text:
This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Application Threat Modeling"
(→Security Controls)
|Line 621:
|Line 621:
*Examine all memory allocations/de-allocations.
*Examine all memory allocations/de-allocations.
*Examine the application for dynamic SQL and determine if it is vulnerable to injection.
*Examine the application for dynamic SQL and determine if it is vulnerable to injection.
*Examine the application for "main()" executable functions and debug harnesses/backdoors
*Examine the application for "main()" executable functions and debug harnesses/backdoors
*Search for commented out code, commented out test code, which may contain sensitive information.
*Search for commented out code, commented out test code, which may contain sensitive information.
*Ensure all logical decisions have a default clause.
*Ensure all logical decisions have a default clause.
Revision as of 17:14, 4 May 2009OWASP Code Review Guide Table of Contents
- 1 Introduction
- 2 Decompose the Application
- 3 Threat Model Information
- 4 External Dependencies
- 5 Entry Points
- 6 Assets
- 7 Trust Levels
- 8 Data Flow Diagrams
- 9 Determine and Rank Threats
- 10 Security Controls
- 11 Threat Analysis
- 12 Ranking of Threats
- 14 Generic Risk Model
- 15 Countermeasure Identification
Threat modeling is an approach for analyzing the security of an application. It is a structured approach that enables you to identify, quantify, and address the security risks associated with an application. Threat modeling is not an approach to reviewing code, but it does complement the security code review process. The inclusion of threat modeling in the SDLC can help to ensure that applications are being developed with security built-in from the very beginning. This, combined with the documentation produced as part of the threat modeling process, can give the reviewer a greater understanding of the system. This allows the reviewer to see where the entry points to the application are and the associated threats with each entry point. The concept of threat modeling is not new but there has been a clear mindset change in recent years. Modern threat modeling looks at a system from a potential attacker's perspective, as opposed to a defender's viewpoint. Microsoft have been strong advocates of the process over the past number of years. They have made threat modeling a core component of their SDLC, which they claim to be one of the reasons for the increased security of their products in recent years.
When source code analysis is performed outside the SDLC, such as on existing applications, the results of the threat modeling help in reducing the complexity of the source code analysis by promoting an in-depth first approach vs. breadth first approach. Instead of reviewing all source code with equal focus, you can prioritize the security code review of components whose threat modeling has ranked with high risk threats.
The threat modeling process can be decomposed into 3 high level steps:
Step 1: Decompose the Application. The first step in the threat modeling process is concerned with gaining an understanding of the application and how it interacts with external entities. This involves creating use-cases to understand how the application is used, identifying entry points to see where a potential attacker could interact with the application, identifying assets i.e. items/areas that the attacker would be interested in, and identifying trust levels which represent the access rights that the application will grant to external entities. This information is documented in the Threat Model document and it is also used to produce data flow diagrams (DFDs) for the application. The DFDs show the different paths through the system, highlighting the privilege boundaries.
Step 2: Determine and rank threats. Critical to the identification of threats is using a threat categorization methodology. A threat categorization such as STRIDE can be used, or the Application Security Frame (ASF) that defines threat categories such as Auditing & Logging, Authentication, Authorization, Configuration Management, Data Protection in Storage and Transit, Data Validation, Exception Management. The goal of the threat categorization is to help identify threats both from the attacker (STRIDE) and the defensive perspective (ASF). DFDs produced in step 1 help to identify the potential threat targets from the attacker's perspective, such as data sources, processes, data flows, and interactions with users. These threats can be identified further as the roots for threat trees; there is one tree for each threat goal. From the defensive perspective, ASF categorization helps to identify the threats as weaknesses of security controls for such threats. Common threat-lists with examples can help in the identification of such threats. Use and abuse cases can illustrate how existing protective measures could be bypassed, or where a lack of such protection exists. The determination of the security risk for each threat can be determined using a value-based risk model such as DREAD or a less subjective qualitative risk model based upon general risk factors (e.g. likelihood and impact).
Step 3: Determine countermeasures and mitigation. A lack of protection of a threat might indicate a vulnerability whose risk exposure could be mitigated with the implementation of a countermeasure. Such countermeasures can be identified using threat-countermeasure mapping lists. Once a risk ranking is assigned to the threats, it is possible to sort threats from the highest to the lowest risk, and prioritize the mitigation effort, such as by responding to such threats by applying the identified countermeasures. The risk mitigation strategy might involve evaluating these threats from the business impact that they pose and reducing the risk. Other options might include taking the risk, assuming the business impact is acceptable because of compensating controls, informing the user of the threat, removing the risk posed by the threat completely, or the least preferable option, that is, to do nothing.
Each of the above steps are documented as they are carried out. The resulting document is the threat model for the application. This guide will use an example to help explain the concepts behind threat modeling. The same example will be used throughout each of the 3 steps as a learning aid. The example that will be used is a college library website. At the end of the guide we will have produced the threat model for the college library website. Each of the steps in the threat modeling process are described in detail below.
Decompose the Application
The goal of this step is to gain an understanding of the application and how it interacts with external entities. This goal is achieved by information gathering and documentation. The information gathering process is carried out using a clearly defined structure, which ensures the correct information is collected. This structure also defines how the information should be documented to produce the Threat Model.
Threat Model Information
The first item in the threat model is the information relating to the threat model. This must include the the following:
- Application Name - The name of the application.
- Application Version - The version of the application.
- Description - A high level description of the application.
- Document Owner - The owner of the threat modeling document.
- Participants - The participants involved in the threat modeling process for this application.
- Reviewer - The reviewer(s) of the threat model.
|Threat Model Information
|Application Version:
|The college library website is the first implementation of a website to provide librarians and library patrons (students and college staff) with online services.
As this is the first implementation of the website, the functionality will be limited. There will be three users of the application:
|Document Owner:
|David Lowry
|David Rook
|Eoin Keary
External Dependencies
External dependencies are items external to the code of the application that may pose a threat to the application. These items are typically still within the control of the organization, but possibly not within the control of the development team. The first area to look at when investigating external dependencies is how the application will be deployed in a production environment, and what are the requirements surrounding this. This involves looking at how the application is or is not intended to be run. For example if the application is expected to be run on a server that has been hardened to the organization's hardening standard and it is expected to sit behind a firewall, then this information should be documented in the external dependencies section. External dependencies should be documented as follows:
- ID - A unique ID assigned to the external dependency.
- Description - A textual description of the external dependency.
|External Dependencies
|The college library website will run on a Linux server running Apache. This server will be hardened as per the college's server hardening standard. This includes the application of the latest operating system and application security patches.
|The database server will be MySQL and it will run on a Linux server. This server will be hardened as per the college's server hardening standard. This will include the application of the lastest operating system and application security patches.
|The connection between the Web Server and the database server will be over a private network.
|The Web Server is behind a firewall and the only communication available is TLS.
Entry Points
Entry points define the interfaces through which potential attackers can interact with the application or supply it with data. In order for a potential attacker to attack an application, entry points must exist. Entry points in an application can be layered, for example each web page in a web application may contain multiple entry points. Entry points should be documented as follows:
- ID - A unique ID assigned to the entry point. This will be used to cross reference the entry point with any threats or vulnerabilities that are identified. In the case of layer entry points, a major.minor notation should be used.
- Name - A descriptive name identifying the entry point and its purpose.
- Description - A textual description detailing the interaction or processing that occurs at the entry point.
- Trust Levels - The level of access required at the entry point is documented here. These will be cross referenced with the trusts levels defined later in the document.
|Entry Points
|Trust Levels
|HTTPS Port
|The college library website will be only be accessable via TLS. All pages within the college library website are layered on this entry point.
|(1) Anonymous Web User
(2) User with Valid Login Credentials
|Library Main Page
|The splash page for the college library website is the entry point for all users.
|(1) Anonymous Web User
(2) User with Valid Login Credentials
|Login Page
|Students, faculty members and librarians must log in to the college library website before they can carry out any of the use cases.
|(1) Anonymous Web User
(2) User with Login Credentials
|Login Function
|The login function accepts user supplied credentials and compares them with those in the database.
(2) User with Valid Login Credentials
|Search Entry Page
|The page used to enter a search query.
(2) User with Valid Login Credentials
The system must have something that the attacker is interested in; these items/areas of interest are defined as assets. Assets are essentially threat targets, i.e. they are the reason threats will exist. Assets can be both physical assets and abstract assets. For example, an asset of an application might be a list of clients and their personal information; this is a physical asset. An abstract asset might be the reputation of an organsation. Assets are documented in the threat model as follows:
- ID - A unique ID is assigned to identify each asset. This will be used to cross reference the asset with any threats or vulnerabilities that are identified.
- Name - A descriptive name that clearly identifies the asset.
- Description - A textual description of what the asset is and why it needs to be protected.
- Trust Levels - The level of access required to access the entry point is documented here. These will be cross referenced with the trust levels defined in the next step.
|Trust Levels
|Library Users and Librarian
|Assets relating to students, faculty members, and librarians.
|User Login Details
|The login credentials that a student or a faculty member will use to log into the College Library website.
(2) User with Valid Login Credentials
|Librarian Login Details
|The login credentials that a Librarian will use to log into the College Library website.
(4) Librarian
|Personal Data
|The College Library website will store personal information relating to the students, faculty members, and librarians.
(4) Librarian
|Assets relating to the underlying system.
|Availability of College Library Website
|The College Library website should be available 24 hours a day and can be accessed by all students, college faculty members, and librarians.
(5) Database Server Administrator
|Ability to Execute Code as a Web Server User
|This is the ability to execute source code on the web server as a web server user.
(6) Website Administrator
|Ability to Execute SQL as a Database Read User
|This is the ability to execute SQL select queries on the database, and thus retrieve any information stored within the College Library database.
(5) Database Server Administrator
|Ability to Execute SQL as a Database Read/Write User
|This is the ability to execute SQL. Select, insert, and update queries on the database and thus have read and write access to any information stored within the College Library database.
(5) Database Server Administrator
|Assets relating to the College Library website.
|Login Session
|This is the login session of a user to the College Library website. This user could be a student, a member of the college faculty, or a Librarian.
(2) User with Valid Login Credentials
|Access to the Database Server
|Access to the database server allows you to administer the database, giving you full access to the database users and all data contained within the database.
(5) Database Server Administrator
|Ability to Create Users
|The ability to create users would allow an individual to create new users on the system. These could be student users, faculty member users, and librarian users.
(4) Librarian
|Access to Audit Data
|The audit data shows all audit-able events that occurred within the College Library application by students, staff, and librarians.
(6) Website Administrator
Trust Levels
Trust levels represent the access rights that the application will grant to external entities. The trust levels are cross referenced with the entry points and assets. This allows us to define the access rights or privileges required at each entry point, and those required to interact with each asset. Trust levels are documented in the threat model as follows:
- ID - A unique number is assigned to each trust level. This is used to cross reference the trust level with the entry points and assets.
- Name - A descriptive name that allows you to identify the external entities that have been granted this trust level.
- Description - A textual description of the trust level detailing the external entity who has been granted the trust level.
|Trust Levels
|Anonymous Web User
|A user who has connected to the college library website but has not provided valid credentials.
|User with Valid Login Credentials
|A user who has connected to the college library website and has logged in using valid login credentials.
|User with Invalid Login Credentials
|A user who has connected to the college library website and is attempting to log in using invalid login credentials.
|The librarian can create users on the library website and view their personal information.
|Database Server Administrator
|The database server administrator has read and write access to the database that is used by the college library website.
|Website Administrator
|The Website administrator can configure the college library website.
|Web Server User Process
|This is the process/user that the web server executes code as and authenticates itself against the database server as.
|Database Read User
|The database user account used to access the database for read access.
|Database Read/Write User
|The database user account used to access the database for read and write access.
Data Flow Diagrams
All of the information collected allows us to accurately model the application through the use of Data Flow Diagrams (DFDs). The DFDs will allow us to gain a better understanding of the application by providing a visual representation of how the application processes data. The focus of the DFDs is on how data moves through the application and what happens to the data as it moves. DFDs are hierarchical in structure, so they can be used to decompose the application into subsystems and lower-level subsystems. The high level DFD will allow us to clarify the scope of the application being modeled. The lower level iterations will allow us to focus on the specific processes involved when processing specific data. There are a number of symbols that are used in DFDs for threat modeling. These are described below:
External Entity
The external entity shape is used to represent any entity outside the application that interacts with the application via an entry point.
The process shape represents a task that handles data within the application. The task may process the data or perform an action based on the data.
Multiple Process
The multiple process shape is used to present a collection of subprocesses. The multiple process can be broken down into its subprocesses in another DFD.
Data Store
The data store shape is used to represent locations where data is stored. Data stores do not modify the data, they only store data.
Data Flow
The data flow shape represents data movement within the application. The direction of the data movement is represented by the arrow.
Privilege Boundary
The privilege boundary shape is used to represent the change of privilege levels as the data flows through the application.
Data Flow Diagram for the College Library Website
User Login Data Flow Diagram for the College Library Website
Determine and Rank Threats
Threat Categorization
The first step in the determination of threats is adopting a threat categorization. A threat categorization provides a set of threat categories with corresponding examples so that threats can be systematically identified in the application in a structured and repeatable manner.
A threat categorization such as STRIDE is useful in the identification of threats by classifying attacker goals such as:
- Spoofing
- Tampering
- Repudiation
- Information Disclosure
- Denial of Service
- Elevation of Privilege.
A threat list of generic threats organized in these categories with examples and the affected security controls is provided in the following table:
|STRIDE Threat List
|Security Control
|Threat action aimed to illegally access and use another user's credentials, such as username and password.
|Threat action aimed to maliciously change/modify persistent data, such as persistent data in a database, and the alteration of data in transit between two computers over an open network, such as the Internet.
|Threat action aimed to perform illegal operations in a system that lacks the ability to trace the prohibited operations.
|Information disclosure
|Threat action to read a file that one was not granted access to, or to read data in transit.
|Denial of service
|Threat aimed to deny access to valid users, such as by making a web server temporarily unavailable or unusable.
|Elevation of privilege
|Threat aimed to gain privileged access to resources for gaining unauthorized access to information or to compromise a system.
Security Controls
Once the basic threat agents and business impacts are understood, the review team should try to identify the set of controls that could prevent these threat agents from causing those impacts. The primary focus of the code review should be to ensure that these security controls are in place, that they work properly, and that they are correctly invoked in all the necessary places. The checklist below can help to ensure that all the likely risks have been considered.
- Ensure all internal and external connections (user and entity) go through an appropriate and adequate form of authentication. Be assured that this control cannot be bypassed.
- Ensure all pages enforce the requirement for authentication.
- Ensure that whenever authentication credentials or any other sensitive information is passed, only accept the information via the HTTP "POST" method and will not accept it via the HTTP "GET" method.
- Any page deemed by the business or the development team as being outside the scope of authentication should be reviewed in order to assess any possibility of security breach.
- Ensure that authentication credentials do not traverse the wire in clear text form.
- Ensure development/debug backdoors are not present in production code.
- Ensure that there are authorization mechanisms in place.
- Ensure that the application has clearly defined the user types and the rights of said users.
- Ensure there is a least privilege stance in operation.
- Ensure that the Authorization mechanisms work properly, fail securely, and cannot be circumvented.
- Ensure that authorization is checked on every request.
- Ensure development/debug backdoors are not present in production code.
Cookie Management:
- Ensure that sensitive information is not comprised.
- Ensure that unauthorized activities cannot take place via cookie manipulation.
- Ensure that proper encryption is in use.
- Ensure secure flag is set to prevent accidental transmission over "the wire" in a non-secure manner.
- Determine if all state transitions in the application code properly check for the cookies and enforce their use.
- Ensure the session data is being validated.
- Ensure cookies contain as little private information as possible.
- Ensure entire cookie is encrypted if sensitive data is persisted in the cookie.
- Define all cookies being used by the application, their name, and why they are needed.
Data/Input Validation:
- Ensure that a DV mechanism is present.
- Ensure all input that can (and will) be modified by a malicious user such as HTP headers, input fields, hidden fields, drop down lists, and other web components are properly validated.
- Ensure that the proper length checks on all input exist.
- Ensure that all fields, cookies, http headers/bodies, and form fields are validated.
- Ensure that the data is well formed and contains only known good chars if possible.
- Ensure that the data validation occurs on the server side.
- Examine where data validation occurs and if a centralized model or decentralized model is used.
- Ensure there are no backdoors in the data validation model.
- Golden Rule: All external input, no matter what it is, is examined and validated.
Error Handling/Information leakage:
- Ensure that all method/function calls that return a value have proper error handling and return value checking.
- Ensure that exceptions and error conditions are properly handled.
- Ensure that no system errors can be returned to the user.
- Ensure that the application fails in a secure manner.
- Ensure resources are released if an error occurs.
- Ensure that no sensitive information is logged in the event of an error.
- Ensure the payload being logged is of a defined maximum length and that the logging mechanism enforces that length.
- Ensure no sensitive data can be logged; e.g. cookies, HTTP "GET" method, authentication credentials.
- Examine if the application will audit the actions being taken by the application on behalf of the client (particularly data manipulation/Create, Update, Delete (CUD) operations).
- Ensure successful and unsuccessful authentication is logged.
- Ensure application errors are logged.
- Examine the application for debug logging with the view to logging of sensitive data.
- Ensure no sensitive data is transmitted in the clear, internally or externally.
- Ensure the application is implementing known good cryptographic methods.
Secure Code Environment:
- Examine the file structure. Are any components that should not be directly accessible available to the user?
- Examine all memory allocations/de-allocations.
- Examine the application for dynamic SQL and determine if it is vulnerable to injection.
- Examine the application for "main()" executable functions and debug harnesses/backdoors.
- Search for commented out code, commented out test code, which may contain sensitive information.
- Ensure all logical decisions have a default clause.
- Ensure no development environment kit is contained on the build directories.
- Search for any calls to the underlying operating system or file open calls and examine the error possibilities.
Session Management:
- Examine how and when a session is created for a user, unauthenticated and authenticated.
- Examine the session ID and verify if it is complex enough to fulfill requirements regarding strength.
- Examine how sessions are stored: e.g. in a database, in memory etc.
- Examine how the application tracks sessions.
- Determine the actions the application takes if an invalid session ID occurs.
- Examine session invalidation.
- Determine how multithreaded/multi-user session management is performed.
- Determine the session HTTP inactivity timeout.
- Determine how the log-out functionality functions.
Threat Analysis
The prerequisite in the analysis of threats is the understanding of the generic definition of risk that is the probability that a threat agent will exploit a vulnerability to cause an impact to the application. From the perspective of risk management, threat modeling is the systematic and strategic approach for identifying and enumerating threats to an application environment with the objective of minimizing risk and the associated impacts.
Threat analysis as such is the identification of the threats to the application, and involves the analysis of each aspect of the application functionality and architecture and design to identify and classify potential weaknesses that could lead to an exploit.
In the first threat modeling step, we have modeled the system showing data flows, trust boundaries, process components, and entry and exit points. An example of such modeling is shown in the Example: Data Flow Diagram for the College Library Website.
Data flows show how data flows logically through the end to end, and allows the identification of affected components through critical points (i.e. data entering or leaving the system, storage of data) and the flow of control through these components. Trust boundaries show any location where the level of trust changes. Process components show where data is processed, such as web servers, application servers, and database servers. Entry points show where data enters the system (i.e. input fields, methods) and exit points are where it leaves the system (i.e. dynamic output, methods), respectively. Entry and exit points define a trust boundary.
Threat lists based on the STRIDE model are useful in the identification of threats with regards to the attacker goals. For example, if the threat scenario is attacking the login, would the attacker brute force the password to break the authentication? If the threat scenario is to try to elevate privileges to gain another user's privileges, would the attacker try to perform forceful browsing?
It is vital that all possible attack vectors should be evaluated from the attacker's point of view. For this reason, it is also important to consider entry and exit points, since they could also allow the realization of certain kinds of threats. For example, the login page allows sending authentication credentials, and the input data accepted by an entry point has to validate for potential malicious input to exploit vulnerabilities such as SQL injection, cross site scripting, and buffer overflows. Additionally, the data flow passing through that point has to be used to determine the threats to the entry points to the next components along the flow. If the following components can be regarded critical (e.g. the hold sensitive data), that entry point can be regarded more critical as well. In an end to end data flow, for example, the input data (i.e. username and password) from a login page, passed on without validation, could be exploited for a SQL injection attack to manipulate a query for breaking the authentication or to modify a table in the database.
Exit points might serve as attack points to the client (e.g. XSS vulnerabilities) as well for the realization of information disclosure vulnerabilities. For example, in the case of exit points from components handling confidential data (e.g. data access components), exit points lacking security controls to protect the confidentiality and integrity can lead to disclosure of such confidential information to an unauthorized user.
In many cases threats enabled by exit points are related to the threats of the corresponding entry point. In the login example, error messages returned to the user via the exit point might allow for entry point attacks, such as account harvesting (e.g. username not found), or SQL injection (e.g. SQL exception errors).
From the defensive perspective, the identification of threats driven by security control categorization such as ASF, allows a threat analyst to focus on specific issues related to weaknesses (e.g. vulnerabilities) in security controls. Typically the process of threat identification involves going through iterative cycles where initially all the possible threats in the threat list that apply to each component are evaluated.
At the next iteration, threats are further analyzed by exploring the attack paths, the root causes (e.g. vulnerabilities, depicted as orange blocks) for the threat to be exploited, and the necessary mitigation controls (e.g. countermeasures, depicted as green blocks). A threat tree as shown in figure 2 is useful to perform such threat analysis
Once common threats, vulnerabilities, and attacks are assessed, a more focused threat analysis should take in consideration use and abuse cases. By thoroughly analyzing the use scenarios, weaknesses can be identified that could lead to the realization of a threat. Abuse cases should be identified as part of the security requirement engineering activity. These abuse cases can illustrate how existing protective measures could be bypassed, or where a lack of such protection exists. A use and misuse case graph for authentication is shown in figure below:
Finally, it is possible to bring all of this together by determining the types of threat to each component of the decomposed system. This can be done by using a threat categorization such as STRIDE or ASF, the use of threat trees to determine how the threat can be exposed by a vulnerability, and use and misuse cases to further validate the lack of a countermeasure to mitigate the threat.
To apply STRIDE to the data flow diagram items the following table can be used:
Ranking of Threats
Threats can be ranked from the perspective of risk factors. By determining the risk factor posed by the various identified threats, it is possible to create a prioritized list of threats to support a risk mitigation strategy, such as deciding on which threats have to be mitigated first. Different risk factors can be used to determine which threats can be ranked as High, Medium, or Low risk. In general, threat risk models use different factors to model risks such as those shown in figure below:
In the Microsoft DREAD threat-risk ranking model, the technical risk factors for impact are Damage and Affected Users, while the ease of exploitation factors are Reproducibility, Exploitability and Discoverability. This risk factorization allows the assignment of values to the different influencing factors of a threat. To determine the ranking of a threat, the threat analyst has to answer basic questions for each factor of risk, for example:
- For Damage: How big the damage can be?
- For Reproducibility: How easy is it to reproduce an attack to work?
- For Exploitability: How much time, effort, and expertise is needed to exploit the threat?
- For Affected Users: If a threat were exploited, what percentage of users would be affected?
- For Discoverability: How easy is it for an attacker to discover this threat?
By referring to the college library website it is possible to document sample threats releated to the use cases such as:
Threat: Malicious user views confidential information of students, faculty members and librarians.
- Damage potential: Threat to reputation as well as financial and legal liability:8
- Reproducibility: Fully reproducible:10
- Exploitability: Require to be on the same subnet or have compromised a router:7
- Affected users: Affects all users:10
- Discoverability: Can be found out easily:10
Overall DREAD score: (8+10+7+10+10) / 5 = 9
In this case having 9 on a 10 point scale is certainly an high risk threat
Generic Risk Model
A more generic risk model takes into consideration the Likelihood (e.g. probability of an attack) and the Impact (e.g. damage potential):
Risk = Likelihood x Impact
The likelihood or probability is defined by the ease of exploitation, which mainly depends on the type of threat and the system characteristics, and by the possibility to realize a threat, which is determined by the existence of an appropriate countermeasure.
The following is a set of considerations for determining ease of exploitation:
- Can an attacker exploit this remotely?
- Does the attacker need to be authenticated?
- Can the exploit be automated?
The impact mainly depends on the damage potential and the extent of the impact, such as the number of components that are affected by a threat.
Examples to determine the damage potential are:
- Can an attacker completely take over and manipulate the system?
- Can an attacker gain administration access to the system?
- Can an attacker crash the system?
- Can the attacker obtain access to sensitive information such as secrets, PII
Examples to determine the number of components that are affected by a threat:
- How many data sources and systems can be impacted?
- How "deep" into the infrastructure can the threat agent go?
These examples help in the calculation of the overall risk values by assigning qualitative values such as High, Medium and Low to Likelihood and Impact factors. In this case, using qualitative values, rather than numeric ones like in the case of the DREAD model, help avoid the ranking becoming overly subjective.
Countermeasure Identification
The purpose of the countermeasure identification is to determine if there is some kind of protective measure (e.g. security control, policy measures) in place that can prevent each threat previosly identified via threat analysis from being realized. Vulnerabilities are then those threats that have no countermeasures. Since each of these threats has been categorized either with STRIDE or ASF, it is possible to find appropriate countermeasures in the application within the given category.
Provided below is a brief and limited checklist which is by no means an exhaustive list for identifying countermeasures for specific threats.
Example of countermeasures for ASF threat types are included in the following table:
|ASF Threat & Countermeasures List
|Threat Type
|Configuration Management
|Data Protection in Storage and Transit
|Data Validation / Parameter Validation
|Error Handling and Exception Management
|User and Session Management
|Auditing and Logging
When using STRIDE, the following threat-mitigation table can be used to identify techniques that can be employed to mitigate the threats.
|STRIDE Threat & Mitigation Techniques List
|Threat Type
|Mitigation Techniques
|Spoofing Identity
|Tampering with data
|Information Disclosure
|Denial of Service
|Elevation of privilege
Once threats and corresponding countermeasures are identified it is possible to derive a threat profile with the following criteria:
- Non mitigated threats: Threats which have no countermeasures and represent vulnerabilities that can be fully exploited and cause an impact
- Partially mitigated threats: Threats partially mitigated by one or more countermeasures which represent vulnerabilities that can only partially be exploited and cause a limited impact
- Fully mitigated threats: These threats have appropriate countermeasures in place and do not expose vulnerability and cause impact
Mitigation Strategies
The objective of risk management is to reduce the impact that the exploitation of a threat can have to the application. This can be done by responding to a theat with a risk mitigation strategy. In general there are five options to mitigate threats
- Do nothing: for example, hoping for the best
- Informing about the risk: for example, warning user population about the risk
- Mitigate the risk: for example, by putting countermeasures in place
- Accept the risk: for example, after evaluating the impact of the exploitation (business impact)
- Transfer the risk: for example, through contractual agreements and insurance
The decision of which strategy is most appropriate depends on the impact an exploitation of a threat can have, the likelihood of its occurrence, and the costs for transferring (i.e. costs for insurance) or avoiding (i.e. costs or losses due redesign) it. That is, such decision is based on the risk a threat poses to the system. Therefore, the chosen strategy does not mitigate the threat itself but the risk it poses to the system. Ultimately the overall risk has to take into account the business impact, since this is a critical factor for the business risk management strategy. One strategy could be to fix only the vulnerabilities for which the cost to fix is less than the potential business impact derived by the exploitation of the vulnerability. Another strategy could be to accept the risk when the loss of some security controls (e.g. Confidentiality, Integrity, and Availability) implies a small degradation of the service, and not a loss of a critical business function. In some cases, transfer of the risk to another service provider might also be an option.


text:
Shipping may have to be upgraded to receive this item in time for the June 5th Venus transit. Please call us with any questions.
Safely view the sun anytime and during all partial phases of an eclipse (viewer required for all phases of an annular eclipse). Thousand Oaks Optical's exclusive high quality substrates provide superior safety features, sharper solar images, and a pleasing orange solar image. These eclipse viewers do not use Mylar. All viewers meet CE requirements. More than 20 million sold.
BLACK POLYMER: Exclusive Thousand Oaks Optical formula developed solely for safe solar observation. Unlike metallized Mylar (commonly used in food packaging), this Polymer gives a sharp pleasing orange image versus unnatural pale blue. Mylar also reflects your eyes in the mirror-like surface making it difficult to see the sun. The protective properties of Black Polymer are throughout the substrate so there is never a concern about safety.
Dimensions: 1.5" x 16" (38mm x 406mm)

subset: commoncrawl


text:
Letter G
My alphabet photography features whimsical letters of the alphabet photographed in a variety of styles: architectural details, golf, rustic, vintage and historic signs. Letters can be purchased individually below to create your own designs. Click here to go back and see all the letters: All Photo LettersRead More
82 / 89
Copyright 2023 AndieDietz.com


text:
September 7 – October 21, 2012
Gallery hours: 12pm – 6pm, Tues – Sat
First Friday receptions: September 7, October 5 |5-7:30pm
Guest Curator Andreina Castillo
Co-Presented with Acción Colombia
*No tickets required for entry
Exhibition Page: http://accioncolombia.org/papeles/
PAPELES: Are we what we sign? aims to serve as a visual examination of our social bond with papers as legal signifiers of identity that shape individual mobility, cultural acceptance, gender and sexual-orientation equality, economic access, labor opportunities, and educational attainment. Visual artists, community leaders, and arts administrators use this project to reflect upon the socio-cultural impact of documentation processes present in American society.
This exhibition gathers thirteen influential—established and emerging—artists working in drawing, painting, installation, printmaking, photography, and mixed media. Participating artists include Andrea Rincon, Andria Morales, Carlos Nuñez, Doris Nogueira-Rogers, Erika Ristovski, the duo Escobar-Morales, Jonas Dos Santos, Jorge Figueroa, Lina Cedeño and Pedro Ospina, Michelle Ortiz, Paula Meninato, and Susana Amundaraín. They propose social-visual experiments from their positions as immigrants and/or descendants of immigrants from Latin American nations. New and existing works in this exhibition illuminate the concept of documentation into powerful narratives of critique, ambiguity, longing, and resilience.


text:
Manufacturer: Vermodje
Category: Oral
Substance: Turinabol (4-Chlorodehydromethyltestosterone)
Package: 10mg (50 pills)
Need Help? Contact Us Leave Feedback
Category: Oral.
Tag: Turinabol (4-Chlorodehydromethyltestosterone).
Usually tickets are responded within 24 hours but sometimes it may take up to 2 business days for us to reply.
If you are looking for trusted source for legal steroids our site is the top place to stop by. We offer anabolic steroids for sale by credit cards and shop them securely with 100% delivery rate to USA, Canada, Australia and UK. Clients from EU countries enjoy delivery from our European shipping centers.
We offer steroids of world famous brands only. This is not only because we care about your health. We really need you to get results after shopping with us cause this will bring us more orders from you and your friends. That's why we are eager to have you as satisfied customer.
When you buy steroids online it's always essential to have secure payment method that allows you to recover you payment in case items are not as advertised or not delivered at all. Our steroid shop offers payments by all major credit cards and Paypal so you can always be sure you will get what you order.
Shipping of steroids is arranged via EMS post (operated by USPS in USA). Shipping takes 5-15 business days to any destination in the world. Every parcel is shipped with tracking code so you are always informed where your steroids are on every stage of shipping.


text:
April 1, 2023
We get it, sometimes life gets in the way. Don't let that stop you from completing the challenge. Simply purchase a day off and it will cover you for that day. All funds collected for Day's off go to KidSport BC.
*Day off option will be available in the online store during the month of challenge.
Looking for information on the event including packet pick up, schedule of events, or refunds?
Looking to manage your registration, change your password, or update your
account information?
Having difficulty registering, fundraising, or transferring?
If you have a question not pertaining to online registration, please contact the event directly.
Welcome To Race Roster, our online registration partner. Please sign in to proceed.
Welcome To Race Roster, our online registration partner. Please sign in to proceed.
Don't have access to the authentication code?
Send a text message instead.
Don't have access to your phone?
Enter the authentication code from an app instead.
We value the trust that you place in us by sharing your personal data with us. Race Roster takes
your privacy seriously and is committed to handling your personal data in a way that is fair
and worthy of that trust. Race Roster will take all reasonable steps to protect your information
from misuse and keep it secure. We believe it is important to inform you about how we will
use your personal data. Therefore, we encourage you to read this Privacy Policy carefully.
These cookies enable the website to provide enhanced functionality and personalisation. They
may be set by us or by third party providers whose services we have added to our pages.
If you do not allow these cookies then some or all of these services may not function properly.
Functional cookies are always active
Analytical Cookies allows us to improve the site's functionality by tracking the usage on this
website. In some cases, these cookies improves the speed with which we can process your request,
allow us to remember the site preferences you have selected. It also helps identify issues faced
by users on the website. De-selecting these cookies may result in poorly-tailored recommendations
and slow site preferences.
Marketing cookies collect information to tailor advertising to your interests, both within and
beyond Race Roster. It is worth noting that opting out of advertising cookies won't stop
you seeing adverts, just that they won't be tailored specifically to you.


text:
Find a post
Favourite Posts Chosen by Viewers
- Welcome to wordcurrents (1506)
- Green (1343)
- in her defense (1334)
- Writing with a cat on my lap (1308)
- Don't Mumble (1240)
- Skin (1237)
- Splish-splash (1234)
- wait for it (1210)
- At a Window Looking Out (1196)
- Waiting for the woe (886)
- That Story (706)
- Getting to Know You (690)
- Doorways (512)
- Review: 7 Important Things by Nadia Ross and George Acheson (376)
- Review: Greenwich Meantime at Murphy's Inn (364)
- . . . in the mi — (351)
- hesi— (339)
- Review: The Drawer Boy by Michael Healey (329)
- Old Wife's Tale (327)
- Boston Legal — Ex-English Teacher Leaking Out . . . . (302)
Popular Posts in the past 10 days
- Review: Departures and Arrivals by Carol Shields (4)
- Review: 7 Important Things by Nadia Ross and George Acheson (3)
- Family news: Shannon Cowan's novel short-listed (3)
- Review: the comedy of errors by William Shakespeare (3)
- Review: The Oxford Roof Climber's Rebellion by… (2)
- Review: Twelfth Night by William Shakespeare (2)
- Review: Tempting Providence by Robert Chafe (2)
- The Allegory of the Photographs (1)
- Boston Legal — Ex-English Teacher Leaking Out . . . . (1)
- Philology XVII (1)
Saving Your Favourites
If you click on the title of a post, you will be taken to the archive copy of the text, where there are many options:
"Print this post" -- creates a printable screen
"Add to Favourites" -- See below
"Related Posts" -- other posts that are in some way similar
"(Visited N times)" -- Started Jan 5, 2010
If you click "Add to Favourites", the software sets a cookie on your device. This cookie is quite harmless; however, it saves a list of your favourite posts on this site. Up to 99 of your favourites will appear on your computer only, in the list to the right, on the device that has the cookie. Note that favourites saved on one device will not be favourites on others, and that clearing your cookies will clear that particular device's list.
I am not sure about this, but the favourites list should work, even if you are not a subscriber. I know that it does work for subscribers.
Most popular posts since I installed this feature in 2010
- Technorati link here 69.7k views
- Review: the comedy of err... 55.5k views
- Welcome to wordcurrents 48.6k views
- wordcurrents Guest Book 47.6k views
- Riverwriter 33.2k views
- Review: Talking With... 30.8k views
- Review: Scorched by Wajdi... 30.6k views
- About riverwriter 27.9k views
- Contact riverwriter 26.1k views
- Review: Tempting Providen... 21.5k views
The flow
Tag Archives: overview
Welcome to wordcurrents
* * My new poems here to date: 1,153* * The header above is out my back window just about dawn. wordcurrents is on Facebook now. Also new: You can now "Share" and "Like" my posts. Please do so. You … Continue reading
Posted in aaa Tagged overview Leave a comment


text:
One of the movies I've watched a dozen times and will watch again every time it's on TV is "Under the Tuscan Sun" – can't get enough of all those beautiful locations! And Diane Lane is absolutely gorgeous – I think Joao has a crush on her, but I don't mind. :)
Last week I received the latest issue of my favorite magazine and there it was: a recipe for beautiful rhubarb crumble bars – because of my current rhubarb/strawberry obsession I considered it a sign - and much better than the one Francesca received in Bramasole. :)
Strawberry crumble bars
adapted from Donna Hay magazine
1/3 cup + 1 tablespoon (78g) caster sugar
1 ½ cups + 2 ½ tablespoons (225g) all purpose flour, sifted
½ teaspoon baking powder, sifted
pinch of salt
1 egg, lightly beaten
100g unsalted butter, melted
Strawberry filling:
450g strawberries, hulled and chopped*
½ cup + 1 tablespoon (112g) caster sugar
1 teaspoon vanilla extract
Crumble topping:
1 ½ cups + 2 ½ tablespoons (225g) all purpose flour, sifted
1/3 cup + 1 tablespoon (78g) caster sugar
150g cold unsalted butter, chopped
Preheat the oven to 180°C/350°F. Butter a 20x30cm (8x12in) baking pan and line with foil, leaving an overhang on two opposite sides. Butter the foil.
Place the sugar, flour, baking powder, salt, egg and butter in a bowl and mix to combine. Press into the base of the prepared pan and bake for 20-25 minutes or until golden and firm. Let cool completely.
While the base is baking, make the filling: place the strawberries, sugar and vanilla in a bowl and toss to combine. Set aside.
Make the topping: place the flour and sugar in a bowl and mix to combine. Add the butter and use your fingertips to rub it into the flour mixture until it resembles coarse breadcrumbs. Using a slotted spoon and shaking off any excess juice, distribute the strawberries over the base**. Top with the crumble topping and bake for 35-40 minutes or until golden.
* or use 500g rhubarb, chopped, instead
** don't throw the juices away – pour them over some yogurt, yum!
Makes 16 – I made 2/3 of the recipe above and used a 20cm (8in) square pan
Wednesday, June 30, 2010
Strawberry crumble bars
One of the movies I've watched a dozen times and will watch again every time it's on TV is "Under the Tuscan Sun" – can't get enough of all those beautiful locations! And Diane Lane is absolutely gorgeous – I think Joao has a crush on her, but I don't mind. :)
26 comments:
- Unknown said...
I love that movie too, puts me in a good mood. These bars look great
- June 30, 2010
- Aaron John said...
These bars look great! Gotta love strawberries!
- June 30, 2010
- Bakericious said...
love the crumble top, yummy.
- June 30, 2010
AAAH! These look wonderful. Oh man.
- June 30, 2010
- The Urban Baker said...
perfection! love crumb bars!
- June 30, 2010
cute! these look adorable and gorgeous at the same time :)
- June 30, 2010
- Window On The Prairie said...
I've had a craving lately for strawberry bars. I'll have to give this one a try.
- June 30, 2010
- Patty said...
Super lovely Patricia!
- June 30, 2010
- katerina said...
Those are perfect little crumb bars!
- June 30, 2010
- Heather said...
These look scrumptious! A perfect treat for this time of the year with all the strawberries on the market.
- July 01, 2010
- Cherine said...
Love those crumbles! Look soooo good!!
- July 01, 2010
Oh yeah - I love slices like these - I normally make a raspberry/coconut type one - drooool!
- July 01, 2010
- Erica Lea said...
Hmmm...they look scrumptious! I love crumble bars. Love the way you styled these.
- July 01, 2010
- ~~louise~~ said...
Dare I say, I've never seen that movie...I'm not much of a movie buff per se. I am, however, a lover of all things strawberry and those Strawberry crumble bars of yours look absolutely mesmerizing! May I have just one?
Thanks for sharing, Patricia. Oh so delightful!
- July 01, 2010
- Clare @ Mrs Multitasker said...
I just discovered your beautiful blog and I love it! These crumble bars look incredible. I am going to make them sometime for sure...
- July 01, 2010
- Katie said...
Just beautiful! You've managed to cut them so cleanly. Delicious
- July 02, 2010
- Patricia Scarpin said...
Jennifurla, thank you!
AJ, thank you!
Jess, that crumble top is delicious! Thank you!
Lovely Android, thank you for stopping by!
Susan, thank you, darling!
Milly, thank you! I'm glad you like them!
Suzanna, thank you for stopping by! I hope you like the recipe.
Patty, thank you!
Katerina, thank you very much!
Heather, thank you! We're having lots of strawberries here too, I love it. :)
Cherine, thank you!
Alicia, I have made that type already too and it's delicious, you're so right! :)
Thank you, sweetie!
Erica Lea, thank you, darling!
Louise, I'm a movie freak, so bear with me, sweetie. :)
You may have as many as you want!
Clare, thank you for stopping by! I hope you give these a go - my coworkers loved them!
Katie, thank you, darling! They were rather easy to cut, and I wasn't expecting that! :)
- July 02, 2010
- Xiaolu @ 6 Bittersweets said...
Patricia, I immediately recognized these from the photo on the DH website (the magazines get to the US only months after their release date so I don't get the hard copy til August :/). Yours look just as tempting, which is to say VERY!
- July 09, 2010
- Patricia Scarpin said...
Xiaolu, that is SO flattering, sweetie!
Thank you - you made my day! :)
- July 12, 2010
- Heidi said...
Oh im so happy i found your blog through vogue, it is gorgeous! So many tempting recipes. I have my eye on the chewy strawberry almond bars! These look delicious aswell.
p.s. i LOVE under the tuscan sun too
Heidi xo
- August 19, 2010
- Patricia Scarpin said...
Heidi, thank you for stopping by! These bars are really good, I hope you give the recipe a try!
- August 19, 2010
- Leah said...
Wow love the bars they look so delicious.
And I love the movie also. I may have worn out the dvd from watching it so much.
- August 19, 2010
Hi, I'm intending to make some of these later this evening for an event next Monday. Should I fridge it when it's done or is it safe to keep it out unfridged?
- August 21, 2010
- Patricia Scarpin said...
Leah, tks for stopping by! That is a lovely movie, indeed. :)
Shu, you can keep the bars out of the fridge, but keep them in a cool place, if possible.
- August 23, 2010
Thanks for the recipe, I just baked a batch today. They're so light and soft, perfect for tea :) I think in the future I'll use a little more strawberries.
- January 25, 2013
- Patricia Scarpin said...
Leebee, that is great news! Thank you for letting me know how the recipe turned out for you.
- January 28, 2013


text:
5Pcs Skin Care Facial Mask
- 100% Money Back Guarantee.
- Fast Delivery Available.
- 96.5% Reviewers Recommend This Product.
Restore and refresh your complexion with this moisturising and revitalising face mask. Made with natural ingredients like lavender, pomegranate, coconut oil and moroccan lava clay - this inventive beauty mask has been clinically proven to reduce wrinkles and tighten facial contours.
Handcrafted in small batches, every ingredient selected has a very specific purpose for your skin and is proudly listed on the label. So don't wait any longer and restore your skins vitality with this vitamin boost of natural and organic botanicals to reveal a fresher & younger looking you.
At LifeHackerGadgets, we confidently believe in the quality of our products and proudly back this up with an ironclad risk-free 60 day guarantee.
We also know that buying items online can be a daunting experience; hence we want to reassure you that there is absolutely ZERO risk in buying from our store. If you don't have a positive experience for any reason whatsoever, we will do whatever it takes to make sure you are nevertheless 100% satisfied with our service. Hence, if for some reason the product is not as expected or you simply just don't like it, no hard feelings… we'll make it right!!!
We have 24/7 Ticket and Email Support. So Please don't hesitate and feel free to contact us if you need assistance.
- We are proud to offer shipping internationally. 100% free shipping worldwide.
- USA, Canada and United Kingdom shipping takes between 14 - 20 days.
- For the rest of the shipping times, refer to the table below.
- We accept and fully refund returns within 60 days of the original purchase.
- To be eligible for a return, your item must be unused and in its original packaging.
- Please note that special sale items i.e. 'sale of the week, free promotions, etc.,' are not eligible for returns.
- Any item that is not in its original condition, damaged or has missing parts may not be accepted for return, or granted a partial refund only.
- Shipping charge will be refunded for items which are incorrect, defective or damaged.
- For orders that are damaged upon arrival (DOA), please refuse the parcel and inform your local postal office of the damage to be eligible for a full refund or redelivery.
- With the exception of incorrect, defective or damaged orders, a shipping charge equal to the amount of postage along with return shipping charge (if applicable) will be deducted from your order total before the refund is issued.
- 15% restocking fee will apply to packages which are returned, unless otherwise stated.
- Once a return is received successfully and verified to be in good order, the refund less shipping charge and restocking fee (if applicable) will be transferred back to you via the original method of payment. Please allow 3-10 working days for the credit to be reflected in your account.
- No refund will be given for packages which are unclaimed, refused (except for DOA), abandoned or disposed of. Please ensure proper arrangements have been made for your parcel to be collected.
- We require up to 8 weeks for delivery of orders before they are listed as missing. Requests for refund or resend will be processed after that.
- Refund or redelivery policy does not apply in the event of service interruptions or failures caused by natural disasters, union strikes or any events beyond our control.
- Please do not return your purchase to our office without the RMA number.
- You will be responsible for return shipping charges, except for defective product or when the wrong item has been sent.
- We strongly suggest that you use a traceable shipping service for returns as we are not liable for missing items.
- Please use proper packaging for return shipping. Items which are damaged during transit will not be accepted for return.
Our store accepts PayPal and all major credit card payments, including Visa, MasterCard and American Express. All credit card payments are managed by Stripe, which ensures the security of all transactions.
Each of them are secure and easy to go with PAYPAL
1. Pay via paypal express You will be redirected to PayPal website and pay directly with your paypal account if you have one. it is very fastest way to completle the payment.
2. Pay via paypal Standard.
You will be redirected to PayPal website when you place an order.
If you have a paypal account, you can log in your account and pay with it.
If you don't have paypal account, it doesn't matter. You can also pay via paypal with you credit card or bank debit card. Payment can be submitted in any currency.
All prices listed on the website are in US dollars.
Payment Safety
No card information is ever saved at icoolgadgets.com and it remains the private property of the card holder at all times before, during, and after the product purchase. All transactions are processed though PayPal which is a secure form of payment. Used by millions of people daily, PayPal is a heavily encrypted third party payment processor. With the help of PayPal, we accept all major cards (Visa, MasterCard, American Express, Discover) and also allow debit card. You do not need a PayPal account to use their payment service.
We at icoolgadgets.com take many active steps to ensure the absolute safety of your credit card and personal information. In addition to processing all credit card sales via a fully secured and reputable third party payment processor, your checkout experience is protected by industry standard 128 Bit SSL encryption to protect your private data. icoolgadgets.com does NOT keep credit card information on record.


text:
We know it's important to find the best dentist near you in. That's why we have sourced the top dentists in Emlenton to make it easier to find the right dental care in your neighborhood. Dentists in Emlenton have an average review of 0.0.
Make an appointment with a Emlenton dentist by clicking on the Book Now buttons below:
|UPMC Centers for Rehab Services: Emlenton
|Average Review
|409 Main St, Emlenton, PA 16373
|0/5 (0 Reviewers)
|(724) 867-1600
Here are some helpful tips for when you're trying to find the best dentist in your area:
- First and foremost, check their hours to make sure that the dentist's schedule matches yours.
- Check with their local office to make sure that they take your dental insurance. Or if you don't have insurance, ask about rates for different procedures to make sure you aren't paying too much out of pocket.
- If you have special needs, like dental anxiety, or a specific medical history that might be important, make sure to discuss these topics openly at your first appointment.
- Don't be afraid to pick a new dentist! If you don't have a fantastic experience during your first appointment, find someone new.
Don't have a preference and just want to find the right dentist for you in Emlenton? Give 1800-Dentist a try. They ask you a few questions and will get you connected quickly.


text:
While we understand that ads are annoying, you should know that advertising-income is what pays for the awesome content we provide [for free to you]. Would you consider disabling adblock on our site? You can also create an account for an ad-light experience!
Thank you for visiting our website! Below you will be able to find the answer to Peru neighbor crossword clue which was last seen on Eugene Sheffer Crossword, December 22 2017. Our site contains over 2.8 million crossword clues in which you can find whatever clue you are looking for. Since you landed on this page then you would like to know the answer to Peru neighbor. Without losing anymore time here is the answer for the above mentioned crossword clue:
We found 6 possible solutions in our database matching the query Peru neighbor
|Eugene Sheffer April 1 2022
|Eugene Sheffer October 23 2020
|Thomas Joseph November 6 2018
|LA Times January 14 2018
|Eugene Sheffer December 22 2017
Want to know where CHILE has appeared as a solution before? Click here for more information on that word.
Oh! It appears there are no comments on this clue yet. Would you like to be the first one?
You must be logged in to comment.
You can only comment in plain text (no html tags are allowed).
|Praise in verse
|Jungfrau, for one
|Where the action is
|"See ya!"
|"Cock-a-doodle- —!"
|Like stale bread
|"Holy cow!"
|Merged, as resources
|"Evita" narrator
|Fun and games
|Pollster's find
|Arcade pioneer
|Cap features
|Sounded hoarse
|Coffee bar offering
|Mata —
|WWII servicewoman
|Atlas page
|— account (never)
|Little accident
|Evening prayers
|"Rumor has it ..."
|Outback bird
|Deep hole
|T-shirt size
|Reuben bread
|English county
|Deli meat
|Spanish gold
|Santa's aides
|City boss
|Turned blue?
|Shoe width
|"Rumour Has It" singer
|Actress Sophia
|Sat for a photo
|Diocese part
|Roman 205
|— polloi
|La-la lead-in
|Sour cream serving
|Univ. dorm supervisors
|Quick swim
|Mars explorer
|Peru neighbor
|Hosp. scans
|Cries of discovery
|Ecol. watchdog
|Get older
|Actor Harrison
Type in your clue and hit Search!
Fill the crossword solver with the word your are looking for. Use '?' for unknown letters.
If you only have the first letter(s) of a word, type the letter(s) below.
or visit our complete Words that start with list.
If you only have the last letter(s) of a word, type the letter(s) below.
or visit our complete Words that end with list.


text:
- Affordable Laminate Countertops in Arab, AL
- Expert Arab Laminate Countertop Professionals
- Free Estimates on Laminate Countertops in Arab
Laminate Countertops in Arab, AL
The laminate countertops Arab, AL has to offer are certainly worth considering, especially if you are going to be remodeling your kitchen or another part of your home. You will find that these countertops are very durable and last a long time but are not expensive at all. If you want long lasting countertops that will serve you well for a number of years, this is definitely an option worth looking into. Arab laminate countertops can be made to look like many other materials, such as granite or some other material.
Avg Costs for Laminate Countertops
Min Cost
Max Cost
Avg Cost
$2,468.40 - $3,563.01
Find the Best Quality Laminate Countertops - Arab, AL
If you have always wanted granite countertops but don't have the money to spend on the real thing, you will definitely need to start looking into everything that Arab laminate countertops have to offer. A lot of people get these countertops installed in their homes because they are so incredibly durable and versatile in their appearance. Laminate countertops in Arab, AL come in a variety of styles, so you should be able to find one in particular that will satisfy all of your needs. Take all the time you need to review your options so you can get the laminate countertops you want. In the end you will be glad you made the decision to get these countertops installed in your home.


text:
EVERETT — More than 17 years have passed since two Snohomish County women were taken from their families forever.
Prosecutors have decided it's time to prove the prime suspect, a convicted rapist, is responsible.
Danny Ross Giles earlier this week was quietly charged with two counts of first-degree murder in the 1995 death of Patti Berry, 26, and the disappearance of Tracey Brazzel, 22.
He was arrested Friday at the state's Special Commitment Center on McNeil Island, where he's been locked up since 2011, awaiting a separate civil trial to determine whether he is a sexually violent predator.
Giles, 44, was expected to be booked into the county jail Friday afternoon. A judge already has set bail at $4 million. The defendant is expected to make his first appearance on the new charges Monday.
He allegedly is linked to both Berry and Brazzel through genetic tests on evidence that detectives gathered at crime scenes years ago. Since learning of those results, Giles has made a series of contradictory statements, initially denying that he knew either woman, but recently writing a friend that he'd been inside Brazzel's home to buy drugs prior to her disappearance, deputy prosecutor Craig Matheson said in court papers. View the charging papers (PDF).
Giles spent much of his life in the area where Berry and Brazzel most likely encountered their killer, Matheson wrote. In an eight-page affidavit, he detailed Giles' suspected connections to the pair, including his frequenting a south Everett bar called Kodiak Ron's. Both Berry and Brazzel were last seen alive in that same block at about the same time of night, a couple of months apart, according to court papers.
Giles "is intimately familiar with the area in which both young women went missing, where Patti Berry worked, where Tracey Brazzel lived, where (Berry's) car was located, and where Patti's body was located," Matheson wrote.
Brazzel disappeared May 26, 1995. Her car was found days later parked along the street near her Lynnwood-area apartment. The passenger side window had been shattered. The lights were on in her apartment and the sheets missing from the bed.
Snohomish County sheriff's Sgt. Gregg Rinta, then a homicide detective, spotted small droplets of blood on the outside of Brazzel's car. He gathered them into evidence.
Key locations in the case:
View Key locations in the case against Danny R. Giles in a larger map
Over the years multiple attempts have been made to find any sign of Brazzel, all without success. Investigators determined that she was last seen alive at Kodiak Ron's, a pub that in 1995 was located along Highway 99 at the intersection with Airport Road, but has since moved.
Berry went missing July 31, 1995. A single mom to a daughter, then just 2, she failed to reach home after working a shift at Honey's, a nude nightclub that used to be in south Everett. Her car had a leaking tire when she left work, and she was last spotted at a convenience store in the same parking lot as Kodiak Ron's. Her blood-spattered vehicle turned up behind a south Everett car wash. Children discovered her body about a week later in a wooded area behind the Everett Mall. She died from multiple stab wounds to the neck.
Both cases eventually wound up under investigation by the county's cold-case detectives, a special team that was created within the sheriff's office after years of lobbying by Berry's mother, Nancy Stensrud, and other parents who had lost loved ones to homicide.
Stensrud said she's grateful for all of the time and effort investigators expended over the years trying to solve the mystery behind her daughter's killing. She's hopeful that soon there will be some healing for the people Patti Berry left behind.
She also wants answers for Brazzel's family, in particular what happened to the missing woman.
"They've been through hell. They need all the answers they can get," Stensrud said. "I know where Patti's body is. I can go there. They can't."
Reached at his home in New Jersey, Tracey Brazzel's father said time has helped temper some of his grief. The early years were filled with anger and tears and searching. Bill Brazzel hired private investigators and took his daughter's disappearance to psychics and national media.
"I'm not looking for vengeance," he said. "All I want is my daughter back. I want to be able to bury her and have some closure."
Snohomish County Sheriff John Lovick said he's proud of the work done by detectives.
The Patti Berry story (1999)
• Part 1: Four years of grief and pain
• Part 2: Family's fears grow when car found in field
• Part 3: Detective uses field skills to track a killer
• Part 4: Investigator narrows in on a key suspect
• Part 5: Investigators hope the devil is in the details
"Today my heart goes out to the families of these young women," he said. "We know we cannot provide closure to this painful chapter in their lives, but I hope that we can at least provide some answers."
In 1995, Giles wasn't suspected in either woman's case. A prolific thief, he was wanted on an arrest warrant for property crimes when Brazzel dropped from sight and Berry was killed.
Suspicion turned toward Giles because of persistence and scientific advances over the years that have allowed DNA testing on increasingly smaller traces of genetic material, Matheson said.
From the outset, the foundation for the case was anchored in smart police work, he said.
In 1995, sheriff's Sgt. Shawn Stich, who now leads the county's major crime detectives, preserved the steering wheel from Berry's blood-spattered car. It was placed into evidence and kept secure.
In 2004, cold-case detective Jim Scharf asked that the steering wheel be searched for trace genetic evidence. Forensic scientists reported finding DNA from an unknown man, mixed in with material from Berry.
In 2008, the DNA was linked to Giles, with the statistical probability of a random match calculated at 1 in 580 million, according to court papers. Giles' DNA by then was in a database of known offenders. He was behind bars, serving time for exposing himself to two college-aged women near the University of Washington in 2005. Giles also has convictions for a 1987 rape in Lynnwood, peeping and other offenses against women and girls, starting in his teens and continuing into middle age. Over the years Giles repeatedly refused to cooperate with sex offender treatment, court papers show.
Scharf requested tests on the blood spatters found in 1995 on the outside of Brazzel's car. The DNA in that blood was linked to Giles in 2010, with the statistical probability of a random match calculated at 1 in 56 quadrillion.
"Although police had long theorized that the disappearance of Tracey Brazzel and the murder of Patti Berry were linked, (based on age, gender, area taken, lifestyles, timeframe of their disappearance) there had previously been no solid connection between the two," Matheson wrote.
And there was more. In 1999, The Herald published a series of articles about the hunt for Berry's killer. The stories prompted a witness to come forward with a previously unreported tip. He described a dark-haired man hosing himself off at the car wash the night Berry was killed. He did this standing just feet away from where her car was later recovered. Police released a sketch, looking for clues.
"The composite that was drawn in 1999 of the purported 'killer' was compared to a photograph of Giles taken in 1996," Matheson wrote. "There is a remarkable similarity between the composite and a photograph of defendant."
Scharf is convinced that the witness got it right.
"I think the person who made that sketch saw Danny Giles cleaning out a car at the car wash," Scharf said.
Giles was publicly named as the prime suspect after search warrants were filed in May 2011 seeking more genetic testing. At the time, he was nearing the completion of his prison term for the Seattle exposure. He was sent to McNeil Island and the state's sex offender treatment center after King County prosecutors in July 2011 filed a civil case seeking to have Giles declared a sexually violent predator. It isn't immediately clear what will happen with that case.
Detectives since have been working to bolster their case. They've interviewed people who knew Giles. Scharf has spoken to him on several occasions. Detectives sent more evidence to the crime lab to be tested. Even now, more evidence is being worked on, Scharf said.
Investigators had Giles' communications monitored. That's how they discovered the letter he wrote offering an explanation to why his DNA could show up in certain locations.
His explanations were inconsistent with earlier statements, according to court papers.
"We're always looking for new information, specifically we'd like to know what vehicles the suspect was driving the summer of 1995. If I can find that car, I can search it for evidence," Scharf said.
Giles was known to get around on a bicycle, but investigators believe he may have had access to vehicles. They've heard he may have used a yellow Toyota, or dark-colored or grayish-blue sedans.
Scharf said he'd also like to speak with anyone who may have seen Berry, Brazzel or Giles at Kodiak Ron's. He wants to hear from anyone who has knowledge of Honey's employees who frequented the bar.
Prosecutors expect they'll face challenges over whether Giles should be tried on both counts at the same time. Meanwhile trying to prove he killed Brazzel means making the case without a body.
Detectives have developed a long paper trail documenting their nationwide efforts to find Brazzel, Matheson said, but he added "a body would really be helpful."
Major challenges also can be expected over the evidence gathered 17 years ago. The detective who originally investigated Berry's murder was fired in part because some evidence in the case was found in his closet by his ex-wife during their messy divorce in 2004. That attracted news coverage in 2006, but tests showed the evidence — five hairs — came from Berry, not her killer.
The evidence linking Giles has a clear record showing that it was properly gathered, stored and kept secure over the years, Matheson said.
Scharf said years of hard work led to the charges.
"I think as a detective you're always looking for answers and finding the truth. You just have to be patient," Scharf said. "By having it charged, we're there. We're finding the truth. You don't always get all the answers when you get the truth. You're still always searching for those answers."
Scott North: 425-339-3431, email@example.com
Talk to us
- You can tell us about news and ask us about our journalism by emailing email@example.com or by calling 425-339-3428.
- If you have an opinion you wish to share for publication, send a letter to the editor to firstname.lastname@example.com or by regular mail to The Daily Herald, Letters, P.O. Box 930, Everett, WA 98206.
- More contact information is here.


text:
St. Paul, Minnesota, United States
This is my almost daily comic strip blog. I'll write about my life, stuff I like, stuff I hate, and sometimes just weird ideas I have to get out of my head. >>>CLICK ON THE IMAGES TO ENLARGE<<< Enjoy!
View my complete profile
Monday, July 6, 2015
Gumbells Make an Entrance.
Email This
Share to Twitter
Share to Facebook
Share to Pinterest
No comments:
Post a Comment
Newer Post
Older Post
Subscribe to:
Post Comments (Atom)


text:
To say it's been a whirlwind year for actress Cristin Miloti is a huge understatement. Since last fall, she's been playing the titular role for the hit sitcom "How I Met Your Mother," and in December, she appeared in one of the most buzzed-about films of the year with director Martin Scorsese's Best Picture Oscar-nominated "The Wolf of Wall Street."
New on Blu-ray and DVD (Paramount Home Media Distribution), "The Wolf of Wall Street" is based on the true story of Jordan Belfort (Leonardo DiCaprio), a low-level stockbroker who reinvents himself after the firm he's working for on Wall Street goes bust in the Black Monday stock market crash in October 1987. Starting over in penny stocks, Belfort and his willing recruits quickly build their own firm on highly lucrative fraudulent deals, and live greedy, decadent lifestyles propelled by sex and drugs as the federal government desperately tries to nail them for securities fraud.
Milioti plays the pivotal role of Teresa Petrillo, Belfort's first wife -- who in reality was Denise Lombardo.
Like many people, Milioti didn't even know who Jordan Belfort was going into the project, but once she started reading his autobiography, she found what he did shocking and "incredibly depressing," especially considering he spent all but 36 months in a minimum security prison for his offenses.
"He swindled so many people and there was such gluttony there -- such greed," Milioti told me in an interview this week. "The book is from his perspective, though, and as repentant as he may seem, it is also told, with what I found anyway, a sort of wink, like, 'I got away with it,' even though he went to prison. He certainly got away with things, though. I wasn't familiar with him before the project though. I thought to myself after reading the script, 'This couldn't all have happened,' and then I read the book and according to Mr. Belfort, it did."
Since Lombardo didn't want her name used in the film, it shouldn't come as a shock that she wasn't accessible to Milioti for research. Still, the 28-year-old actress says, she remains fascinated by what Belfort's scorned ex went through.
"I'd be interested in hearing what her side of the story was," Milioti said. "They were married for years and she was with him since the beginning. She was with him because she loved him, and not for his money."
Because of the woman's plight, Milioti certainly doesn't blame Lombardo for distancing herself from the film.
"No one would want to re-live what she went through," Milioti said. "Plus -- and the movie didn't show this -- she was dragged through the tabloids when everything with Jordan was happening. She was only 25 years old, and people were saying -- and Jordan mentions it in the book -- that he traded her in for a better model, essentially. That's terrible. I never would want to have someone revisit that period in their life when they obviously don't want to."
The release of "The Wolf of Wall Street" comes about a week before the series finale of "How I Met Your Mother," which is wrapping up its ninth and final season on CBS. And while Milioti was only a part of the sitcom's ensemble for one season, she said she's taking the end of the sitcom hard.
"I am mourning, but I feel guilty about it because I feel I don't have the right to," Milioti said with a laugh. "I was so sad when the show wrapped. I sobbed on the set."
Milioti said what's even more amazing than her personal experience is her discovery how invested fans are in the show, especially given the rampant rumors of late that surmise a morbid fate for her character. In fact, Milioti said she was taken aback by all of the emotion at the recent TV fan festival PaleyFest in Los Angeles.
"We did the panel in the same theater as the Oscars, filled the auditorium with 2,500 people and took questions from fans," Milioti said. "To see how much this show has affected people's live and to see how invested they are, is incredible. It's what you hope and dream for as a performer. It's the ultimate dream to have people that invested in your character."
Tim Lammers is a nationally syndicated movie journalist and the author of the new ebook Direct Conversations: The Animated Films of Tim Burton (Foreword by Tim Burton)


text:
Angiogram of the Lung
Test Overview
An angiogram of the lung is an X-ray test that uses a special dye and camera (fluoroscopy) to take pictures of the blood flow in the blood vessels of the lung.
During an angiogram, a thin tube called a catheter is placed into a femoral blood vessel in the groin (femoral vein) or just above the elbow (brachial vein). The catheter is guided to the area to be studied. Then an iodine dye (contrast material) is injected into the vessel to make the area show clearly on the X-ray pictures. The angiogram pictures can be made into regular X-ray films or stored as digital pictures in a computer.
A lung (pulmonary) angiogram is used to check the arteries that lead to the lungs (pulmonary arteries) and the blood vessels in the lungs. It can also find narrowing or a blockage in a blood vessel that slows or stops blood flow.
Why It Is Done
A lung angiogram may be done to measure the pressure in the blood vessels carrying blood to the lungs, to look for lung problems, or to find other causes of blockage or narrowing of the vessels.
How To Prepare
Before an angiogram, tell your doctor if you:
- Are or might be pregnant.
- Are breastfeeding. Use formula (throw out your breast milk) for 1 to 2 days after the angiogram until the dye has passed from your body. This generally takes 24 hours.
- Are allergic to iodine dye used in the test.
- Have ever had a serious allergic reaction (anaphylaxis) from any substance, such as the venom from a bee sting or from eating shellfish.
- Have asthma.
- Are allergic to any medicines.
- Have any bleeding problems or are taking blood-thinning medicines.
- Have a history of kidney problems or diabetes, especially if you take metformin (such as Glucophage) to control your diabetes. The dye used during an angiogram can cause kidney damage in people who have poor kidney function.
Do not eat or drink for 4 to 8 hours before the angiogram. You may be asked to not take aspirin, aspirin products, or blood thinners for several days before the test and for 1 day after the test. If you take these medicines, talk with your doctor.
An angiogram can be done as an inpatient or outpatient. If you are an outpatient, you will stay in a recovery room for several hours before you go home. You may want to bring something to do or read to pass the time. Arrange to have someone take you home because you may get a sedative before the test. If you stay overnight in the hospital, you will probably go home the next day.
The test may take several hours, so you will empty your bladder just before it begins.
Also before the angiogram you may have other blood tests, such as blood clotting (coagulation) studies, blood urea nitrogen (BUN), and creatinine.
You will be asked to sign a consent form that says you understand the risks of the test and agree to have it done.
Talk to your doctor about any concerns you have regarding the need for the test, its risks, how it will be done, or what the results will mean. To help you understand the importance of this test, fill out the medical test information form( What is a PDF document? ).
How It Is Done
An angiogram can be done by different types of doctors, including a radiologist, cardiologist, or surgeon. Your doctor may be helped by a radiology technologist or a nurse.
You will need to take off any jewelry. You may need to take off all or most of your clothes. You will be given a gown to wear during the test.
During the test
You will likely have an intravenous (IV) line in a vein in your arm so your doctor can give you medicine or fluids if needed. A device called a pulse oximeter, which measures oxygen levels in your blood, may be clipped to your finger or ear. Small pads or patches (electrodes) are placed on your arms, chest, or legs to record your heart rate and rhythm.
You will lie on your back on an X-ray table. Ask for a pad or blanket to make yourself comfortable. A strap, tape, or sandbags may be used to hold your body still. A lead apron may be placed under your genital and pelvic areas to protect them from X-ray exposure.
A round cylinder or rectangular box that takes the pictures during fluoroscopy will be moved above you. The fluoroscope will move under you during the test.
The place where the catheter will be inserted (in the groin or above the elbow) will be shaved and cleaned. Your doctor will numb the area with a local anesthetic. Then he or she will put a needle into the blood vessel. A guide wire will be put through the needle into the blood vessel and the needle will be removed. The catheter will be placed over the guide wire and moved into the blood vessel. The catheter will be guided through the blood vessels until the tip is in the area to be studied. Your doctor will use the fluoroscope to watch the movement of the catheter in the blood vessels.
When the catheter is in place, the dye is injected through it. You may be asked to take a breath and hold it for several seconds. Several X-ray pictures will be taken one after another. These will be available right away for your doctor to look at. You need to lie very still so the pictures are clear. Sometimes only one lung is studied, or the process may be repeated more than once for each lung.
An angiogram takes 1 to 2 hours.
After the test
The catheter is taken out after the angiogram, and pressure is put on the needle site for 10 to 15 minutes to stop any bleeding. Then the area may be covered with a bandage or a compression device. This will prevent bleeding. You will be given pain medicine if you need it.
If the catheter was put in your groin, you will need to lie still and keep your leg straight for several hours. The nurse may put a weighted bag on your leg to keep it still. If the catheter was put in your arm, you may be able to sit up and get out of bed right away. But you will need to keep your arm still for at least 1 hour.
The place in your hands and feet where your heartbeat (peripheral pulse) can be felt may be marked with a pen. Your pulse may be checked before and after the angiogram.
How It Feels
You may feel a brief sting or pinch from the numbing medicine. Most people do not have pain when the catheter is in the blood vessel.
You may feel pressure in the blood vessel as the catheter is moved. Let your doctor know if you are having pain.
You will probably feel some warmth when the dye is put in. This feeling lasts only a few seconds. For some people, the feeling of heat is strong and for others it is very mild.
You may feel a need to cough but try to keep holding your breath until you are told to breathe.
You may have a headache, flushing of the face, or a salty or metallic taste in your mouth after the dye is used. These feelings do not last long. Some people may feel sick to their stomach or may vomit, but this is not common.
After the test, you may have some tenderness and bruising at the site where the catheter was inserted.
You can drink extra fluids to pass the dye from your body unless your doctor has told you not to.
The chance of any major problem from an angiogram is very small, but some problems can occur. In most cases the problems occur within 2 hours after the test when you are in the recovery room. If the problem occurs during the angiogram, the test may not be completed. You may need urgent treatment that could include surgery.
- There is a chance of an allergic reaction to the iodine dye. The reaction can be mild (itching, rash) or severe (trouble breathing or sudden shock). Most reactions can be treated with medicines. Be sure to tell your doctor if you have hay fever, asthma, or iodine allergy or food allergies.
- Bleeding from the needle site may occur. Also, a blood clot can form where the catheter was inserted. This may cause some blockage of the blood flow from the arm or leg.
- The iodine dye used for the test can cause water loss or direct damage to the kidneys. This is a special concern for people who have kidney problems, diabetes, or who are dehydrated. Special measures are used during the test to prevent problems for people who need an angiogram and have these conditions.
- There is always a small chance of damage to cells or tissue from being exposed to any radiation, even the low level used for this test.
An angiogram of the lung is an X-ray test that uses a special dye and camera (fluoroscopy) to take pictures of the blood flow in the blood vessels of the lung. Your doctor may tell you some results right after the test. Full results are usually ready the same day.
The dye flows evenly through the blood vessels.
No narrowing, blockage, bulging, or other problem of the blood vessels is seen. The pulmonary artery pressures are normal.
Blood vessels that are not in their normal position may mean that a tumor or other growth is pushing against them.
A bulge in a blood vessel may mean a weakness in the blood vessel wall ( aneurysm).
Dye that leaks out of a blood vessel may mean there is a hole in the blood vessel.
There is an abnormal vessel or blockage between vessels in the lung.
There is abnormal branching of blood vessels present since birth (congenital).
What Affects the Test
Reasons you may not be able to have the test or why the results may not be helpful include:
- Being pregnant. An angiogram is not usually done during pregnancy because the radiation could damage the developing baby (fetus).
- Having a blocked blood vessel or another blood vessel problem.
- Having high blood pressure in the blood vessels that carry blood to the lungs (pulmonary hypertension).
- Not being able to lie still during the test.
- Having an abnormal heart rhythm. Your doctor will talk to you about this.
What To Think About
- A computed tomography angiogram (CTA) or a magnetic resonance angiogram (MRA) may be an option instead of an angiogram. Each of these tests is less invasive than a standard angiogram. Some MRA tests and all CTA tests require an injection of dye. A CTA also involves radiation exposure. Some doctors may want results from a standard angiogram before doing surgery to treat a damaged or abnormal blood vessel.
- For people with kidney problems, diabetes, or dehydration, steps are taken to prevent kidney damage. Less dye may be used or more fluids may be given before, during, and after the test. If you have a history of kidney problems, other blood tests (creatinine, blood urea nitrogen) may be done before an angiogram to make sure that your kidneys are working well.
- In rare cases, surgery may be needed to repair a hole in the blood vessel where the catheter was placed. There is also a substance that can be used to help plug the hole in the vessel and stop the bleeding. The substance used to plug the hole in the vessel is normally absorbed by the body over several months.
Other Works Consulted
- Chernecky CC, Berger BJ (2008). Laboratory Tests and Diagnostic Procedures, 5th ed. St. Louis: Saunders.
- Pagana KD, Pagana TJ (2010). Mosby's Manual of Diagnostic and Laboratory Tests, 4th ed. St. Louis: Mosby.
Current as of: March 28, 2019
Author: Healthwise Staff
Medical Review:Rakesh K. Pai, MD – Cardiology, Electrophysiology & Adam Husney, MD – Family Medicine & Martin J. Gabica, MD – Family Medicine & E. Gregory Thompson, MD – Internal Medicine & Howard B. Schaff, MD – Diagnostic Radiology
This information does not replace the advice of a doctor. Healthwise, Incorporated, disclaims any warranty or liability for your use of this information. Your use of this information means that you agree to the Terms of Use. Learn how we develop our content.


text:
Applications and libraries/Concurrency and parallelism
< Applications and librariesJump to navigation Jump to search
Concurrent and Parallel Programming
Haskell has been designed for parallel and concurrent programming since its inception. In particular, Haskell's purity greatly simplifies reasoning about parallel programs. This page lists libraries and extensions for programming concurrent and parallel applications in Haskell. See also the research papers on parallel and concurrent Haskell.
Collected tutorials and information on multicore programming with Haskell:
SMP Haskell
- Multiprocessor GHC
- As of GHC 6.5, GHC supports running programs in parallel on an SMP or multicore machine, and has been used successfully on up to 40 cpus.
- Concurrent Haskell
- GHC has supported concurrency via forkIO and MVars for more than a
decade, and its threading support is very fast.
- Wrapped Concurrency
- A wrapper around Control.Concurrency and Control.Exception that provides versions of forkIO that have more guarantees.
Concurrent channels
- Control.Concurrent.Chan
- channels allow threads to pass messages to each other
Software transactional memory
- Software Transactional Memory
- GHC supports a sophisticated version of software transactional memory. Software Transactional Memory (STM) is a new way to coordinate concurrent threads.
- Documentation
- The paper Composable memory transactions.
- The paper Lock-free data structures using Software Transactional Memory in Haskell gives further examples of concurrent programming using STM.
Parallel strategies
- Control.Parallel
- Parallel evaluation stratagies may be hinted, which is a much lighter way to achieve paralellism than to use explicit concurrency primitives.
- Documentation. -- Broken?
- The HEAD version of the same contains more information.
- The original paper
Data Parallel Haskell
- Data Parallel Haskell
- Implicitly parallel, high performance (nested) arrays, supporting large multicore programming.
Unified events and threads
- User-level events and threads
- Ultra lightweight, user level threads for GHC Haskell, layered over epoll. Supports up to 10 million lightweight threads. Experimental.
Feedback-directed implicit parallelism
Implicit parallelism in Haskell, and a feedback-directed mechanism to increase its granularity
Parallel Haskell
- GpH: Glasgow Parallel Haskell
- A complete, GHC-based implementation of the parallel Haskell extension GpH and of evaluation strategies is available. Extensions of the runtime-system and language to improve performance and support new platforms are under development.
Distributed Haskell
- GdH: Glasgow Distributed Haskell
- GdH supports distributed stateful interactions on multiple locations. It is a conservative extension of both Concurrent Haskell and GpH, enabling the distribution of the stateful IO threads of the former on the multiple locations of the latter. The programming model includes forking stateful threads on remote locations, explicit communication over channels, and distributed exception handling.
- Mobile Haskell (mHaskell)
- Mobile Haskell supports both strong and weak mobility of computations across open networks. The mobility primitives are higher-order polymorphic channels. Mid-level abstractions like remote evaluation, analogous to Java RMI, are readily constructed. High-level mobility skeletons like mobile map and mobile fold encapsulate common patterns of mobile computation.
- Eden
- Eden extends Haskell with a small set of syntactic constructs for explicit process specification and creation. While providing enough control to implement parallel algorithms efficiently, it frees the programmer from the tedious task of managing low-level details by introducing automatic communication (via head-strict lazy lists), synchronisation, and process handling.
- hMPI
- hMPI is an acronym for HaskellMPI. It is a Haskell binding conforming to MPI (Message Passing Interface) standard 1.1/1.2. The programmer is in full control over the communication between the nodes of a cluster.
Distributed Haskell: Ports
- The Haskell Ports Library (HPL)
- Ports are an abstraction for modelling variables whose values evolve over time without the need to resort to mutable variable, such as IORefs. More precisely, a port represents all values that a time-dependent variable successively takes as a stream, where each element of the stream corresponds to a state change - we can also say that a port represents a time series. Moreover, a port supports concurrent construction of the time series, or stream of values.
Modelling concurrent and distributed systems
- HCPN: Haskell-Coloured Petri Nets
- Haskell-Coloured Petri Nets (HCPN) are an instance of high-level Petri Nets, in which anonymous tokens are replaced by Haskell data objects (and transitions can operate on that data, in addition to moving it around). This gives us a hybrid graphical/textual modelling formalism for Haskell, especially suited for modelling concurrent and distributed systems.
Communicating Haskell Processes
- CHP: Communicating Haskell Processes
- CHP is built on the ideas of CSP (Communicating Sequential Processes), featuring encapsulated parallel processes (no shared data!) communicating over synchronous channels. This is a very composable mode that also allows choice on communications, so that a process may offer to either read on one channel or write on another, but will only take the first that is available.