text:
Some friends have been badgering me to run Mage, not that I have the time. But it did remind me that I've never been totally happy with some of the Traditions' paradigms. Or, rather, that some traditions are long on "stuff they do" and short on "why they think that works." Dreamspeakers, Euthanatos, and Virtual Adepts have always been major offenders. Even the excellent Ascension Campaign 2000 got trapped into explaining more about why Euthanatos kill people than why they think magic works. So, here are my ideas in as short a form as possible. I think all of these are generally in line with the canon splats, but may err on the side of boiling complex mystical beliefs down to something that can be explained to a new player.
Akashic Brotherhood
Do is the way and the way is Do. The world is full of chi and your body is the richest source of it. Knowing ourselves, we can order our minds. Ordering our minds, we can direct our chi. Directing our chi, we can command our form. Commanding our form, we can control our environment. Controlling our environment, we can change our world.
The smallest thought, from the mind of a being in harmony with himself and the world can change everything. By practicing the forms of Do, we bring mind, soul, body, and chi into the harmony required to make our own reality.
Celestial Chorus
Reality is the symphony of the creator. Everything is a note in its song. Some of those notes can make music of their own, creating an infinitely varied score of the cosmos itself. Yet infinite variety brings the risk of discord and dissonance. Some of the notes are wrong, and they infect the rest of the symphony with their flaws.
We have been given the gift of singing in a voice that resonates with the symphony. We can use our powers to try to fix the discord and elevate the song back to the beautiful state envisioned by its first singer.
Cult of Ecstasy
Reality has a heartbeat. We call it Ananda, the pulse of the world, but you could call it Bliss. If you can hear it and you can feel it, you can change it. We have heartbeats of our own. If you can match your own pulse to the world's, you can impose your intentions on your reality.
If you know how to look for the pulse, there are a number of ways to meet it. The best are found in ecstasy: moments of perfect intimacy, altered and elevated states, and strains of pure music. Or, if you're bound to be glib, sex, drugs, and rock and roll.
What we call reality is the dream of spirits. There are many worlds that border ours. This is fact. Many believe that our world is what is real, and those others are our reflection. This is wrong. These worlds are full not just of waking spirits, but of sleeping ones. Their dreams blend together and make this world.
Many know that a spirit may be roused to use its abilities in our world, and it can accomplish many things. But the wisest of men learns to subtly speak to the sleeping ones, changing their dreams and, thus, changing our perception of "real."
Reality is a wheel. Everything turns, powered by the rush of new creation being purified and flowing into Oblivion. Entropy is progress: things that are destroyed merely have their potential released to flow up or down according to their accomplishment while extant. The only bad death is stasis; if things never change, the wheel ceases to turn.
The awake can harness the flow of change. The nearer and greater the change, the easier its motion can be used to turn our own workings. And so we make things happen, and liberate what we can from the flow to ensure that we can remove its obstructions.
Order of Hermes
The cosmos is built on rules. They are not simple to understand. They are the politics of gods and spirits, the correspondences between things that were once one, and the contagion of changes propagating throughout their spheres. Everything we think of as real is the consequence of aeons of accretion from this beautiful morass.
Any can learn some of these rules and to bend them, but only the awake have the intuition to perceive them and the will to force them to change. We are the legates of reality: first you learn the law, then you learn to use it, and then you learn to break it.
Sons of Ether
Reality is weird. Through Science! we can learn how it works. That's not science, with the lowercase, mind you. Ours still uses the real scientific method, the one you were taught in school but not the one the Technocracy imposes (where they quietly keep sleeper scientists from asking the really interesting questions).
An awakened scientist gains an intuition for staying just inside the line between genius and madness. We discover truths that your secret masters have deemed too difficult. And then we use those theories to make tech that you couldn't even dream of. But you will.
Reality is alive. There is a good reason why many great religions come back to a tree: everything that is has grown from what was. If left alone, reality would be a vast and amazing forest, full of wonders. But it has not been left alone, and the best parts of it have been wounded and left to die to make way for the desires of the few.
Those who awake to the nature of the world can learn to prune reality's growth, direct it into new shapes, and even change it on a fundamental level. Blood calls to blood as life calls to life, and we use these truths to tend the garden.
Virtual Adepts
The first thing you need to know about reality is that it's a lie. There is no space, there is no time, and what we perceive as matter is nothing but tiny charges floating in a cosmic void. Everything about it is in flux, at all times, and, if you can figure out the math and where to apply a little quantum pressure, everything is true.
Used to be by the time you'd done the calculations, you had a room full of paper and reality had moved on. But we've got computers, now, and they just keep getting faster. If you can intuit the right inputs and run the right program, anything's possible.


text:
In order for hot foods to stay hot and cold food to remain cold, it is important to understand the temperature limits of different containers in order to ensure the best performance. We often times receive questions from those who want to know if a foam container is microwave-safe or if our oven-safe products can go in the freezer. So, here's a helpful guide that will help you understand your temperature limits to determine the proper use of Genpak products.
Polystyrene (Foam) Containers, Cups, and Dinnerware
Foam has excellent insulation properties and decent thermal resistance making it applicable for both hot and cold foods. Hot foods will stay hot longer and cold foods will stay cold longer in a foamed PS container. Not only is it a popular choice due to its sustainable qualities, but it is also the most versatile substrate and very economical for a variety of food packaging applications. Temperature limit for Genpak's foam products is 150°F
PET – Deli & Bakery Containers, Oven-Ready Containers, and Drinking Cups
PET is a solid plastic material most often used to produce water and soda bottles. PET is a versatile substrate that is widely accepted by most municipalities curbside recycling programs. Genpak's PET containers included up to 30% post-consumer recycled content, in our conservational efforts to eliminate waste, and reduce the burden on the environment. There are two types of Genpak PET products that each have very distinct purposes: APET, which is safe for freezing and room temperature display and CPET, which is safe in the oven, microwave, and freezer.
- APET – Every food item has an expiration date, and APET is a great candidate for offering a longer shelf life. If you've ever come across any of our APET products then you've probably encountered our Clear Hinged Deli Containers, Clear Hinged Bakery Containers, Supermarket Containers, or Cold Drink Cups. Our clear APET products are perfect for savory, natural snacks, cookies, cakes, pastries, confectionary items, cold drinks and much more. Its structural integrity serves as a defense against oxygen to prolong the lifespan of a food item. This substrate also works well under cooler temperatures up to -20◦F, safe for a refrigerator or freezer. From transporting the container from one location to the next, consumers can ensure that it's effective in preserving a food item without caving in or cracking open.
- CPET – CPET material is simply a crystallized form of PET, which is able to withstand very high temperatures for oven ready applications. Great care must be taken when using these products in the oven and we offer a Use & Handling sheet that can guide you through. These products are perfectly safe in the oven, microwave and even the freezer as it can withstand temperatures of up to 400°F.
Polypropylene Containers – Proview, Smart Set Pro, & Harvest Pro
When microwave safe options are required for food packaging, polypropylene is the best choice of materials. Smart Set Pro, ProView, and Harvest Pro are the three product lines that you will want to consider. They are offered in colors such as black and white. We are also the only company to offer a unique textured PP material that allows us to produce products that are up to 20% lighter in weight than most other competitive items, without sacrificing strength or functionality. This translates into much less raw materials being used and lower product cost to our customers. Genpak's microwave-safe containers include Proview, Smart Set Pro, and Harvest Pro. Temperature limit for Genpak's microwave-safe, polypropylene products are 210° F.
Biodegradable & Compostable Products
Genpak Harvest Fiber material is manufactured from renewable resources and is 100% BPI certified compostable. The base fiber material for all of our products is bagasse, which is a byproduct of the sugar industry. Harvest Fiber products are microwave safe and grease & water resistant. Each item is engineered with ease of use in mind. Perfect for preserving temperature, whether hot or cold. In addition to our compostable products, the Harvest Paper product line consists of our paper cone, portion and drink cups. They are produced from raw materials originating from forests managed with Sustainable Forestry Practices and are all compostable. All of our Harvest Paper product configurations are engineered for maximum strength and durability utilizing box pleats, concave surface areas and rolled rims. Temperature limits for Genpak's biodegradable and compostable products are 210° F.< For more information on temperature limits of Genpak products, you can always go to our Materials page where you can stay informed on different types of food packaging and recommended uses.

subset: commoncrawl


text:
Parkway Radiator & Transmission Service has been in business for 25 years, meaning that we've seen almost every kind of car trouble there is. In addition to doing radiator and transmission work, we're equipped to handle general auto repairs. We do driveline repairs, so if you feel a vibration or hear an unfamiliar noise, bring your car by our shop! If you break down, we offer rental cars and towing services.
We also do detailing for cars and boats, so not only will we get your vehicle running smoothly, but it will look great too. For an estimate, or to book an appointment, get in touch with us today. We offer 2-year and unlimited kilometre warranties on our transmission work.
If you have questions, feel free to fill out our eform.
Peterborough area
568 Neal Dr, Peterborough, ON, K9J 6X7
Monday - Friday: 8AM - 5PM
Saturday & Sunday: Closed


text:
Sunset Mai Tai Sunglasses
Maitai" is the Tahitian word for "good." And of course, the Mai Tai is a delicious drink invented in the great state of California. Mai Tais call to mind vacations to tropical locations, lounging by the pool with friends, and spending all day soaking up the sun with a cold drink in hand.
- UV400 protection
- FDA approved impact resistant lenses
- Matte finish
- Reflective lenses


text:
There was a point in time (for probably at least a year and a half, to be honest) where for breakfast I would eat some baked sweet potato, wilted spinach and top it with a pair of soft fried eggs and hot sauce.
If you're wondering what that breakfast was actually like, darling Megan wrote a post about it once and all of her photos/instructions are 100% better than anything I could ever construct.
When I got back from the Texas Trip That I Haven't Blogged About Yet in December, I ate it for a week and was completely repulsed. I don't know if I was just "over" the eggs or if it was the whole spinach tastes like earth-thing or what, but I could not do it.
So I've been on a bit of a toast crusade for the past month or so.
It has involved a lot of avocado toast.
Avocado toast is really not a new thing in this house. I've been known to bring the fixings for lunch during the week if Marcus and I are out of leftovers (I really try to avoid buying lunch at all costs!) and it has made its appearance for breakfast/lunch on the weekend more times than I can count!
I've also been actioning a lot of smoked salmon + cream cheese.
Because smoked salmon = fancy. It has honestly been ages since it has made an appearance on the grocery list and it is one of my favorites. I remember the first time I ate "lox." We were on a Carnival cruise when I was in third grade and we were sitting down to breakfast in the formal dining room (my parents were insistent upon this – we were not buffet eaters). I don't know how they determined that an eight year old needed to try bagels and lox for breakfast instead of say, pancakes, but that is what they ordered for me and it has been love ever since.
Considering the fact that it used to take me a solid 15 minutes to get my breakfast assembled in the morning (heating up the spinach and potatoes, frying the eggs, cleaning the pans), clearly these are much faster options. Toasting has freed up extra time for me to sleep in, log more intense workouts (without having to wake up before 5:00 AM), and to just relax a little bit more as I get ready for my day.
I'll be honest, switching from my sweet potato-spinach-egg breakfast to this one worried me just a bit, because that meal was loaded with protein and fiber. But! This has done a great job of keeping me full. Next week? I may just have to try a mashed banana-almond butter-honey-combo.


text: Hello, I'm Rachelle Telford. I like to say I found myself on my 30th birthday when I purchased my first DSLR. After I began taking pictures I noticed the unique beauty in each and every face. It brings me great joy to capture that beauty. I hope you have nice portraits of you and your loved ones on display in your home (not just cell phone pictures on social media). As a child my family had professional family pictures taken almost every year. Each photo has been printed and carefully placed in a photo book as well as framed and hung on the wall. My kids always enjoy admiring the photos on display at my parents' house. I recognize their value. Please contact me and let's get you some high quality portraits of you and your loved ones.


text:
Our Services
Why Choose Us?
- Over 17 Years Of Experience
- Flexible Hours
- Doctor Of Medicine
- Certified Holistic Health Practitioner
- Bachelors Of Science In Psychology
- Background In Pathology
- JMT Certified Practitioner
- Highly Trained & Experienced
- Allergy Testing (Hair Analysis & ALCAT Sales Science)
- Attention To Detail
- Large Scope Of Knowledge Of The Body
- Expert In Multiple Sclerosis
- Motivational Speaker
- Webinars
- Customized Lifestyle Programs
- In-Person, Telephone, & Skype Consultations
- Will Travel To Off-site Appointments
- Weekly Newsletters
- AAA+ Rating With The BBB
- Health Detox Program
- Health Supplement Distributor
Business Hours
|9:00 AM to 5:00 PM
|9:00 AM to 5:00 PM
|9:00 AM to 5:00 PM
|9:00 AM to 5:00 PM
|9:00 AM to 5:00 PM
|By Appointment
By Appointment.
Call To Schedule Yours Today!
The Circle of Life
This exercise will help you to discover which primary foods you are missing the most. The Circle of Life has 12 sections. Look at each section and place a dot on the line marking how satisfied you are with each area of your life. A dot placed at the center of the circle or close to the middle indicates dissatisfaction, while a dot placed on the periphery indicates ultimate happiness. When you have placed a dot on each of the lines, connect the dots to see your circle of life. You will have a clear visual of any imbalances in primary food and a starting point for determining where you may wish to spend more time and energy to create balance and joy in your life.
Current Promotions:
Free Health History Consultation!
Designs For Health 14 Day Detox Special!
Greco Holistic Health & Wellness E-Store
Call Today For Details!
Contact Us Today
Certificates & Degrees:
- Doctor Of Medicine
- Certified Holistic Health Practitioner
- JMT Certified
- Bachelor Degree in Psychology


text:
2018 Red Kettle Campaign
Thanks to all who signed up to work a one-hour shift as a bell-ringer between noon and 6:00 p.m on Saturday, December 8th at Price Chopper.
A total of $1,572 was collected for Madison County! Worn Again Thrift Shop additionally donated $500 to The Salvation Army in 2018, raising the total to $2,072 available to the communities of Lebanon, Bouckville, Brookfield, Earlville, Hamilton, Hubbardsville, Leonardsville, Madison, North Brookfield, Poolville, and Solsville.
First Baptist Church
27 Broad Street, Hamilton, NY 13346 315-824-2780
American Baptist Churches USA American Baptist Churches of New York State
Colgate University
Chamber Singers
Thursday, November 1st
7:00 p.m.
Colgate's superb chamber singers performed here at the university's mother church.
International Student
Fellowship Dinner
First Baptist Church
Every Friday at 5:30 p.m.
During Colgate Semesters
Christian Women's Fellowship
First Baptist Church
Next meeting: February 21st
Open to the public
Click here to learn more about CWF.
Men's Fellowship Breakfast
First Baptist Church
Third Saturday of each month
7:30 a.m.
Next breakfast: August 17th
All are welcome.
Good food
Good fellowship
Bring a friend!
Adult Sunday School Class
First Baptist Church
Every Sunday at 9:30 a.m.
Fall through Spring
This past year:
Series by Ray Vander Laan on Biblical places in the desert
Interwoven Hearts
Interdenominational Women's Bible Study
Thursdays beginning Jan. 31st
9 to 11 a.m. or 6:30 to 8:30 p.m.
The Quest by Beth Moore: 7-week study in which you will find greater intimacy with God as you ask and discuss deeper questions of faith
To sign up for a study,
call Meg Parfitt
at (315) 794-2141
Click here


text:
16 CALABARZON protected areas to be part of 100 in Expanded NIPAS Act of 2015
Department of Environment and Natural Resources Region 4A CALABARZON Regional Director Reynulfo Juan (left), in his presentation during the National Protected Area Management Board (PAMB) Conference held recently at the Ace Hotel in Pasig City, revealed that only one out of the 17 protected areas in Calabarzon is considered a full fledged Protected Area by virtue of Republic Act No. 9847 which established the Mts. Banahaw-San Cristobal Protected Landscape (MBSCPL) in 2009, and 16 others including the Taal Vocano Protected Landscape (TVPL), Mounts Palaypalay and Mataas Na Gulod Protected Landscape (MPPMNGPL), Pamitinan Protected Landscape (PPL), Upper Marikina River Basin Protected Landscape (UMRBPL), Maulawin Spring Protected Landscape (MSPL), Quezon Protected Landscape (QPL), and Hinulugang Taktak Protected Landscape (HTPL), are still awaiting Congressional action for their establishment as Protected Areas.
Juan, who concurrently chairs the 17 Protected Area Management Boards reported to Secretary Ramon J.P. Paje (seated left at head table), environmentalist legislator Senator Loren Legarda (center) and DENR Undersecretary for Field Operations Demetrio Ignacio Jr. (not in photo) and fellow chair and members of the PAMB, on the protection and management efforts of the regional and provincial DENR offices, such as at the Taal Volcano Protected Landscape (TVPL) in Batangas and Cavite where the PAMB formulated a management plan, accordingly agreed to reduce to 6,000 the more that 13,000 fishcages, and organized a Task Force to implement the dismantling of excess fishcages.
The DENR Calabarzon chief also reported the rehabilitation and development of 9,950 hectares within the UMRBPL, 40 hectares in MSPL, 192 hectares in MPPMNGPL, 390 in QPL, through the National Greening Program as part of the rehabilitation of 1.5 million hectares of degraded public forest lands from year 2011 to 2016.
He said, "We had problems with illegal settlers then, but with the help of the local government units, PAMB members, we have them relocated."
"We also had problems with timber poachers and charcoal makers. Instead of putting them in jail, they have been provide with livelihood assistance. They underwent capacity building for nature interpretation and tour guiding and were mobilized as partners in the operation of ecotourism plans and thus diverting their wood-based activities to ecotourism," he revealed.
He also shared, "We had difficulty implementing each PA's management plans due to shortness of resources, but hopefully, with the 16 Calabarzon PAs inclusion in the 100 under the ENIPAS Act, that will be a different scenario. And hopefully better!"


text:
The times, they are a-changin' and it means critical improvements for our kids and communities. In state legislatures across the country, an undercurrent of reform driven by youth advocates and policymakers of both parties has inspired a sea change within juvenile justice systems nationwide. This is dramatically reversing a troubling trend in youth incarceration, while also benefiting kids, saving taxpayer money and keeping communities safe.
For much of the mid-twentieth century, our approach to juvenile justice was largely rooted in a belief that the behavior of youth who committed offenses could be changed through rehabilitation. Following a wave of highly publicized violent youth crimes in the 1980s, our nation took a shift toward increased incarceration, creating laws that defined more behavior as criminal and delivered stiffer penalties. Soon these policies made way for the rapid expansion in the construction of youth correctional facilities and continued a perceived "tough on crime" leadership that would remain for more than two decades.
After years of a one-size-fits-all approach to juvenile justice that relied heavily on the incarceration and imprisonment of youth, the number of juveniles confined in state and county facilities nationwide reached an alarming high in 2000, totaling more than 100,000 kids. Many of these youth were placed in facilities that exposed them to violence, disconnected them from their families and communities, and offered few pathways for rehabilitation that would help prevent the likelihood they would come in contact with the law again and strengthen the skills needed to become contributing members of society.
Since then, a quiet revolution to reverse this trend has brought together advocates and policymakers across a broad spectrum of ideologies in so-called "red" and "blue" states, including, organizations like the National Juvenile Justice Network (NJJN) and the Texas Public Policy Foundation (TPPF).
Although we have different constituencies and agendas - NJJN represents state-based advocates who work toward a more equitable and fair justice system, while TPPF supports the application of conservative principles such as limited government to criminal justice -we have both seen first-hand the effects of our country's broken juvenile system and the growing positive impact of policies that have sought to address these challenges.
To illustrate the impact of policies that have shifted our reliance on incarceration and returned our focus to alternative ways to hold young people accountable without confining them in detention, we've collaborated on a new report, The Comeback States, that examines national and state incarceration trends since the record-setting 63 percent increase in youth detention from 1985 to 2000.
And the progress has been stunning. Since 2000, when the number of kids incarcerated was at a record high, the number of detained or incarcerated youth has decreased by nearly 40 percent nationwide, fully erasing the increase from the previous 15 years.
Since the 1980s, a greater understanding of the development of the teenage brain and adolescent development, decline in youth arrests, effectiveness of evidence-based alternatives, and the growing cost of operating secure facilities, has given way to a new approach to ensuring the best outcomes for our kids and our communities.
The Comeback States report looks at the key policies and practices responsible for this pivotal turnaround, and highlights nine "comeback states" that are leading the nation on this critical juvenile justice effort, including California, Connecticut, Illinois, Ohio, Mississippi, New York, Texas, Washington and Wisconsin.
Each of these states has adopted fiscally sound, evidence-based solutions that have contributed to this remarkable change, including increasing the availability of evidence-based alternatives to incarceration, requiring intake procedures that reduce the use of secure detention facilities, closing or downsizing youth confinement facilities, reducing schools' overreliance on the justice system to address discipline issues, disallowing incarceration for minor offenses, and restructuring juvenile justice responsibilities and finances among the state and counties. In addition to the significant decline in youth incarceration, each of these states also experienced a decline in youth crime over the same period.
There is no denying this is a remarkable time in the history of juvenile justice policy and there is reason to celebrate. But there is still more work to be done in these nine states and in every jurisdiction to address other issues, including the need to better resource our communities so that youth have adequate opportunities and support, the high taxpayer cost of youth incarceration - which exceeds more than $100,000 per child in some states - and the number of youth who are confined for non-serious offenses like breaking school rules.
Too often history has a way of repeating itself. Let us not allow the future of our young people and our communities to receive the same cheap fate. Our collaboration is only the beginning of the common ground that can be achieved when each of us - parents, law enforcement, advocates and legislators - work together to ensure that we are a nation that lives up to its principle of justice for all.


text:
Gas hot water units are becoming increasingly more popular in residential and commercial properties, due to gas being a cheaper and more efficient fuel for heating and cooling in the long-term to electricity. At Aldirect Plumbing & Gas Fitting, we supply and service all of the leading brands in hot water systems, be it gas, electric or solar.
Our technicians will ensure your hot water unit performs optimally all year round, as all of the systems we supply are covered by a comprehensive warranty, with aftersales servicing provided.
We also offer one-off or scheduled maintenance on request for hot water systems purchased through other distributors, or systems that are out of warranty. For supply and servicing of hot water systems, be it electric, gas or solar, contact Aldirect Plumbing & Gas Fitting today.


text:
Listening, the Floundering Communication Skill
Listening. It is a big component of communication and is crucial in fostering human relationships. We've all sat in business meetings or across the table from someone and found our mind wandering while they were talking. Was it our inability to really listen that made us lose focus on the speaker? Listening has taken a back seat to the fast-paced, too often "me first" society in which we live. A lack of listening causes a myriad of issues including miscommunication and arguments which could be avoided if we just took the time to hone this struggling communication skill. So read on for some easy tips to build your listening repertoire.
1) Be objective and keep an open mind, you might learn something new.
2) Don't interrupt, it's just plain rude.
3) Make eye contact. It shows you are paying attention and are interested.
4) Be aware of your body language. Fingers tapping on a table are a sure sign of boredom, and crossed arms say "I'm closed-off to what you are saying".
5) Limit distractions by not looking at your phone or other tech devices.
6) Be patient. Use encouraging words or appropriate facial expressions to show you are listening.
7) Summarize what is being said so they know you are following along.
So next time your mind travels to a sandy beach in Tahiti remember what Activist Bryant H. McGill once said, "One of the most sincere forms of respect is actually listening to what another has to say". Couldn't have said it better myself.


text:
The Vetro Crib is apparently what Beyonce has chosen for her baby daughter Blue Ivy. It is made of clear acrylic and would have set her back a cool $3500. What do you think? I think it would look fabulous with a pink Cot Wrap.
i think it looks like a storage box for files…………..


text:
Dell WM126 Wireless Optical Mouse (USB, Black)
Get rid of cables, clutters, and confusions around your personal computer or laptop with the Dell WM126 Wireless Optical Mouse. This is an ideal computer accessory to use for daily tasks.
Ideal for Home and Office Use
This is a comfortable and convenient wireless mouse. Also, you can connect up to six compatible devices with one receiver, so you can wirelessly connect with your keyboards and mice at office or home.
Long Battery Life
The battery of this computer accessory lasts for up to one-year for uninterrupted performance.
Comfortable Design
The contoured design of this mouse makes it a comfortable computer accessory to use. Also, this is an easy-to-use computer accessory that features three clickable buttons and a scroll wheel.
|Model Name
|System Requirements
|Sales Package
|Other Dimensions
|Warranty Summary
Classy product
Certified Buyer, North Twenty Four Parganas District
Jun, 2018
One Star
Saynwaz Molla
Certified Buyer, Kolkata
Jul, 2017
Certified Buyer, Bangalore
Mar, 2017
Certified Buyer
2 months ago
Waste of money!
Flipkart Customer
Certified Buyer, Vasai Virar
Jan, 2018
Cell battery drains
Gaurav Batra
Certified Buyer, Sonipat
Mar, 2018
Worst experience ever!
Flipkart Customer
Certified Buyer, Bangalore
Sep, 2016
Waste of money!
Ashish Bodhale
Certified Buyer, Dombivli
Mar, 2018
Simplicity at its best....
Jude Fernandes
Certified Buyer, Vasai Virar
Feb, 2018


text:
Community members are welcome to bring their families for fun and interactive groups for adults, teens, and children. Those who attend groups are welcome to come to The Well beginning at 5:30 for a free family-style dinner. There is no cost, but please stop by The Well to register in advance so we can prepare enough dinner.
Back to All Events
Earlier Event: March 4COR Class - Health & Wellness
Later Event: March 5Hon's Honey Production


text:
- For infants through 2-year-olds, we provide safe and clean childcare rooms where they can play and explore with age appropriate toys and activities.
- Preschoolers (ages 3-5) will also get in on the action as their experience will include games, songs, crafts and lessons.
- Homeschooled kids (grades K and above) will complete school assignments in a supervised study hall. Please have your child bring school work they can complete independently.
Please note that no childcare is offered for the December and May Coffeehouses.


text:
|T. Reddy
|Intended status: Standards Track
|M. Boucadair
|Expires: January 9, 2020
|J. Shallow
|July 08, 2019
Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Call Home
This document specifies the DOTS signal channel Call Home service, which enables a DOTS server to initiate a secure connection to a DOTS client, and to receive the attack traffic information from the DOTS client. The DOTS server in turn uses the attack traffic information to identify the compromised devices launching the outgoing DDoS attack and takes appropriate mitigation action(s).
The DOTS Call Home service is not specific to the home networks; the solution targets any deployment which requires to block DDoS attack traffic closer to the source(s) of a DDoS attack.
Please update these statements within the document with the RFC number to be assigned to this document:
Please update this statement with the RFC number to be assigned to the following documents:
Please update TBD statements with the assignment made by IANA to DOTS Signal Channel Call Home.
Also, please update the "revision" date of the YANG module.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 9, 2020.
Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The DOTS signal channel protocol [I-D.ietf-dots-signal-channel] is used to carry information about a network resource or a network (or a part thereof) that is under a Distributed Denial of Service (DDoS) attack. Such information is sent by a DOTS client to one or multiple DOTS servers so that appropriate mitigation actions are undertaken on traffic deemed suspicious. Various use cases are discussed in [I-D.ietf-dots-use-cases].
Internet of Things (IoT) devices are becoming more and more prevalent in home networks, and with compute and memory becoming cheaper and cheaper, various types of IoT devices become available in the consumer market at affordable prices. But on the downside, the main threat being most of these IoT devices are bought off-the-shelf and most manufacturers haven't considered security in the product design. IoT devices deployed in home networks can be easily compromised, they do not have an easy mechanism to upgrade, and IoT manufactures may cease manufacture and/or discontinue patching vulnerabilities on IoT devices (Sections 5.4 and 5.5 of [RFC8576]). However, these vulnerable and compromised devices will continue to be used for a long period of time in the home, and the end-user does not know that IoT devices in his/her home are compromised. The compromised IoT devices are typically used for launching DDoS attacks (Section 3 of [RFC8576]) on victims while the owner/administrator of the home network is not aware about such misbehaviors. Similar to other DDoS attacks, the victim in this attack can be an application server, a host, a router, a firewall, or an entire network.
Nowadays, network devices in a home network offer network security (e.g., firewall or Intrusion Protection System (IPS) service on a home router) to protect the devices connected to the home network from both external and internal attacks. Over the years several techniques have been identified to detect DDoS attacks, some of these techniques can be enabled on home network devices but most of them are used in the Internet Service Provider (ISP)'s network. The ISP offering DDoS mitigation service can detect outgoing DDoS attack traffic originating from its subscribers or the ISP may receive filtering rules (e.g., using BGP flowspec [RFC5575]) from a downstream service provider to filter, block, or rate-limit DDoS attack traffic originating from the ISP's subscribers to a downstream target.
Some of the DDoS attacks like spoofed RST or FIN packets, Slowloris, and Transport Layer Security (TLS) re-negotiation are difficult to detect on a home network device without adversely affecting its performance. The reason is typically home devices such as home routers have fast path to boost the throughput. For every new TCP/UDP flow, only the first few packets are punted through the slow path. Hence, it is not possible to detect various DDoS attacks in the slow path, since the attack payload is sent to the target server after the flow is switched to fast path. Deep Packet Inspection (DPI) of all the packets of a flow would be able to detect some of the attacks. However, a full-fledged DPI to detect these type of DDoS attacks is functionally or operationally not possible for all the devices attached to the home network owing to the memory and CPU limitations of the home routers. Further, for certain DDoS attacks the ability to distinguish legitimate traffic from attacker traffic on a per packet basis is complex. This complexity is due to that the packet itself may look "legitimate" and no attack signature can be identified. The anomaly can be identified only after detailed statistical analysis.
The ISP on the other hand can detect some DDoS attacks originating from a home network (e.g., Section 2.6 of [RFC8517]), but the ISP does not have a mechanism to detect which device in the home network is generating the DDoS attack traffic. The primary reason being that devices in an IPv4 home network are typically behind a Network Address Translation (NAT) border. Even in case of an IPv6 home network, although the ISP can identify the infected device in the home network launching the DDoS traffic by tracking its unique IPv6 address, the infected device can easily change its IPv6 address to evade remediation.
Existing approaches are still suffering from misused access network resources by abusing devices; the support of means for blocking such attacks close to the sources are missing. In particular, the DOTS signal protocol does not discuss cooperative DDoS mitigation between the network hosting an attack source and the ISP to the suppress the outbound DDoS attack traffic originating from that network.
This specification addresses the problems discussed in Section 1.1 and presents the DOTS signal channel Call Home extension, which enables the DOTS server to initiate a secure connection to the DOTS client, and the DOTS client then conveys the attack traffic information to the DOTS server.
A DOTS client relies upon a variety of triggers to make use of the Call Home function (e.g., scrubbing the traffic from the attack source, receiving an alert from an attack target, a peer DDoS Mitigation System (DMS), or a transit provider). The definition of these triggers is deployment-specific. It is therefore out of the scope of this document to elaborate on how these triggers are made available to a DOTS client.
In a typical deployment scenario, the DOTS server is enabled on a Customer Premises Equipment (CPE), which is aligned with recent trends to enrich the CPE with advanced security features. Unlike classic DOTS deployments [I-D.ietf-dots-use-cases], such DOTS server maintains a single DOTS signal channel session for each DOTS-capable upstream provisioning domain [I-D.ietf-dots-multihoming].
For instance, the DOTS server in the home network initiates the Call Home in 'idle' time and then subsequently the DOTS client in the ISP environment can initiate a mitigation request whenever the ISP detects there is an attack from a compromised device in the DOTS server domain (i.e., from within the home network).
The DOTS server uses the DDoS attack traffic information to identify the compromised device in its domain that is responsible for launching the DDoS attack, optionally notifies a network administrator, and takes appropriate mitigation action(s). A mitigation action can be to quarantine the compromised device or block its traffic to the attack target(s) until the mitigation request is withdrawn.
Other motivations for introducing the Call Home function are discussed in Section 1.1 of [RFC8071].
This document assumes that DOTS servers are provisioned with a way to know how to reach the upstream DOTS client(s), which could occur by a variety of means (e.g., [I-D.ietf-dots-server-discovery]). The specification of such means are out of scope of this document.
The aforementioned problems may be encountered in other deployments than those discussed in Section 1.1 (e.g., data centers, enterprise networks). The solution specified in this document can be used for those deployments to block DDoS attack traffic closer to the source(s) of the attack. The Call Home reference architecture is shown in Figure 1.
+-------------+ |Attack Target| +-----+-------+ | /\ | || Target Network ......................|.||.................... | || .--------+-||-------. ( || )-. .' || ' ( Internet || ) ( || -' '-( || ) '------+-||---------' ......................|.||..................... | || Network Provider | || (DMS) .--------+-||-------. ( || )-. .' DOTS || ' ( client || ) ( || -' '-( || ) '------+-||---------' | || ......................|.||....................... | || Source Network .--------+-||-------. ( || )-. .' DOTS || ' ( server || Outbound ) ( || DDoS -' '-( || Attack ) '------+-||---------' | || +-----+-++----+ |Attack Source| +-------------+
Figure 1: Call Home Reference Architecture
It is out of the scope of this document to identify an exhaustive list of such deployments.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.
The reader should be familiar with the terms defined in [RFC8612].
The meaning of the symbols in YANG tree diagrams is defined in [RFC8340].
(D)TLS is used for statements that apply to both Transport Layer Security (TLS) [RFC8446] and Datagram Transport Layer Security (DTLS) [RFC6347]. Specific terms are used for any statement that applies to either protocol alone.
The DOTS signal channel Call Home extension preserves all but one of the DOTS client/server roles in the DOTS protocol stack, as compared to DOTS client-initiated DOTS signal channel protocol [I-D.ietf-dots-signal-channel]. The role reversal that occurs is at the (D)TLS layer; that is, (1) the DOTS server acts as a DTLS client and the DOTS client acts as a DTLS server or (2) the DOTS server acts as a TLS client initiating the underlying TCP connection and the DOTS client acts as a TLS server. The DOTS server initiates (D)TLS handshake to the DOTS client.
For example, a home network element (e.g., home router) co-located with a DOTS server (likely, a client-domain DOTS gateway) is the (D)TLS server. However, when calling home, the DOTS server initially assumes the role of the (D)TLS client, but the network element's role as a DOTS server remains the same. Furthermore, existing certificate chains and mutual authentication mechanisms between the DOTS agents are unaffected by the Call Home function. This Call Home function enables the DOTS server co-located with a network element (possibly behind NATs and firewalls) reachable by only the intended DOTS client and hence the DOTS server cannot be subjected to DDoS attacks.
Figure 2 illustrates a sample Call Home flow exchange:
+--------+ +--------+ | DOTS | | DOTS | | server | | client | +---+----+ +----+---+ (D)TLS client (D)TLS server | | | 1. (D)TLS connection | |----------------------------------->| | 2. Mitigation request | |<-----------------------------------| | ... |
Figure 2: DOTS Signal Channel Call Home Sequence Diagram
The DOTS signal channel Call Home procedure is as follows:
The Heartbeat mechanism used for the Call Home deviates from the one defined in Section 4.7 of [I-D.ietf-dots-signal-channel]. This section specifies the behavior to be followed by DOTS agents for the Call Home.
Once the (D)TLS section is established between the DOTS agents, the DOTS client contacts the DOTS server to retrieve the session configuration parameters (Section 4.5 of [I-D.ietf-dots-signal-channel]). The DOTS server adjusts the 'heartbeat-interval' to accommodate binding timers used by on-path NATs and firewalls. Heartbeats will be then exchanged by the DOTS agents following the instructions retrieved using the signal channel session configuration exchange.
It is the responsibility of DOTS servers to ensure that on-path translators/firewalls are maintaining a binding so that the same external IP address and/or port number is retained for the DOTS signal channel session. A DOTS client MAY trigger their heartbeat requests immediately after receiving heartbeat probes from its peer DOTS server.
When an outgoing attack that saturates the outgoing link from the DOTS server is detected and reported by a DOTS client, the latter MUST continue to use the signal channel even if no traffic is received from the DOTS server.
If the DOTS server receives traffic from the DOTS client, the DOTS server MUST continue to use the signal channel even if the missing heartbeat allowed threshold is reached.
If the DOTS server does not receive any traffic from the peer DOTS client, the DOTS server sends heartbeat requests to the DOTS client and after maximum 'missing-hb-allowed' threshold is reached, the DOTS server concludes the session is disconnected. Then, the DOTS server MUST try to resume the (D)TLS session.
This specification extends the mitigation request defined in Section 4.4.1 of [I-D.ietf-dots-signal-channel] to convey the attacker source prefixes and source port numbers. The DOTS client conveys the following new parameters in the CBOR body of the mitigation request:
The 'source-prefix' parameter is a mandatory attribute when the attack traffic information is signaled by a DOTS client in the Call Home scenario (depicted in Figure 2). The 'target-uri' or 'target-fqdn' parameters can be included in a mitigation request for diagnostic purposes to notify the DOTS server domain administrator, but SHOULD NOT be used to determine the target IP addresses. Note that 'target-prefix' becomes a mandatory attribute in the mitigation request signaling the attack information because 'target-uri' and 'target-fqdn' are optional attributes and 'alias-name' will not be conveyed in a mitigation request.
In order to help attack source identification by a DOTS server, the DOTS client SHOULD include in its mitigation request additional information such as 'source-port-range' or 'source-icmp-type-range'. The DOTS client may not include such information if 'source-prefix' conveys an IPv6 address/prefix.
Only immediate mitigation requests (i.e., 'trigger-mitigation' set to 'true') are allowed; DOTS clients MUST NOT send requests with 'trigger-mitigation' set to 'false'. Such requests MUST be discarded by the DOTS server with a 4.00 (Bad Request).
The DOTS server MUST check that the 'source-prefix' is within the scope of the DOTS server domain in the Call Home scenario. Note that in such scenario, the DOTS server considers, by default, that any routeable IP prefix enclosed in 'target-prefix' is within the scope of the DOTS client. Invalid mitigation requests are handled as per Section 4.4.1 of [I-D.ietf-dots-signal-channel].
The DOTS server domain administrator consent MAY be required to block the traffic from the compromised device to the attack target. An implementation MAY have a configuration knob to block the traffic from the compromised device to the attack target with or without DOTS server domain administrator consent. If the attack traffic is blocked, the DOTS server informs the DOTS client that the attack is being mitigated.
If the attack traffic information is identified by the DOTS server or the DOTS server domain administrator as legitimate traffic, the mitigation request is rejected, and 4.09 (Conflict) is returned to the DOTS client. The conflict-clause (defined in Section 4.4.1 of [I-D.ietf-dots-signal-channel]) indicates the cause of the conflict. The following new value is defined:
Once the request is validated by the DOTS server, appropriate actions are enforced to block the attack traffic within the source network. The DOTS client is informed about the progress of the attack mitigation following the rules in [I-D.ietf-dots-signal-channel]. For example, if the DOTS server is embedded in a CPE, it can program the packet processor to punt all the traffic from the compromised device to the target to slow path. The CPE inspects the punted slow path traffic to detect and block the outgoing DDoS attack traffic or quarantine the device (e.g., using MAC level filtering) until it is remediated, and notifies the CPE administrator about the compromised device.
If a Carrier Grade NAT (CGN, including NAT64) is located between the DOTS client domain and DOTS server domain, communicating an external IP address in a mitigation request is likely to be discarded by the DOTS server because the external IP address is not visible locally to the DOTS server (see Figure 3). The DOTS server is only aware of the internal IP addresses/prefixes bound to its domain. Thus, the DOTS client MUST NOT include the external IP address and/or port number identifying the suspect attack source, but MUST include the internal IP address and/or port number. To that aim, the DOTS client SHOULD rely on mechanisms, such as [RFC8512] or [RFC8513], to retrieve the internal IP address and port number which are mapped to an external IP address and port number.
N | .-------------------. E | ( )-. T | .' ' W | ( ) O | ( DOTS client -' R | '-( ) K | '-------+-----------' | | P | | R | +---+---+ O | | CGN | External Realm V |..............| |...................... I | | | Internal Realm D | +---+---+ E | | R | | --- | .---------+---------. ( )-. .' Source Network ' ( ) ( DOTS server -' '-( ) '------+------------' | +-----+-------+ |Attack Source| +-------------+
Figure 3: Example of a CGN between DOTS Domains
If a MAP Border Relay [RFC7597] or lwAFTR [RFC7596] is enabled in the provider's domain to service its customers, the identification of an attack source bound to an IPv4 address/prefix MUST also rely on source port numbers because the same IPv4 address is assigned to multiple customers. The port information is required to unambiguously identify the source of an attack.
If a translator is enabled on the boundaries of the domain hosting the DOTS server (e.g., a CPE with NAT enabled as shown in Figures 4 and 5), the DOTS server uses the attack traffic information conveyed in a mitigation request to find the internal source IP address of the compromised device and blocks the traffic from the compromised device traffic to the attack target until the mitigation request is withdrawn. Doing so allows to isolate the suspicious device while avoiding to disturb other services.
.-------------------. ( )-. .' Network Provider ' ( (DMS) ) ( DOTS client -' '-( ) '------+------------' | | --- +--+----+ S | | CPE | External Realm O |..............| |................ U | | NAT | Internal Realm R | +-------+ C | | E | .--------+----------. | ( )-. N | .' ' E | ( ) T | ( DOTS server -' W | '-( ) O | '------+------------' R | | K | +-----+-------+ | |Attack Source| +-------------+
Figure 4: Example of a DOTS Server Domain with a NAT Embedded in a CPE
.-------------------. ( )-. .' Network Provider ' ( (DMS) ) ( DOTS client -' '-( ) '---------+---------' | | --- +-----+-----+ S | | CPE/NAT | External Realm O |..............| |................ U | |DOTS server| Internal Realm R | +-----------+ C | | E | .--------+----------. | ( )-. N | .' ' E | ( Local Area Network ) T | ( -' W | '-( ) O | '------+------------' R | | K | +-----+-------+ | |Attack Source| +-------------+
Figure 5: Example of a DOTS Server and a NAT Embedded in a CPE
module: ietf-dots-call-home augment /ietf-signal:dots-signal/ietf-signal:message-type /ietf-signal:mitigation-scope/ietf-signal:scope: +--rw source-prefix* inet:ip-prefix {source-signaling}? +--rw source-port-range* [lower-port] {source-signaling}? | +--rw lower-port inet:port-number | +--rw upper-port? inet:port-number +--rw source-icmp-type-range* | [lower-type] {source-signaling}? +--rw lower-type uint8 +--rw upper-type? uint8
This document augments the "dots-signal-channel" DOTS signal YANG module defined in [I-D.ietf-dots-signal-channel] for signaling the attack traffic information. This document defines the YANG module "ietf-dots-call-home", which has the following tree structure:
This module uses the common YANG types defined in [RFC6991].
<CODE BEGINS> file "firstname.lastname@example.com" module ietf-dots-call-home { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-dots-call-home"; prefix call-home; import ietf-inet-types { prefix inet; reference "Section 4 of RFC 6991"; } import ietf-dots-signal-channel { prefix ietf-signal; reference "RFC YYYY: Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification"; } organization "IETF DDoS Open Threat Signaling (DOTS) Working Group"; contact "WG Web: <https://datatracker.ietf.org/wg/dots/> WG List: <mailto:firstname.lastname@example.com> Author: Konda, Tirumaleswar Reddy <mailto:email@example.com>; Author: Mohamed Boucadair <mailto:firstname.lastname@example.com>; Author: Jon Shallow <mailto:email@example.com>"; description "This module contains YANG definitions for the signaling messages exchanged between a DOTS client and a DOTS server for the Call Home deployment scenario. Copyright (c) 2019 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; revision 2019-04-25 { description "Initial revision."; reference "RFC XXXX: Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Call Home"; } feature source-signaling { description "This feature means that source-related information can be supplied in mitigation requests."; } augment "/ietf-signal:dots-signal/ietf-signal:message-type/" + "ietf-signal:mitigation-scope/ietf-signal:scope" { if-feature source-signaling; description "Attacker source details."; leaf-list source-prefix { type inet:ip-prefix; description "IPv4 or IPv6 prefix identifying the attacker(s)."; } list source-port-range { key "lower-port"; description "Port range. When only lower-port is present, it represents a single port number."; leaf lower-port { type inet:port-number; mandatory true; description "Lower port number of the port range."; } leaf upper-port { type inet:port-number; must ". >= ../lower-port" { error-message "The upper port number must be greater than or equal to lower port number."; } description "Upper port number of the port range."; } } list source-icmp-type-range { key "lower-type"; description "ICMP type range. When only lower-type is present, it represents a single ICMP type."; leaf lower-type { type uint8; mandatory true; description "Lower ICMP type of the ICMP type range."; } leaf upper-type { type uint8; must ". >= ../lower-type" { error-message "The upper ICMP type must be greater than or equal to lower ICMP type."; } description "Upper type of the ICMP type range."; } } } } <CODE ENDS>
IANA is requested to assign the port number TBD to the DOTS signal channel Call Home protocol for both UDP and TCP from the "Service Name and Transport Protocol Port Number Registry" available at: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.
Service Name: dots-call-home Port Number: TBD Transport Protocol(s): TCP/UDP Description: DOTS Signal Channel Call Home Assignee: IESG <email@example.com> Contact: IETF Chair <firstname.lastname@example.com> Reference: RFC XXXX
The assignment of port number 4647 is strongly suggested (DOTS signal channel uses port number 4646).
This specification registers the 'source-prefix', 'source-port-range', and 'source-icmp-type-range' parameters in the IANA "DOTS Signal Channel CBOR Key Values" registry established by [I-D.ietf-dots-signal-channel] (Figure 6).
The 'source-prefix', 'source-port-range', and 'source-icmp-type-range' are comprehension-optional parameters.
+-------------------+------------+--------+---------------+--------+ | Parameter Name | YANG | CBOR | CBOR Major | JSON | | | Type | Key | Type & | Type | | | | | Information | | +-------------------+------------+--------+---------------+--------+ | source-prefix | leaf-list | 0x8000 | 4 array | Array | | | inet: | (TBD1) | | | | | ip-prefix | | 3 text string | String | | source-port-range | list | 0x8001 | 4 array | Array | | | | (TBD2) | | | | source-icmp-type- | list | 0x8002 | 4 array | Array | | range | | (TBD3) | | | | lower-type | uint8 | 0x8003 | 0 unsigned | Number | | | | (TBD4) | | | | upper-type | uint8 | 0x8004 | 0 unsigned | Number | | | | (TBD5) | | | +-------------------+------------+--------+---------------+--------+
Figure 6: Assigned DOTS Signal Channel CBOR Key Values
This document requests IANA to assign a new code from the "DOTS Signal Channel Conflict Cause Codes" registry:
|Mitigation request rejected. This code is returned by the DOTS server to indicate the attack traffic has been classified as legitimate traffic.
URI: urn:ietf:params:xml:ns:yang:ietf-dots-call-home Registrant Contact: The IESG. XML: N/A; the requested URI is an XML namespace.
name: ietf-call-home namespace: urn:ietf:params:xml:ns:yang:ietf-dots-call-home maintained by IANA: N prefix: call-home reference: RFC XXXX
This document requests IANA to register the following URI in the "ns" subregistry within the "IETF XML Registry" [RFC3688]: [RFC7950] within the "YANG Parameters" registry:
This document deviates from classic DOTS signal channel usage by having the DOTS server initiate the (D)TLS connection. DOTS signal channel related security considerations discussed in Section 10 of [I-D.ietf-dots-signal-channel] MUST be considered. DOTS agents MUST authenticate each other using (D)TLS before a DOTS signal channel session is considered valid.
An attacker may launch a DoS attack on the DOTS client by having it perform computationally expensive operations, before deducing that the attacker doesn't possess a valid key. For instance, in TLS 1.3 [RFC8446], the ServerHello message contains a Key Share value based on an expensive asymmetric key operation for key establishment. Common precautions mitigating DoS attacks are recommended, such as temporarily blacklisting the source address after a set number of unsuccessful authentication attempts.
DOTS servers may not blindly trust mitigation requests from DOTS clients. For example, DOTS servers can use the attack flow information in a mitigation request to enable full-fledged packet inspection function to inspect all the traffic from the compromised device to the target or to re-direct the traffic from the compromised device to the target to a DDoS mitigation system to scrub the suspicious traffic. DOTS servers can also seek the consent of DOTS server domain administrator to block the traffic from the compromised device to the target (see Section 3.3.1).
The considerations discussed in [RFC6973] were taken into account to assess whether the DOTS Call Home extension introduces privacy threats.
Concretely, the protocol does not leak any new information that can be used to ease surveillance. In particular, the DOTS server is not required to share information that is local to its network (e.g., internal identifiers of an attack source) with the DOTS client.
The DOTS Call Home extension does not preclude the validation of mitigation requests received from a DOTS client. For example, a security service running on the CPE may require administrator's consent before the CPE acts upon the mitigation request indicated by the DOTS client. How the consent is obtained is out of scope of this document.
Note that a DOTS server can seek for an administrator's consent, validate the request by inspecting the traffic, or proceed with both.
The DOTS Call Home extension is only advisory in nature. Concretely, the DOTS Call Home extension does not impose any action to be enforced within the home network; it is up to the DOTS server (and/or network administrator) to decide whether and which actions are required.
Moreover, the DOTS Call Home extension avoids misattribution by appropriately identifying the network to which a suspect attack source belongs to (e.g., address sharing issues discussed in Section 3.3.1).
Triggers to send a DOTS mitigation request to a DOTS server are deployment-specific. For example, a DOTS client may rely on the output of some DDoS detection systems deployed within the DOTS client domain to detect potential outbound DDoS attacks or on abuse claims received from remote victim networks. Such DDoS detection and mitigation techniques are not meant to track the activity of users, but to protect the Internet and avoid altering the IP reputation of the DOTS client domain.
The following individuals have contributed to this document:
Joshi Harsha McAfee, Inc. Embassy Golf Link Business Park Bangalore, Karnataka 560071 India Email: email@example.com Wei Pan Huawei Technologies China Email: firstname.lastname@example.com
Thanks to Wei Pei, Xia Liang, Roman Danyliw, Dan Wing, Töma Gavrichenkov, Daniel Migault, and Valery Smyslov for the comments.
|K, R., Boucadair, M., Patil, P., Mortensen, A. and N. Teague, "Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification", Internet-Draft draft-ietf-dots-signal-channel-35, July 2019.
|Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997.
|Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004.
|Rescorla, E. and N. Modadugu, "Datagram Transport Layer Security Version 1.2", RFC 6347, DOI 10.17487/RFC6347, January 2012.
|Schoenwaelder, J., "Common YANG Data Types", RFC 6991, DOI 10.17487/RFC6991, July 2013.
|Bjorklund, M., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016.
|Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017.
|Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018.
|Boucadair, M. and R. K, "Multi-homing Deployment Considerations for Distributed-Denial-of-Service Open Threat Signaling (DOTS)", Internet-Draft draft-ietf-dots-multihoming-01, January 2019.
|Boucadair, M. and R. K, "Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server Discovery", Internet-Draft draft-ietf-dots-server-discovery-04, June 2019.
|Dobbins, R., Migault, D., Fouant, S., Moskowitz, R., Teague, N., Xia, L. and K. Nishizuka, "Use cases for DDoS Open Threat Signaling", Internet-Draft draft-ietf-dots-use-cases-17, January 2019.
|Kohler, E., Handley, M. and S. Floyd, "Datagram Congestion Control Protocol (DCCP)", RFC 4340, DOI 10.17487/RFC4340, March 2006.
|Fuller, V. and T. Li, "Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan", BCP 122, RFC 4632, DOI 10.17487/RFC4632, August 2006.
|Handley, M., Rescorla, E. and IAB, "Internet Denial-of-Service Considerations", RFC 4732, DOI 10.17487/RFC4732, December 2006.
|Stewart, R., "Stream Control Transmission Protocol", RFC 4960, DOI 10.17487/RFC4960, September 2007.
|Marques, P., Sheth, N., Raszuk, R., Greene, B., Mauch, J. and D. McPherson, "Dissemination of Flow Specification Rules", RFC 5575, DOI 10.17487/RFC5575, August 2009.
|Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M. and R. Smith, "Privacy Considerations for Internet Protocols", RFC 6973, DOI 10.17487/RFC6973, July 2013.
|Cui, Y., Sun, Q., Boucadair, M., Tsou, T., Lee, Y. and I. Farrer, "Lightweight 4over6: An Extension to the Dual-Stack Lite Architecture", RFC 7596, DOI 10.17487/RFC7596, July 2015.
|Troan, O., Dec, W., Li, X., Bao, C., Matsushima, S., Murakami, T. and T. Taylor, "Mapping of Address and Port with Encapsulation (MAP-E)", RFC 7597, DOI 10.17487/RFC7597, July 2015.
|Watsen, K., "NETCONF Call Home and RESTCONF Call Home", RFC 8071, DOI 10.17487/RFC8071, February 2017.
|Bjorklund, M. and L. Berger, "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018.
|Boucadair, M., Sivakumar, S., Jacquenet, C., Vinapamula, S. and Q. Wu, "A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)", RFC 8512, DOI 10.17487/RFC8512, January 2019.
|Boucadair, M., Jacquenet, C. and S. Sivakumar, "A YANG Data Model for Dual-Stack Lite (DS-Lite)", RFC 8513, DOI 10.17487/RFC8513, January 2019.
|Dolson, D., Snellman, J., Boucadair, M. and C. Jacquenet, "An Inventory of Transport-Centric Functions Provided by Middleboxes: An Operator Perspective", RFC 8517, DOI 10.17487/RFC8517, February 2019.
|Garcia-Morchon, O., Kumar, S. and M. Sethi, "Internet of Things (IoT) Security: State of the Art and Challenges", RFC 8576, DOI 10.17487/RFC8576, April 2019.
|Mortensen, A., Reddy, T. and R. Moskowitz, "DDoS Open Threat Signaling (DOTS) Requirements", RFC 8612, DOI 10.17487/RFC8612, May 2019.
With the call home extension, there is a chance that two DOTS agents can simultaneously establish two DOTS signal channels with different directions (base DOTS signal channel and DOTS signal channel call home). Here is one example drawn from the home network. Nevertheless, the outcome of the discussion is not specific to these networks, but applies to any DOTS call home scenario.
In the call home scenario, the DOTS server in the home network can mitigate the DDoS attacks launched by the compromised device in its domain by receiving the mitigation request sent by the DOTS client in the ISP environment. In addition, the DOTS client in the home network can initiate a mitigation request to the DOTS server in the ISP environment to ask for help when the home network is under a DDoS attack. Such DOTS server and DOTS client in the home network can co-locate in the same home network element (e.g., the Customer Premises Equipment). In this case, with the same peer at the same time the home network element will have the basic DOTS signal channel defined in [I-D.ietf-dots-signal-channel] and the call home DOTS signal channel defined in this specification. Thus these two signal channels need to be distinguished when they are both supported.
In the call home scenario, the DOTS server in, for example, the home network can mitigate the DDoS attacks launched by the compromised device in its domain by receiving the mitigation request sent by the DOTS client in the ISP environment. In addition, the DOTS client in the home network can initiate a mitigation request to the DOTS server in the ISP environment to ask for help when the home network is under a DDoS attack. Such DOTS server and DOTS client in the home network can co-locate in the same home network element (e.g., the Customer Premises Equipment). In this case, with the same peer at the same time the home network element will have the basic DOTS signal channel defined in [I-D.ietf-dots-signal-channel] and the call home DOTS signal channel defined in this specification. Thus these two signal channels need to be distinguished when they are both supported. Two approaches have been considered for distinguishing the two DOTS signal channels, but only the one that using the dedicated port number has been chosen as the best choice.
By using a dedicated port number for each, these two signal channels can be separated unambiguously and easily. For example, the CPE uses the port number 4646 defined in [I-D.ietf-dots-signal-channel] to initiate the basic signal channel to the ISP when it acts as the DOTS client, and uses the port number TBD to initiate the call home signal channel. Based on the different ports, the ISP can directly decide which kind of procedures should follow immediately after it receives the DOTS messages. This approach just requires two (D)TLS sessions to be established respectively for the basic signal channel and call home signal channel.
The other approach is signaling the role of each DOTS agent (e.g., by using the DOTS data channel). For example, the DOTS agent in the home network first initiates a DOTS data channel to the peer DOTS agent in the ISP environment, at this time the DOTS agent in the home network is the DOTS client and the peer DOTS agent in the ISP environment is the DOTS server. After that, the DOTS agent in the home network retrieves the DOTS call home capability of the peer DOTS agent. If the peer supports the call home extension, the DOTS agent needs to subscribe to the peer to use this extension. Then the reversal of DOTS role can be recognized as done by both DOTS agents. When the DOTS agent in the ISP environment, which now is the DOTS client, wants to filter the attackers' traffic, it requests the DOTS agent in the home network, which now is the DOTS server, for help.
Signaling the role will complicate the DOTS protocol, and this complexity is not required in context where call home extension is not required or only when call home extension is needed. Besides, the DOTS data channel may not work during attack time. Even if changing the above example from using the DOTS data channel to the DOTS signal channel, the more procedures will still reduce the efficiency. Using the dedicated port number is much easier and more concise compared to the second approach, and its cost that establishing two (D)TLS sessions is much less. So, using a dedicated port number for the call home extension is chosen in this specification.


text:
Repairs to homeFall 2018 CSANews Issue 108 | Posted date : Sep 06, 2018.Back to list
Can I do repairs to my own property in California (non-permit-required work)? Thanks.
John Bastone
Cobble Hill, BC
Response :
Ed.: Yes, of course. I would be very cautious if it is a rental property, however, and would visit the county office for advice.
Back to list | More articles


text:
Baltimore Indian Wedding Videography
Technology is often the driver of trends in the videography industry. Some trends can be fun, however employing most will only do one thing, put an expiration date on your wedding film. As industry leaders and educators, we often see new videographers allow technology to take the lead and dictate the way a story is told. In contrast, the experienced filmmakers at Pacific Pictures aim to tell a timeless story and employ technology to serve an inspired vision to create a lasting experience strengthened over time.
As one of the finest Indian wedding cinematography studios in the world, Pacific Pictures is often commissioned to capture multiple days of pre-wedding events leading up to our client's wedding. For our Hindu clients, this generally includes grah shanti, mehndi, and sangeet events. Among our most favorite pre-wedding events is the sangeet, a fun, festive event filled with music and dance along with skits and choreographed dance numbers performed for the bride and groom by friends and family. Our approach combines the very best in candid documentary journalism with a touch of modern storytelling to emphasize the spiritual meaning and range of emotion of each pre-wedding event, how that relates to the couple's union of marriage, and using specific sounds and inspired visual imagery to tell the complete story of their wedding.


text:
Hello everyone! Join us this Friday, February 17th from 6PM-8PM in our room VC 3-160 for our second meeting.
Business Casual Attire
Topical News Discussion
History of Wall Street
Careers in Finance
Guest Speaker for the Evening:
Philip Bent
Investment Banking Analyst (Restructuring)
Miller Buckfire
We look forward to seeing you all there!
RSVP HERE: https://www.facebook.com/events/973221116141482/


text:
With the cooler weather ahead fall is a great season to cozy down with some of these excellent reads.
The Leopold and Loeb Files: An Intimate Look at One of America's Most Infamous Crimes
by Nina Barrett
In 1924, University of Chicago students Nathan Leopold and Richard Loeb were young, rich, and looking for a thrill. The crime that came next—the brutal, cold-blood murder of 14-year-old Bobby Franks—would come to captivate the country and unfold into what many dubbed the crime of the century. As the decades passed, the mythology surrounding the unlikely killers continued to capture the interest of new generations, spawning numerous books, fictionalizations, and dramatizations.
In The Leopold and Loeb Files, author Nina Barrett returns to the primary sources—confessions, interrogation transcripts, psychological reports, and more—the kind of rare, pre-computer court documents that were usually destroyed as a matter of course. Until now, these documents have not been part of the murder's central narrative. This first-of-its-kind approach allows readers to view the case through a keyhole and look past all of the stories that have been spun in the last 90 years to focus on the heart of the crime.
Carefully curated and steeped in historical context from Barrett, this book allows the surviving Leopold and Loeb documents, most of which are in the form of either transcripts or narrative, to function as both artifact and literature, recounting the moves of the murder and sentencing hearing as well as addressing the questions that continue to fascinate—issues of morality, sanity, sexuality, religious assimilation, parental grief and responsibility, remorse, and the use of the death penalty.
This comprehensive, ephemera-driven history allows the reader to act as a fly on the wall and speaks powerfully to the unsolved mysteries of this distinct crime, in which the guilt of the perpetrators is unambiguous but almost everything else is open to interpretation.
The Best of Royko: The Tribune Years
by Mike Royko
For more than 30 years, Mike Royko was a part of the daily fabric of Chicagoans' lives, penning often humorous and always honest columns first for the Chicago Daily News, then the Sun-Times, and finally the Tribune. Culled from thousands of his Tribune columns and edited by his son David Royko, this collection offers up his best material from the last stage in his career, which was cut short by his premature death in 1997.
Vintage Chicago: The Best of @vintagetribune on Instagram
by Chicago Tribune Staff (Author), Pamela Bannos
The @vintagetribune Instagram, a beloved photography account produced by the photo editors of the Chicago Tribune, has been mining the newspaper's vast subterranean archives since 2014 and breathing new life into its most gram-worthy black-and-white images.
You won't find the 300 photos in this collection in your typical time capsule. These aren't the dramatic, front-page, history-making photographs we're used to seeing from photojournalists. These are the images that would have been posted had Instagram existed in, say, 1932—the offbeat, gritty, strange, funny, rare, charming, everyday images captured in the moments that happened between the well-documented events that make up the city's official biography.
This book is an unexpected, inspired portrait of one of the world's great metropolises, told through the lenses of the countless feet-on-the-street photographers from the city's hometown paper.
And yes, there are cats. We are talking about Instagram, after all.
Vote Her In: Your Guide to Electing Our First Woman President
by Rebecca Sive
Men are not the enemy, but they are the problem. It's easy to feel angry, but much harder to do something about it. This book shows us how.
Women are wildly underrepresented at every level of the US government: federal, state, and local. Research has shown that women in executive government positions are far more likely than men to commit to policies that benefit women, girls, and other marginalized groups, so after centuries of underrepresentation, it's clear: our best bet for creating a system that is more fair, balanced, and just for everyone is electing our first Madam President—as soon as we can.
Vote Her In is organized around the inspirational messages seen on protest signs carried at the record-breaking 2017 Chicago Women's March. Part One outlines the case for why we need to mobilize now, and Part Two provides a clear strategy for how to do it. Each chapter in Part Two includes an action plan that women can complete to help each other (or themselves) attain political power and work toward electing our first woman president.
Author Rebecca Sive draws on her decades of political experience to create this crucial book, which empowers every American man, woman, and child who cares about our nation's democratic future to harness their collective power in the run-up to 2020 and, at last, form a more perfect union.
The Chicago Tribune Book of the Chicago White Sox: A Decade-by-Decade History
by Chicago Tribune Staff
The Chicago Tribune Book of the Chicago White Sox is a decade-by-decade look at one of the American League's original eight teams, starting with the franchise's Windy City beginnings in 1900 as the Chicago White Stockings (the former name of crosstown rivals the Cubs) and ending with the current team.
For more than a century, the Chicago Tribune has documented every Sox season through original reporting, photography, and box scores. For the first time, this mountain of Sox history has been mined and curated by the paper's sports department into a single one-of-a-kind volume. Each era in Sox history includes its own timeline, profiles of key players and coaches, and feature stories that highlight it all, from the heavy hitters to the no-hitters to the one-hit wonders.
To be a Sox fan means to know breathtaking highs and dramatic lows. The team's halcyon days―starting with the championship it won during the first official season of the newly formed American League in 1901―have always been punctuated with doldrums and stormy stretches, including a period of time in the '80s when it looked likely that the team would leave Chicago. But with the diehard support of their fans, the "Good Guys" have always made a comeback―including the team's landmark 2005 World Series win, the first by any Chicago major league team in 88 years. This book records it all.
The award-winning journalists, photographers, and editors of the Chicago Tribune have produced a comprehensive collector's item that every Sox fan will love.
Someone Has Led This Child to Believe: A Memoir
by Regina Louise
In this unflinching, unforgettable memoir, Regina Louise tells the true story of overcoming neglect in the US foster-care system. Drawing on her experience as one of society's abandoned children, she tells how she emerged from the cruel, unjust system, not only to survive, but to flourish.
After years of jumping from one fleeting, often abusive home to the next, Louise meets a counselor named Jeanne Kerr. For the first time in her young life, Louise knows what it means to be seen, wanted, understood, and loved. After Kerr tries unsuccessfully to adopt Louise, the two are ripped apart—seemingly forever—and Louise continues her passage through the cold cinder-block landscape of a broken system, enduring solitary confinement, overmedication, and the actions of adults who seem hell-bent on convincing her that she deserves nothing, that she is nothing. But instead of losing her will to thrive, Louise remains determined to achieve her dream of a higher education. After she ages out of the system, Louise is thrown into adulthood and, haunted by her trauma, struggles to finish school, build a career, and develop relationships. As she puts it, it felt impossible "to understand how to be in the world."
Eventually, Louise learns how to confront her past and reflect on her traumas. She starts writing, quite literally, a new future for herself, a new way to be. Louise weaves together raw, sometimes fragmented memories, excerpts from real documents from her case file, and elegant reflections to tell the story of her painful upbringing and what came after. The result is a rich, engrossing account of one abandoned girl's efforts to find her place in the world, people to love, and people to love her back.
I received complimentary copies.
Cassandra's Review- The books featured today are a great mix of everything to make hours fly by while enjoying and are perfect for older readers. They are also perfect for coffee table reading and will lead to discussions. Vintage Chicago may be a huge blast of nostalgia for some readers while others can really get a glimpse of what once was. The books can be gifted as well and make a really nice surprise.


text:
New Jersey boasts a number of organizations that actively support the brave men and women who serve, as well as those that have already served, in active duty for the United States. The sacrifices of these men and women are invaluable; that's why countless businesses — including a unique brewery along the Jersey Shore, Backward Flag Brewing Company — employ a variety of ways to serve them, both in front of and behind the counter.
On this episode of Life & Living with Joanna Gagis, Torie Fisher, founder and owner of Backward Flag Brewing Company, visited the set to tell show host Joanna Gagis about how her military service and passion for brewing beer led her to create a brewing company dedicated to helping veterans.
Backward Flag Brewing Company, based out of Forked River, Ocean County, focuses on the quality of its beer nearly as much as it does helping the county's courageous veterans. In fact, much of the brewery's staff are veterans; Fisher herself served 13 total years in active duty and with the Army National Guard.
"I joined the Army right out of high school," said Fisher. "I got stationed in Germany. When my plane landed in Germany, they told us, 'Hey, welcome to Germany. Your unit's already in Iraq. You'll be going there next.'"
It wasn't long until Fisher was deployed to Iraq, where she spent her 19th birthday before eventually being deployed a second time, soon becoming a helicopter crew chief. Following her service, Fisher opened up her own successful brewing company, where she fell into the role fluidly.
"Just in general, the military puts you in positions to be a leader, to make decisions on your own," Fisher explained. "They kind of force you in positions where you need to figure out how to get the job done with very little guidance. And I think that's kind of all the same attributes that you look for in an entrepreneur."
To learn more about Fisher's service and brewery, and how she's supporting our nation's veterans, check out this edition of Life & Living with Joanna Gagis.
For more stories that impact New Jersey residents, click over to our Hot Topics in NJ series.


text:
Peel Zone TutorialThe PEEL Zone is the online hub of the Project PEEL initiative. A bespoke content-managed system, the PEEL Zone allows schools and other educational organisations to run their own course. With the guidance of a PEEL trainer, students can upload their poetry and photography to the PEEL zone, making it private or public for the world to see. Various permissions have been enabled throughout the site, ensuring that consent and visibility is protected. An anonymous questionnaire is completed by each participant, both before and after submission of their project, allowing the PEEL Zone to monitor the increase of positive responses, making it a key tool to track the effects of the PEEL programme on young people's mental health.
The PEEL Zone acts as a gallery of the work submitted by participants; a particularly stunning feature is the ability to view a submission on a mobile device as a lenticular, by rocking the phone from left to right, both portrait and poem fade in and out.


text: A handful of lighthouses in the Florida Keys are there for the taking for any non-profits or educational organizations that want to take over ownership. The price: Nada. Free. Gratis. Applications are being taken by the US Coast Guard, eager to rid themselves of the burden and expense of structures no longer logistical useful in an era of GPS, though still beautiful and historically interesting. Granted, if your organization is selected to take the keys, you will be responsible for maintenance and keeping the lighthouse preserved and available to the public for tours. Also, you have to prove financial ability to keep the lighthouse standing. If any of the four lighthouses available to be given away (like Alligator Reef Station, above) cannot find a home with a non-profit group, they will be auctioned off to the public. Check 'em out here.


text:
Excited to present a special night of music, these musicians are not something to be missed:
8:00 - Joanna Sternberg Solo
In a world where daily life revolves around a screen and a finger, KADAWA gives their audience an 'offline' experience worth lifting their heads for.
Born in Israel and based in New York City, the collective-trio of guitarist Tal Yahalom, double bassist Almog Sharvit and drummer Ben Silashi performs original music by all three members, alongside their own interpretations of pieces by David Bowie, Bjork and Ornette Coleman, among others. Drawing inspiration from jazz, rock, cinema and literature to create song-like instrumental compositions driven by mood, sound and improvisation, KADAWA's music inhabits many different dimensions of a wide musical spectrum.
10:00 - I Have Considered The Lilies - Gaya Sings Connie:
Disappearing in 1974, folk musician and songwriter Connie Converse left behind a unique, wistful and haunting body of work that for many years remained unheard. Gaya found Connie earlier this year, and sat with her songs as they delicately unfolded. Amidst stories and melodies beautifully interwoven, it is an immense pleasure to relive Connie's enigma through Gaya's blooming reimagination.
Gaya Feldheim Schorr - voice, guitar
Grey Mcmurray - guitar, voice
Tal Yahalom - guitar
Eva Lawitts - bass
Doors open at 8pm, $12 cover for the whole night!
Looking forward to play, hang and see you all there 🙌
Excited to present a special night of music, these musicians are not something to be missed:


text:
Your shopping cart is empty!
- Face
- Body
- Hair
- Makeup
- Perfumes
- Man Care
- Body Care
- Face Care
- Hair
- Supplements
- Mother & Child
Victorias Secret Endless Love Hand and Body Cream 200ml
Out Of StockPrice: 24.90€ 19.90€Ex Tax: 16.72€
An irresistible, fresh fragrance. Believe in Endless Love, romantic with bright apple blossom and ylang ylang. Experience the luxury of fragrant hydration. Intensive formula is fortified with replenishing avocado and sweet almond oils, plus hydrating honey. Massage on for rich, 24-hour moisture, focusing on dry, rough areas. Skin feels soft, smooth and touchable: the ultimate sexy sensation.
Write a review
Note: HTML is not translated!
Rating: Bad Good
Enter the code in the box below:
- Face Care
- Makeup
- Hair
- Body
- Face


text:
The proper pipe fittings and flanges let your equipment do the work that you intend it to do. The various types of pipe fittings include adapters, bulkhead fittings, plugs, rigid couplings, flexible couplings, 90 degree elbows, 45 degree elbows, reducing elbows, flanges, nipples, concentric reducers, eccentric reducers, side outlet eyes, standard eyes, reducing eyes, bullhead eyes, unions, standard wyes, reducing wyes and many more. You should select the right fitting for your application among the wide range of fitting types and sizes offered.
Common points to consider:
The integrity of any fitting for proper functioning depends upon the following:


text:
Cryptopia exchange has issued a notice of the delisting of GoldReserve's XGR. The last day of the token on the exchange is set to April 29. The reason of the delisting is that XGR transitioning to an ERC-20 token standard. Unfortunately, the exchange has not been properly notified about this change in advance and the communication with the project is not clear. XGR holders are strongly advised to be cautious and investigate the developers' plans on the coin.
For ensuring safety and accessibility of the coin after the removal users are also advised to withdraw their funds immediately (as of March 29). The swap research is highly recommended.
XGR changed to be an ERC-20 token on the Ethereum Blockchain. There is a swap page (fork.goldreservecoin.com) where you can swap all the coins you have.
Excerpt from XGR developer's message
Cryptopia is not part of the swap and thus further details on whether the ERC-20 version of XGR will be listed is not clear. At the moment of publication, the GoldReserve market characteristics are as follows
Average price: $0.017326
Market cap: $297,506


text: It's crunch time, packing, pricing and organizing my work in order to drive up to Asheville, NC on Wednesday in time for the Conference! But the weather looks good for the drive there and back and I'm so looking forward to seeing my like-minded Arts & Crafts friends and colleagues there again. It's a total immersion art history experience, along with some of the finest artists and craftspersons working today.


text:
English · Español
27 de mayo de 2015 | Videos | Anti-neoliberalismo
Descargar: MP3 (1.8 MB)
"Popular environmental education is a political-pedagogical process that goes beyond methodological aspects and involves the understanding of life by the people.
It is an appropriation process that seeks to organize subjects in a way to enable political advocacy work. We refer to these as "collective subjects"", said activist Juan Francisco Santos, of the Center for Education and Promotion of Sustainable Development in Cuba (CEPRODESO).
According to Santos, "what matters is not the concept, but people experiencing this appropriation from their points of view and experiences".
"Therefore, popular environmental education is a collective building process; it involves the capacity building of political subjects in permanent dialogue with their practice and the rest of the realities of the context or territories they belong to", adds a video produced by "Desde Abajo" (www.desdeabajo.info) and supported by CEPRODESO and the environmental organization CENSAT Agua Viva – Friends of the Earth Colombia.
On April 15-16, in Bogota, Colombian capital city, the two groups organized a
workshop on popular environmental education, which resulted in the new video.
Environmental activist Danilo Urrea, of CENSAT, states in the video that "popular environmental education schools, or schools of sustainability, aim to join the territorial defense processes in a more permanent way".
In this sense, "popular environmental education, as stated by the developers of this practice, involves trying to recompose the relationship between human beings and nature".
Friends of the Earth Latin America and the Caribbean (ATALC) has been organizing an annual capacity-building school for several years, called the "School of Sustainability". This is an itinerant school, and CENSAT has been a fundamental actor in its creation and development.
Urrea believes that popular environmental education also seeks to "present an education model that is against domination and the models that only reproduce exercises to control the population".
"Popular environmental education, in turn, aims to understand nature as an integral part of our lives and ourselves as part of nature, and therefore, strengthen the defense of our territories"
Imagen: censat.org
Radio Mundo Real 2003 - 2018 Todo el material aquí publicado está bajo una licencia Creative Commons (Atribución - Compartir igual). El sitio está realizado con Spip, software libre especializado en publicaciones web... y hecho con cariño.


text:
Healthy and Sustainable Building Design Standards
While the LEED certificate deals primarily with the environmental impacts of the built environment, in recent years the standard has been accompanied by growing consensus that any sustainable building project must consider the impact of the structure on the health and wellbeing of its occupants.
One of the earliest means of measuring this impact was the Living Building Challenge developed by the International Living Future Institute in 2006. The award judges a building based on seven factors, or "petals"; Place, Water, Energy, Health, Happiness, Materials, Equity and Beauty. These eight elements provide a framework for design, construction and the symbiotic relationship between people and all aspects of the built environment.
Another standard which Altanova has successfully pursued for our clients is the WELL building certification. This standard uses over 100 factors to determine a broad range of design strategies and policies to benefit the inhabitants of a building. It is based on a thorough review and onsite performance assessment administered by a third party and can be applied to new or existing buildings. The factors under review are all linked closely to human health with each one directly linked to a different health system of the human body. By viewing design through such a prism, we can understand how small changes in lighting, temperature or acoustics can have a direct impact on employee health.


text:
Google Chrome is an Internet browser that was developed and released by Google. The first released version was for Windows and it was a beta one. The beta version was officially released in 43 different languages on 2nd of September 2008. The public release of the browser was on 11.12.2008. After its release the browser gain a lot of popularity and till the beginning of 2009 Chrome became the 4th most used browser all over the world. If we compare Google Chrome with the well known already developed builds of Internet Explorer, Firefox, Safari, and Opera, Chrome rating is lower than Firefox 3.1 Beta 1, Safari 4, and Opera, but it is higher compared to Internet Explorer. On 04.06.2009 versions of Chrome for Mac OS X and Linux were released.
The primary goal of the Google Chrome's design was to improve the speed, security, interface, and stability in comparison with the already existing browsers. The Google Browser Chrome was put together from 26 different Google code libraries in combination with other from third parties, for instance Netscape.
Google developed the V8 JavaScript engine. It has features such as precise garbage collection, dynamic code generation, and hidden class transitions. The Google test made on 02.09.2008 revealed that V8 is about 2 times faster in comparison with Internet Explorer 7 & 8, Safari (modified version of WebKit), Opera and Firefox 3.0, but that didn't last for long since the WebKit team announced ten days later the SquirrelFish Extreme, making Chromium and WebKit even.
The Chrome Google Browser downloads updates of 2 blacklists and they send warnings to the users when they are going to visit a harmful site with harmful software presence. This is available for free for a public use and it is called Google Safe Browsing API. Chrome will allot every tab to fit in its process in order to prevent any malware from installing. In order to decrease the exposure to any attack, the plugins are run in processes which are separated and communicate with the renderer. The plugins have to be specifically modified for this software. Incognito mode is a feature that prevents the Google Browser from storing cookies and any other history information from the visited websites. It is referred to as porn mode, such as the private browsing feature in Internet Explorer 8, Apple's Safari , and Mozilla Firefox 3.5.
The Chrome interface includes options like refresh, bookmark, back, forward, cancel and go. The turn on of the home button is through options which will take every user to a custom home page or a new tab page. This Google Browser's options are close to those of Safari, while the setting locations are as in Internet Explorer 7, and the idea of windows decorations design has been taken from Windows Vista. Google Chrome includes Gears and it replaces the home page of the displayed browser with a New Tab Page when it is created a new tab. That will show the thumbnails with the most searched sites, recently closed tabs, recent bookmarks, and the nine most visited sites.