first place and set the meet record in the high jump with a leap of 6-08.75 feet.
In the 400 meter dash Ari Leao (New Bedford, Mass.) recorded a new personal best with a time of 1:00.55 to earn second place in the event. O'Brien notched a new career best in the high jump with a new mark of 5-03.75 feet to earn first place. McGuffie earned a second place finish in the long jump to help the Beacons earn a fourth place finish overall with her jump of 17-02.75 feet.
After Smith's record setting throw in the discus, Anitra Kloczewiak (Newton, Mass.) and Brittany Moore (Billerica, Mass.) each recorded new personal bests with throws of 100-03 and 95-00 feet respectively. Smith also posted a new career best in the javelin with a throw of 101-00 feet.
On the men's side, Kelly Desane (Cambridge, Mass.) earned a new personal best in the 100 meter dash and took fourth place overall with a time of 11.41 seconds. Fritz Gustave (Fall River, Mass.) posted a time of 23.17 seconds overall in the 200 meter dash.
In the 400 meter dash Nobert Simon (Chelsea, Mass.) and Patrick Powell (Dorchester, Mass.) posted times of 52.89 and 53.88 seconds respectively. Powell's time was also a career best. Tad Delaney (Halifax, Mass.) recorded a new PB in the 800 meter run as he crossed the finish line with a time of 2:11.59.
Xavier Romero (Phoenix, Ariz.) recorded two new personal best the first of which came in the 400 meter hurdles with a time of 59.79 seconds. He then notched a fourth place finish in the long jump with a leap of 20-05.25 feet.
The 4x100 meter relay team earned a second place finish with a time of 43.98 seconds. Tylor Hart (Newton, Mass.) finished in second place in the high jump with a leap of 6-06.75 feet.
Track and Field returns to action next Saturday when they compete at the MIT Invitational.


text:
Expert Overview
Countertops come in an exciting range of options. Beyond the sheer variety of colors and finishes, today there are more materials than ever to choose from, running
the gamut from engineered to recycled materials.
Think about: Esthetics
First decide the look you want to achieve: neutral or statement? Then explore surface types, which include stone, stainless steel, concrete, lavastone, tile, "green"
materials like bamboo or recycled glass. Most of these come in a variety of colors and finishes. Engineered stone, another "green" option, is more durable and less porous
than natural stone so it doesn't stain as easily. It also comes in many color options.
Think about: Durability
Natural stone—granite, marble, slate—holds up well over time; you can cut food and place hot pots on it without worrying about damage. It's also beautiful. However,
it's one of the more costly materials.
Think about: Finishing touches
While many countertops are square-edged, consider rounded or beveled, decorative edges. Also consider mixing and matching: placing a wood inset for chopping, or
using a different surface on the island.


text:
- Date first available at amazon.ae: March 9, 2019
- Average Customer Review: Be the first to review this item
Have one to sell?
Loud Universe Mike Wazowski Quote iPhone 7 Case Monsters University iPhone 7 Cover with 3d Wrap around Edges
This item at this price, sold by amazon.ae, is currently reserved exclusively for Prime members.
Available from these sellers.
1 new from AED89.00
Product details
Have a question?
Find answers in product info, Q&As, reviews
Product description
Features transparent edges with sleek finishes and a sophisticated look. The design is faced at the back of the case with the edges of the phone covered by sleek transparent plastic material. Extra slim lightweight profile offers full protection and durability. Advanced sublimation heat press printing technology gives bright vibrant colors and safeguards case from scratching and fading. - Combines durability and lightweight attributes in a slim form factor - Sturdy exterior protects your device from smudges, scratches and sudden impact - Precisely measured cut-outs allow easy access to all ports and buttons
No customer reviews
|5 star (0%)
|4 star (0%)
|3 star (0%)
|2 star (0%)
|1 star (0%)


text:
Date:Saturday 28th April 2018
Doors Open:19:30
Show Begins:21:00
You're too late to book for this performance as it has ended.
You may only book a maximum of 6 tickets per performance. If you would like to book more then please call our box office on 0131 558 7272
Only members that have paid their annual subscription may access member priced tickets. If you have paid your annual subscription and you cannot select members tickets please call our box office on 0131 558 7272
SORRY, SOLD OUT! If there are any returned tickets they will go back on sale on the door 15 mins before the show starts. Please note it will be standing room only by this point.
Our fabulous flagship Saturday show has been sold out every week for the past five years. And no wonder- it's the best night out in Glasgow. Five different acts on every bill including our top drawer resident comperes and the best headliners from the UK and abroad.
Please note we require a payment in advance for Saturday evenings, there is a 50p surcharge per ticket for all card payments.
With Ben Norris, Andy Fury, Christopher MacArthur-Boyd, Kimi Loughton and host Susie McCabe.
Salt 'n' Sauce Promotions Ltd. Trading as 'The Stand Comedy Club'.
5 York Place, EH1 3EB
0131 558 7272
We are a Living Wage Employer, click here to find out more.
Sign up to receive email to be the first to hear about upcoming shows & special offers.


text:
Initial Entry
First, a very quick bio:
- I am a graduate student at Indiana University (in Bloomington, IN, home of The Bernard Clayton), studying cognitive psychology (on the research side of things, not the clinical/helpful side of things). More specifically I'm studying the evolution of learning and decision making processes. It has been noted several times on the site that folks with a technical bent tend to be drawn into baking. I am indeed one of those folks...My undergraduate education was in physics and computer science, and I spent 8 years as a software developer before the career change.
- One of the most rewarding aspects of being a graduate student, at least for me, is that I get to teach. I love teaching, and I have an immense respect for people that are excited and enthusiastic about sharing their knowledge of any topic. It's one thing to be an expert. It's something totally different to be an expert that can convey your knowledge to others and get them excited about it in the process. That's one of the things that draws me to this site...there are lots of teachers here.
- My wife and I do enjoy lots of other culinary adventures, trying to eat and cook just about anything we can, as time and finances permit. I have always loved to cook, but lately baking is winning out. As a big Alton Brown fan, I was drawn in by his baking book, and I haven't looked back...now I've got a 1/2 dozen baking books around and several more on the "need to pick that up soon" list. It's addicting.


text:
Sherlock and Watson
Sherlock (Jonny Lee Miller) and Watson (Lucy Liu) discover a crime that's been lying dormant for years and sets out to find the intended victim, hoping it will lead them to the perpetrator. Also pictured Jon Michael Hill as Detective Marcus Bell. Photo: Jojo Whilden CBS ©2012 CBS Broadcasting, Inc. All Rights Reserved.


text: Use mouse scroll wheel over image or pinch-to-zoom on touch devices. You can also click and drag around on image. Park it 0 0 Follow Tapout Moto Parked to SS Lifestyle by Speed & Strength Keywords Sign up to add your own keywords More from this Garage: More from this Profile: Project American Beauty Project Black Nine Project Rust and Redemption


text:
Networking is all about connecting computers together, so it follows that a computer network is no more secure than the machines that it connects. A single insecure host can make lots of trouble for your entire network, as it can act as a tool for reconnaissance or a strong base of attack if it is under the control of an adversary. Firewalls, intrusion detection, and other advanced security measures are useless if your servers offer easily compromised services. Before delving into the network part of network security, you should first make sure that the machines you are responsible for are as secure as possible.
This chapter offers many methods for reducing the risks involved in offering services on a Unix-based system. Even though each of these hacks can stand on its own, it is worth reading through this entire chapter. If you only implement one type of security measure, you run the risk of all your preparation being totally negated once an attacker figures out how to bypass it. Just as Fort Knox isn't protected by a regular door with an ordinary dead bolt, no single security feature can ultimately protect your servers. And the security measures you may need to take increase proportionally to the value of what you're protecting.
As the old saying goes, security isn't a noun, it's a verb. That is, security is an active process that must be constantly followed and renewed. Short of unplugging the machine, there is no single action you can take to secure your machine. With that in mind, consider these techniques as a starting point for building a secure server that meets your particular needs.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Secure Mount Points Hack #1}
Use mount options to help prevent intruders from further escalating a compromise.
The primary way of interacting with a Unix machine is through its filesystem. Thus, when an intruder has gained access to a system, it is desirable to limit what he can do with the files available to him. One way to accomplish this is with the use of restrictive mount options.
A mount option is a flag that controls how the filesystem may be accessed. It is passed to the operating system kernel's code when the filesystem is brought online. Mount options can be used to prevent files from being interpreted as device nodes, to disallow binaries from being executed, and to disallow the SUID bit from taking affect (by using the nodev, noexec, and nosuid flags). Filesystems can also be mounted read-only with the ro option.
These options are specified from the command line by running mount with the -o flag. For example, if you have a separate partition for /tmp that is on the third partition of your first IDE hard disk, you can mount with the nodev, noexec, and nosuid flags, which are enabled by running the following command:
# mount -o nodev,noexec,nosuid /dev/hda3 /tmp
An equivalent entry in your /etc/fstab would look something like this:
/dev/hda3 /tmp ext3 defaults,nodev,noexec,nosuid 1 2
By carefully considering your requirements and dividing up your storage into multiple filesystems, you can utilize these mount options to increase the work that an attacker will have to do in order to further compromise your system. A quick way to do this is to first categorize your directory tree into areas that need write access for the system to function and those that don't. You should consider using the read-only flag on any part of the filesystem where the contents do not change regularly. A good candidate for this might be /usr, depending on how often updates are made to system software.
Obviously, many directories (such as /home) will need to be mounted as read-write. However, it is unlikely that users on an average multiuser system will need to run SUID binaries or create device files within their home directories. Therefore, a separate filesystem, mounted with the nodev and nosuid options, could be created to house the users' home directories. In addition, if you've determined that your users will not need to execute programs stored in their home directories, you can use the noexec mount option as well. Similar situations also arise when looking at /tmp and /var, where it is highly unlikely that any process will legitimately need to execute SUID or non-SUID binaries or access device files. This helps prevent the possibility of an attacker leaving a Trojan horse in common directories, such as /tmp or a user's home directory. The attacker may be able to install the program, but it cannot actually run, with or without the proper chmod bits.
Note that services running in a chroot( ) environment [Hack #10] may be broken if nodev is specified on the filesystem running under the chroot. This is because device nodes such as /dev/log and /dev/null must be available within the chroot( ) environment.
There are a number of ways that an attacker can still circumvent these mount restrictions. For example, the noexec option on Linux can be bypassed by using /lib/ld-linux.so to execute binaries residing on such filesystems. At first glance, you'd think that this can be remedied by making ld-linux.so nonexecutable, but this would render all dynamically linked binaries unexecutable. So, unless all of the programs you rely on are statically linked (they're probably not), then the noexec option is of little use in Linux. In addition, an attacker who has already gained root privileges will not be significantly hampered by filesystems mounted with special options, since these can often be remounted with the -o remount option. But by using mount flags, you can easily limit the possible attacks available to a hostile user before he gains root privileges.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Scan for SUID and SGID Programs Hack #2}
Quickly check for potential root-exploitable programs and backdoors.
One potential way for a user to escalate her privileges on a system is to exploit a vulnerability in an SUID or SGID program. SUID and SGID are legitimately used when programs need special permissions above and beyond those that are available to the user who is running them. One such program is passwd. Simultaneously allowing a user to change her password while not allowing any user to modify the system password file means that the passwd program must be run with root privileges. Thus the program has its SUID bit set, which causes it to be executed with the privileges of the program file's owner. Similarly, when the SGID bit is set, the program is executed with the privileges of the file's group owner.
Running ls -l on a binary that has its SUID bit set should look like this:
-r-s–x–x 1 root root 16336 Feb 13 2003 /usr/bin/passwd
Notice that instead of an execute bit (x) for the owner bits, it has an s. This signifies an SUID file.
Unfortunately, a poorly written SUID or SGID binary can be used to quickly and easily escalate a user's privileges. Also, an attacker who has already gained root access may hide SUID binaries throughout your system in order to leave a backdoor for future access. This leads us to the need for scanning systems for SUID and SGID binaries. This is a simple process and can be done with the following command:
# find / ( -perm -4000 -o -perm -2000 ) -type f -exec ls -la {} ;
One important thing to consider is whether an SUID program is in fact a shell script rather than an executable, since it's trivial for someone to change an otherwise innocuous script into a backdoor. Most operating systems will ignore any SUID or SGID bits on a shell script, but if you want to find all SUID or SGID scripts on a system, change the argument to the -exec option in the last command and add a pipe so that the command reads:
# find / ( -perm -4000 -o -perm -2000 )
-type f -exec file {} ; | grep -v ELF
Now every time an SUID or SGID file is encountered, the file command will run and determine what type of file is being examined. If it's an executable, grep will filter it out; otherwise, it will be printed to the screen with some information about what kind of file it is. Most operating systems use ELF-format executables, but if you're running an operating system that doesn't (older versions of Linux used a.out, and AIX uses XCOFF), you'll need to replace the ELF in the previous grep command with the binary format used by your operating system and architecture. If you're unsure of what to look for, run the file command on any binary executable, and it will report the string you're looking for.
For example, here's an example of running file on a binary in Mac OS X:
$ file /bin/sh
/bin/sh: Mach-O executable ppc
To go one step further, you could even queue the command to run once a day using cron and have it redirect the output to a file. For instance, this crontab entry would scan for files that have either the SUID or SGID bits set, compare the current list to the one from the day before, and then email the differences to the owner of the crontab (make sure this is all on one line):
0 4 * * * find / ( -perm -4000 -o -perm -2000 ) -type f
> /var/log/sidlog.new &&
diff /var/log/sidlog.new /var/log/sidlog &&
mv /var/log/sidlog.new /var/log/sidlog
This example will also leave a current list of SUID and SGID files in /var/log/sidlog.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Scan For World- and Group-Writable Directories Hack #3}
Quickly scan for directories with loose permissions.
World- and group-writable directories present a problem: if the users of a system have not set their umask properly, they will inadvertently create insecure files, completely unaware of the implications. With this in mind, it seems it would be good to scan for directories with loose permissions. Much like "Scan for SUID and SGID Programs" [Hack #2], this can be accomplished by running the find command:
# find / -type d ( -perm -g+w -o -perm -o+w ) -exec ls -lad {} ;
Any directories that are listed in the output should have the sticky bit set, which is denoted by a t in the directory's permission bits. A world-writable directory with the sticky bit set ensures that even though anyone may create files in the directory, they may not delete or modify another user's files. If you see a directory in the output that does not contain a sticky bit, consider whether it really needs to be world-writable or whether the use of groups or ACLs [Hack #4] will work better for your situation. If you really do need the directory to be world-writable, set the sticky bit on it using chmod +t.
To get a list of the directories that don't have their sticky bit set, run this:
# find / -type d ( -perm -g+w -o -perm -o+w )
-not -perm -a+t -exec ls -lad {} ;
If you're using a system that creates a unique group for each user (e.g., you create a user andrew, which in turn creates a group andrew as the primary group), you may want to modify the commands to not scan for group-writable directories. (Otherwise, you will get a lot of output that really isn't pertinent.) To do this, run the command without the -perm -g+w portion.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Create Flexible Permissions Hierarchies w/ith POSIX ACLs Hack #4}
When Unix mode-based permissions just aren't enough, use an ACL.
Most of the time, the traditional Unix file permission system fits the bill just fine. But in a highly collaborative environment with multiple people needing access to files, this scheme can become unwieldy. Access control lists, otherwise known as ACLs (pronounced to rhyme with "hackles"), are a feature that is relatively new to the Linux operating system, but has been available in FreeBSD and Solaris for some time. While ACLs do not inherently add "more security" to a system, they do reduce the complexity of managing permissions. ACLs provide new ways to apply file and directory permissions without resorting to the creation of unnecessary groups.
ACLs are stored as extended attributes within the filesystem metadata. As the name implies, they allow you to define lists that either grant or deny access to a given file based on the criteria you provide. However, ACLs do not abandon the traditional permission system completely. ACLs may be specified for both users and groups and are still separated into the realms of read, write, and execute access. In addition, a control list may be defined for any user or group that does not correspond to any of the user or group ACLs, much like the "other" mode bits of a file. Access control lists also have what is called an ACL mask, which acts as a permission mask for all ACLs that specifically mention a user and a group. This is similar to a umask, but not quite the same. For instance, if you set the ACL mask to r–, any ACLs that pertain to a specific user or group and are looser in permissions (e.g., rw-) will effectively become r–. Directories also may contain a default ACL, which specifies the initial ACLs of files and subdirectories created within them.
To modify or remove ACLs, use the setfacl command. To modify an ACL, the -m option is used, followed by an ACL specification and a filename or list of filenames. You can delete an ACL by using the -x option and specifying an ACL or list of ACLs.
There are three general forms of an ACL: one for users, another for groups, and one for others. Let's look at them here:
# User ACL
# Group ACL
# Other ACL
Notice that in the user and group ACLs, the actual user and group names that the ACL applies to are optional. If these are omitted, it means that the ACL will apply to the base ACL, which is derived from the file's mode bits. Thus, if you modify these, the mode bits will be modified and vice versa.
See for yourself by creating a file and then modifying its base ACL:
$ touch myfile
$ ls -l myfile
-rw-rw-r– 1 andrew andrew 0 Oct 13 15:57 myfile
$ setfacl -m u::—,g::—,o:— myfile
$ ls -l myfile
———- 1 andrew andrew 0 Oct 13 15:57 myfile
From this example, you can also see that multiple ACLs can be listed by separating them with commas.
You can also specify ACLs for an arbitrary number of groups or users:
$ touch foo
$ setfacl -m u:jlope:rwx,g:wine:rwx ,o:— foo
$ getfacl foo
# file: foo
# owner: andrew
# group: andrew
Now if you changed the mask to r–, the ACLs for jlope and wine would effectively become r– as well:
$ setfacl -m m:r– foo
$ getfacl foo
# file: foo
# owner: andrew
# group: andrew
jlope:rwx #effective:r–
group:wine:rwx #effective:r–
As mentioned earlier, directories can have default ACLs that will automatically be applied to files that are created within the directory. Default ACLs are set by prepending a d: to the ACL that you want to set:
$ mkdir mydir
$ setfacl -m d:u:jlope:rwx mydir
$ getfacl mydir
# file: mydir
# owner: andrew
# group: andrew
$ touch mydir/bar
$ getfacl mydir/bar
# file: mydir/bar
# owner: andrew
# group: andrew
jlope:rwx #effective:rwgroup::—
As you may have noticed from the previous examples, you can list ACLs by using the getfacl command. This command is pretty straightforward and has only a few options. The most useful is the -R option, which allows you to list ACLs recursively and works very much like ls -R.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Protect Your Logs from Tampering Hack #5}
Use file attributes to prevent intruders from removing traces of their break-in.
In the course of an intrusion, an attacker will more than likely leave telltale signs of his actions in various system logs. This is a valuable audit trail that should be well protected. Without reliable logs, it can be very difficult to figure out how the attacker got in, or where the attack came from. This information is crucial in analyzing the incident and then responding to it by contacting the appropriate parties involved [Hack #100]. However, if the breakin attempt is successful and the intruder gains root privileges, what's to stop him from removing the traces of his misbehavior?
This is where file attributes come in to save the day (or at least make it a little better). Both Linux and the BSDs have the ability to assign extra attributes to files and directories. This is different from the standard Unix permissions scheme in that the attributes set on a file apply universally to all users of the system, and they affect file accesses at a much deeper level than file permissions or ACLs [Hack #4]. In Linux you can see and modify the attributes that are set for a given file by using the lsattr and chattr commands, respectively. Under the BSDs, ls -lo can be used to view the attributes, and chflags can be used to modify them. At the time of this writing, file attributes in Linux are available only when using the ext2 and ext3 filesystems. There are also kernel patches available for attribute support in XFS and reiserfs.
One useful attribute for protecting log files is append-only. When this attribute is set, the file cannot be deleted, and writes are only allowed to append to the end of the file.
To set the append-only flag under Linux, run this command:
# chattr +a filename
Under the BSDs, use this:
# chflags sappnd filename
See how the +a attribute works by creating a file and setting its append-only attribute:
# touch /var/log/logfile
# echo "append-only not set" > /var/log/logfile
# chattr +a /var/log/logfile
# echo "append-only set" > /var/log/logfile
bash: /var/log/logfile: Operation not permitted
The second write attempt failed, since it would overwrite the file. However, appending to the end of the file is still permitted:
# echo "appending to file" >> /var/log/logfile
# cat /var/log/logfile
append-only not set
appending to file
Obviously, an intruder who has gained root privileges could realize that file attributes are being used and just remove the append-only flag from our logs by running chattr –a. To prevent this, we need to disable the ability to remove the append-only attribute. To accomplish this under Linux, use its capabilities mechanism. Under the BSDs, use its securelevel facility.
The Linux capabilities model divides up the privileges given to the allpowerful root account and allows you to selectively disable them. In order to prevent a user from removing the append-only attribute from a file, we need to remove the CAP_LINUX_IMMUTABLE capability. When present in the running system, this capability allows the append-only attribute to be modified. To
modify the set of capabilities available to the system, we will use a simple utility called lcap (http://packetstormsecurity.org/linux/admin/lcap-0.0.3.tar.bz2).
To unpack and compile the tool, run this command:
# tar xvfj lcap-0.0.3.tar.bz2 && cd lcap-0.0.3 && make
Then, to disallow modification of the append-only flag, run:
# ./lcap CAP_LINUX_IMMUTABLE
# ./lcap CAP_SYS_RAWIO
The first command removes the ability to change the append-only flag, and the second command removes the ability to do raw I/O. This is needed so that the protected files cannot be modified by accessing the block device they reside on. It also prevents access to /dev/mem and /dev/kmem, which would provide a loophole for an intruder to reinstate the CAP_LINUX_ IMMUTABLE capability. To remove these capabilities at boot, add the previous two commands to your system startup scripts (e.g., /etc/rc.local). You should ensure that capabilities are removed late in the boot order, to prevent problems with other startup scripts. Once lcap has removed kernel capabilities, they can be reinstated only by rebooting the system.
The BSDs accomplish the same thing through the use of securelevels. The securelevel is a kernel variable that can be set to disallow certain functionality. Raising the securelevel to 1 is functionally the same as removing the two previously discussed Linux capabilities. Once the securelevel has been set to a value greater than 0, it cannot be lowered. By default, OpenBSD will raise the securelevel to 1 when in multiuser mode. In FreeBSD, the securelevel is –1 by default.
To change this behavior, add the following line to /etc/sysctl.conf:
Before doing this, you should be aware that adding append-only flags to your log files will most likely cause log rotation scripts to fail. However, doing this will greatly enhance the security of your audit trail, which will prove invaluable in the event of an incident.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Delegate Administrative Roles Hack #6}
Let others do your work for you without giving away root privileges.
The sudo utility can help you delegate some system responsibilities to other people, without giving away full root access. It is a setuid root binary that executes commands on an authorized user's behalf, after she has entered her current password.
As root, run /usr/sbin/visudo to edit the list of users who can call sudo. The default sudo list looks something like this:
root ALL=(ALL) ALL
Unfortunately, many system administrators tend to use this entry as a template and grant unrestricted root access to all other admins unilaterally:
root ALL=(ALL) ALL
rob ALL=(ALL) ALL
jim ALL=(ALL) ALL
david ALL=(ALL) ALL
While this may allow you to give out root access without giving away the root password, this method is truly useful only when all of the sudo users can be completely trusted. When properly configured, the sudo utility provides tremendous flexibility for granting access to any number of commands, run as any arbitrary uid.
The syntax of the sudo line is:
user machine=(effective user) command
The first column specifies the sudo user. The next column defines the hosts in which this sudo entry is valid. This allows you to easily use a single sudo configuration across multiple machines.
For example, suppose you have a developer who needs root access on a development machine, but not on any other server:
peter beta.oreillynet.com=(ALL) ALL
The next column (in parentheses) specifies the effective user that may run the commands. This is very handy for allowing users to execute code as users other than root:
peter lists.oreillynet.com=(mailman) ALL
Finally, the last column specifies all of the commands that this user may run:
david ns.oreillynet.com=(bind) /usr/sbin/rndc,/usr/sbin/named
If you find yourself specifying large lists of commands (or, for that matter, users or machines), then take advantage of sudo's Alias syntax. An Alias can be used in place of its respective entry on any line of the sudo configuration:
User_Alias ADMINS=rob,jim,david
User_Alias WEBMASTERS=peter,nancy
Runas_Alias DAEMONS=bind,www,smmsp,ircd
Host_Alias WEBSERVERS=www.oreillynet.com,www.oreilly.com,www.perl.com
Cmnd_Alias PROCS=/bin/kill,/bin/killall,/usr/bin/skill,/usr/bin/top
Cmnd_Alias APACHE=/usr/local/apache/bin/apachectl
WEBMASTERS WEBSERVERS=(www) APACHE
It is also possible to specify system groups in place of the user specification, to allow any user who belongs to that group to execute commands. Just preface the group with a %, like this:
%wwwadmin WEBSERVERS=(www) APACHE
Now any user who is part of the wwwadmin group can execute apachectl as the www user on any of the web server machines.
One very useful feature is the NOPASSWD: flag. When present, the user won't have to enter a password before executing the command:
rob ALL=(ALL) NOPASSWD: PROCS
This will allow the user rob to execute kill, killall, skill, and top on any machine, as any user, without entering a password.
Finally, sudo can be a handy alternative to su for running commands at startup out of the system rc files:
(cd /usr/local/mysql; sudo -u mysql ./bin/safe_mysqld &)
sudo -u www /usr/local/apache/bin/apachectl start
For that to work at boot time, the default line root ALL=(ALL) ALL must be present.
Use sudo with the usual caveats that apply to setuid binaries. Particularly if you allow sudo to execute interactive commands (like editors) or any sort of compiler or interpreter, you should assume that it is possible that the sudo user will be able to execute arbitrary commands as the effective user. Still, under most circumstances this isn't a problem, and it's certainly preferable to giving away undue access to root privileges.
—Rob Flickenger
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Automate Cryptographic Signature Verification Hack #7}
Use scripting and key servers to automate the chore of checking software authenticity.
One of the most important things you can do for the security of your system is to be familiar with the software you are installing. You probably will not have the time, knowledge, or resources to actually go through the source code for all of the software that you are installing. However, verifying that the software you are compiling and installing is what the authors intended it to be can go a long way toward preventing the widespread distribution of Trojan horses. Recently, several pivotal pieces of software (such as tcpdump, LibPCap, Sendmail, and OpenSSH) have had Trojaned versions distributed. Since this is an increasingly popular vector for attack, verifying
your software is critically important.
Why is this even an issue? Unfortunately, it takes a little bit of effort to verify software before installing it. Either through laziness or ignorance, many system administrators overlook this critical step. This is a classic example of "false" laziness, as it will likely lead to more work for the sysadmin in the long run. This problem is difficult to solve because it relies on the programmers and distributors to get their acts together. Then there's the laziness aspect: many times, software packages don't even come with a signature to use for verifying the legitimacy of what you've downloaded. Often, signatures are available right along with the source code, but in order to verify the code, you must then hunt through the site for the public key that was used to create the signature. After finding the public key, you have to download it, verify that the key is genuine, add it to your keyring, and finally check the signature of the code.
Here is what this would look like when checking the signature for Version 1.3.28 of the Apache web server using GnuPG (http://www.gnupg.org):
# gpg -import KEYS
# gpg -verify apache_1.3.28.tar.gz.asc apache_1.3.28.tar.gz
gpg: Signature made Wed Jul 16 13:42:54 2003 PDT using DSA key ID 08C975E5
gpg: Good signature from "Jim Jagielski <firstname.lastname@example.com>"
gpg: aka "Jim Jagielski <firstname.lastname@example.com>"
gpg: aka "Jim Jagielski <firstname.lastname@example.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
Fingerprint: 8B39 757B 1D8A 994D F243 3ED5 8B3A 601F 08C9 75E5
As you can see, it's not terribly difficult to do, but this step is often overlooked when you are in a hurry. This is where this hack comes to the rescue. We'll use a little bit of shell scripting and what are known as key servers to reduce the number of steps to perform this process.
Key servers are a part of a public-key cryptography infrastructure that allows you to retrieve keys from a trusted third party. A nice feature of GnuPG is its ability to query key servers for a key ID and to download the result into a local keyring. To figure out which key ID to ask for, we rely on the fact that the error message generated by GnuPG tells us which key ID it was unable to find locally when trying to verify the signature.
In the previous example, if the key that GnuPG was looking for had not been imported prior to verifying the signature, it would have generated an error like this:
gpg: Signature made Wed Jul 16 13:42:54 2003 PDT using DSA key ID 08C975E5
gpg: Can't check signature: public key not found
The following script takes advantage of that error:
KEYID="0x`gpg –verify $1 $2 2>&1 | grep 'key ID' | awk '{print $NF}'`"
gpg –no-default-keyring –keyring $VENDOR_KEYRING –recv-key
–keyserver $KEYSERVER $KEYID
gpg –keyring $VENDOR_KEYRING –verify $1 $2
The first line of the script specifies the keyring in which the result from the key server query will be stored. You could use pubring.gpg (which is the default keyring for GnuGP), but using a separate file will make managing vendor public keys easier. The second line of the script specifies which key server to query (the script uses search.keyserver.net; another good one is pgp.mit.edu). The third line attempts (and fails) to verify the signature without first consulting the key server. It then uses the key ID it saw in the error, and prepends an 0x in order to query the key server on the next line. Finally, GnuPG attempts to verify the signature, and specifies the keyring in which the query result was stored.
This script has shortened the verification process by eliminating the need to search for and import the public key that was used to generate the signature. Going back to the example of verifying the Apache 1.3.28 source code, you can see how much more convenient it is to verify the package's authenticity:
# checksig apache_1.3.28.tar.gz.asc apache_1.3.28.tar.gz
gpg: requesting key 08C975E5 from HKP keyserver search.keyserver.net
gpg: key 08C975E5: public key imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: Warning: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: Signature made Wed Jul 16 13:42:54 2003 PDT using DSA key ID 08C975E5
gpg: Good signature from "Jim Jagielski <firstname.lastname@example.com>"
gpg: aka "Jim Jagielski <email@example.com>"
gpg: aka "Jim Jagielski <firstname.lastname@example.com>"
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
Fingerprint: 8B39 757B 1D8A 994D F243 3ED5 8B3A 601F 08C9 75E5
With this small and quick script, both the number steps needed to verify a source package and the amount of time needed have been reduced. As with any good shell script, it should help you to be lazy in a good way: by doing more work properly, but with less effort on your part.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Check for Listening Services Hack #8}
Find out whether unneeded services are listening and looking for possible backdoors.
One of the first things that should be done after a fresh operating system install is to see what services are running, and remove any unneeded services from the system startup process. You could use a port scanner (such as nmap [Hack #42]) and run it against the host, but if one didn't come with the operating system install, you'll likely have to connect your fresh (and possibly insecure) machine to the network to download one. Also, nmap can be fooled if the system is using firewall rules. With proper firewall rules, a service can be completely invisible to nmap unless certain criteria (such as the source IP address) also match. When you have shell access to the server itself, it is usually more efficient to find open ports using programs that were installed with the operating system. One program that will do what we need is netstat, a program that will display various network-related information and statistics.
To get a list of listening ports and their owning processes under Linux, run this:
# netstat -luntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1679/sshd
udp 0 0 0.0.0.0:68 0.0.0.0:* 1766/dhclient
From the output, you can see that this machine is probably a workstation, since it just has a DHCP client running along with an SSH daemon for remote access. The ports in use are listed after the colon in the Local Address column (22 for sshd and 68 for dhclient). The absence of any other listening processes means that this is probably a workstation, and not a network server.
Unfortunately, the BSD version of netstat does not let us list the processes and the process IDs (PIDs) that own the listening port. Nevertheless, the BSD netstat command is still useful for listing the listening ports on your system.
To get a list of listening ports under FreeBSD, run this command:
# netstat -a -n | egrep 'Proto|LISTEN'
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 *.587 *.* LISTEN
tcp4 0 0 *.25 *.* LISTEN
tcp4 0 0 *.22 *.* LISTEN
tcp4 0 0 *.993 *.* LISTEN
tcp4 0 0 *.143 *.* LISTEN
tcp4 0 0 *.53 *.* LISTEN
Again, the ports in use are listed in the Local Address column. Many seasoned system administrators have memorized the common port numbers for popular services, and can see that this server is running SSH, SMTP, DNS, IMAP, and IMAP+SSL services. If you are ever in doubt about which services typically run on a given port, either eliminate the -n switch from netstat (which tells netstat to use names but can take much longer to run when looking up DNS addresses) or manually grep the /etc/services file:
# grep –w 993 /etc/services
imaps 993/udp # imap4 protocol over TLS/SSL
imaps 993/tcp # imap4 protocol over TLS/SSL
Also notice that, unlike the output of netstat on Linux, we don't get the PIDs of the daemons themselves. You might also notice that no UDP ports were listed for DNS. This is because UDP sockets do not have a LISTEN state in the same sense that TCP sockets do. In order to display UDP sockets, you must add udp4 to the argument for egrep, thus making it 'Proto|LISTEN|udp4'. However, due to the way UDP works, not all UDP sockets will necessarily be associated with a daemon process.
Under FreeBSD, there is another command that will give us just what we want. The sockstat command performs only a small subset of what netstat can do, and is limited to just listing information on both Unix domain sockets and Inet sockets.
To get a list of listening ports and their owning processes with sockstat, run this command:
# sockstat -4 -l
root sendmail 1141 4 tcp4 *:25 *:*
root sendmail 1141 5 tcp4 *:587 *:*
root sshd 1138 3 tcp4 *:22 *:*
root inetd 1133 4 tcp4 *:143 *:*
root inetd 1133 5 tcp4 *:993 *:*
named named 1127 20 tcp4 *:53 *:*
named named 1127 21 udp4 *:53 *:*
named named 1127 22 udp4 *:1351 *:*
Once again, we see that sshd, SMTP, DNS, IMAP, and IMAP+SSL services are running, but now we have the process that owns the socket plus its PID. We can now see that the IMAP services are being spawned from inetd instead of standalone daemons, and that sendmail and named are providing the SMTP and DNS services.
For most other Unix-like operating systems you can use the lsof utility (ftp://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof/). lsof is short for "list open files" and, as the name implies, allows you to list files that are open on a system, in addition to the processes and PIDs that have them open. Since sockets and files work the same way under Unix, lsof can also be used to list open sockets. This is done with the -i command-line option.
To get a list of listening ports and the processes that own them using lsof, run this command:
# lsof -i -n | egrep 'COMMAND|LISTEN'
named 1127 named 20u IPv4 0xeb401dc0 0t0 TCP *:domain (LISTEN)
inetd 1133 root 4u IPv4 0xeb401ba0 0t0 TCP *:imap (LISTEN)
inetd 1133 root 5u IPv4 0xeb401980 0t0 TCP *:imaps (LISTEN)
sshd 1138 root 3u IPv4 0xeb401760 0t0 TCP *:ssh (LISTEN)
sendmail 1141 root 4u IPv4 0xeb41b7e0 0t0 TCP *:smtp (LISTEN)
sendmail 1141 root 5u IPv4 0xeb438fa0 0t0 TCP *:submission (LISTEN)
Again, you can change the argument to egrep to display UDP sockets. However, this time use UDP instead of udp4, which makes the argument 'COMMAND|LISTEN|UDP'. As mentioned earlier, not all UDP sockets will necessarily be associated with a daemon process.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Prevent Services from Binding to an Interface Hack #9}
Keep services from listening on a port instead of firewalling them.
Sometimes you might want to limit a service to listen on only a specific interface. For instance, Apache [Hack #50] can be configured to listen on a specific interface as opposed to all available interfaces. You can do this by using the Listen directive in your configuration file and specifying the IP address of the interface:
Listen 192.168.0.23:80
If you use VirtualHost entries, you can specify interfaces to bind to on a pervirtual-host basis:
<VirtualHost 192.168.0.23>
You may even have services that are listening on a TCP port but don't need to be. Database servers such as MySQL are often used in conjunction with Apache, and are frequently set up to coexist on the same server when used in this way. Connections that come from the same machine that MySQL is installed on use a domain socket in the filesystem for communications. Therefore, you don't need to have MySQL listening on a TCP socket. To do this, you can either use the –skip-networking command-line option when starting MySQL or specify it in the [mysqld] section of your my.cnf file:
Another program that you'll often find listening on a port is your X11 server, which listens on TCP port 6000 by default. This port is traditionally used to enable remote clients to connect to your X11 server so they can draw their windows and accept keyboard and mouse input; however, with the advent of SSH and X11 forwarding, this really isn't needed anymore. With X11 forwarding enabled in ssh, any client that needs to connect to your X11 server will be tunneled through your SSH connection and will bypass the listening TCP port when connecting to your X11 server. To get your X Windows server to stop listening on this port, all you need to do is add -nolisten tcp to the command that is used to start the server. This can be tricky, though — figuring out which file controls how the server is started can be a daunting task. Usually, you can find what you're looking for in /etc/X11.
If you're using gdm, open your gdm.conf and look for a line similar to this one:
Then just add -nolisten tcp to the end of the line.
If you're using xdm, look for a file called Xservers and make sure it contains a line similar to this:
:0 local /usr/X11R6/bin/X -nolisten tcp
Alternatively, if you're not using a managed display and instead you're using startx or a similar command to start your X11 server, you can just add -nolisten tcp to the end of your startx command. To be sure that it is passed to the X server process, start it after an extra set of hyphens:
$ startx — -nolisten tcp
Once you start X, fire up a terminal and see what is listening using lsof or netstat [Hack #8]. You should no longer see anything bound to port 6000.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.
{mospagebreak title=Restrict Services with Sandboxed Environments Hack #10}
Mitigate system damage by keeping service compromises contained.
Sometimes keeping up with the latest patches just isn't enough to prevent a break-in. Often, a new exploit will circulate in private circles long before an official advisory is issued, during which time your servers may be open to unexpected attack. With this in mind, it's wise to take extra preventative measures to contain the aftermath of a compromised service. One way to do this is to run your services in sandbox environments. Ideally, this lets the service be compromised while minimizing the effects on the overall system.
Most Unix and Unix-like systems include some sort of system call or other mechanism for sandboxing that offers various levels of isolation between the host and the sandbox. The least restrictive and easiest to set up is a chroot( ) environment, which is available on nearly all Unix and Unix-like systems. In addition to chroot( ), FreeBSD includes another mechanism called jail( ), which provides a few more restrictions beyond those provided by chroot( ).
chroot( ) very simply changes the root directory of a process and all of its children. While this is a powerful feature, there are many caveats to using it. Most importantly, there should be no way for anything running within the sandbox to change its effective UID (EUID) to 0, which is root's UID. Naturally, this implies that you don't want to run anything as root within the jail. If an attacker is able to gain root privileges within the sandbox, then all bets are off. While the attacker will not be able to directly break out of the sandbox environment, it does not prevent him from running functions inside the exploited processes' address space that will let him break out. There are many ways to break out of a chroot( ) sandbox. However, they all rely on being able to get root privileges within the sandboxed environment. The Achilles heel of chroot( ) is possession of UID 0 inside the sandbox.
There are a few services that support chroot( ) environments by calling the function within the program itself, but many services do not. To run these services inside a sandboxed environment using chroot( ), we need to make use of the chroot command. The chroot command simply calls chroot( ) with the first command-line argument and attempts to execute the program specified in the second argument. If the program is a statically linked binary, all you have to do is copy the program to somewhere within the sandboxed environment; but if the program is dynamically linked, you will need to copy all of its supporting libraries to the environment as well.
See how this works by setting up bash in a chroot( ) environment. First we'll try to run chroot without copying any of the libraries bash needs:
# mkdir -p /chroot_test/bin
# cp /bin/bash /chroot_test/bin/
# chroot /chroot_test /bin/bash
chroot: /bin/bash: No such file or directory
Now we'll find out what libraries bash needs, which you can do with the ldd command, and attempt to run chroot again:
# ldd /bin/bash
libtermcap.so.2 => /lib/libtermcap.so.2 (0x4001a000)
libdl.so.2 => /lib/libdl.so.2 (0x4001e000)
libc.so.6 => /lib/tls/libc.so.6 (0x42000000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
# mkdir -p chroot_test/lib/tls &&
> (cd /lib;
> cp libtermcap.so.2 libdl.so.2 ld-linux.so.2 /chroot_test/lib;
> cd tls; cp libc.so.6 /chroot_test/lib/tls)
# chroot /chroot_test /bin/bash
bash-2.05b# echo /*
/bin /lib
Setting up a chroot environment mostly involves trial and error in getting permissions right and all of the library dependencies in order. Be sure to consider the implications of having other programs such as mknod or mount available in the chroot environment. If these were available, the attacker could possibly create device nodes to access memory directly or to remount filesystems, thus breaking out of the sandbox and gaining total control of the overall system. This threat can be mitigated by putting the directory on a filesystem mounted with options that prohibit the use of device files (as in "Secure Mount Points" [Hack #1]), but that isn't always convenient. It is advisable to make as many of the files and directories in the chrooted directory as possible owned by root and writable only by root, in order to make it impossible for a process to modify any supporting files (this includes files such as libraries and configuration files). In general it is best to keep permissions as restrictive as possible, and to relax them only when necessary (for example, if the permissions prevent the daemon from working properly).
The best candidates for a chroot( ) environment are services that do not need root privileges at all. For instance, MySQL listens for remote connections on port 3306 by default. Since this port is above 1024, mysqld can be started without root privileges and therefore doesn't pose the risk of being used to gain root access. Other daemons that need root privileges can include an option to drop these privileges after completing all the operations for which it needs root access (e.g., binding to a port below 1024), but care should be taken to ensure that the program drops its privileges correctly. If a program uses seteuid( ) rather than setuid( ) to drop its privileges, it is still possible to gain root access when exploited by an attacker. Be sure to read up on current security advisories for programs that will run only with root privileges.
You might think that simply not putting compilers, a shell, or utilities such as mknod in the sandbox environment may protect them in the event of a root compromise within the restricted environment. In reality, attackers can accomplish the same functionality by changing their code from calling system("/bin/sh") to calling any other C library function or system call that they desire. If you can mount the filesystem that the chrooted program runs from using the read-only flag [Hack #1], you can make it more difficult for attackers to install their own code, but this is still not quite bulletproof. Unless the daemon you need to run within the environment can meet the criteria discussed earlier, you might want to look into using a more powerful sandboxing mechanism.
One such mechanism is available under FreeBSD and is implemented through the jail( ) system call. jail( ) provides many more restrictions in isolating the sandbox environment from the host system and provides additional features, such as assigning IP addresses from virtual interfaces on the host system. Using this functionality, you can create a full virtual server or just run a single service inside the sandboxed environment.
Just as with chroot( ), the system provides a jail command that uses the jail( ) system call. The basic form of the jail command is:
jail new root hostname ipaddr command
where ipaddr is the IP address of the machine on which the jail is running.
Try it out by running a shell inside a jail:
# mkdir -p /jail_test/bin
# cp /bin/sh /jail_test/sh
# jail /jail_test jail_test 192.168.0.40 /bin/sh
# echo /*
This time, no libraries needed to be copied, because FreeBSD's /bin/sh is statically linked.
On the opposite side of the spectrum, we can build a jail that can function as a nearly full-function virtual server with its own IP address. The steps to do this basically involve building FreeBSD from source and specifying the jail directory as the install destination.
You can do this by running the following commands:
# mkdir /jail_test
# cd /usr/src
# make world DESTDIR=/jail_test
# cd /etc && make distribution DESTDIR=/jail_test -DNO_MAKEDEV_RUN
# cd /jail_test/dev && sh MAKEDEV jail
# cd /jail_test && ln -s dev/null kernel
However, if you're planning to run just one service from within the jail, this is definitely overkill. Note that in the real world you'll most likely need to create /dev/null and /dev/log device nodes in your sandbox environment for most daemons to work correctly.
|If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today!
Visit the O'Reilly Network http://www.oreillynet.com for more online content.


text:
Bob Doran
After graduating I went to work for AMF Inc. which was a large diversified global company. Early in 1962 I took a leave from AMF and spent six months on active duty with the Ct. National Guard. In October 1962 I married Dotsie my wife of 49 years. We have two daughters Susan and Kathy and a grandson Reid
In 1963 I accepted a position as an Export Manager for Thermatool Corp. in AMF's International Division which was based at their headquarters in NYC. In 1972 AMF sold Thermatool Corp.,to another large privately owned company Inductotherm Industries. I was offered the opportunity to work for Inductotherm/Thermatool and I accepted. The decision to go with Thermatool was a good one as AMF eventually declared bankruptcy and went out of business.
My career with Thermatool was spent in the sales and marketing of equipment which is used in high speed production lines to produce various welded products from coiled strip . One of he main products produced was small and large diameter welded tube and pipe which is used in many diverse automotive,furniture, and structural applications and for the transmission of water, oil, and gas. Fifty percent of Thermatool's business was outside of the USA which gave me the opportunity to travel all over the World including to China where in the mid 1980's Thermatool was one of the first American companies who made significant sales. I retired from Thermatool in 2008 as the Vice President of Sales and Marketing.
Since retiring Dotsie and I have spent our time taking cruises with friends. I also enjoy fishing. Dotsie continues to run the Interior Design firm in Greenwich which was started by her great aunt in the late 1920's and which she took over from her mother when she retired in the 1970's. Our daughter Kathy also works for the firm.
We are both looking forward to attending the 50th reunion and to renewing friendships with class mates that we have not seen in fifty years.


text:
Veterinary Equipment
50 CC Multi-Dose Syringe and Syringe Kits$18.00A sturdy, lightweight, economical multi-dose syringe. Features 1-5 cc accurate adjustable dosages. Learn More
Disinfectant Mat$37.95Place at the entrance to your barn so everyone's feet are disinfected before they enter. When filled, mat repels dirt and is effective for one week before it needs to be emptied and refilled. Learn More
1/2" and 1" Needles$0.20Needles to fit disposable syringes. In 20 gauge size that is best for goats. The 1/2" length is the choice for most injections. 1" works better for subcutaneous injections. Each needle comes sealed in a protective case. Also available in boxes of 100 needles. Learn More
3 cc, 6 cc, 12 cc, and 35 cc Syringes$0.20Our sterile, disposable, polypropylene syringes are each sealed in a protective jacket. Needles are not included. 3 cc, 6 cc, and 12 cc syringes are also available in box of 100 syringes. Learn More
3 cc Syringe and Needle Combo -- Box of 100$20.953 cc Syringe and Needle Combo -- Box of 100. Learn More
3 cc Syringe and Needle Combo$0.40A 3 cc syringe and needle, packaged as one unit. 20 gauge, 1" needle. Also available by the box. Learn More
Small Burdizzo$59.95Fine precision tool in a small size for castrating goat kids and lambs aged 1 week to about 6 months. Can also be used to remove wattles and extra teats. High quality steel; precision fitted, nickel-plated instrument with patented cord stops. Learn More
Surgical Scissors$6.95Stainless steel scissors, 6 inches in length. A must for all medical boxes. Scissors have one blade with a sharp, pointed end; the other blade is rounded and blunt. Excellent for opening abscesses, cutting off loose skin around wounds, and other medical needs around the farm. Learn More
Elastrator Rings$1.10Package of 100 elastrator rings. Learn More
Elastrator (No Rings Included)$14.95For "rubber band" method of castration. Uses special extra-thick rubber rings, stretches them wide open. Please purchase rings separately. Learn More


text:
The Seattle Mariners are hosting the Rays on Friday evening, and because they already had a bobblehead night for Felix Hernandez, they have no choice but to start honoring local grunge rockers. Friday night is Mike McCready night at Safeco Field, which also happens to overlap with a benefit night for the Crohn's & Colitis Foundation of America. Nothing like a McCready national anthem and reminders about crippling intestinal disorders to excite a crowd about baseball.
Mariners To Give Away Pearl Jam Bobbleheads [Ted Williams Head]


text:
A $4 Find in a Secondhand Bookstore
A Copy of the Diary
A Copy of the Diary
written by
Right: The Ship 'Great Britain' on which Mother Mary Paul Mulquin sailed to Australia in 1873.
Whilst rummaging through a secondhand bookstore recently, as I am commonly apt to do, I discovered a plastic sleeve containing a hard bound typed manuscript bearing the price tag of a mere $4. As I reached inside the plastic sleeve I felt my excitement growing as I saw a document entitled, 'A Copy of the Diary of Mother Mary Paul Mulquin' on board the 'Great Britain' 1873.' I can never resist an exciting 'find' and though I realised that this was only a copy of the diary, I made my purchase,already curious to discover what I could about Mother Mary Paul Mulquin and her Diary.
After a brief read through the copy of the diary, I could see that it appeared capably written and significantly, that it contained a great deal of interesting information about the 1873 voyage to Australia, of the ship Great Britain.
Right: The first entry in Mother Mary Paul Mulquin's Diary
Not wasting a moment when I arrived home, I began to read the diary in depth. Mother Mary Paul Mulquin's quaint style of writing proved to be a fascinating and most compelling story. The Catholic Sister's use of language was masterful and her entertaining and descriptive writing kept me reading late into the night. Such lovely use of words, as those I have reproduced in the diary excerpts below, transported me back in time, to the world in which Mother Mary Paul Mulquin and her fellow sisters lived, more than 140 years ago. Her words gave me more than a mere glimpse but rather, generously permitted me to share the every pleasure and pain of her meticulously recorded long voyage from Ireland to Australia.
The diary was fascinating and detailed, from the very first passage. The excitement felt by Mother Mary Paul Mulquin was infectious and one could not help but admire the courage of this nun and her fellow religious sisters as they embarked on their journey to a brave new world. Her emotions are conveyed through her every word.
'We started from our loved convent and sisters at 11 a.m. Oct., 22nd (Wednesday) and met at the terminus a throng of relatives and others, such as was rarely if ever, seen before on a like occasion.'
'we felt the novelty of the scene, and resolved at whatever cost, to brave every other danger after breaking ties so near and dear.'
On reaching Dublin, which was the first stop on her journey to England, (where she was to depart for Australia), Mother Mary Paul Mulquin wrote,
'Everyone was so kind, so like our own sisters at home...M Vincent served the sausages, while S.M. Clare who is remarkably like our dear sister Ignatius helped us to veal cutlets and at the end of the table stood a round of beef, after doing justice to all we had apple pie, jelly, wine of various sorts, in fact everything - served in elegant style.'
The more I read of Mother Mary Paul's diary, the more I was irresistibly drawn into her life through her poetic and wonderfully descriptive account of her journey. The following are just a few excerpts from the diary, which I found to be delightful anecdotes detailing the voyage on the Great Britain.
'We have a nice piano in the Ladies' cabin, and some very finished performers in singing and music favour us with their execution.'
'..the bell rang for dinner and we sallied through passages, ascended steep flights of stairs to the saloon a beautiful, lighted apartment, with mirrors all around and tables laden with every variety of viands - a range of every coloured glasses suspended from the ceiling, the seats covered with crimson velvet, and everything that luxury could invent to make the meal agreeable.'
Right: The Dining Saloon as described in the Diary with its crimson velvet seats.
'A harp gave forth its notes very sweetly on deck, the moon shone beautifully so our party took a turn after tea and a more delicious scene could hardly be imagined - all so still -'
The manner in which the author of this diary greeted every trial on board the ship Great Britain revealed her great strength of character, her deep faith and her marvellous sense of humour.
'Walking on deck today is difficult enough. Sliding to the edge at every step, and falling about in all directions, getting up and down stairs is a dangerous business, we sometimes fall back and again on our noses - so anyone to see us would think we were the worse for wear after dinner.'
'It is difficult enough at other times as the vessel dips on both sides - then it is a real novel sight - trying to keep your place. ....I was thrown from the end of the Ladies' cabin into the bathroom, on my back and could not rise for some time - the door burst open by the fall and M. Patrick thinking that I was doing it intentionally began to laugh at the disaster, but instantly she was taken off her feet and pitched to the opposite side while others were laid flat on the corridor - so to see us all getting into the saloon for meals, staggering and holding seats for balance would cause general merriment.'
Right: The deck of the ship 'Great Britain'
After reading Mother Mary Paul Mulquin's extraordinarily detailed account of the voyage of the Great Britain, I found myself compelled to find out more about this brave Nun who left Limerick in Ireland to travel to Australia in 1873.
My first Internet search was of the National Library of Australia's website to find out whether its holdings included the original diary written by this Catholic Sister from Limerick in Ireland. It was immediately obvious to me, that Mother Mary Mulquin must have been a person of considerable interest, as amongst the library's holdings I discovered 'Biographical cuttings on Mother Mary Paul Mulquin, Limerick nun sailed to Australia in 1873, containing one or more cuttings from newspapers or journals.'
A biographical entry in the online Australian Dictionary of Biography (author Kathleen Dunlop Kane) informed me that the sister's name was Katherine Mulquin, that she was born in Limerick in 1842 and died in Australia in 1930. I also discovered several articles written about Mother Mary Paul Mulquin on a site dedicated to the Friends of St Kilda cemetery as well as the Presentation College, Windsor, Melbourne Victoria.
From these websites, I learned that Presentation Convent Windsor, a school in Melbourne, Victoria, was established in 1873 'on the arrival of seven Presentation Sisters from Ireland.'[1] The governments of Australia in 1872, deemed it financially impossible to continue to support Catholic Schools, thus rendering them unable to survive whilst staffed by lay people. The Parish priest at St Mary's, East St Kilda, one Father Corbett quickly wrote a letter to the Presentation Convent in Limerick requesting urgent assistance with the education of Melbourne's growing population of Catholic students. The letter began, 'Dear Reverend Mother. From the ends of the earth I write to you for help....'[2] Along with six other nuns, Mother Mary Paul Mulquin embarked on the long journey to Melbourne, Australia leaving Liverpool, England in September of 1873 and arriving in Port Melbourne on December, 21, 1873. Mother Mary Paul spoke French and Italian fluently and being very fond of music, introduced her pupils to a curriculum which favoured the arts, manners, letter writing and social graces. When the emphasis on academic education for women became essential with the University of Melbourne allowing the admission of women in 1881, Mother Mary Paul, was able to adapt to the change in educational trend and 'examinations began to take precedence over accomplishments.'[3]
On a personal note, I discovered that Mother Mary Paul Mulquin was born, Katherine Mulquin, in 1842, in Adare, Limerick, Ireland, to parents John Mulquin, a farmer and his wife Catherine (maiden surname Sheehy). John and Catherine Mulquin were comfortably well off enough to provide their daughter with a good education at the Faithful Companions of Jesus Convent, Laurel Hill, Limerick. In 1863, aged 21 years, Katherine was professed in the Congregation of the Blessed Virgin Mary as a nun, adopting the religious name of Mary Paul.
Having discovered information about Mother Mary Paul Mulquin, her family, background and place of origin, I then conducted a google search to find out more about the sister's life in Australia, with the group of the Sisters of Presentation from the Limerick Convent. My very first find was a most exciting discovery on the Trove website. A feature article published in the Australian Women's weekly regarding the 100 year Centenary of Presentation College,a school in Windsor, Victoria, in 1973, not only included much biographical information about Mother Mary Paul Mulquin but significantly, revealed the amazing circumstances in which the original diary was discovered.
Right: The Presentation Convent, Windsor, Victoria. Now known as Presentation College.
The diary written by Mother Mary Paul Mulquin, is amongst a collection of letters, photographs and newspaper cuttings which the Presentation College, Windsor now holds in its archives. Some years after the death of Mother Mary Paul, in 1930, two sisters at the presentation Convent were given the task of cleaning out an old tin trunk. As Sister Mary Kavanagh sorted through the contents of the trunk, she became increasingly more fascinated.She described the trunk as 'a miniature museum.'[4] Amongst the items discovered in the trunk which had belonged to Mother Mary Paul Mulquin was the diary which described her voyage to Australia in 1873.
Right: The clipping from the Women's Weekly, from the Trove website, dated November, 28, 1973, which tells of the accidental discovery of Mother Mary Paul Mulquin's Diary.
Right: Eva Anderson who died at age three. her father was unable to remain in the family homeand sold it to the Catholic Church. The house became the first Presentation School in Australia.
From all accounts it is obvious that Mother Mary Paul Mulquin was an intelligent and deeply spiritual woman. Her strength of character, her courage and conviction is evident through her dedication to education and her willingness to leave her homeland to travel a great distance to found a school to educate catholic girls. Mother Mary Paul remained as Superior of the College until 1899 and remained at the Windsor Convent where she died on February, 10 th 1930.
- http://www.foskc.org/mulquin.htm
- Australian Dictionary of Biography - online Edition (Mulquin, Katherine (1842-1930), Biographical Entry.
- http://www.foskc.org/mulquin.htm
- http://trove.nla.gov.au/ndp/del/printArticleJpg/51197412/3?print=y


text:
A 'Monster' achievement
When Jeff Taylor got his bachelor's degree from University of Massachusetts in 2001, one of the speakers at his graduation was an inspirational entrepreneur, the head of one of the most successful Internet companies going. The speaker was, well, Jeff Taylor.
Taylor, the founder of job-hunting site Monster.com, had first come to UMass 23 years earlier, fresh out of Needham High School. For the next 5½ years he worked diligently, selling advertising for the college paper, leading campus tours, running his own DJ service, and producing a summer entertainment guide, among other endeavors.
"I absolutely loved the college environment,'' he said, "but I didn't go to enough classes.''
In 1984, still several credits shy of a degree, Taylor left UMass.
He worked as a full-time DJ, then as a recruiter and an advertising rep before founding Monster in 1994. UMass was 10 years behind Taylor by then, but he says the lessons he learned there helped him develop leadership skills, entrepreneurial vision, and the confidence to take risks. So when Taylor decided to finish his undergraduate degree, he returned to where he started, UMass, this time as part of the University Without Walls program, which allowed him to complete his studies while continuing to run Monster.
Since graduating, Taylor has left Monster, started three new companies, and taken a job as a senior executive with hedge fund Bridgewater Associates in Connecticut. He credits the university for his continued record of accomplishments.
"My university experience,'' he said, "was incredible as a training ground for me to go on to find the successes I have had.''