text:
Difference between revisions of "Dm-crypt/Encrypting an entire system"
(→LUKS on software RAID: rm expansion template (references dated compared to User:Sparky's new contribution.) re Talk)
m (Correct internal link)
|Line 743:
|Line 743:
See [[Dm-crypt/System configuration#Boot loader]] and [[GRUB#Boot partition]] for details. The {{ic|''<device-UUID>''}} refers to the UUID of {{ic|/dev/sdaZ}} (the partition which holds the lvm containing the root filesystem), see [[Persistent block device naming]].
See [[Dm-crypt/System configuration#Boot loader]] and [[GRUB#Boot partition]] for details. The {{ic|''<device-UUID>''}} refers to the UUID of {{ic|/dev/sdaZ}} (the partition which holds the lvm containing the root filesystem), see [[Persistent block device naming]].
Generate GRUB's [[GRUB#Generate the main configuration file|configuration]] file and [[GRUB#
Generate GRUB's [[GRUB#Generate the main configuration file|configuration]] file and [[GRUB#|install]] to the mounted ESP:
# grub-mkconfig -o /boot/grub/grub.cfg
# grub-mkconfig -o /boot/grub/grub.cfg
Revision as of 17:07, 6 March 2017
Back to dm-crypt.
The following are examples of common scenarios of full system encryption with dm-crypt. They explain all the adaptations that need to be done to the normal installation procedure. All the necessary tools are on the installation image.
- 1 Overview
- 2 Simple partition layout with LUKS
- 3 LVM on LUKS
- 4 LUKS on LVM
- 5 LUKS on software RAID
- 6 Plain dm-crypt
- 7 Encrypted boot partition (GRUB)
- 8 Btrfs subvolumes with swap
- 8.1 Preparing the disk
- 8.2 Preparing the system partition
- 8.3 Creating btrfs subvolumes
- 8.4 Configuring mkinitcpio
- 8.5 Configuring the boot loader
- 8.6 Configuring swap
Securing a root filesystem is where dm-crypt excels, feature and performance-wise. Unlike selectively encrypting non-root filesystems, an encrypted root filesystem can conceal information such as which programs are installed, the usernames of all user accounts, and common data-leakage vectors such as mlocate and
/var/log/. Furthermore, an encrypted root filesystem makes tampering with the system far more difficult, as everything except the boot loader and (usually) the kernel is encrypted.
All scenarios illustrated in the following share these advantages, other pros and cons differentiating them are summarized below:
|#Simple partition layout with LUKS
shows a basic and straight-forward set-up for a fully LUKS encrypted root.
|#LVM on LUKS
achieves partitioning flexiblity by using LVM inside a single LUKS encrypted partition.
|#LUKS on LVM
uses dm-crypt only after the LVM is setup.
|#LUKS on software RAID
uses dm-crypt only after RAID is setup.
|#Plain dm-crypt
uses dm-crypt plain mode, i.e. without a LUKS header and its options for multiple keys.
|#Encrypted boot partition (GRUB)
shows how to encrypt the boot partition using the GRUB bootloader.
|#Btrfs subvolumes with swap
shows how to encrypt a Btrfs system, including the
While all above scenarios provide much greater protection from outside threats than encrypted secondary filesystems, they also share a common disadvantage: any user in possession of the encryption key is able to decrypt the entire drive, and therefore can access other users' data. If that is of concern, it is possible to use a combination of blockdevice and stacked filesystem encryption and reap the advantages of both. See Disk encryption to plan ahead.
See Dm-crypt/Drive preparation#Partitioning for a general overview of the partitioning strategies used in the scenarios.
Another area to consider is whether to set up an encrypted swap partition and what kind. See Dm-crypt/Swap encryption for alternatives.
If you anticipate to protect the system's data not only against physical theft, but also have a requirement of precautions against logical tampering, see Dm-crypt/Specialties#Securing the unencrypted boot partition for further possibilities after following one of the scenarios.
Simple partition layout with LUKS
This example covers a full system encryption with dmcrypt + LUKS in a simple partition layout:
+--------------------+--------------------------+--------------------------+ |Boot partition |LUKS encrypted system |Optional free space | | |partition |for additional partitions | |/dev/sdaY |/dev/sdaX |or swap to be setup later | +--------------------+--------------------------+--------------------------+
The first steps can be performed directly after booting the Arch Linux install image.
Preparing the disk
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in Dm-crypt/Drive preparation.
Then create the needed partitions, at least one for
/ (e.g.
/dev/sdaX) and
/boot (
/dev/sdaY), see Partitioning.
Preparing non-boot partitions
The following commands create and mount the encrypted root partition. They correspond to the procedure described in detail in Dm-crypt/Encrypting a non-root file system#Partition (which, despite the title, can be applied to root partitions, as long as mkinitcpio and the boot loader are correctly configured). If you want to use particular non-default encryption options (e.g. cipher, key length), see the encryption options before executing the first command:
# cryptsetup -y -v luksFormat /dev/sdaX # cryptsetup open /dev/sdaX cryptroot # mkfs.ext4 /dev/mapper/cryptroot # mount /dev/mapper/cryptroot /mnt
Check the mapping works as intended:
# umount /mnt # cryptsetup close cryptroot # cryptsetup open /dev/sdaX cryptroot # mount /dev/mapper/cryptroot /mnt
If you created separate partitions (e.g.
/home), these steps have to be adapted and repeated for all of them, except for
/boot. See Dm-crypt/Encrypting a non-root file system#Automated unlocking and mounting on how to handle additional partitions at boot.
Note that each blockdevice requires its own passphrase. This may be inconvenient, because it results in a separate passphrase to be input during boot. An alternative is to use a keyfile stored in the system partition to unlock the separate partition via
crypttab. See Dm-crypt/Device encryption#Using LUKS to format partitions with a keyfile for instructions.
Preparing the boot partition
What you do have to setup is a non-encrypted
/boot partition, which is needed for a crypted root. For a standard MBR/non-EFI
/boot partition, for example, execute:
# mkfs.ext4 /dev/sdaY # mkdir /mnt/boot # mount /dev/sdaY /mnt/boot
Mounting the devices
At Installation guide#Mount the file systems you will have to mount the mapped devices, not the actual partitions. Of course
/boot, which is not encrypted, will still have to be mounted directly.
Afterwards continue with the installation procedure up to the mkinitcpio step.
Configuring mkinitcpio
Add the
keyboard and
encrypt hooks to mkinitcpio.conf:
HOOKS="... keyboard block encrypt ... filesystems ..."
Depending on which other hooks are used, the order may be relevant. See dm-crypt/System configuration#mkinitcpio for details and other hooks that you may need.
Configuring the boot loader
In order to unlock the encrypted root partition at boot, the following kernel parameters need to be set by the boot loader:
cryptdevice=UUID=<device-UUID>:cryptroot root=/dev/mapper/cryptroot
See Dm-crypt/System configuration#Boot loader for details.
<device-UUID> refers to the UUID of
/dev/sdaX, see Persistent block device naming for details.
LVM on LUKS
The straight-forward method is to set up LVM on top of the encrypted partition instead of the other way round. Technically the LVM is setup inside one big encrypted blockdevice. Hence, the LVM is not transparent until the blockdevice is unlocked and the underlying volume structure is scanned and mounted during boot.
The disk layout in this example is:
+-----------------------------------------------------------------------+ +----------------+ | Logical volume1 | Logical volume2 | Logical volume3 | | | |/dev/mapper/MyVol-swap |/dev/mapper/MyVol-root |/dev/mapper/MyVol-home | | Boot partition | |_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _| | (may be on | | | | other device) | | LUKS encrypted partition | | | | /dev/sdaX | | /dev/sdbY | +-----------------------------------------------------------------------+ +----------------+
- Instructions at Dm-crypt/Specialties#Encrypted system using a remote LUKS header use this setup with a remote LUKS header on a USB device to achieve a two factor authentication with it.
- Instructions at Pavel Kogan's blog show how to encrypt the
/bootpartition while keeping it on the main LUKS partition when using GRUB.
Preparing the disk
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in Dm-crypt/Drive preparation.
When using the GRUB bootloader together with GPT, create a BIOS Boot Partition as explained in GRUB#BIOS systems.
Create a partition to be mounted at
/boot of type
8300 with a size of 100 MB or more.
Create a partition of type
8E00, which will later contain the encrypted container.
Create the LUKS encrypted container at the "system" partition. Enter the chosen password twice.
# cryptsetup luksFormat /dev/sdaX
For more information about the available cryptsetup options see the LUKS encryption options prior to above command.
Open the container:
# cryptsetup open /dev/sdaX cryptolvm
The decrypted container is now available at
Preparing the logical volumes
Create a physical volume on top of the opened LUKS container:
# pvcreate /dev/mapper/cryptolvm
Create the volume group named
MyVol (or whatever you want), adding the previously created physical volume to it:
# vgcreate MyVol /dev/mapper/cryptolvm
Create all your logical volumes on the volume group:
# lvcreate -L 8G MyVol -n swap # lvcreate -L 15G MyVol -n root # lvcreate -l 100%FREE MyVol -n home
Format your filesystems on each logical volume:
# mkfs.ext4 /dev/mapper/MyVol-root # mkfs.ext4 /dev/mapper/MyVol-home # mkswap /dev/mapper/MyVol-swap
Mount your filesystems:
# mount /dev/mapper/MyVol-root /mnt # mkdir /mnt/home # mount /dev/mapper/MyVol-home /mnt/home # swapon /dev/mapper/MyVol-swap
Preparing the boot partition
The bootloader loads the kernel, initramfs, and its own configuration files from the
/boot directory. This directory must be located on a separate unencrypted filesystem.
Create an Ext2 filesystem on the partition intended for
/boot. Any filesystem that can be read by the bootloader is eligible.
# mkfs.ext2 /dev/sdbY
Create the directory
# mkdir /mnt/boot
Mount the partition to
# mount /dev/sdbY /mnt/boot
Afterwards continue with the installation procedure up to the
mkinitcpio step.
Configuring mkinitcpio
Add the
encrypt and
lvm2 hooks to mkinitcpio.conf:
HOOKS="... keyboard block encrypt lvm2 ... filesystems ..."
See dm-crypt/System configuration#mkinitcpio for details and other hooks that you may need.
Configuring the boot loader
In order to unlock the encrypted root partition at boot, the following kernel parameter needs to be set by the boot loader:
<device-UUID> refers to the UUID of
/dev/sdaX, see Persistent block device naming for details.
See Dm-crypt/System configuration#Boot loader for details.
LUKS on LVM
To use encryption on top of LVM, the LVM volumes are set up first and then used as the base for the encrypted partitions. This way, a mixture of encrypted and non-encrypted volumes/partitions is possible as well.
The following short example creates a LUKS on LVM setup and mixes in the use of a key-file for the /home partition and temporary crypt volumes for
/tmp and
/swap. The latter is considered desirable from a security perspective, because no potentially sensitive temporary data survives the reboot, when the encryption is re-initialised. If you are experienced with LVM, you will be able to ignore/replace LVM and other specifics according to your plan. If you want to span a logical volume over multiple disks during setup already, a procedure to do so is described in Dm-crypt/Specialties#Expanding LVM on multiple disks.
Preparing the disk
Partitioning scheme:
+----------------+-----------------------------------------------------------------------+ | | LUKS encrypted volume | LUKS encrypted volume | LUKS encrypted volume | | | /dev/mapper/swap | /dev/mapper/root | /dev/mapper/home | | |_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _| | | Logical volume1 | Logical volume2 | Logical volume3 | | |/dev/mapper/MyVol-swap |/dev/mapper/MyVol-root |/dev/mapper/MyVol-home | | |_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _| | Boot partition | | | /dev/sda1 | /dev/sda2 | +----------------+-----------------------------------------------------------------------+
/dev/sda2 according to Dm-crypt/Drive preparation#dm-crypt wipe on an empty disk or partition.
Preparing the logical volumes
# pvcreate /dev/sda2 # vgcreate MyVol /dev/sda2 # lvcreate -L 10G -n lvroot MyVol # lvcreate -L 500M -n swap MyVol # lvcreate -L 500M -n tmp MyVol # lvcreate -l 100%FREE -n home MyVol
# cryptsetup luksFormat -c aes-xts-plain64 -s 512 /dev/mapper/MyVol-lvroot # cryptsetup open /dev/mapper/MyVol-lvroot root # mkfs.ext4 /dev/mapper/root # mount /dev/mapper/root /mnt
More information about the encryption options can be found in Dm-crypt/Device encryption#Encryption options for LUKS mode.
Note that
/home will be encrypted in #Encrypting logical volume /home. Further, note that if you ever have to access the encrypted root from the Arch-ISO, the above
open action will allow you to after the LVM shows up.
Preparing the boot partition
# dd if=/dev/zero of=/dev/sda1 bs=1M status=progress # mkfs.ext4 /dev/sda1 # mkdir /mnt/boot # mount /dev/sda1 /mnt/boot
Now after setup of the encrypted LVM partitioning, it would be time to install: Arch Install Scripts.
Configuring mkinitcpio
Add the
lvm2 and
encrypt hooks to mkinitcpio.conf:
HOOKS="... keyboard block lvm2 encrypt ... filesystems ..."
See dm-crypt/System configuration#mkinitcpio for details and other hooks that you may need.
Configuring the boot loader
In order to unlock the encrypted root partition at boot, the following kernel parameters need to be set by the boot loader:
cryptdevice=/dev/mapper/MyVol-lvroot:root root=/dev/mapper/root
See Dm-crypt/System configuration#Boot loader for details.
Configuring fstab and crypttab
/dev/mapper/root / ext4 defaults 0 1 /dev/sda1 /boot ext4 defaults 0 2 /dev/mapper/tmp /tmp tmpfs defaults 0 0 /dev/mapper/swap none swap sw 0 0
The following crypttab options will re-encrypt the temporary filesystems each reboot:
swap /dev/mapper/MyVol-swap /dev/urandom swap,cipher=aes-xts-plain64,size=256 tmp /dev/mapper/MyVol-tmp /dev/urandom tmp,cipher=aes-xts-plain64,size=256
Encrypting logical volume /home
Since this scenario uses LVM as the primary and dm-crypt as secondary mapper, each encrypted logical volume requires its own encryption. Yet, unlike the temporary filesystems configured with volatile encryption above, the logical volume for
/home should be persistent, of course. The following assumes you have rebooted into the installed system, otherwise you have to adjust paths.
To safe on entering a second passphrase at boot for it, a keyfile is created:
# mkdir -m 700 /etc/luks-keys # dd if=/dev/random of=/etc/luks-keys/home bs=1 count=256 status=progress
The logical volume is encrypted with it:
# cryptsetup luksFormat -v -s 512 /dev/mapper/MyVol-home /etc/luks-keys/home # cryptsetup -d /etc/luks-keys/home open /dev/mapper/MyVol-home home # mkfs.ext4 /dev/mapper/home # mount /dev/mapper/home /home
The encrypted mount is configured in crypttab:
home /dev/mapper/MyVol-home /etc/luks-keys/home
/dev/mapper/home /home ext4 defaults 0 2
and setup is done.
If you want to expand the logical volume for
/home (or any other volume) at a later point, it is important to note that the LUKS encrypted part has to be resized as well. For a procedure see Dm-crypt/Specialties#Expanding LVM on multiple disks.
LUKS on software RAID
This example is based on a real-world setup for a workstation class laptop equipped with two SSDs of equal size, and an additional HDD for bulk storage. The end result is LUKS based full disk encryption (including
/boot) for all drives, with the SSDs in a RAID0 array, and keyfiles used to unlock all encryption after GRUB is given a correct passphrase at boot. TRIM support is enabled on the SSDs, but you may wish to review the security implications detailed at Dm-crypt/Specialties#Discard/TRIM support for solid state drives (SSD) before considering using this.
This setup utilizes a very simplistic partitioning scheme, with all the available RAID storage being mounted at
/ (no separate
/boot partition), and the decrypted HDD being mounted at
/mnt/data. It is also worth mentioning that the system in this example boots in BIOS mode and the drives are partitioned with GPT partitions.
Please note that regular backups are very important in this setup. If either of the SSDs fail, the data contained in the RAID array will be practically impossible to recover. You may wish to select a different RAID level if fault tolerance is important to you.
The encryption is not deniable in this setup.
For the sake of the instructions below, the following block devices are used:
/dev/sda = first SSD /dev/sdb = second SSD /dev/sdc = HDD
Be sure to substitue them with the appropriate device designations for your setup, as they may be different.
Preparing the disks
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in Dm-crypt/Drive preparation.
When using the GRUB bootloader together with GPT, create a BIOS Boot Partition as explained in GRUB#BIOS systems. For this setup, this includes a 1M partition for "BIOS boot" at
/dev/sda1 and the remaining space on the drive being partitioned for "Linux RAID" at
Once partitions have been created on
/dev/sda, the following commands can be used to clone them to
# sfdisk -d /dev/sda > sda.dump # sfdisk /dev/sdb < sda.dump
The HDD is prepared with a single Linux partition covering the whole drive at
Building the RAID array
Create the RAID array for the SSDs. This example utilizes RAID0, you may wish to substitute a different level based on your preferences or requirements.
# mdadm --create --verbose --level=0 --metadata=1.2 --raid-devices=2 /dev/md0 /dev/sda2 /dev/sdb2
Preparing the block devices
As explained in Dm-crypt/Drive preparation, the devices are wiped with random data utilizing
/dev/zero and a crypt device with a random key. Alternatively, you could use
dd with
/dev/random or
/dev/urandom, though it will be much slower.
# cryptsetup open --type plain /dev/md0 container --key-file /dev/random # dd if=/dev/zero of=/dev/mapper/container bs=1M status=progress # cryptsetup close container
And repeat above for the HDD (
/dev/sdc1 in this example).
Set up encryption for
# cryptsetup -y -v luksFormat -c aes-xts-plain64 -s 512 /dev/md0 # cryptsetup open /dev/md0 cryptroot # mkfs.ext4 /dev/mapper/cryptroot # mount /dev/mapper/cryptroot /mnt
And repeat for the HDD:
# cryptsetup -y -v luksFormat -c aes-xts-plain64 -s 512 /dev/sdc1 # cryptsetup open /dev/sdc1 cryptdata # mkfs.ext4 /dev/mapper/cryptdata # mkdir -p /mnt/mnt/data # mount /dev/mapper/cryptdata /mnt/mnt/data
Configuring the boot loader
Configure GRUB for the encrypted system by editing
/etc/defaults/grub with the following. Note that the
:allow-discards option enables TRIM support on the SSDs, if you do not wish to use it you should omit this.
GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:cryptroot:allow-discards root=/dev/mapper/cryptroot" GRUB_ENABLE_CRYPTODISK=y
See Dm-crypt/System configuration#Boot loader and GRUB#Boot partition for details.
Complete the GRUB install to both SSDs (in reality, installing only to
/dev/sda will work).
# grub-install --target=i386-pc /dev/sda # grub-install --target=i386-pc /dev/sdb # grub-mkconfig -o /boot/grub/grub.cfg
Creating the keyfiles
The next steps save you from entering your passphrase twice when you boot the system (once so GRUB can unlock the encryption, and second time once the initramfs assumes control of the system). This is done by creating a keyfile for the encryption and adding it to the initramfs image to allow the encrypt hook to unlock the root device. See Dm-crypt/Device_encryption#With a keyfile embedded in the initramfs for additional details.
Create the keyfile.
# dd bs=512 count=4 if=/dev/random of=/crypto_keyfile.bin
Make sure only root can read it. If on a multi-user system, you may want to apply similar permissions to
/boot as well, as someone could dump the keyfile from the initramfs image.
# chmod 600 /crypto_keyfile.bin # chmod -R g-rwx,o-rwx /boot
Add the key to
# cryptsetup luksAddKey /dev/md0 /crypto_keyfile.bin
Create another keyfile for the HDD so it can also be unlocked at boot. For convenience, leave the passphrase created above in place as this can make recovery easier if you ever need it.
# mkdir -m 700 /etc/luks-keys # dd bs=512 count=4 if=/dev/random of=/etc/luks-keys/data # cryptsetup luksAddKey /dev/sdc1 /etc/luks-keys/data
Find the UUID for
/dev/sdc1, to be used in
/etc/crypttab for persistent naming.
# ls -al /dev/disk/by-uuid | grep sdc1
/etc/crypttab to decrypt the HDD at boot, substituting in the UUID found in the previous step.
cryptdata UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /etc/luks-keys/data
Configuring the system
Edit /etc/fstab to mount the cryptroot and cryptdata block devices; if you are not enabling TRIM support, delete the
discard mount option:
/dev/mapper/cryptroot / ext4 rw,noatime,discard 0 1 /dev/mapper/cryptdata /mnt/data ext4 defaults 0 2
Save the RAID configuration:
# mdadm --detail --scan > /etc/mdadm.conf
Edit mkinitcpio.conf to include your keyfile and add the proper hooks:
FILES="/crypto_keyfile.bin" HOOKS=" ... mdadm_udev encrypt ... " (insert right before "filesystems")
See dm-crypt/System configuration#mkinitcpio for details.
Plain dm-crypt
Contrary to LUKS, dm-crypt plain mode does not require a header on the encrypted device: this scenario exploits this feature to set up a system on an unpartitioned, encrypted disk that will be indistinguishable from a disk filled with random data, which could allow deniable encryption. See also wikipedia:Disk encryption#Full disk encryption.
Note that if full-disk encryption is not required, the methods using LUKS described in the sections above are better options for both system encryption and encrypted partitions. LUKS features like key management with multiple passphrases/key-files or re-encrypting a device in-place are unavailable with plain mode.
Plain dm-crypt encryption can be more resilient to damage than LUKS, because it does not rely on an encryption master-key which can be a single-point of failure if damaged. However, using plain mode also requires more manual configuration of encryption options to achieve the same cryptographic strength. See also Disk encryption#Cryptographic metadata. Using plain mode could also be considered if concerned with the problems explained in Dm-crypt/Specialties#Discard/TRIM support for solid state drives (SSD).
- tcplay which offers headerless encryption but with the PBKDF2 function, or
- dm-crypt LUKS mode by using the cryptsetup
--headeroption. It cannot be used with the standard encrypt hook, but the hook may be modified.
The scenario uses two USB sticks:
- one for the boot device, which also allows storing the options required to open/unlock the plain encrypted device in the boot loader configuration, since typing them on each boot would be error prone;
- another for the encryption key file, assuming it stored as raw bits so that to the eyes of an unaware attacker who might get the usbkey the encryption key will appear as random data instead of being visible as a normal file. See also Wikipedia:Security through obscurity, follow Dm-crypt/Device encryption#Keyfiles to prepare the keyfile.
The disk layout is:
+--------------------+------------------+--------------------+ +---------------+ +---------------+ |Volume 1: |Volume 2: |Volume 3: | |Boot device | |Encryption key | | | | | | | |file storage | |root |swap |home | |/boot | |(unpartitioned | | | | | | | |in example) | |/dev/store/root |/dev/store/swap |/dev/store/home | |/dev/sdY1 | |/dev/sdZ | |--------------------+------------------+--------------------| |---------------| |---------------| |disk drive /dev/sdaX encrypted using plain mode and LVM | |USB stick 1 | |USB stick 2 | +------------------------------------------------------------+ +---------------+ +---------------+
- It is also possible to use a single usb key by copying the keyfile to the initram directly. An example keyfile
/etc/keyfilegets copied to the initram image by setting
/etc/mkinitcpio.conf. The way to instruct the
encrypthook to read the keyfile in the initram image is using
rootfs:prefix before the filename, e.g.
- Another option is using a passphrase with good entropy.
Preparing the disk
It is vital that the mapped device is filled with data. In particular this applies to the scenario usecase we apply here.
See Dm-crypt/Drive preparation and Dm-crypt/Drive preparation#dm-crypt specific methods
Preparing the non-boot partitions
See Dm-crypt/Device encryption#Encryption options for plain mode for details.
Using the device
/dev/sdX, with the twofish-xts cipher with a 512 bit key size and using a keyfile we have the following options for this scenario:
# cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 --offset=0 --key-file=/dev/sdZ --key-size=512 open --type=plain /dev/sdX enc
Unlike encrypting with LUKS, the above command must be executed in full whenever the mapping needs to be re-established, so it is important to remember the cipher, hash and key file details.
We can now check a mapping entry has been made for
# fdisk -l
Next, we setup LVM logical volumes on the mapped device, see LVM#Installing Arch Linux on LVM for further details:
# pvcreate /dev/mapper/enc # vgcreate store /dev/mapper/enc # lvcreate -L 20G store -n root # lvcreate -L 10G store -n swap # lvcreate -l 100%FREE store -n home
We format and mount them and activate swap, see File systems#Create a file system for further details:
# mkfs.ext4 /dev/store/root # mkfs.ext4 /dev/store/home # mount /dev/store/root /mnt # mkdir /mnt/home # mount /dev/store/home /mnt/home # mkswap /dev/store/swap # swapon /dev/store/swap
Preparing the boot partition
/boot partition can be installed on the standard vfat partition of a USB stick, if required. But if manual partitioning is needed, then a small 200MB partition is all that is required. Create the partition using a partitioning tool of your choice.
We choose a non-journalling file system to preserve the flash memory of the
/boot partition, if not already formatted as vfat:
# mkfs.ext2 /dev/sdY1 # mkdir /mnt/boot # mount /dev/sdY1 /mnt/boot
Configuring mkinitcpio
Add the
encrypt and
lvm2 hooks to mkinitcpio.conf:
HOOKS="... keyboard block encrypt lvm2 ... filesystems ..."
See dm-crypt/System configuration#mkinitcpio for details and other hooks that you may need.
Configuring the boot loader
In order to boot the encrypted root partition, the following kernel parameters need to be set by the boot loader:
cryptdevice=/dev/sdX:enc cryptkey=/dev/sdZ:0:512 crypto=sha512:twofish-xts-plain64:512:0:
luks.uuid instead of cryptdevice, see systemd-cryptsetup-generator(8).
See Dm-crypt/System configuration#Boot loader for details and other parameters that you may need.
/boot partition with:
# grub-install --recheck /dev/sdY
You may wish to remove the USB sticks after booting. Since the
/boot partition is not usually needed, the
noauto option can be added to the relevant line in
# /dev/sdYn /dev/sdYn /boot ext2 noauto,rw,noatime 0 2
However, when an update to the kernel or bootloader is required, the
/boot partition must be present and mounted. As the entry in
fstab already exists, it can be mounted simply with:
# mount /boot
Encrypted boot partition (GRUB)
This setup utilizes the same partition layout and configuration for the system's root partition as the previous #LVM on LUKS section, with two distinct differences:
- The setup is performed for an UEFI system and
- A special feature of the GRUB bootloader is used to additionally encrypt the boot partition
/boot. See also GRUB#Boot partition.
The disk layout in this example is:
+---------------+----------------+----------------+----------------+----------------+ |ESP partition: |Boot partition: |Volume 1: |Volume 2: |Volume 3: | | | | | | | |/boot/efi |/boot |root |swap |home | | | | | | | | | |/dev/store/root |/dev/store/swap |/dev/store/home | |/dev/sdaX |/dev/sdaY +----------------+----------------+----------------+ |unencrypted |LUKS encrypted |/dev/sdaZ encrypted using LVM on LUKS | +---------------+----------------+--------------------------------------------------+
cryptboot script from cryptbootAUR package for simplified encrypted boot management (mounting, unmounting, upgrading packages) and as a defense against Evil Maid attacks with UEFI Secure Boot. For more informations and limitations see cryptboot project page.
Preparing the disk
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in Dm-crypt/Drive preparation.
Create an EFI System Partition with an appropriate size, it will later be mounted at
Create a partition to be mounted at
/boot of type
8300 with a size of 100 MB or more.
Create a partition of type
8E00, which will later contain the encrypted container.
Create the LUKS encrypted container at the "system" partition.
# cryptsetup luksFormat /dev/sdaZ
For more information about the available cryptsetup options see the LUKS encryption options prior to above command.
Your partition layout should look similar to this:
# gdisk /dev/sda
Number Start (sector) End (sector) Size Code Name 1 2048 1050623 512.0 MiB EF00 EFI System 2 1050624 1460223 200.0 MiB 8300 Linux filesystem 3 1460224 41943006 19.3 GiB 8E00 Linux LVM
Open the container:
# cryptsetup open /dev/sdaZ lvm
The decrypted container is now available at
Preparing the logical volumes
The LVM logical volumes of this example follow the exact layout as the previous scenario. Therefore, please follow Preparing the logical volumes above or adjust as required.
Preparing the boot partition
The bootloader loads the kernel, initramfs, and its own configuration files from the
/boot directory.
First, create the LUKS container where the files will be located and installed into:
# cryptsetup luksFormat /dev/sdaY
Next, open it:
# cryptsetup open /dev/sdaY cryptboot
Create a filesystem on the partition intended for
/boot. Any filesystem that can be read by the bootloader is eligible:
# mkfs.ext2 /dev/mapper/cryptboot
Create the directory
# mkdir /mnt/boot
Mount the partition to
# mount /dev/mapper/cryptboot /mnt/boot
Create a mountpoint for the EFI System Partition at
/boot/efi for compatibility with
grub-install and mount it:
# mkdir /mnt/boot/efi # mount /dev/sdaX /mnt/boot/efi
At this point, you should have the following partitions and logical volumes inside of
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 200G 0 disk ├─sda1 8:1 0 512M 0 part /boot/efi ├─sda2 8:2 0 200M 0 part │ └─boot 254:0 0 198M 0 crypt /boot └─sda3 8:3 0 100G 0 part └─lvm 254:1 0 100G 0 crypt ├─MyStorage-swapvol 254:2 0 8G 0 lvm [SWAP] ├─MyStorage-rootvol 254:3 0 15G 0 lvm / └─MyStorage-homevol 254:4 0 77G 0 lvm /home
Afterwards continue with the installation procedure up to the mkinitcpio step.
Configuring mkinitcpio
Add the
encrypt and
lvm2 hooks to mkinitcpio.conf:
HOOKS="... keyboard block encrypt lvm2 ... filesystems ..."
See dm-crypt/System configuration#mkinitcpio for details and other hooks that you may need.
Configuring the boot loader
Configure GRUB to recognize the LUKS encrypted
/boot partition and unlock the encrypted root partition at boot:
GRUB_CMDLINE_LINUX="... cryptdevice=UUID=<device-UUID>:lvm ..." GRUB_ENABLE_CRYPTODISK=y
See Dm-crypt/System configuration#Boot loader and GRUB#Boot partition for details. The
<device-UUID> refers to the UUID of
/dev/sdaZ (the partition which holds the lvm containing the root filesystem), see Persistent block device naming.
Generate GRUB's configuration file and install to the mounted ESP:
# grub-mkconfig -o /boot/grub/grub.cfg # grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub --recheck
If this finished without errors, GRUB should prompt for the passphrase to unlock the
/boot partition after the next reboot.
Configuring fstab and crypttab
This section deals with extra configuration to let the system mount the encrypted
While GRUB asks for a passphrase to unlock the encrypted
/boot after above instructions, the partition unlock is not passed on to the initramfs. Hence,
/boot will not be available after the system has re-/booted, because the
encrypt hook only unlocks the system's root.
If you used the genfstab script during installation, it will have generated
/etc/fstab entries for the
/boot and
/boot/efi mount points already, but the system will fail to find the generated device mapper for the boot partition. To make it available, add it to crypttab. For example:
cryptboot /dev/sdaY none luks
will make the system ask for the passphrase again (i.e. you have to enter it twice at boot: once for GRUB and once for systemd init). To avoid the double entry for unlocking
/boot, follow the instructions at Dm-crypt/Device encryption#Keyfiles to:
- Create a randomtext keyfile,
- Add the keyfile to the (
/dev/sdaY) boot partition's LUKS header and
- Check the
/etc/fstabentry and add the
/etc/crypttabline to unlock it automatically at boot.
If for some reason the keyfile fails to unlock the boot partition, systemd will fallback to ask for a passphrase to unlock and, in case that is correct, continue booting.
- It may be worth considering to add the GRUB bootloader to the ignore list of
/etc/pacman.confin order to take particular control of when the bootloader (which includes its own encryption modules) is updated.
- If you want to encrypt the
/bootpartition to protect against offline tampering threats, the mkinitcpio-chkcryptoboot hook has been contributed to help.
Btrfs subvolumes with swap
The following example creates a full system encryption with LUKS using Btrfs subvolumes to simulate partitions.
If using UEFI, an EFI System Partition (ESP) is required.
/boot itself may reside on
/ and be encrypted; however, the ESP itself cannot be encrypted. In this example layout, the ESP is
/dev/sdaY and is mounted at
/boot itself is located on the system partition,
/boot resides on the encrypted
/, GRUB must be used as the bootloader because only GRUB can load modules necessary to decrypt
/boot (e.g., crypto.mod, cryptodisk.mod and luks.mod) [1].
Additionally an optional plain-encrypted swap partition is shown.
+--------------------------+--------------------------+--------------------------+ |ESP |System partition |Swap partition | |unencrypted |LUKS-encrypted |plain-encrypted | | | | | |/boot/efi |/ | | |/dev/sdaY |/dev/sdaX |/dev/sdaZ | |--------------------------+--------------------------+--------------------------+
Preparing the disk
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in Dm-crypt/Drive preparation. If you are using UEFI create an EFI System Partition with an appropriate size. It will later be mounted at
/boot/efi. If you are going to create an encrypted swap partition, create the partition for it, but do not mark it as swap, since plain dm-crypt will be used with the partition.
Create the needed partitions, at least one for
/ (e.g.
/dev/sdaX). See the Partitioning article.
Preparing the system partition
Create LUKS container
Follow dm-crypt/Device encryption#Encrypting devices with LUKS mode to setup
/dev/sdaX for LUKS. See the Dm-crypt/Device encryption#Encryption options for LUKS mode before doing so for a list of encryption options.
Unlock LUKS container
Now follow Dm-crypt/Device encryption#Unlocking/Mapping LUKS partitions with the device mapper to unlock the LUKS container and map it.
Format mapped device
Proceed to format the mapped device as described in Btrfs#File system on a single device, where
/dev/partition is the name of the mapped device (i.e.,
cryptroot) and not
Mount mapped device
Finally, mount the now-formatted mapped device (i.e.,
/dev/mapper/cryptroot) to
compress=lzo mount option. See Btrfs#Compression for more information.
Creating btrfs subvolumes
Subvolumes will be used to simulate partitions, but other (nested) subvolumes will also be created. Here is a partial representation of what the following example will generate:
subvolid=5 (/dev/sdaX) | ├── @ (mounted as /) | | | ├── /bin (directory) | | | ├── /home (mounted @home subvolume) | | | ├── /usr (directory) | | | ├── /.snapshots (mounted @snapshots subvolume) | | | ├── /var/cache/pacman/pkg (nested subvolume) | | | ├── ... (other directories and nested subvolumes) | ├── @snapshots (mounted as /.snapshots) | ├── @home (mounted as /home) | └── @... (additional subvolumes you wish to use as mount points)
This section follows the Snapper#Suggested filesystem layout, which is most useful when used with Snapper. You should also consult Btrfs Wiki SysadminGuide#Layout.
Create top-level subvolumes
Here we are using the convention of prefixing
@ to subvolume names that will be used as mount points, and
@ will be the subvolume that is mounted as
Following the Btrfs#Creating a subvolume article, create subvolumes at
/mnt/@snapshots, and
Create any additional subvolumes you wish to use as mount points now.
Mount top-level subvolumes
Unmount the system partition at
Now mount the newly created
@ subvolume which will serve as
/ to
/mnt using the
subvol= mount option. Assuming the mapped device is named
cryptroot, the command would look like:
# mount -o compress=lzo,subvol=@ /dev/mapper/cryptroot /mnt
See Btrfs#Mounting subvolumes for more details.
Also mount the other subvolumes to their respective mount points:
@home to
/mnt/home and
@snapshots to
Create nested subvolumes
Create any subvolumes you do not want to have snapshots of when taking a snapshot of
/. For example, you probably do not want to take snapshots of
/var/cache/pacman/pkg. These subvolumes will be nested under the
@ subvolume, but just as easily could have been created earlier at the same level as
@ according to your preference.
Since the
@ subvolume is mounted at
/mnt you will need to create a subvolume at
/mnt/var/cache/pacman/pkg for this example. You may have to create any parent directories first.
Other directories you may wish to do this with are
/var/tmp, and
Mount ESP
If you prepared an EFI system partition earlier, create its mount point and mount it now.
/boot/efi, since it is not a btrfs file system.
At the pacstrap installation step, the btrfs-progs must be installed in addition to the base group.
Configuring mkinitcpio
Create keyfile
In order for GRUB to open the LUKS partition without having the user enter his passphrase twice, we will use a keyfile embedded in the initramfs. Follow Dm-crypt/Device encryption#With a keyfile embedded in the initramfs making sure to add the key to
/dev/sdaX at the luksAddKey step.
Edit mkinitcpio.conf
After creating, adding, and embedding the key as described above, add the
encrypt hook to mkinitcpio.conf as well as any other hooks you require. See Dm-crypt/System configuration#mkinitcpio for detailed information. Be sure to regenerate the initial ramdisk when finished.
BINARIES="/usr/bin/btrfs" to your
mkinitcpio.conf. See the Btrfs#Corruption recovery article.
Configuring the boot loader
Install GRUB to
/dev/sda. Then, edit
/etc/default/grub as instructed in the GRUB#Encryption article, following both the instructions for an encrypted root and boot partition. Finally, generate the GRUB configuration file.
Configuring swap
If you created a partition to be used for encrypted swap, now is the time to configure it. Follow the instructions at Dm-crypt/Swap encryption.
After completing this step, continue configuring your system as normal according to the installation guide.


text:
BreedDomestic Short Hair
Agekitten (0 - 6 months)
ColorBrown Tabby
Good With Kids?
Good With Cats?Unknown
Good With Dogs?Unknown Learn More
Born #5 out of 5, Mambo has never been last again. She is the most likely of Kayla's kittens to be the first to investigate something, explore a new area or follow her human to see what they are up to. She is confident and friendly but mostly just wants to play until she's exhausted. On the rare occasion she is exhausted she will happily allow you to be the pillow she rests up against until she is ready to get back to slaying imaginary prey to protect her humans from harm.
All of Kayla's kittens are curious and playful. They have the slight hesitation of caution that most kittens have, but there isn't a scared or shy one in the bunch. They get along equally well with each other and have been exposed to other adult cats throughout their life so likely will adapt well to any accepting cat. They will do best in a home with another feline (possibly canine) playmate as they are a bundle of energy with a voracious appetite for play. They are fine about being held, but as they are still kittens they are usually a bit impatient about getting back to playtime. They love toys and play with virtually every one put before them (and a few other things they deem worthy of the designation). The family favorites are the laser pointer and the crinkly tunnel.
Estimated date of birth: 11/20/2018
For information on Mambo, please email firstname.lastname@example.com

subset: commoncrawl


text:
On the day the Assad regime falls, it is expected to harm the Alawite clan. We are preparing to receive Alawite refugees on the Golan Heights.
Bashar al-Assad and his family are, as may be guessed, members of this clan.
Al Jazeera's efforts to get any comments on this statement had come to nought when this report was filed. Thus, for now at least, we have no way of knowing whether Gantz was making a policy statement on behalf of the Israeli Defense Forces or whether he was speaking as an individual with the authority to follow through on his proposal. (Gantz is currently Chief of Staff for the Army.) This is not quite a "retirement community" scenario. More likely it reflects a better-the-devil-you-know approach to foreign policy. Nevertheless, the "family resemblance" to Márquez vision is striking, not to mention ironic!


text:
Cincinnati Bengals at Baltimore Ravens 11/18/2018
FILE - In this Sunday, Nov. 18, 2018 file photo, Baltimore Ravens head coach John Harbaugh walks on the sideline in the first half of an NFL football game against the Cincinnati Bengals in Baltimore. Ravens coach John Harbaugh has received a new four-year contract following a season in which he guided Baltimore to the AFC North title. The new deal is designed to keep the winningest coach in Ravens history under contract through the 2022 season. It replaces a pact that was slated to end after next year. (AP Photo/Nick Wass, File)
FILE - In this Nov. 18, 2018, file photo, Baltimore Ravens tight end Nick Boyle runs against the Cincinnati Bengals during an NFL football game, in Baltimore. The Ravens have signed Nick Boyle to a three-year contract, the latest in a series of moves by first-year general manager Eric DeCosta during a busy offseason. Though Boyle has not scored a touchdown over his four NFL seasons, the 6-foot-4, 270-pounder has value that transcends catches and scores. (AP Photo/Rich Schultz, File)


text:
Convincing features
Product information
The 3-speed fan clutch of the LINNIG brand can realize three possible fan speeds, which are each influenced through the input speed.
Speed stage 1: In inactivated condition, the approx. fan speed is 150 RPM.
Speed stage 2: Through activation of the stage 2 electromagnet and with employment of the permanent magnets, a contact-free and wear-free speed of 30 % - 75 % of the input speed can be realized. The respective speed is adapted to customer specifications.
Speed stage 3: The stage 3 electromagnet is activated in order to achieve the maximum rated fan speed. The fan now runs synchronous to the input speed, with no loss of speed.
The signals for the electromagnets either come directly from temperature sensors in the cooling circuit or via the engine-control system. The result is demand-meeting fan engagement.
A mechanical interface, as an example, is the front of the engine. In this section, the clutch also contains the assembly plate as well as the pulley. Further possible interfaces, depending on application, can be the water pump or the crankshaft. When the fan is positioned offset of the engine, the pulley forms the mechanical interface.
Fan sizes for applications range between 300 mm and 1,200 mm.
Among other applications, the 3-speed electromagnetic fan clutches are also used in cooler regions, as the speed stage 1 prevents over-cooling of the engine at minimal fan speed.
Specifications and technical data
|Transferable torque:
|Up to 400 Nm
|Diameter of driven fans:
|Up to approx. 1,200 mm
|Supply voltage:
|12 or 24 V
Worldwide availability
Kendrion - Serving our customers worldwide. Providing upfront competence on location.
- Trucks
- Buses
- Off highway
- Construction and agricultural machinery
- Gen sets, pumps and compressors


text:
The secret to the Pitt Panthers success in the 2015-16 season is when they were consistent. Excellent play on offense when they were able to make baskets, (especially timely ones) and when they were able to play effective defense and make free throws. The key to Pitt's failure? When their performance was exactly the opposite.
Such of a case happened in their first round of their NCAA Tournament game vs. the 7th seeded Wisconsin Badgers. The 10th seeded Panthers underperformed and fell to the Badgers 47-43 in St. Louis. Wisconsin moves on to play the winner of #2 Xavier/#15 Weber State, and the Panthers season ends.
Make no mistake, both teams didn't play well as it was one of the lowest scores in NCAA Tournament history. Pitt shot an awful 37.5%(18-48) floor and an even worse 27.3% (3-11) from the 3-point line. But surprisingly, those numbers were slightly better than Wisconsin's 32.1%(17-53) from the floor and 21.1%(4-19) from the 3-point line. But the most important stat that the Badgers fared better than Pitt-was on the scoreboard. And when they needed key baskets, they made them.
The best the Panthers could get was 13 points from F Jamel Artis. He was the only Panther who scored in double figures. Plus, he had all of Pitt's 3-pointers, plus a huge one that got them within a point with over a minute left in the game. Meanwhile, the rest of the starters combined for 19 points as G James Robinson had 7 points and F Mike Young and G Chris Jones combined for 6 points.
Robinson's subpar production hurt the Panthers the most as he was only 3-14 from the floor and missed all 3 of his three-point attempts. He also had a chance to win the game for Pitt with seconds left, but his attempted layup bounced off the rim. He did lead the team with 11 rebounds and 4 assists. This loss to the Badgers officially ends his college basketball career.
The Panthers were able to get 9 points off the bench from F Sheldon Jeter, but F Cameron Johnson could only muster 2 points which also didn't help their cause.
Robinson actually gave Pitt a 2-0 lead with a jumper and he was very instrumental on defense. Artis then scored to make it 4-0, but the Badgers quickly made it 4-3 when F Zack Showalter hit a 3-pointer. Artis and Robinson then extended Pitt's lead to 10-3 with key baskets, then Jeter joined the scoring party with baskets and suddenly Pitt had a 13-3.
But Pitt wasn't done. After Wisconsin added 2 points, Artis hit his first 3-pointer and after Jeter and Jones scored, Pitt had a commanding 20-6 lead. Then back came the Badgers as G Charlie Thomas, Nigel Hayes closed Pitt's lead. And when G Vitto Brown hit a 3-pointer, Pitt's lead had shrunk to 22-16, which was the halftime score.
In the second half, Wisconsin got the scoring started when F Ethan Happ scored on a jumper. Jeter then made a layup on his own, but Happ was just getting started as his second layup and a free throw closed Pitt's lead to 24-21. After Brown closed Pitt's lead to 24-23, Happ was at it again, this time on a dunk which gave the Badgers their first lead of the night at 25-24.
Pitt quickly took back the lead on Young's layup until Happ scored again, giving Wisconsin a 27-26 lead. Then Johnson scored his only points of the game, returning the lead to Pitt at 28-27. Artis then hit 2 free throws to extend Pitt's lead to 3.
The score was 34-31 until Hayes' 2 free throws closed Pitt's lead to 1. Young then extended Pitt's lead by 3 on a jumper, but then Hayes would score again to close the gap to 36-35. It would remain that way until Brown would hit a huge 3-pointer to give the Badgers a 38-36 lead, but Artis would strike again-hitting a 3-pointer of his own returning the lead to Pitt at 39-38.
The score was tied at 39 when Robinson would give the Panthers a 1-point lead, but that would turn out to be Robinson's final points of the game as the rest of his attempts failed to reach the basket. Then the Badgers would put the final hurt on the Panthers when Brown would hit another huge 3-pointer, giving the Badgers a 42-40 lead.
After a Pitt timeout, Artis would give the Panthers hope as his 3rd 3-pointer would pull Pitt to within 1 with seconds left on the clock. Pitt would get the rebound, drive the length of the court and miss a potential game-winning layup. The Badgers would eventually get fouled and add 2 more on free throws, and seal the 47-43 victory, giving Pitt another early exit in the Big Dance.
Happ would lead all scorers with 15 points, and also led his team with 9 rebounds and 3 assists. They weren't exactly great in this game, but they were great when they had to be, and that's why they will advance to the field of 32.
The Panthers will now lick their wounds as their offseason begins. They say goodbye to Robinson, (Graduate Transfers) Centers Rafael Maia, Alonzo Nelson-Ododa and G Sterling Smith, and reserve G Mike Lecak. As a result, they will probably need to retool with more graduate-transfers and will be welcoming a new class of recruits for the 2016-17 season. It will also help the Panthers as their leading scorers return in Artis and Young, but here's hoping that they use the summer to hone their skills in an effort at being more consistent. If they can improve, the Panthers will improve.
In conclusion, it was a good season for Pitt because after facing their struggles during the regular season, they still managed to make the NCAA tournament for the 13th time in 15 seasons, but this would've been a better season if they would've held onto beat the Badgers.
Please e-mail Ray at email@example.com
Follow him @urbanmediaRay on twitter


text:
The Phaistos Disc (also spelled Phaistos Disk, Phaestos Disc) is a disk of fired clay from the Minoan palace of Phaistos on the Greek island of Crete, possibly dating to the middle or late Minoan Bronze Age (2nd millennium BC). It is about 15 cm (5.9 in) in diameter and covered on both sides with a spiral of stamped symbols. Its purpose and meaning, and even its original geographical place of manufacture, remain disputed, making it one of the most famous mysteries of archaeology. This unique object is now on display at the archaeological museum of Heraklion.
The disc was discovered in 1908 by the Italian archaeologist Luigi Pernier in the Minoan palace-site of Phaistos, and features 241 tokens, comprising 45 unique signs, which were apparently made by pressing hieroglyphic "seals" into a disc of soft clay, in a clockwise sequence spiraling toward the disc's center.
The Phaistos Disc captured the imagination of amateur and professional archeologists, and many attempts have been made to decipher the code behind the disc's signs. While it is not clear that it is a script, most attempted decipherments assume that it is; most additionally assume a syllabary, others an alphabet or logography. Attempts at decipherment are generally thought to be unlikely to succeed unless more examples of the signs are found, as it is generally agreed that there is not enough context available for a meaningful analysis.
Although the Phaistos Disc is generally accepted as authentic by archaeologists, a few scholars believe that the disc is a forgery or a hoax.
The Phaistos Disc was discovered in the Minoan palace-site of Phaistos, near Hagia Triada, on the south coast of Crete; specifically the disc was found in the basement of room 8 in building 101 of a group of buildings to the northeast of the main palace. This grouping of 4 rooms also served as a formal entry into the palace complex. Italian archaeologist Luigi Pernier recovered this remarkably intact "dish", about 15 cm in diameter and uniformly slightly more than one centimetre in thickness, on 3 July 1908 during his excavation of the first Minoan palace.
It was found in the main cell of an underground "temple depository". These basement cells, only accessible from above, were neatly covered with a layer of fine plaster. Their content was poor in precious artifacts but rich in black earth and ashes, mixed with burnt bovine bones. In the northern part of the main cell, in the same black layer, a few inches south-east of the disc and about twenty inches above the floor, Linear A tablet PH 1 was also found. The site apparently collapsed as a result of an earthquake, possibly linked with the eruption of the Santorini volcano that affected large parts of the Mediterranean region during the mid second millennium BC.
The Phaistos Disc is generally accepted as authentic by archaeologists. The assumption of authenticity is based on the excavation records by Luigi Pernier. This assumption is supported by the later discovery of the Arkalochori Axe with similar but not identical glyphs.
The possibility that the disc is a 1908 forgery or hoax has been raised by two or three scholars. According to a report in The Times the date of manufacture has never been established by thermoluminescence. In his 2008 review, Robinson does not endorse the forgery arguments but argues that "a thermoluminescence test for the Phaistos Disc is imperative. It will either confirm that new finds are worth hunting for, or it will stop scholars from wasting their effort."
A gold signet ring from Knossos (the Mavro Spilio ring), found in 1926, contains a Linear A inscription developed in a field defined by a spiral—similar to the Phaistos Disc. This is considered as evidence that the Phaistos Disc is a genuine Minoan artifact.
Yves Duhoux (1977) dates the disc to between 1850 BC and 1600 BC (MMIII) on the basis of Luigi Pernier's report, which says that the Disc was in a Middle Minoan undisturbed context. Jeppesen (1963) dates it to after 1400 (LMII-III). Doubting the viability of Pernier's report, Louis Godart (1990) resigns himself to admitting that archaeologically, the disc may be dated to anywhere in Middle or Late Minoan times (MMI-LMIII, a period spanning most of the 2nd millennium BC). J. Best (in Achterberg et al. 2004) suggests a date in the first half of the 14th century BC (LMIIIA) based on his dating of tablet PH 1.
The inscription was apparently made by pressing pre-formed hieroglyphic "seals" into the soft clay, in a clockwise sequence spiraling towards the disc's center. It was then fired at high temperature. The unique character of the Phaistos Disc stems from the fact that the entire text was inscribed in this way, reproducing a body of text with reusable characters.
The German typesetter and linguist Herbert Brekle, in his article "The typographic principle" in the Gutenberg-Jahrbuch, argues that the Phaistos Disc is an early document of movable type printing, since it meets the essential criteria of typographic printing, that of type identity:
An early clear incidence for the realization of the typographic principle is the notorious Phaistos Disc (ca. 1800–1600 BC). If the disc is, as assumed, a textual representation, we are really dealing with a "printed" text, which fulfills all definitional criteria of the typographic principle. The spiral sequencing of the graphematical units, the fact that they are impressed in a clay disc (blind printing!) and not imprinted are merely possible technological variants of textual representation. The decisive factor is that the material "types" are proven to be repeatedly instantiated on the clay disc.
As a medieval example for the same technique he goes on to cite the Prüfening dedicatory inscription.
In his work on decipherment, Benjamin Schwartz also refers to the Phaistos Disc as "the first movable type".
In his popular science book Guns, Germs and Steel, Jared Diamond describes the disc as an example of a technological advancement that did not become widespread because it was made at the wrong time in history, and contrasts this with Gutenberg's printing press.


text:
Chin / Jaw / Nose shaping with fillers
A masculine profile carries a lot of weight in our society both professionally and socially.
Easy Enhancements
Those who were born with less definition or lose definition over time from aging can easily create a strong jawline, more desired angularity and chin projection to overcome any chin recession or appearance of a weak chin.
Immediate Results
Long term dense substance fillers provide an immediate effect and can solve the issues either at once or over time if you prefer a subtler approach that is not obvious. Most people will simply compliment you on your weight loss as they assume your more defined contours are a result of new health habits (always a good assumption!)
Filler Choices for Shaping
Radiesse provides the longest lasting shaping filler and can be used along the jawline, in the chin and even along the nose to camouflage irregular lines. Radiesse is composed of a calcium based product which holds its shape very well and has no defined edges like those evident to surgical implants. Plus, fillers won't shift, so you won't have to worry about things moving about.
Other options should you wish to use a product that you can have removed if for some reason you decide to change your mind.
Comfortable Cannula Placement
Fillers come with lidocaine so injection is very comfortable. Dr. Pilest exclusively uses round tip cannulas instead of those spikey needles so the filler is placed with virtually no sensation at all.
Video with Cosmetic Physician Colleague Dr. David Mabrie
Nose Shaping – No surgery
Genetically or from incident, noses with bumps, dents and some level of curve or asymmetry can be simply altered with small amounts of long lasting dermal filler.
Profile views often bring attention to misshaping of the nose – even when it is very minor.
Filler Options for Nose Shaping
Radiesse is an easy to inject dermal filler with longevity of around 18 months. Since the product contains lidocaine, the injection process is on the low end of discomfort.
Restylane of Juvederm can also be chosen with less longevity and also carries the ability to be dissolved if desired.
Fast and Simple 15 Minute Procedure
The process of nose shaping is simple and quick. Dr. Pilest places tiny amounts of the filler while you assess the level of buildup. The outcome is totally in your control as you decide when enough is enough and what improvements and balancing you want to achieve. The proverbial "15 minute nose job" really does exist!
Making the Nose Appear Smaller
Particularly useful for men with ethnic profiles that call attention to a larger nose, the nose shaping process creates a visual refinement and an unbroken slope generally can make the nose appear smaller
Dr. Nissan Pilest is a member of the distinguished Expert Injector collaboration and holds the Circle of Excellence in Soft Tissue Fillers through the American Society of Dermatologic Surgeons. Dr. Pilest performs all injections for dermal fillers and neuromodulators at Total Dermatology. About Dr. Pilest
If you would like to learn more about face shaping, please call our office at 949-727-3800 today to schedule a consultation or fill out the form on this page and one of our trusted staff members will reach out to you promptly.


text:
Keywords: Sherlock Holmes
The Girl with the Scarab Necklace
Tyro Vogel
Year of publication: 2014
Tyro Vogel THE GIRL WITH THE SCARAB NECKLACE Who is Mr. Sherlock Holmes In the year 1903 I was honorably discharged from the army, and Uncle Sam sent me back home to rub shoulders with all the other out-of-work boys roaming the streets. I got lucky: a buddy of mine got me a job at the port. Night shifts. Mine was a sad lot: night after night of back-breaking work, only to give half of my 1.50 a week pay for a room uglier than the rats Id shared it with. The rest of the money Id wisely spent on ...
Keywords: Doctor Who jedi Sherlock Holmes Star Wars time travel whovian


text:
Chinese smartphone manufacturer Meizu unveiled its latest flagship devices — 'PRO 7' and 'PRO 7 Plus' — which feature dual screens (one at the rear) and dual cameras. The 'PRO 7' and 'PRO 7 Plus' feature an AMOLED rear display which allows users to manage notifications and take 'selfies' with rear cameras.
In the front, 'Pro 7' carries 5.2-inch super-AMOLED full-HD display while 'PRO 7 Plus' has 5.7-inch Quad-HD display. The devices pack 12MP dual cameras on the rear and 16MP 'selfie' cameras.
"The 'Meizu PRO 7' and 'PRO 7 Plus' convey the very essence of Meizu — our passion for innovating and our commitment to creating premium devices," said Ard Boudeling, Head of Global Marketing, Meizu, in a statement. "We have been trying out different implementations of rear displays for the past years and are confident we have now created an implementation that truly offers a great user experience," he added.
'PRO 7' is equipped with Helio P25 processor and has 4GB RAM and 64GB of internal storage. 'PRO 7 Plus' comes with 6GB RAM and offers two storage options of 64GB and 128GB. 'Meizu PRO 7' and 'PRO 7 Plus' are powered by 3,000mAh and 3,500mAh batteries, respectively, which are capable of quick-charging. The prices of both the devices are yet to be announced.
You Might be Interested


text:
13-year-old boy shot inside Milwaukee residence
A 13-year-old boy was shot early Friday inside a Milwaukee residence, police said.
The teen was shot about 4:40 a.m. in the 4700 block of N. 40th St. and was taken to the 1300 block of W. Ring St. before paramedics took him by ambulance to the hospital, according to Milwaukee police.
His injuries are not life-threatening, authorities said.
ARCHIVE: Precious Lives: Kids, guns and how we stop the violence
Milwaukee police are investigating the circumstances of the shooting and searching for suspects.
The boy is the second teen to be wounded in a shooting in Milwaukee in recent days. A 17-year-old was dropped off at a hospital Thursday with a gunshot wound and is expected to survive his injuries, police said.
Read or Share this story: https://jsonl.in/2DqTNJp


text:
From relationship goals to sex advice: if it's about sex or relationships, share it here.
would you get breast implants if they started to sag
because of weight loss or having kids
or any other reason that made them sag
I'm thinking about getting mines done I lost a lot of weight.... They don't sag but they aren't as perky as before ??
My husband said he'll pay for them if that's what I want??
Vote below to see results!


text:
Pages: 1
Hello all,
Used linux since the early Slackware days back in the early 90's. Became a serious distro hopper until I discovered #!. I loved that distro. Then went back to distro hopping when it died then BunsenLabs. No need to distro hop any more. Just thank you for the best distro out there, by far.
You must be about as old as me, lol...I cut my Linux teeth on Slackware in the early 90s as well, and did some distro hopping myself. Red Hat, Fedora, then Debian (and its many flavors). Fun times!
Real Men Use Linux
Hi Gerry welcome to the Lab!
( a boring Japan blog, idle Twitterings and GitStuff )
In case you forget, the rules.
Hi Gerry, welcome to the Lab and thank you for the kind words!
"Et ignotas animum dimittit in artes." — Ovid, Metamorphoses, VIII., 18.
Welcome to the forum!
I tend to call ex-#! fans ending up here "users from the lost legion" (after the movie Eagle). Thinking about it, I'd say #! had a significant influence on distro development as it was the first of "its kind" (I might be wrong though, but #! was surely popular and "different" meaning minimalistic in a cool way). Now there are Archbang, Archlabs, Archlabs Minimo, SalentOS, etc.
Love that description of 'Lost Legion' It's so true.
Pages: 1


text:
This application (Intent to Enroll and Acceptance of Policy) must be submitted in order to be considered for enrollment. Seats are filling up quickly. Please contact our Registrar office with all questions at 801-822-2668. Freedom Preparatory Academy cannot be responsible for late, incomplete or illegible applications.
In accordance with Federal and State law, Freedom Preparatory Academy does not discriminate based on race, creed, color, religion, national origin or ability/disability status. Enrollment preference is given to siblings of currently enrolled students. Families will be notified via e-mail regarding their child's placement. Once notified of their child's placement, parents have ten calendar days to claim the space. If the parent fails to claim said space, the acceptance email will be void and their child will lose their allotted space.
If parent's last name differs from student's last name, please check:
We will use your e-mail address to let you know your place in the lottery draw. Please notify the school if any of the above information changes.
Applications received by February 28, 2020 will be entered into the lottery for admission. Applications received after the lottery will be entered at the bottom of the waiting list in the order received. Freedom Preparatory Academy is not responsible for late or incomplete applications. In accordance with Federal and Utah State law, Freedom Preparatory Academy does not discriminate based on race, creed, color, religion, national origin or ability/disability status.
After reading this page, please sign where indicated.
1. I understand that Freedom Preparatory Academy is an academically challenging school and utilizes the following curricula: Core Knowledge, Saxon Math, Leader In Me, Spalding Language Arts and Shurley English. I will become familiar with the curriculum by accessing the websites and/or checking out materials from the school resource library. The Freedom Preparatory Academy mission is to help children gain knowledge and to love learning. I will support this effort by providing a place and a regular time each school day that my child can engage in learning activities in our home and complete his/her assignments in a timely manner.
2. I understand that Freedom Preparatory Academy is a charter school, and as such, is in need of parents who are anxious to serve the school community on a volunteer basis. I understand the school requests every family to provide 40 hours of volunteer service each year.
3. I understand that charter schools receive less funding than traditional schools and rely on additional sources of funding. I understand Freedom Preparatory Academy suggests that parents make an annual $200 donation.
4. I understand that my child will be required to wear a school uniform. I have read the uniform policy and I will ensure my child is in compliance with the school uniform policy.
5. I will promote the vision of Freedom Preparatory Academy by using positive communication, courtesy and respect when interacting with staff, students, parents and anyone else in the school community. I will follow the Academy's feedback process, specifically; I will take any concerns I have directly to that person. If the situation is not resolved, I will schedule an appointment with the director. If further mediation is required, I will submit my situation in writing to the Governing Board.
6. I understand that this signed form, along with a completed "Intent to Enroll" form, will constitute application for enrollment at Freedom Preparatory Academy.
"I have read and understand the Freedom Preparatory Academy Policies as written above."


text:
In the beginning of April the National Gallery of Art, Washington is going to start an amazing series focusing on postwar Eastern European experimental cinema: Artists, Amateurs, Alternative Spaces: Experimental Cinema in Eastern Europe, 1960–1990.
The "national cinemas" of the countries of the former Eastern Bloc are hardly unknown to film lovers elsewhere in the world. Despite Cold War–era cultural divisions and conflicts, a number of filmmakers from Poland, Hungary, and the former USSR, Czechoslovakia, and Yugoslavia received international acclaim from the 1950s through the 1980s and have continued to receive it since 1989.
Less known and rarely seen both at home and abroad are the histories of filmmaking that took place outside large state-run feature film studios in postwar Eastern Europe.[1] The aim of Artists, Amateurs, Alternative Spaces: Experimental Cinema in Eastern Europe, 1960–1990, curated by the Department of Film Programs at the National Gallery of Art, is to fill these knowledge gaps with the first series of screenings of its kind. The series shows the variety of filmmaking and early video practices that existed in the region in the postwar period, and it sheds light on work that was made by artists and amateurs, as well as professionals, who, despite restrictions, made independent and experimental work both on their own and with the support of smaller state-funded amateur film clubs, festivals, and studios.
The scope of the series is broad, and it showcases work from across the region. Present-day countries represented are Croatia, Czech Republic, Estonia, Germany, Hungary, Latvia, Lithuania, Poland, Romania, Serbia, Slovenia, and Slovakia. Though a handful of the films shown were made in the second half of the 1950s, the vast majority fall into the turbulent decades of the 1960s through 1980s, during which waves of enthusiasm for socialism alternated with periods of increasingly bitter disillusionment in "the system." Against often divergent and country-specific historical backgrounds, what unites the filmmakers included in the series is an interest in film and video that defies the genre expectations of both narrative feature films and "straight" documentary. As a result, these predominantly short works offer highly subjective and partial glimpses into the lives and interests of Eastern Bloc filmmakers. They also, however, highlight the creativity and spirit of experimentation to which many remained committed despite often facing the possibility of official censorship—a facet of the larger history that forms a leitmotif in the series.
Gábor Bódy: Four Bagatelles (1975)
The organizing principles of the series draw connections both among films made in one place and those made in different countries. Some screenings bring together works created in one institution that shaped its members, such as the Workshop of the Film Form in Łódź, Poland, or the Balázs Béla Studio (BBS) in Budapest, Hungary. These are some of the "alternative spaces" of the series title—officially funded studios that supported at various times a surprisingly wide array of experimental film practices, driven by the dual desire of both filmmakers and policy makers to give younger generations the resources necessary for their artistic development. Interspersed throughout the series are films made at several other such "alternative spaces," including the Riga Film Studio in Latvia, the Neoplanta Film Studio in Novi Sad, Serbia, and the Se-Ma-For Studio in Łódź.
The significance of these "alternative spaces" is hard to overstate—they seem largely to account for the numerous notable experimental films that came out of such countries as Poland and Hungary. One can appreciate their significance all the more when one considers the experimental films that emerged from such countries as East Germany, Romania, and Russia, where comparable resources were lacking. Though East Germany still produced an active "Super 8 movement," Romania had the phenomenon of the amateur Kinema Ikon workshop, and Russia saw "Parallel Cinema" emerge in the 1980s, on the whole, the latter groups—whose work undoubtedly has great historical significance—could not match their better-resourced peers living under less repressive regimes in either quantity or artistic and technical sophistication of output. A full mapping of the "alternative spaces" across Eastern Europe is thus imperative to understanding the history of film experimentation in the region. The mapping offered here is only a beginning. Our hope is that future scholarship and public attention will both expand it and shed light on the connections that such spaces fostered among filmmakers from across Eastern Europe (as, for example, in the case of the Croatian filmmaker Ivan Ladislav Galeta, who worked on a number of projects at the BBS in Hungary).
Ladislav Galeta: Ping-Pong (1976-1978)
Several screenings, most notably the selection of films made by amateurs in Serbia and Croatia and the selection of films from The Enthusiasts project, highlight the history of amateur film clubs in the region. These were another kind of "alternative space" actively supported by some governments in the socialist bloc, particularly those of Poland and Yugoslavia, which saw them, at least in theory, as a way of fulfilling the ideal of offering opportunities for self-realization and access to cultured leisure for all. In Yugoslavia, amateurs were able to organize by and for themselves the Genre Experimental Film Festival (GEFF) in Zagreb, Croatia. Its history, now documented in some depth, is a testament to the vibrant amateur film scene that existed in parallel with the professional mainstream establishment. The existence of this scene, moreover, made more porous the boundary between amateur and professional filmmaking—members of the Academic Film Club in Belgrade, including the renowned director Dušan Makavejev, were particularly prone to crossing over from amateurs to professionals while retaining experimental sensibilities. In Poland, where the history of the amateur film movement was only recently documented by the artists Marysia Lewandowska and Neil Cummings, its significance was nevertheless acknowledged by at least one professional filmmaker as early as 1979 in Krzysztof Kieślowski's Film Buff (Amator).
The remaining groupings showcase tendencies that transcended national boundaries. These include experimentation with the technical possibilities of materials and mediums; exploration of the actions possible in the private and public spheres; and commemoration of significant historical events. As the series demonstrates, people who had access only to small-gauge "amateur" 8 mm and 16 mm film cameras in the former East also grappled with many of the same concerns as "alternative" media makers in the West, where access to equipment, distribution channels, and professional dialogue was far greater. Yet another commonality that the series traces throughout (and especially in the screening titled "Artists, Collectives, Communities") is that visual artists all around the former East—much like their Western counterparts—showed widespread interest in exploring the possibilities of film and video, using both amateur and professional resources, depending on what was available.
Andrzej Pawłowski: Cinéforms (1957)
Although not a comprehensive survey of experimental film and early video in postwar Eastern Europe, this series makes an important step toward illuminating the complicated cinematic past of the region and embedding it in its social history. It maps many of the currently accessible works while exploring the similarities and differences between makers and their methods and motivations. It recognizes the contributions of such renowned figures as Dušan Makavejev and Jonas Mekas, but primarily seeks to acknowledge less well known artists and their legacies. In addition, the films and videos selected shed light on the important work of the archives lending their materials and raise awareness about the importance of preservation, restoration, and circulation of experimental film."
— Ksenya Gurshtein and Joanna Raczynska
More information available here.
To see the calendar, click here.
Series filmography
- 1,2,3…Operator's Exercise (1,2,3… Ćwiczenie operatorskie, Paweł Kwiek, Poland, 1972, 8 minutes)
- 10 Minutes Older (Vecāks par 10 minūtēm, Herz Frank, Latvia, 1978, 10 minutes)
- 19th Nervous Breakdown (19. Živčni Zlom, Naško Križnar and OHO, Slovenia, 1966, 4 minutes 31 seconds)
- 30 Sound Situations (30 sytuacji dźwiękowych, Ryszard Waśko, Poland, 1975, 9 minutes 28 seconds)
- 235 000 000 (Uldis Brauns, Latvia, 1967, 70 minutes)
- Acceleration (Ubrzanje, Ivan Martinac, Croatia, 1969, 7 minutes 14 seconds)
- Anthony's Broken Mirror (Antonijevo razbijeno ogledalo, Dušan Makavejev, Serbia, 1957, 11 minutes 30 seconds)
- Black Film (Crni film, Želmir Žilnik, Serbia, 1971, 14 minutes)
- Boxing (Ion Grigorescu, Romania, 1977, 2 minutes 45 seconds)
- Carousel (Karuzela, Krzysztof Szafraniec, AKF Nowa Huta, Kraków, Poland, 1984, 2 minutes 20 seconds)
- Centaur (Kentaur, Tamás St. Auby, Hungary, 1973–75/2009, 40 minutes)
- Centre (Centrum, Kazimierz Bendkowski, Poland, 1973, 5 minutes 20 seconds)
- Checkmate (Mat, Pavel Bárta, Czech Republic, 1983, 16 minutes 30 seconds)
- Cinéforms (Kineformy, Andrzej Pawłowski, Poland, 1957, 6 minutes 45 seconds)
- Clapper (Klaskacz, Wojciech Bruszewski, Poland, 1971, 5 minutes 53 seconds)
- Contemporary Symphony (Współcześna Symfonia, Maciej Korus and Jerzy Ridan, Amateur Film Club (AKF) Nowa Huta, Kraków, Poland, 1971, 6 minutes 20 seconds)
- Cut (Goran Trbuljak, Croatia, 1976, 31 seconds)
- DM1978 Talks to DM2010 (Dalibor Martinis, Croatia, 1978/2010, 13 minutes)
- Death of Metalosaurus (Smrt metalosaurusa, Igor Toholj, Serbia, 1989, 3 minutes)
- Dok. Film (Naško Križnar and OHO, Slovenia, 1968, 4 minutes 11 seconds)
- Drawings (Vladimir Havrilla, Slovakia, 1976, 3 minutes 30 seconds)
- Encounter (Sretanje, Vladimir Petek, Croatia, 1963, 8 minutes)
- Endless Day (Lõputu Päev, Jaan Tooming and Virve Aruoja, Estonia, 1971/1990, 30 minutes)
- Four Bagatelles (Film Language Series) (Négy Bagatell, Gábor Bódy, Hungary, 1975, 27 minutes 40 seconds)
- Function (Funkcja, Zdzisław Zinczuk, AKF Awa, Poznán, Poland, 1981, 1 minute 7 seconds)
- Game (Divjad, Karpo Godina and Jure Pervanje, Slovenia, 1965, 6 minutes)
- Gypsies (Cigányok, Sándor Sára, Hungary, 1962, 17 minutes)
- Hello, Berlin! (Guten Tag, Berlin!, Thomas Werner, Germany (GDR), 1987, 11 minutes)
- Humbug (G. Piszczek and M. Kuczminski, AKF IKS, Mikołów, Poland, 1970s, 3 minutes 40 seconds)
- I'm Going (Ide, Josef Robakowski, Poland, 1973, 3 minutes)
- Image Is Virus (Dalibor Martinis, Croatia, 1983, 5 minutes 17 seconds excerpt from 20 minutes)
- Innocence Unprotected (Nevinost bez zaštite, Dušan Makavejev, Serbia, 1968, 79 minutes)
- K3 or Clear Sky without Clouds (K3 ili čisto nebo bez oblaka, Mihovil Pansini, Croatia, 1963, 2 minutes 30 seconds)
- Kalah (Dóra Maurer and Zoltán Jeney, Hungary, 1980, 12 minutes)
- Kariokinesis (Kariokineza, Zlatko Hajdler, Croatia, 1965 reconstructed 1998, 2 minutes)
- Litany of Happy People (Zdravi ljudi za razonodu, Karpo Godina, Slovenia, 1971, 14 minutes 26 seconds)
- Long Distance Runner (Hosszú futásodra mindig számíthatunk, Gyula Gazdag, Hungary, 1968, 13 minutes)
- Market (Rynek, Josef Robakowski, Poland, 1970, 4 minutes)
- Media (Zbigniew Rybczyński, Poland, 1980, 1 minute 36 seconds)
- New Year's Eve (Szilveszter, Elemér Ragályi, Hungary, 1974, 15 minutes 29 seconds)
- One Day More (Dan više, Vlatko Gilić, Serbia, 1971, 10 minutes)
- Open Form – Game on an Actress' Face (Forma Otwarta – Gra na twarzy aktorki, The KwieKulik Group, Poland, 1971, 3 minutes)
- Oskar Hansen – Groping One's Way (Po omacku, Piotr Andrejew, Poland, 1975, 11 minutes 13 seconds)
- Painted in the Air (Malování do vzduchu, Radek Pilař, Czech Republic, 1965, 3 minutes)
- Paweł Freisler – Puppets (Pajace, Piotr Andrejew, Poland, 1971, 6 minutes 44 seconds)
- Personal Cuts (Osobni rezovi, Sanja Iveković, Croatia, 1982, 4 minutes)
- Ping-Pong (Ivan Ladislav Galeta, Croatia, 1976–78, 2 minutes 18 seconds)
- Pression (Ljubomir Šimunić, Serbia, 1970- 1975, 15 minutes)
- Private History (Privát Történelem, Gábor Bódy and Peter Timar, Hungary, 1978, 25 minutes)
- Prophecy (Věštba, Petr Skala, Czech Republic, 1980, 2 minutes)
- Raven (Gavran, Nikola Đurić, Serbia, 1973, 6 minutes 30 seconds)
- Reminiscences of a Journey to Lithuania (Jonas Mekas, US/Lithuania, 1972, 88 minutes)
- Searching for Balance (Hledání rovnováhy, Petr Skala, Czech Republic, 1973, silent, 3 minutes)
- Self Fashion Show (Öndivatbemutató, Tibor Hajas, Hungary, 1976, 14 minutes 41 seconds)
- Sisyphus (Syzyfowie, Tadeusz Wudzki, AKF Wiedza, Warsaw, Poland, 1971, 5 minutes 30 seconds)
- Somnambulists (Somnambulicy, Mieczysław Waśkowski and Tadeusz Kantor, Poland, 1958, 8 minutes 46 seconds)
- Straight Line (Stevens Duke) (Pravac [Stevens-Duke], Tomislav Gotovac, Croatia, 1964, 7 minutes 20 seconds)
- Symbiosis (Symbioza, Tadeusz Junak, STK Rotunda, Kraków, Poland, 1969, 10 minutes 14 seconds)
- Termites (Termiti, Milan Šamec, Croatia, 1963, 1 minute 40 seconds)
- The First Photo of Me Ever Taken (Kako su me prvi put fotografirali, Milenko Jovanović, Serbia, 1972, 1 minute)
- The Flip Side of the Coin (Monētas dubultportrets, Romualds Pipars and Maija Selecka, Latvia, 2008, 100 minutes)
- The Hands (Les Mains, Geta Brătescu, Romania, 1977, 6 minutes 45 seconds)
- The Seal (Pečat, Dušan Makavejev, Serbia, 1955, 17 minutes 40 seconds)
- The Space Transmission (Transmisja przestrzenna, Wojciech Bruszewski, Poland, 1974, 1 minute 8 seconds)
- The Square (Kwadrat, Zbigniew Rybczyński, Poland, 1972, 3 minutes 30 seconds)
- Together (Razem, Krzysztof Janicki and Marek Baranski, AKF Grunwald, Olsztyn, Poland, 1977, 3 minutes 30 seconds)
- Touch the Sound (Dotknąć Dźwięku, Darek Skubel and Zdzisław Zinczuk, AKF Awa, Poznán, Poland, 1981, 6 minutes 13 seconds)
- Trace (Slad, Helena Włodarczyk, Poland, 1976, 13 minutes)
- Transformation (Transformacja, Grzegorz G. Zgraja, Poland, 1978, 3 minutes 38 seconds)
- Transformations: Potter's Bull (Verwandlungen: Potters Stier, Jürgen Böttcher, Germany (GDR), 1981, 17 minutes)
- Twist Twist (Ante Verzotti, Croatia, 1962, 2 minutes 20 seconds)
- Video A (Studio Situation) (Video A [Sytuacja studia], Paweł Kwiek, Poland, 1974, 3 minutes 25 seconds)
- Video Manual (Dalibor Martinis, Croatia, 1978, 1 minute 27 seconds)
- Vowels (Samoglasnici, Nikola Đurić, Serbia, 1973, 7 minutes 45 seconds)
- White People (Beli Ljudje, Naško Križnar and OHO, Slovenia, 1970, 10 minutes 40 seconds)
- Winding Paths (Kręte ścieżki, Andrzej Barański, Poland, 1970, 6 minutes)


text:
Wearing your heart on your sleeve can is not nearly as fun as wearing your drink on your wrist. Perfect situations that require subtle sipping, this bangle flask might be the most utilitarian and stylish accessory you own.
Time is money—best spent on great wine, rather than waiting for it to decant. Instead, use our aerating spout's air-blending helix to let the vintage breathe as you pour. Now, sit back and relish that full flavor.
What's something exciting your business offers? Say it here.
Sign up to hear from us about specials, sales, and events.
Copyright © 2019 VNSN.TV - All Rights Reserved.
A Victoria Napolitano Group Company


text:
Barcelona Vs Athletic Bilbao – (La Liga Season 2015-16) Prediction, Live Streaming, Preview, Head to Head, Commentary, and News.
Barcelona Vs Athletico Bilbao will play their season's 5th match and 2nd match of the league in this Sunday and match will kick off at 19:00 BST, 1:05 BST. And match will kick off at Camp Nou (Barcelona). Before this match among at Barcelona Vs Athletico Bilbao had made 3 head to head at current season. Watch this match at the below tv channel on this 17th January 2016 at kick off time.
Match Details:
Tournament : La Liga Season 2015-16
Match : Barcelona Vs Athletic Bilbao
Kick off Date : 17th January 2016
Kickoff : 19:00 BST, 1:05 BST.
Day : Sunday
Stadium : Camp Nou (Barcelona)
TV Broadcasting List:
- Idman TV
- beIN Sports Arabia 1 HD
- ESPN Play Latin America
- QQ Sports Live
Since 1993-94 season Barca and Athletic Club has 54 head to head. Last match of them Barcelona has won the match by 0-1 goals and the deference were 0-1 goals also at Athletic Club's home. But at the first meeting of them were in Spanish Super Cup and there they beat Barcelona by 5-1 aggregate goals also won first title in 32 years. This victory for Barcelona for 34th time and in this 54 match run Athletic Club have won only 8 match where last one were a title winning match.
Barca is on the 2nd place at the league group table with 42 points currently. Atletico Madrid in the top of the table with 44 points and that is followed by Barcelona with 44 points. In the other hand Athletic Club in the 8th after 19 match with 28 points and they have 8 victory of this season run so far.
Barcelona Squad:
Claudio Bravo, Jordi Alba, Dani Alves, Javier Mascherano, Gerard Pique, Andres Iniesta, Ivan Rakitic, Lionel Messi, Sergio Busquets, Luis Suarez, Neymar.
Athletic Bilbao:
Gorka Iraizoz, Balenziaga, Benat, San Jose, Eneko Boveda, Etxeita, Aymeric Laporte, De Marcos, Markel Susaeta, Javier Eraso, Inaki Williams
Spanish la Liga 2015-16 Standings:
Team MP W D L GF GA GD P
Barcelona 18 13 3 2 44 15 +29 42
Athletic Bilbao 19 8 4 7 27 22 +5 28


text:
Discover Blue Sol
Hello Alfred is a residential hospitality service that provides personal help inside your home from dedicated "Alfreds" — trained and trusted professionals who fulfill weekly requests that residents submit through a mobile app. From shopping and stocking your fridge and pantry to picking up and putting away your dry cleaning to handling most any to-do on your list, Hello Alfred helps you save time to focus on the things that matter most.
Hello Alfred - Personal Concierge Services
Stylish granite countertops and custom cabinets
State-of-the-art athletic center
Cyber lounge and sophisticated board room
Hello Alfred - Personal Concierge Services
Stylish granite countertops and custom cabinets
State-of-the-art athletic center
Cyber lounge and sophisticated board room
Live Costa Mesa Inside And Out
We've crafted every detail of Blue Sol to give you the easiness of California lifestyle. In-home washer/dryers, ample parking, dual sinks, designer finishes, plus an unmatched location just minutes from Costa Mesa's best beach hang-outs and nightlife. All you have to do is settle in.View Amenities
Habana Restaurant
Cuban food lovers will go crazy over Habana. This shabby-chic restaurant features a wide selection of delicious, authentic Cuban dishes, specialty drinks, signature mojitos and more in an eclectic candle-lit space and garden patio. Enjoy an intimate dinner with family and loved ones, or gather with friends outside and enjoy some of the best drinks around.Explore More
The Triangle
One of Orange County's premier dining and entertainment destinations, The Triangle offers an array of exciting restaurants and entertainment options for both kids and adults. Spend a fun night at the modern bowling alley and movie theater or stop by the nightclub for drinks and dancing. There's something for everyone at the Triangle Center. Check it out!Explore More
South Coast Plaza
South Coast Plaza is your destination for upscale shopping and luxury goods. If the architecture from the outside isn't enough tget you in, the notable and extensive collection of high-end shops, boutiques and restaurants definitely will. Explore the largest mall on the West Coast today; it's more than just a mall, it's an entirely unique shopping experience.Explore More
Drop Us A Line
Thank You!
Your submission was successful. We will get back with you shortly.


text:
This was a really good episode. We actually saw some real action this time.
The whole episode was filled with action and the arc is building up nicely.
In this episode we see how strong Garou really is as he fights S-rank Tanktop Master. The fight was really intense as two really strong people were fighting. In the end Garou was the one remaining standing as his martial arts moves were a bit too much for the Tanktop Master. Also Mumen rider was beat up really badly by Garou.
This episode was a bit dark in compare to the first two episodes.
Saitama and Garou did meet momentarily, but Saitama didn't knew who he was nor did Garou knew about Saitama. Garou attacks him thinking that he is just a random hero, but gets knocked out by Saitama.Thats where the episode just ends.
Overall an amazing episode, i think the later episodes will be even better.


text:
The Tecno Camon C8 was released last year along with the Tecno Camon C5. The Tecno Camon C8 is a superior phone in many regards, but what exactly can it offer to the buyers and how much does it cost? Find out from our Tecno Camon C8 review!
Find hundreds of money-saving offers on Tecno Camon C8 on Jiji
1. Tecno C8 specification
It's worth noting that every review of the C8 in Nigeria praised the Tecno C8 specs as much as the Tecno C8 price. Before we move on to the Camon C8 price, let's find out what this phone has in store for the potential users.
Shop the Tecno C8 and other Tecno smartphones at the lowest prices in Nigeria on Jiji.
[otw_shortcode_button href="https://jiji.ng/mobile-phones/tecno-camon-c8?utm_source=blog&utm_medium=article&utm_campaign=jiji" size="medium" icon_position="left" shape="square" color_class="otw-red"]Click for price[/otw_shortcode_button]
Tecno Camon C8 Key Specs & Features
- 5.5-inch IPS Display, 720 x 1280 pixels (267ppi)
- 1.3GHz quad-core Processor with 1GB RAM
- Android 5.0 (Lollipop)
- 16GB Storage with support for memory card up to 32GB
- 13MP Rear Camera and 5MP Front Camera
- 3G Data
- Dual-SIM
- 3000 mAh Battery with Fast Charging
1. Design and display
The Tecno Camon C8 is one of the few Tecno models to employ three different materials in its build: the front panel of the phone is made of plastic, while the side and back panels are made from leather with metal accents. Needless to say, the Camon C8 is an exceptionally elegant device.
The display of the Tecno Camon C8 has the size of 5.5 inches and the IPS type. Together with the HD resolution, the display features of the C8 provide for a very enjoyable user experience whether you're watching or playing something.
2. Performance
The Tecno Camon C8 was never marketed as the flagship device, but the performance features of the phone are still pretty decent. The phone is powered by a 1.3GHz processor that is paired with 1GB of RAM and 16GB of storage. The RAM could have been bigger, but even with 1GB the C8 delivers optimal performance in nearly any situation.
Out of the box the Tecno Camon C8 runs on Android 5.0 Lollipop, which isn't the most recent version of Android but can be easily upgraded any time you want to enjoy the newest features of the upgraded operating system.
3. Camera and battery
With the Tecno Camon C8 Tecno has clearly hoped to appeal to the fans of smartphone photography, and they definitely succeeded. The C8 has a 13MP rear camera with LED flash and autofocus and a 5MP camera on the front. Both cameras are designed to produce great photos even under insufficient lighting.
Tecno phones have always been praised for their battery capabilities, and the Tecno Camon C8 follows suit with its 3000mAh battery. It should give you more than 24 hours of active use. However, the C8 owners point out that the phone is rather slow to charge – with the fast charging technology missing, the 0 to 100% charging time is about 3 hours.
2. Tecno Camon C8 price
By now you're probably convinced that the Tecno Camon C8 is worth at least considering if you're planning to upgrade your mobile phone. You're probably wondering: how much is Tecno Camon C8? The good news is that right now the Tecno C8 price in Nigeria is significantly lower than when it first launched.
Currently, you can buy the Tecno Camon C8 for about ₦40,000. Luckily, you can score an even more lucrative deal if you shop for the Tecno C8 on Jiji, where you get to buy from genuine Nigerian sellers at attractively low prices.
Buy affordable mobile phones from top brands on the Jiji app


text:
By Thomas Corhern, TTU Sports Information
MONTGOMERY, Ala. – After the weather washed out last week's action, the Tennessee Tech softball team will try to get back into action this weekend as they head down to Montgomery, Ala., for the Alabama State Invitational.
Tech will open up play on Friday with games against Southeastern Louisiana and Western Illinois, then take on the Fighting Leathernecks once more on Saturday before facing host Alabama State. Tech wraps up the tournament on Sunday with Purdue Fort Wayne.
SLU (9-8) is led at the plate by Ella Manzer, who has a .455 average, collecting 20 hits with two home runs and has driven in 11 runs. Rebecca Skains (.393) has a team-high 24 hits and 13 RBI and has 11 runs on the season.
In the circle, Alley McDonald (1-2, 2.40 ERA) has the most innings worked with 35 frames tenure, while Tanner Wright (3-3, 2.28) and Sophie Hannabas (2-2, 3.21 ERA) has also seen the bulk of time.
The Lions have won three of their last five, including a mid-week 7-5 victory against Kent State. They went 2-2 last week at Mississippi State's The Snowman tournament, taking two wins against Alcorn State, while falling to the host Bulldogs in nine innings, as well as a defeat at the hands of Georgia Tech.
SLU also fell to SIUE on Feb. 17 in a 2-1 defeat on the Lions' home field.
Western Illinois has a 4-4 record on the season, going 1-2 at Western Kentucky on Feb. 16 and 17.
Sydney Hollings has the top batting average with a .348 effort, driving in three and scoring eight runs. Peyton Abbott (.208) has a team-high nine RBI. Abbott also has some solid pitching stats as well, posting a 1.05 ERA in 6 2/3 innings.
Emily Ira has worked the most, pitching 20 innings with a 2-1 record and a 3.50 ERA. She has a 0.9 WHIP with two walks and 16 strikeouts.
Alabama State comes into the weekend with an 8-5 record, going 3-1 last weekend in the second of three tournaments hosted by the Hornets. ASU fell to Presbyterian, then defeated Grambling State, Missouri-Kansas City and Howard. The Hornets also dropped a 10-1 decision to UT Martin on Feb. 17.
Hailey Walker is averaging .355, leading all batters with more than 15 at-bats. Charlene Castro has driven in a team-high 10 RBI. Castro also has a 1-1 record with a 1.11 ERA in 19 innings of work.
Justine Jean (4-2, 3.18) has walked 16 and struck out 30 in 44 innings of work, while Vanessa Bradford (3-2, 3.65) has walked 18 and struck out 14.
Purdue Fort Wayne (4-6) makes a return trip to Montgomery after going 3-2 at the Black and Gold Tournament two weeks ago. The two losses came to Ohio Valley Conference foes UT Martin (L, 9-1) and Jacksonville State (L, 7-2).
Morganne Denny leads the Mastadons with a .419 average and nine RBI, hitting the team's lone home run. Abby Baez (.370) and Lauren Watson (.313) both have 10 hits on the year.
Lauren McConnell (3-1) leads the team with a 2.82 ERA, walking 11 and striking out 15 in 27 1/3 innings of work, while Shaina Eyre (0-3) has 10 walks and 14 strikeouts.
Tech (3-5) has not played a game since Feb. 16 at the Chattanooga Challenge, going 1-3 in that event. Beth McCulley leads the Golden Eagle batters with double-digit at-bats with a .370 average, while Gabby LaSala (.259) has a team-high seven RBI, with Hallie Davis (.278) and Alexis Trimiar (.185) each driving in six.
Alyssa Arden (1-2) has a 4.48 ERA with 15 walks and 12 strikeouts, Haeli Bryson (1-2) has a 6.22 ERA with six walks and seven strikeouts, and Kayla Hughes (1-1) has a 6.79 ERA with 11 walks and nine strikeouts.


text:
Room with a View
Room With a View has gained a solid reputation for highly professional service and as well as top-quality accommodation located right in the the centre of the city. Apartments here are spacious and mostly chic.
- Paul Sullivan, Destination expert
The apartments are located in downtown Reykjavík, slap bang on the main high street (Laugavegur) in the same building as the famous – and highly atmospheric – Mál og menning bookshop. There are manifold restaurants, bar and clubs, as well as cultural sights, within quick and easy walking distance.
Style and Character
The building that houses the apartments – known locally as Rúblan or The Rubla – is quite historic, having been built by local publishing house and bookshop Mál og menning in 1961. The discreet main entrance leads to a quiet and modest lobby area (literally just a reception desk, sofa and a few shelves of books and plants); apartments – some of which feature contemporary lamps, tables and other furnishings, others with more Eighties décor such as fairly kitsch artworks – are located above and reached by a lift from the ground floor.
Service and Facilities
The reception is staffed around the clock and staff are helpful with sightseeing tips and can help with booking excursions and trips. Aside from a couple of comfy sofas in the lobby, there are no real communal areas on the ground floor, though there are shared balconies among some of the rooms. There is also a rooftop terrace with a hot tub and panoramic views of the city and Faxaflói Bay. The spa has a relaxation area with the option to enjoy a glass of champagne.
- Wi-Fi
There are several styles of apartment to choose from, in that all are different in terms of layout, size and style but all come with fully equipped kitchenettes, private bathrooms, TVs (with DVDs) and amenities like irons, hair-dryers and Wi-Fi. The larger studios have either three single beds, a double and single, or pull-out sofas, making them suitable for groups or families (up to five people). For a little extra bling you can book the apartment with the private hot tub and fully equipped kitchenette. Most – but not all – of the apartments look across the city to the sea, and many also come with shared balconies; the fifth and sixth floor penthouses have the best views.
Food and Drink
There are no dining or drinking facilities on site but all apartments are equipped with kitchenettes are various options right outside the door. The reception also sells hot and cold drinks as well as snacks around the clock.
Value for Money
Studio apartments from £125 in low season; and from £250 in high. There is no breakfast available at the hotel. Wi-Fi is free.
Access for guests with disabilities?
Upon request, management can arrange large spacious apartments for guests with disabilities.
The 1-4 bedroom apartments are perfect for large families, and the rooftop terrace and hot tub are popular among younger guests.