text:
XWARNING: This documentation is for an old version of Exim (latest)
Chapter 9 - File and database lookups
Exim can be configured to look up data in files or databases as it processes messages. Two different kinds of syntax are used:
A string that is to be expanded may contain explicit lookup requests. These cause parts of the string to be replaced by data that is obtained from the lookup. Lookups of this type are conditional expansion items. Different results can be defined for the cases of lookup success and failure. See chapter 11, where string expansions are described in detail. The key for the lookup is specified as part of the string expansion.
Lists of domains, hosts, and email addresses can contain lookup requests as a way of avoiding excessively long linear lists. In this case, the data that is returned by the lookup is often (but not always) discarded; whether the lookup succeeds or fails is what really counts. These kinds of list are described in chapter 10. The key for the lookup is given by the context in which the list is expanded.
String expansions, lists, and lookups interact with each other in such a way that there is no order in which to describe any one of them that does not involve references to the others. Each of these three chapters makes more sense if you have read the other two first. If you are reading this for the first time, be aware that some of it will make a lot more sense after you have read chapters 10 and 11.
1. Examples of different lookup syntax
It is easy to confuse the two different kinds of lookup, especially as the lists that may contain the second kind are always expanded before being processed as lists. Therefore, they may also contain lookups of the first kind. Be careful to distinguish between the following two examples:
domains = ${lookup{$sender_host_address}lsearch{/some/file}} domains = lsearch;/some/file
The first uses a string expansion, the result of which must be a domain list. No strings have been specified for a successful or a failing lookup; the defaults in this case are the looked-up data and an empty string, respectively. The expansion takes place before the string is processed as a list, and the file that is searched could contain lines like this:
192.168.3.4: domain1:domain2:... 192.168.1.9: domain3:domain4:...
When the lookup succeeds, the result of the expansion is a list of domains (and possibly other types of item that are allowed in domain lists).
In the second example, the lookup is a single item in a domain list. It causes Exim to use a lookup to see if the domain that is being processed can be found in the file. The file could contains lines like this:
domain1: domain2:
Any data that follows the keys is not relevant when checking that the domain matches the list item.
It is possible, though no doubt confusing, to use both kinds of lookup at once. Consider a file containing lines like this:
192.168.5.6: lsearch;/another/file
If the value of $sender_host_address is 192.168.5.6, expansion of the first domains setting above generates the second setting, which therefore causes a second lookup to occur.
The rest of this chapter describes the different lookup types that are available. Any of them can be used in any part of the configuration where a lookup is permitted.
2. Lookup types
Two different types of data lookup are implemented:
The single-key type requires the specification of a file in which to look, and a single key to search for. The key must be a non-empty string for the lookup to succeed. The lookup type determines how the file is searched.
The query-style type accepts a generalized database query. No particular key value is assumed by Exim for query-style lookups. You can use whichever Exim variables you need to construct the database query.
The code for each lookup type is in a separate source file that is included in the binary of Exim only if the corresponding compile-time option is set. The default settings in src/EDITME are:
LOOKUP_DBM=yes LOOKUP_LSEARCH=yes
which means that only linear searching and DBM lookups are included by default. For some types of lookup (e.g. SQL databases), you need to install appropriate libraries and header files before building Exim.
3. Single-key lookup types
The following single-key lookup types are implemented:
cdb: The given file is searched as a Constant DataBase file, using the key string without a terminating binary zero. The cdb format is designed for indexed files that are read frequently and never updated, except by total re-creation. As such, it is particularly suitable for large files containing aliases or other indexed data referenced by an MTA. Information about cdb can be found in several places:
http://www.pobox.com/~djb/cdb.html ftp://ftp.corpit.ru/pub/tinycdb/ http://packages.debian.org/stable/utils/freecdb.html
A cdb distribution is not needed in order to build Exim with cdb support, because the code for reading cdb files is included directly in Exim itself. However, no means of building or testing cdb files is provided with Exim, so you need to obtain a cdb distribution in order to do this.
dbm: Calls to DBM library functions are used to extract data from the given DBM file by looking up the record with the given key. A terminating binary zero is included in the key that is passed to the DBM library. See section 4.4 for a discussion of DBM libraries.
For all versions of Berkeley DB, Exim uses the DB_HASH style of database when building DBM files using the exim_dbmbuild utility. However, when using Berkeley DB versions 3 or 4, it opens existing databases for reading with the DB_UNKNOWN option. This enables it to handle any of the types of database that the library supports, and can be useful for accessing DBM files created by other applications. (For earlier DB versions, DB_HASH is always used.)
dbmjz: This is the same as dbm, except that the lookup key is interpreted as an Exim list; the elements of the list are joined together with ASCII NUL characters to form the lookup key. An example usage would be to authenticate incoming SMTP calls using the passwords from Cyrus SASL's /etc/sasldb2 file with the gsasl authenticator or Exim's own cram_md5 authenticator.
dbmnz: This is the same as dbm, except that a terminating binary zero is not included in the key that is passed to the DBM library. You may need this if you want to look up data in files that are created by or shared with some other application that does not use terminating zeros. For example, you need to use dbmnz rather than dbm if you want to authenticate incoming SMTP calls using the passwords from Courier's /etc/userdbshadow.dat file. Exim's utility program for creating DBM files (exim_dbmbuild) includes the zeros by default, but has an option to omit them (see section 53.9).
dsearch: The given file must be a directory; this is searched for an entry whose name is the key by calling the lstat() function. The key may not contain any forward slash characters. If lstat() succeeds, the result of the lookup is the name of the entry, which may be a file, directory, symbolic link, or any other kind of directory entry. An example of how this lookup can be used to support virtual domains is given in section 50.7.
iplsearch: The given file is a text file containing keys and data. A key is terminated by a colon or white space or the end of the line. The keys in the file must be IP addresses, or IP addresses with CIDR masks. Keys that involve IPv6 addresses must be enclosed in quotes to prevent the first internal colon being interpreted as a key terminator. For example:
220.127.116.11: data for 126.96.36.199 192.168.0.0/16: data for 192.168.0.0/16 "abcd::cdab": data for abcd::cdab "abcd:abcd::/32" data for abcd:abcd::/32
The key for an iplsearch lookup must be an IP address (without a mask). The file is searched linearly, using the CIDR masks where present, until a matching key is found. The first key that matches is used; there is no attempt to find a "best" match. Apart from the way the keys are matched, the processing for iplsearch is the same as for lsearch.
Warning 1: Unlike most other single-key lookup types, a file of data for iplsearch can not be turned into a DBM or cdb file, because those lookup types support only literal keys.
Warning 2: In a host list, you must always use net-iplsearch so that the implicit key is the host's IP address rather than its name (see section 10.12).
lsearch: The given file is a text file that is searched linearly for a line beginning with the search key, terminated by a colon or white space or the end of the line. The search is case-insensitive; that is, upper and lower case letters are treated as the same. The first occurrence of the key that is found in the file is used.
White space between the key and the colon is permitted. The remainder of the line, with leading and trailing white space removed, is the data. This can be continued onto subsequent lines by starting them with any amount of white space, but only a single space character is included in the data at such a junction. If the data begins with a colon, the key must be terminated by a colon, for example:
baduser: :fail:
Empty lines and lines beginning with # are ignored, even if they occur in the middle of an item. This is the traditional textual format of alias files. Note that the keys in an lsearch file are literal strings. There is no wildcarding of any kind.
In most lsearch files, keys are not required to contain colons or # characters, or white space. However, if you need this feature, it is available. If a key begins with a doublequote character, it is terminated only by a matching quote (or end of line), and the normal escaping rules apply to its contents (see section 6.17). An optional colon is permitted after quoted keys (exactly as for unquoted keys). There is no special handling of quotes for the data part of an lsearch line.
nis: The given file is the name of a NIS map, and a NIS lookup is done with the given key, without a terminating binary zero. There is a variant called nis0 which does include the terminating binary zero in the key. This is reportedly needed for Sun-style alias files. Exim does not recognize NIS aliases; the full map names must be used.
wildlsearch or nwildlsearch: These search a file linearly, like lsearch, but instead of being interpreted as a literal string, each key in the file may be wildcarded. The difference between these two lookup types is that for wildlsearch, each key in the file is string-expanded before being used, whereas for nwildlsearch, no expansion takes place.
Like lsearch, the testing is done case-insensitively. However, keys in the file that are regular expressions can be made case-sensitive by the use of
(-i)within the pattern. The following forms of wildcard are recognized:
The string may begin with an asterisk to mean "ends with". For example:
*.a.b.c data for anything.a.b.c *fish data for anythingfish
The string may begin with a circumflex to indicate a regular expression. For example, for wildlsearch:
^\N\d+\.a\.b\N data for <digits>.a.b
Note the use of
\Nto disable expansion of the contents of the regular expression. If you are using nwildlsearch, where the keys are not string-expanded, the equivalent entry is:
^\d+\.a\.b data for <digits>.a.b
The case-insensitive flag is set at the start of compiling the regular expression, but it can be turned off by using
(-i)at an appropriate point. For example, to make the entire pattern case-sensitive:
^(?-i)\d+\.a\.b data for <digits>.a.b
If the regular expression contains white space or colon characters, you must either quote it (see lsearch above), or represent these characters in other ways. For example,
\scan be used for white space and
\x3Afor a colon. This may be easier than quoting, because if you quote, you have to escape all the backslashes inside the quotes.
Note: It is not possible to capture substrings in a regular expression match for later use, because the results of all lookups are cached. If a lookup is repeated, the result is taken from the cache, and no actual pattern matching takes place. The values of all the numeric variables are unset after a (n)wildlsearch match.
Although I cannot see it being of much use, the general matching function that is used to implement (n)wildlsearch means that the string may begin with a lookup name terminated by a semicolon, and followed by lookup data. For example:
cdb;/some/file data for keys that match the file
The data that is obtained from the nested lookup is discarded.
Keys that do not match any of these patterns are interpreted literally. The continuation rules for the data are the same as for lsearch, and keys may be followed by optional colons.
Warning: Unlike most other single-key lookup types, a file of data for (n)wildlsearch can not be turned into a DBM or cdb file, because those lookup types support only literal keys.
4. Query-style lookup types
The supported query-style lookup types are listed below. Further details about many of them are given in later sections.
dnsdb: This does a DNS search for one or more records whose domain names are given in the supplied query. The resulting data is the contents of the records. See section 9.10.
ibase: This does a lookup in an InterBase database.
ldap: This does an LDAP lookup using a query in the form of a URL, and returns attributes from a single entry. There is a variant called ldapm that permits values from multiple entries to be returned. A third variant called ldapdn returns the Distinguished Name of a single entry instead of any attribute values. See section 9.14.
mysql: The format of the query is an SQL statement that is passed to a MySQL database. See section 9.21.
nisplus: This does a NIS+ lookup using a query that can specify the name of the field to be returned. See section 9.20.
oracle: The format of the query is an SQL statement that is passed to an Oracle database. See section 9.21.
passwd is a query-style lookup with queries that are just user names. The lookup calls getpwnam() to interrogate the system password data, and on success, the result string is the same as you would get from an lsearch lookup on a traditional /etc/passwd file, though with
*for the password value. For example:
*:42:42:King Rat:/home/kr:/bin/bash
pgsql: The format of the query is an SQL statement that is passed to a PostgreSQL database. See section 9.21.
redis: The format of the query is an SQL statement that is passed to a Redis database. See section 9.21.
sqlite: The format of the query is a file name followed by an SQL statement that is passed to an SQLite database. See section 9.26.
testdb: This is a lookup type that is used for testing Exim. It is not likely to be useful in normal operation.
whoson: Whoson (http://whoson.sourceforge.net) is a protocol that allows a server to check whether a particular (dynamically allocated) IP address is currently allocated to a known (trusted) user and, optionally, to obtain the identity of the said user. For SMTP servers, Whoson was popular at one time for "POP before SMTP" authentication, but that approach has been superseded by SMTP authentication. In Exim, Whoson can be used to implement "POP before SMTP" checking using ACL statements such as
require condition = \ ${lookup whoson {$sender_host_address}{yes}{no}}
The query consists of a single IP address. The value returned is the name of the authenticated user, which is stored in the variable $value. However, in this example, the data in $value is not used; the result of the lookup is one of the fixed strings "yes" or "no".
5. Temporary errors in lookups
Lookup functions can return temporary error codes if the lookup cannot be completed. For example, an SQL or LDAP database might be unavailable. For this reason, it is not advisable to use a lookup that might do this for critical options such as a list of local domains.
When a lookup cannot be completed in a router or transport, delivery of the message (to the relevant address) is deferred, as for any other temporary error. In other circumstances Exim may assume the lookup has failed, or may give up altogether.
6. Default values in single-key lookups
In this context, a "default value" is a value specified by the administrator that is to be used if a lookup fails.
Note: This section applies only to single-key lookups. For query-style lookups, the facilities of the query language must be used. An attempt to specify a default for a query-style lookup provokes an error.
If "*" is added to a single-key lookup type (for example, lsearch*) and the initial lookup fails, the key "*" is looked up in the file to provide a default value. See also the section on partial matching below.
Alternatively, if "*@" is added to a single-key lookup type (for example dbm*@) then, if the initial lookup fails and the key contains an @ character, a second lookup is done with everything before the last @ replaced by *. This makes it possible to provide per-domain defaults in alias files that include the domains in the keys. If the second lookup fails (or doesn't take place because there is no @ in the key), "*" is looked up. For example, a redirect router might contain:
data = ${lookup{$local_part@$domain}lsearch*@{/etc/mix-aliases}}
Suppose the address that is being processed is firstname.lastname@example.com. Exim looks up these keys, in this order:
firstname.lastname@example.com *@eyre.example *
The data is taken from whichever key it finds first. Note: In an lsearch file, this does not mean the first of these keys in the file. A complete scan is done for each key, and only if it is not found at all does Exim move on to try the next key.
7. Partial matching in single-key lookups
The normal operation of a single-key lookup is to search the file for an exact match with the given key. However, in a number of situations where domains are being looked up, it is useful to be able to do partial matching. In this case, information in the file that has a key starting with "*." is matched by any domain that ends with the components that follow the full stop. For example, if a key in a DBM file is
then when partial matching is enabled this is matched by (amongst others) 2001.dates.fict.example and 1984.dates.fict.example. It is also matched by dates.fict.example, if that does not appear as a separate key in the file.
Note: Partial matching is not available for query-style lookups. It is also not available for any lookup items in address lists (see section 10.19).
Partial matching is implemented by doing a series of separate lookups using keys constructed by modifying the original subject key. This means that it can be used with any of the single-key lookup types, provided that partial matching keys beginning with a special prefix (default "*.") are included in the data file. Keys in the file that do not begin with the prefix are matched only by unmodified subject keys when partial matching is in use.
Partial matching is requested by adding the string "partial-" to the front of the name of a single-key lookup type, for example, partial-dbm. When this is done, the subject key is first looked up unmodified; if that fails, "*." is added at the start of the subject key, and it is looked up again. If that fails, further lookups are tried with dot-separated components removed from the start of the subject key, one-by-one, and "*." added on the front of what remains.
A minimum number of two non-* components are required. This can be adjusted by including a number before the hyphen in the search type. For example, partial3-lsearch specifies a minimum of three non-* components in the modified keys. Omitting the number is equivalent to "partial2-". If the subject key is 2250.dates.fict.example then the following keys are looked up when the minimum number of non-* components is two:
2250.dates.fict.example *.2250.dates.fict.example *.dates.fict.example *.fict.example
As soon as one key in the sequence is successfully looked up, the lookup finishes.
The use of "*." as the partial matching prefix is a default that can be changed. The motivation for this feature is to allow Exim to operate with file formats that are used by other MTAs. A different prefix can be supplied in parentheses instead of the hyphen after "partial". For example:
domains = partial(.)lsearch;/some/file
In this example, if the domain is a.b.c, the sequence of lookups is
.a.b.c, and
.b.c (the default minimum of 2 non-wild
components is unchanged). The prefix may consist of any punctuation characters
other than a closing parenthesis. It may be empty, for example:
domains = partial1()cdb;/some/file
For this example, if the domain is a.b.c, the sequence of lookups is
b.c, and
If "partial0" is specified, what happens at the end (when the lookup with just one non-wild component has failed, and the original key is shortened right down to the null string) depends on the prefix:
If the prefix has zero length, the whole lookup fails.
If the prefix has length 1, a lookup for just the prefix is done. For example, the final lookup for "partial0(.)" is for
Otherwise, if the prefix ends in a dot, the dot is removed, and the remainder is looked up. With the default prefix, therefore, the final lookup is for "*" on its own.
Otherwise, the whole prefix is looked up.
If the search type ends in "*" or "*@" (see section 9.6 above), the search for an ultimate default that this implies happens after all partial lookups have failed. If "partial0" is specified, adding "*" to the search type has no effect with the default prefix, because the "*" key is already included in the sequence of partial lookups. However, there might be a use for lookup types such as "partial0(.)lsearch*".
The use of "*" in lookup partial matching differs from its use as a wildcard
in domain lists and the like. Partial matching works only in terms of
dot-separated components; a key such as
in a database file is useless, because the asterisk in a partial matching
subject key is always followed by a dot.
8. Lookup caching
Exim caches all lookup results in order to avoid needless repetition of lookups. However, because (apart from the daemon) Exim operates as a collection of independent, short-lived processes, this caching applies only within a single Exim process. There is no inter-process lookup caching facility.
For single-key lookups, Exim keeps the relevant files open in case there is another lookup that needs them. In some types of configuration this can lead to many files being kept open for messages with many recipients. To avoid hitting the operating system limit on the number of simultaneously open files, Exim closes the least recently used file when it needs to open more files than its own internal limit, which can be changed via the lookup_open_max option.
The single-key lookup files are closed and the lookup caches are flushed at strategic points during delivery – for example, after all routing is complete.
9. Quoting lookup data
When data from an incoming message is included in a query-style lookup, there is the possibility of special characters in the data messing up the syntax of the query. For example, a NIS+ query that contains
will be broken if the local part happens to contain a closing square bracket. For NIS+, data can be enclosed in double quotes like this:
but this still leaves the problem of a double quote in the data. The rule for NIS+ is that double quotes must be doubled. Other lookup types have different rules, and to cope with the differing requirements, an expansion operator of the following form is provided:
For example, the safest way to write the NIS+ query is
See chapter 11 for full coverage of string expansions. The quote operator can be used for all lookup types, but has no effect for single-key lookups, since no quoting is ever needed in their key strings.
10. More about dnsdb
The dnsdb lookup type uses the DNS as its database. A simple query consists of a record type and a domain name, separated by an equals sign. For example, an expansion string could contain:
${lookup dnsdb{mx=a.b.example}{$value}fail}
If the lookup succeeds, the result is placed in $value, which in this case
is used on its own as the result. If the lookup does not succeed, the
fail keyword causes a forced expansion failure – see section
11.4 for an explanation of what this means.
The supported DNS record types are A, CNAME, MX, NS, PTR, SOA, SPF, SRV, TLSA and TXT, and, when Exim is compiled with IPv6 support, AAAA. If no type is given, TXT is assumed.
For any record type, if multiple records are found, the data is returned as a concatenation, with newline as the default separator. The order, of course, depends on the DNS resolver. You can specify a different separator character between multiple records by putting a right angle-bracket followed immediately by the new separator at the start of the query. For example:
${lookup dnsdb{>: a=host1.example}}
It is permitted to specify a space as the separator character. Further white space is ignored. For lookup types that return multiple fields per record, an alternate field separator can be specified using a comma after the main separator character, followed immediately by the field separator.
When the type is PTR, the data can be an IP address, written as normal; inversion and the addition of in-addr.arpa or ip6.arpa happens automatically. For example:
${lookup dnsdb{ptr=192.168.4.5}{$value}fail}
If the data for a PTR record is not a syntactically valid IP address, it is not altered and nothing is added.
For an MX lookup, both the preference value and the host name are returned for each record, separated by a space. For an SRV lookup, the priority, weight, port, and host name are returned for each record, separated by spaces. The field separator can be modified as above.
For TXT records with multiple items of data, only the first item is returned, unless a field separator is specified. To concatenate items without a separator, use a semicolon instead. For SPF records the default behaviour is to concatenate multiple items without using a separator.
${lookup dnsdb{>\n,: txt=a.b.example}} ${lookup dnsdb{>\n; txt=a.b.example}} ${lookup dnsdb{spf=example.org}}
It is permitted to specify a space as the separator character. Further white space is ignored.
For an SOA lookup, while no result is obtained the lookup is redone with successively more leading components dropped from the given domain. Only the primary-nameserver field is returned unless a field separator is specified.
${lookup dnsdb{>:,; soa=a.b.example.com}}
11. Dnsdb lookup modifiers
Modifiers for dnsdb lookups are given by optional keywords, each followed by a comma, that may appear before the record type.
The dnsdb lookup fails only if all the DNS lookups fail. If there is a temporary DNS error for any of them, the behaviour is controlled by a defer-option modifier. The possible keywords are "defer_strict", "defer_never", and "defer_lax". With "strict" behaviour, any temporary DNS error causes the whole lookup to defer. With "never" behaviour, a temporary DNS error is ignored, and the behaviour is as if the DNS lookup failed to find anything. With "lax" behaviour, all the queries are attempted, but a temporary DNS error causes the whole lookup to defer only if none of the other lookups succeed. The default is "lax", so the following lookups are equivalent:
${lookup dnsdb{defer_lax,a=one.host.com:two.host.com}} ${lookup dnsdb{a=one.host.com:two.host.com}}
Thus, in the default case, as long as at least one of the DNS lookups yields some data, the lookup succeeds.
Use of DNSSEC is controlled by a dnssec modifier. The possible keywords are "dnssec_strict", "dnssec_lax", and "dnssec_never". With "strict" or "lax" DNSSEC information is requested with the lookup. With "strict" a response from the DNS resolver that is not labelled as authenticated data is treated as equivalent to a temporary DNS error. The default is "never".
See also the $lookup_dnssec_authenticated variable.
Timeout for the dnsdb lookup can be controlled by a retrans modifier. The form is "retrans_VAL" where VAL is an Exim time specification (e.g. "5s"). The default value is set by the main configuration option dns_retrans.
Retries for the dnsdb lookup can be controlled by a retry modifier. The form if "retry_VAL" where VAL is an integer. The default count is set by the main configuration option dns_retry.
Dnsdb lookup results are cached within a single process (and its children). The cache entry lifetime is limited to the smallest time-to-live (TTL) value of the set of returned DNS records.
12. Pseudo dnsdb record types
By default, both the preference value and the host name are returned for each MX record, separated by a space. If you want only host names, you can use the pseudo-type MXH:
${lookup dnsdb{mxh=a.b.example}}
In this case, the preference values are omitted, and just the host names are returned.
Another pseudo-type is ZNS (for "zone NS"). It performs a lookup for NS records on the given domain, but if none are found, it removes the first component of the domain name, and tries again. This process continues until NS records are found or there are no more components left (or there is a DNS error). In other words, it may return the name servers for a top-level domain, but it never returns the root name servers. If there are no NS records for the top-level domain, the lookup fails. Consider these examples:
${lookup dnsdb{zns=xxx.quercite.com}} ${lookup dnsdb{zns=xxx.edu}}
Assuming that in each case there are no NS records for the full domain name, the first returns the name servers for quercite.com, and the second returns the name servers for edu.
You should be careful about how you use this lookup because, unless the top-level domain does not exist, the lookup always returns some host names. The sort of use to which this might be put is for seeing if the name servers for a given domain are on a blacklist. You can probably assume that the name servers for the high-level domains such as com or co.uk are not going to be on such a list.
A third pseudo-type is CSA (Client SMTP Authorization). This looks up SRV records according to the CSA rules, which are described in section 43.50. Although dnsdb supports SRV lookups directly, this is not sufficient because of the extra parent domain search behaviour of CSA. The result of a successful lookup such as:
${lookup dnsdb {csa=$sender_helo_name}}
has two space-separated fields: an authorization code and a target host name. The authorization code can be "Y" for yes, "N" for no, "X" for explicit authorization required but absent, or "?" for unknown.
The pseudo-type A+ performs an AAAA and then an A lookup. All results are returned; defer processing (see below) is handled separately for each lookup. Example:
${lookup dnsdb {>; a+=$sender_helo_name}}
13. Multiple dnsdb lookups
In the previous sections, dnsdb lookups for a single domain are described. However, you can specify a list of domains or IP addresses in a single dnsdb lookup. The list is specified in the normal Exim way, with colon as the default separator, but with the ability to change this. For example:
${lookup dnsdb{one.domain.com:two.domain.com}} ${lookup dnsdb{a=one.host.com:two.host.com}} ${lookup dnsdb{ptr = <; 18.104.22.168 ; 126.96.36.199}}
In order to retain backwards compatibility, there is one special case: if the lookup type is PTR and no change of separator is specified, Exim looks to see if the rest of the string is precisely one IPv6 address. In this case, it does not treat it as a list.
The data from each lookup is concatenated, with newline separators by default, in the same way that multiple DNS records for a single item are handled. A different separator can be specified, as described above.
14. More about LDAP
The original LDAP implementation came from the University of Michigan; this has become "Open LDAP", and there are now two different releases. Another implementation comes from Netscape, and Solaris 7 and subsequent releases contain inbuilt LDAP support. Unfortunately, though these are all compatible at the lookup function level, their error handling is different. For this reason it is necessary to set a compile-time variable when building Exim with LDAP, to indicate which LDAP library is in use. One of the following should appear in your Local/Makefile:
If LDAP_LIB_TYPE is not set, Exim assumes
OPENLDAP1, which has the
same interface as the University of Michigan version.
There are three LDAP lookup types in Exim. These behave slightly differently in the way they handle the results of a query:
ldap requires the result to contain just one entry; if there are more, it gives an error.
ldapdn also requires the result to contain just one entry, but it is the Distinguished Name that is returned rather than any attribute values.
ldapm permits the result to contain more than one entry; the attributes from all of them are returned.
For ldap and ldapm, if a query finds only entries with no attributes, Exim behaves as if the entry did not exist, and the lookup fails. The format of the data returned by a successful lookup is described in the next section. First we explain how LDAP queries are coded.
15. Format of LDAP queries
An LDAP query takes the form of a URL as defined in RFC 2255. For example, in the configuration of a redirect router one might have this setting:
data = ${lookup ldap \ {ldap:///cn=$local_part,o=University%20of%20Cambridge,\ c=UK?mailbox?base?}}
The URL may begin with
ldap or
ldaps if your LDAP library supports
secure (encrypted) LDAP connections. The second of these ensures that an
encrypted TLS connection is used.
With sufficiently modern LDAP libraries, Exim supports forcing TLS over regular
LDAP connections, rather than the SSL-on-connect
See the ldap_start_tls option.
Starting with Exim 4.83, the initialization of LDAP with TLS is more tightly controlled. Every part of the TLS configuration can be configured by settings in exim.conf. Depending on the version of the client libraries installed on your system, some of the initialization may have required setting options in /etc/ldap.conf or ~/.ldaprc to get TLS working with self-signed certificates. This revealed a nuance where the current UID that exim was running as could affect which config files it read. With Exim 4.83, these methods become optional, only taking effect if not specifically set in exim.conf.
16. LDAP quoting
Two levels of quoting are required in LDAP queries, the first for LDAP itself and the second because the LDAP query is represented as a URL. Furthermore, within an LDAP query, two different kinds of quoting are required. For this reason, there are two different LDAP-specific quoting operators.
The quote_ldap operator is designed for use on strings that are part of filter specifications. Conceptually, it first does the following conversions on the string:
in accordance with RFC 2254. The resulting string is then quoted according to the rules for URLs, that is, all non-alphanumeric characters except
! $ ' - . _ ( ) * +
are converted to their hex values, preceded by a percent sign. For example:
${quote_ldap: a(bc)*, a<yz>; }
Removing the URL quoting, this is (with a leading and a trailing space):
a\28bc\29\2A, a<yz>;
The quote_ldap_dn operator is designed for use on strings that are part of base DN specifications in queries. Conceptually, it first converts the string by inserting a backslash in front of any of the following characters:
, + " \ < > ;
It also inserts a backslash before any leading spaces or # characters, and before any trailing spaces. (These rules are in RFC 2253.) The resulting string is then quoted according to the rules for URLs. For example:
${quote_ldap_dn: a(bc)*, a<yz>; }
Removing the URL quoting, this is (with a trailing space):
\ a(bc)*\, a\<yz\>\;\
There are some further comments about quoting in the section on LDAP authentication below.
17. LDAP connections
The connection to an LDAP server may either be over TCP/IP, or, when OpenLDAP is in use, via a Unix domain socket. The example given above does not specify an LDAP server. A server that is reached by TCP/IP can be specified in a query by starting it with
If the port (and preceding colon) are omitted, the standard LDAP port (389) is used. When no server is specified in a query, a list of default servers is taken from the ldap_default_servers configuration option. This supplies a colon-separated list of servers which are tried in turn until one successfully handles a query, or there is a serious error. Successful handling either returns the requested data, or indicates that it does not exist. Serious errors are syntactical, or multiple values when only a single value is expected. Errors which cause the next server to be tried are connection failures, bind failures, and timeouts.
For each server name in the list, a port number can be given. The standard way of specifying a host and port is to use a colon separator (RFC 1738). Because ldap_default_servers is a colon-separated list, such colons have to be doubled. For example
ldap_default_servers = ldap1.example.com::145:ldap2.example.com
If ldap_default_servers is unset, a URL with no server name is passed to the LDAP library with no server name, and the library's default (normally the local host) is used.
If you are using the OpenLDAP library, you can connect to an LDAP server using
a Unix domain socket instead of a TCP/IP connection. This is specified by using
ldapi instead of
ldap in LDAP queries. What follows here applies only
to OpenLDAP. If Exim is compiled with a different LDAP library, this feature is
not available.
For this type of connection, instead of a host name for the server, a pathname for the socket is required, and the port number is not relevant. The pathname can be specified either as an item in ldap_default_servers, or inline in the query. In the former case, you can have settings such as
ldap_default_servers = /tmp/ldap.sock : backup.ldap.your.domain
When the pathname is given in the query, you have to escape the slashes as
%2F to fit in with the LDAP URL syntax. For example:
${lookup ldap {ldapi://%2Ftmp%2Fldap.sock/o=...
When Exim processes an LDAP lookup and finds that the "hostname" is really
a pathname, it uses the Unix domain socket code, even if the query actually
ldap or
ldaps. In particular, no encryption is used for a
socket connection. This behaviour means that you can use a setting of
ldap_default_servers such as in the example above with traditional
ldaps queries, and it will work. First, Exim tries a connection via
the Unix domain socket; if that fails, it tries a TCP/IP connection to the
backup host.
If an explicit
ldapi type is given in a query when a host name is
specified, an error is diagnosed. However, if there are more items in
ldap_default_servers, they are tried. In other words:
Using a pathname with
ldapsforces the use of the Unix domain interface.
ldapiwith a host name causes an error.
ldapi with no host or path in the query, and no setting of
ldap_default_servers, does whatever the library does by default.
18. LDAP authentication and control information
The LDAP URL syntax provides no way of passing authentication and other control information to the server. To make this possible, the URL in an LDAP query may be preceded by any number of <name>=<value> settings, separated by spaces. If a value contains spaces it must be enclosed in double quotes, and when double quotes are used, backslash is interpreted in the usual way inside them. The following names are recognized:
DEREFERENCEset the dereferencing parameter
NETTIMEset a timeout for a network operation
USERset the DN, for authenticating the LDAP bind
PASSset the password, likewise
REFERRALSset the referrals parameter
SERVERSset alternate server list for this query only
SIZEset the limit for the number of entries returned
TIMEset the maximum waiting time for a query
The value of the DEREFERENCE parameter must be one of the words "never", "searching", "finding", or "always". The value of the REFERRALS parameter must be "follow" (the default) or "nofollow". The latter stops the LDAP library from trying to follow referrals issued by the LDAP server.
The name CONNECT is an obsolete name for NETTIME, retained for backwards compatibility. This timeout (specified as a number of seconds) is enforced from the client end for operations that can be carried out over a network. Specifically, it applies to network connections and calls to the ldap_result() function. If the value is greater than zero, it is used if LDAP_OPT_NETWORK_TIMEOUT is defined in the LDAP headers (OpenLDAP), or if LDAP_X_OPT_CONNECT_TIMEOUT is defined in the LDAP headers (Netscape SDK 4.1). A value of zero forces an explicit setting of "no timeout" for Netscape SDK; for OpenLDAP no action is taken.
The TIME parameter (also a number of seconds) is passed to the server to set a server-side limit on the time taken to complete a search.
The SERVERS parameter allows you to specify an alternate list of ldap servers to use for an individual lookup. The global ldap_default_servers option provides a default list of ldap servers, and a single lookup can specify a single ldap server to use. But when you need to do a lookup with a list of servers that is different than the default list (maybe different order, maybe a completely different set of servers), the SERVERS parameter allows you to specify this alternate list (colon-separated).
Here is an example of an LDAP query in an Exim lookup that uses some of these values. This is a single line, folded to fit on the page:
${lookup ldap {user="cn=manager,o=University of Cambridge,c=UK" pass=secret ldap:///o=University%20of%20Cambridge,c=UK?sn?sub?(cn=foo)} {$value}fail}
The encoding of spaces as
%20 is a URL thing which should not be done for
any of the auxiliary data. Exim configuration settings that include lookups
which contain password information should be preceded by "hide" to prevent
non-admin users from using the -bP option to see their values.
The auxiliary data items may be given in any order. The default is no connection timeout (the system timeout is used), no user or password, no limit on the number of entries returned, and no time limit on queries.
When a DN is quoted in the USER= setting for LDAP authentication, Exim removes any URL quoting that it may contain before passing it LDAP. Apparently some libraries do this for themselves, but some do not. Removing the URL quoting has two advantages:
It makes it possible to use the same quote_ldap_dn expansion for USER= DNs as with DNs inside actual queries.
It permits spaces inside USER= DNs.
For example, a setting such as
should work even if $1 contains spaces.
Expanded data for the PASS= value should be quoted using the quote expansion operator, rather than the LDAP quote operators. The only reason this field needs quoting is to ensure that it conforms to the Exim syntax, which does not allow unquoted spaces. For example:
The LDAP authentication mechanism can be used to check passwords as part of SMTP authentication. See the ldapauth expansion string condition in chapter 11.
19. Format of data returned by LDAP
The ldapdn lookup type returns the Distinguished Name from a single entry as a sequence of values, for example
cn=manager,o=University of Cambridge,c=UK
The ldap lookup type generates an error if more than one entry matches the search filter, whereas ldapm permits this case, and inserts a newline in the result between the data from different entries. It is possible for multiple values to be returned for both ldap and ldapm, but in the former case you know that whatever values are returned all came from a single entry in the directory.
In the common case where you specify a single attribute in your LDAP query, the result is not quoted, and does not contain the attribute name. If the attribute has multiple values, they are separated by commas. Any comma that is part of an attribute's value is doubled.
If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the quotes, the quote character, backslash, and newline are escaped with backslashes, and commas are used to separate multiple values for the attribute. Any commas in attribute values are doubled (permitting treatment of the values as a comma-separated list). Apart from the escaping, the string within quotes takes the same form as the output when a single attribute is requested. Specifying no attributes is the same as specifying all of an entry's attributes.
Here are some examples of the output format. The first line of each pair is an LDAP query, and the second is the data that is returned. The attribute called attr1 has two values, one of them with an embedded comma, whereas attr2 has only one value. Both attributes are derived from attr (they have SUP attr in their schema definitions).
ldap:///o=base?attr1?sub?(uid=fred) value1.1,value1,,2 ldap:///o=base?attr2?sub?(uid=fred) value two ldap:///o=base?attr?sub?(uid=fred) value1.1,value1,,2,value two ldap:///o=base?attr1,attr2?sub?(uid=fred) attr1="value1.1,value1,,2" attr2="value two" ldap:///o=base??sub?(uid=fred) objectClass="top" attr1="value1.1,value1,,2" attr2="value two"
You can make use of Exim's -be option to run expansion tests and thereby check the results of LDAP lookups. The extract operator in string expansions can be used to pick out individual fields from data that consists of key=value pairs. The listextract operator should be used to pick out individual values of attributes, even when only a single value is expected. The doubling of embedded commas allows you to use the returned data as a comma separated list (using the "<," syntax for changing the input list separator).
20. More about NIS+
NIS+ queries consist of a NIS+ indexed name followed by an optional colon and field name. If this is given, the result of a successful query is the contents of the named field; otherwise the result consists of a concatenation of field-name=field-value pairs, separated by spaces. Empty values and values containing spaces are quoted. For example, the query
might return the string
name=mg1456 passwd="" uid=999 gid=999 gcos="Martin Guerre" home=/home/mg1456 shell=/bin/bash shadow=""
(split over two lines here to fit on the page), whereas
would just return
Martin Guerre
with no quotes. A NIS+ lookup fails if NIS+ returns more than one table entry for the given indexed key. The effect of the quote_nisplus expansion operator is to double any quote characters within the text.
21. SQL lookups
Exim can support lookups in InterBase, MySQL, Oracle, PostgreSQL, Redis, and SQLite databases. Queries for these databases contain SQL statements, so an example might be
${lookup mysql{select mailbox from users where id='userx'}\ {$value}fail}
If the result of the query contains more than one field, the data for each field in the row is returned, preceded by its name, so the result of
${lookup pgsql{select home,name from users where id='userx'}\ {$value}}
might be
home=/home/userx name="Mister X"
Empty values and values containing spaces are double quoted, with embedded quotes escaped by a backslash. If the result of the query contains just one field, the value is passed back verbatim, without a field name, for example:
Mister X
If the result of the query yields more than one row, it is all concatenated, with a newline between the data for each row.
22. More about MySQL, PostgreSQL, Oracle, InterBase, and Redis
If any MySQL, PostgreSQL, Oracle, InterBase or Redis lookups are used, the mysql_servers, pgsql_servers, oracle_servers, ibase_servers, or redis_servers option (as appropriate) must be set to a colon-separated list of server information. (For MySQL and PostgreSQL, the global option need not be set if all queries contain their own server information – see section 9.23.) For all but Redis each item in the list is a slash-separated list of four items: host name, database name, user name, and password. In the case of Oracle, the host name field is used for the "service name", and the database name field is not used and should be empty. For example:
hide oracle_servers = oracle.plc.example//userx/abcdwxyz
Because password data is sensitive, you should always precede the setting with "hide", to prevent non-admin users from obtaining the setting via the -bP option. Here is an example where two MySQL servers are listed:
hide mysql_servers = localhost/users/root/secret:\ otherhost/users/root/othersecret
For MySQL and PostgreSQL, a host may be specified as <name>:<port> but because this is a colon-separated list, the colon has to be doubled. For each query, these parameter groups are tried in order until a connection is made and a query is successfully processed. The result of a query may be that no data is found, but that is still a successful query. In other words, the list of servers provides a backup facility, not a list of different places to look.
For Redis the global option need not be specified if all queries contain their own server information – see section 9.23. If specified, the option must be set to a colon-separated list of server information. Each item in the list is a slash-separated list of three items: host, database number, and password.
The host is required and may be either an IPv4 address and optional port number (separated by a colon, which needs doubling due to the higher-level list), or a Unix socket pathname enclosed in parentheses
The database number is optional; if present that number is selected in the backend
The password is optional; if present it is used to authenticate to the backend
The quote_mysql, quote_pgsql, and quote_oracle expansion operators convert newline, tab, carriage return, and backspace to \n, \t, \r, and \b respectively, and the characters single-quote, double-quote, and backslash itself are escaped with backslashes.
The quote_redis expansion operator escapes whitespace and backslash characters with a backslash.
23. Specifying the server in the query
For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterBase), it is possible to specify a list of servers with an individual query. This is done by starting the query with
Each item in the list may take one of two forms:
If it contains no slashes it is assumed to be just a host name. The appropriate global option (mysql_servers or pgsql_servers) is searched for a host of the same name, and the remaining parameters (database, user, password) are taken from there.
If it contains any slashes, it is taken as a complete parameter set.
The list of servers is used in exactly the same way as the global list. Once a connection to a server has happened and a query has been successfully executed, processing of the lookup ceases.
This feature is intended for use in master/slave situations where updates are occurring and you want to update the master rather than a slave. If the master is in the list as a backup for reading, you might have a global setting like this:
mysql_servers = slave1/db/name/pw:\ slave2/db/name/pw:\ master/db/name/pw
In an updating lookup, you could then write:
${lookup mysql{servers=master; UPDATE ...} }
That query would then be sent only to the master server. If, on the other hand, the master is not to be used for reading, and so is not present in the global option, you can still update it by a query of this form:
${lookup pgsql{servers=master/db/name/pw; UPDATE ...} }
24. Special MySQL features
For MySQL, an empty host name or the use of "localhost" in mysql_servers causes a connection to the server on the local host by means of a Unix domain socket. An alternate socket can be specified in parentheses. An option group name for MySQL option files can be specified in square brackets; the default value is "exim". The full syntax of each item in mysql_servers is:
<hostname>::<port>(<socket name>)[<option group>]/<database>/<user>/<password>
Any of the four sub-parts of the first field can be omitted. For normal use on the local host it can be left blank or set to just "localhost".
No database need be supplied – but if it is absent here, it must be given in the queries.
If a MySQL query is issued that does not request any data (an insert, update, or delete command), the result of the lookup is the number of rows affected.
Warning: This can be misleading. If an update does not actually change anything (for example, setting a field to the value it already has), the result is zero because no rows are affected.
25. Special PostgreSQL features
PostgreSQL lookups can also use Unix domain socket connections to the database. This is usually faster and costs less CPU time than a TCP/IP connection. However it can be used only if the mail server runs on the same machine as the database server. A configuration line for PostgreSQL via Unix domain sockets looks like this:
hide pgsql_servers = (/tmp/.s.PGSQL.5432)/db/user/password : ...
In other words, instead of supplying a host name, a path to the socket is given. The path name is enclosed in parentheses so that its slashes aren't visually confused with the delimiters for the other server parameters.
If a PostgreSQL query is issued that does not request any data (an insert, update, or delete command), the result of the lookup is the number of rows affected.
26. More about SQLite
SQLite is different to the other SQL lookups because a file name is required in addition to the SQL query. An SQLite database is a single file, and there is no daemon as in the other SQL databases. The interface to Exim requires the name of the file, as an absolute path, to be given at the start of the query. It is separated from the query by white space. This means that the path name cannot contain white space. Here is a lookup expansion example:
${lookup sqlite {/some/thing/sqlitedb \ select name from aliases where id='userx';}}
In a list, the syntax is similar. For example:
domainlist relay_to_domains = sqlite;/some/thing/sqlitedb \ select * from relays where ip='$sender_host_address';
The only character affected by the quote_sqlite operator is a single quote, which it doubles.
The SQLite library handles multiple simultaneous accesses to the database internally. Multiple readers are permitted, but only one process can update at once. Attempts to access the database while it is being updated are rejected after a timeout period, during which the SQLite library waits for the lock to be released. In Exim, the default timeout is set to 5 seconds, but it can be changed by means of the sqlite_lock_timeout option.


text:
Cordless Drills Market Industry Report With Top Companies, Diverse Applications, Feasibility And Growth Opportunities Check
The market study on"Global Cordless Drills Industry 2015-2027" is a key guide for the Cordless Drills Industry players to gauge the past, present and forecast industry situation. The base year considered in this study is 2019, the past year is 2015-2019 and the forecast year is 2020-2026. The report is categorized based on Cordless Drills product types, applications, key players, and geographical regions. The regions namely North America, Europe, Middle East, Asia-Pacific, Africa, South America and top countries falling in these regions are analyzed. The Cordless Drills market value, production, sales, industry size, growth, and revenue is analyzed.
Click The Link To Receive Sample Report Copy Free Of Cost (Company emails will be given priority):https://reportscheck.biz/report/41025/global-cordless-drills-industry-market-research-report/
The major players analysed in Global Cordless Drills Market Research Report are: Panasonic Senco Metabo Ryobi WEN Genesis Hilti Porter-Cable Rockwell DEWALT Zhongdeer Milwaukee Buffalo Corp Wickes Bosch Festool Chengkang Makita RIDGID Skil BLACK+DECKER
Main Product Types are: Type 1 Type 2 Type 3 Type 4 Type 5
Top Applications or End-User Analysis is: Application 1 Application 2 Application 3 Application 4 Application 5
The competitive analysis of all top players presented in this study will help the industries and clients in gauging the market potential. It will also help in investment feasibility, understand the new entrants, new product launches and more. The sub-regions and country-level analysis of Cordless Drills Industry is as follows.
North America: Canada, United States, Mexico
Europe: Germany, France, UK, Italy, Spain, Russia and rest
Asia-Pacific: Japan, China, India, South Korea, Australia, and rest
Central and South America: Argentina, Brazil and Rest
Middle East & Africa: Saudi Arabia, UAE, Turkey, Iran and Rest
Checkout More Info About The Report Or Send Any Query:https://reportscheck.biz/report/41025/global-cordless-drills-industry-market-research-report/
The report serves as a unique tool for strategic and tactical decision making. The up-to-date Cordless Drills industry information, developments, trends, production volume, demand analysis is provided. The report begins with Cordless Drills market overview, market competition by top players, industry chain study, sourcing strategy, and downstream buyers analysis. The marketing strategy, distributors, traders, buyers, SWOT analysis, Cordless Drills market saturation, and constraint analysis is offered.
Competitive Study: The Cordless Drills development status is fragmented based on the top 10 global players and other prominent industry leaders. Global players are trying to keep their product place on top whereas regional players are focusing on product offerings to establish themselves in this industry. The diverse range of products and their applications across different fields is intensifying the competition.
The study objectives of this Global Cordless Drills Report are as follows:
• To study the industry sales, Cordless Drills market value & volume, status from 2015-2026, and forecast situations.
• To analyze the top global players, their revenue and market share with product line study and strategies implemented by them.
• Focus on growth aspects, future expansion plans, sales, and supply-demand views.
• To define, classify, and provide comprehensive details on product types, Cordless Drills applications, regions, and key players.
• To gauge the market potential, opportunity, risk factors, restraints, and advantages.
• Any type of custom query will be incorporated in the sample report. Please contact the sales team for more details and to know about our services.
Contact Us:
Olivia Martin (Marketing Manager)
Call: +1 831 679 3317
Email: email@example.com
Website: www.reportscheck.biz

subset: commoncrawl


text:
Net Surplus Compensation
Green Energy Generates Its Own Rewards
With the enactment of Assembly Bill 920 (AB 920), California utilities, including PG&E, have been authorized to offer special compensation — called Net Surplus Compensation (NSC) — to customers for excess energy their renewable system generates and sends back to the grid. To learn more, just click on the headings, below, to see Net Energy Metering (NEM) customers' most frequently asked questions.
Your Surplus Energy and Your PG&E Bill
What is Net Surplus Compensation and how does it affect my bill?
Assembly Bill 920 (AB 920) authorized payments to be made to NEM customers who produce more electricity than they use over a 12-month period — also called the "true-up period." The compensation offered to customers — known as Net Surplus Compensation (NSC) — is a rate based on a rolling 12-month average of spot market prices and may fluctuate on a monthly basis. If you qualify for a Net Surplus Compensation payment, it will be added to your PG&E bill as a credit. If a negative balance exists on your PG&E bill during your true-up month when this credit is applied, you may request a check.
Depending on your type of PG&E account, this credit will either be included in the "Total Adjustments"* or "Electricity" line item on your PG&E bill as shown in the examples below:
What is surplus electricity?
If during the course of your true-up period, the electricity in kilowatt-hours (kWh) exported to PG&E by your solar or wind generator is greater than the electricity you used onsite, you'll have generated surplus electricity.
How can I tell if I have generated surplus electricity?
On your annual true-up statement, if the Total Energy amount (kWh) is shown as a negative number, you have generated surplus electricity and are entitled to compensation. If the Total Energy amount is positive, you've used more electricity than you produced over the course of your true-up period and may be billed for this usage. The most important thing to know is — whether you generated a surplus or not — your energy bills were still reduced thanks to your green energy commitment.
Why is NSC less than the credit on my NEM statement?
The credit you see on your NEM statement is calculated using the full retail rate for energy. Several components make up this rate, including generation, transmission, distribution, and the funding of public purpose programs. When PG&E buys energy, it pays a generator a wholesale rate for energy. Similarly, when you generate surplus energy, you receive a wholesale-type rate for generation just like all other generators. The credit shown on your statement is calculated using the retail rate, which is higher than the wholesale rate because it takes into account several costs in addition to the generation component.
Net Surplus Compensation Facts and Information
What is this program about?
In 2009, the law governing the Net Energy Metering (NEM) program for solar and wind generators was revised by Assembly Bill 920 (AB 920) to allow payment to those customers who have generated more electricity (kWh) than they used at their annual true-up. AB 920 is an added component of the NEM program for customers whose true-ups were on January 1, 2011, or later. On June 9, 2011, the California Public Utilities Commission (CPUC) approved the Net Surplus Compensation (NSC) rate for Net Energy Metering (NEM) customers who produce more electricity (kWh) than they use over their true-up period, usually 12 billing months. This payment was authorized by Assembly Bill 920 (AB 920). The Net Surplus Compensation rate may fluctuate every month, as it is based on a rolling 12-month average of spot market prices. Based on current market prices, the rate would be approximately 4 cents per kWh.
What if my true-up happened before the June 9, 2011, decision?
AB 920 took effect as of January 1, 2011. So, all customers who qualify on or after that date will receive payment for their surplus electricity as soon as the regulatory requirements are in place for the payment portion of the program. We are working as quickly as possible to comply with these requirements so that we can begin to pay customers.
When will this program go into effect?
The AB 920 program has been in effect since January 1, 2011. Payments to PG&E customers will begin on October 21, 2011.
How long will this program be in effect?
This program will continue indefinitely. However, you may only qualify for compensation for years (or true-ups) whereby your renewable system has excess generation. If there are no excess kWhs generated in a given true-up period, you will not receive any AB 920 compensation for that period.
What will happen if I install a larger-than-necessary PV system?
The NEM solar program is designed to enable customers to offset usage, not generate surplus energy. In order to participate in the NEM program, you are required to install a PV system that allows you to offset your annual onsite consumption.
Eligibility and Enrollment
What do I have to do to participate?
As an existing Net Energy Metering (NEM) customer, PG&E has automatically enrolled you into the program, and your eligibility for payment will start with your 2011 true-up bill. For example:
- If you have surplus electricity at the end of your typical 12-month true-up period starting in 2011, you will qualify for payment for any surplus electricity.
- If you do not have surplus electricity at the end of your typical 12-month true-up period, you will not be eligible for payment and there will be no change from the current NEM program. If you have surplus electricity in any subsequent 12-month true-up, you will qualify for payment and be notified of your eligibility.
Note that your true-up may be any number of months, as long as it ends in 2011 or thereafter. For most customers it will be a 12-month cycle.
I moved into a house that has a solar system. How do I enroll in the Net Surplus Compensation program?
Most customers who move into homes with previously interconnected solar PV systems are automatically enrolled in PG&E's NEM program and are therefore eligible for this program. If your PV system is larger than 30 kW, additional steps may be required to enroll in the NEM program. Please contact our Solar Customer Service Center at 1-877-743-4112 for more information.
What if my solar system is owned by a third party?
If you are an NEM customer you will still be eligible to receive payment for any surplus electricity you generate. However, if you have relinquished ownership of your Renewable Energy Credits (RECs) to your system's third-party owner, you would only be paid for the wholesale value of the surplus electricity and not for the renewable component of the compensation program. This is because payment for surplus electricity under this program is comprised of two components: the value of actual electricity generated and the value of the renewable attributes of this electricity.
What if I own the system and the renewable attributes as well? Will PG&E pay me for both components
The Commission has placed a hold on any payments for Renewable Energy Credits until the California Energy Commission has set up a process to verify and track these attributes. Once this process is in place, PG&E should be allowed to make an additional payment to you in exchange for the REC value of your excess kWh.
Can I take advantage of this program if I am a Multifamily Affordable Solar Housing / New Solar Housing Partnership low-income customer?
Yes. Each PG&E electric account owner, whether a tenant unit or common area, which is under our NEM Virtual Net Metering program is eligible for this payment. If the electricity (kWh) allocated to your account over your true-up year exceeds your usage, you should be eligible to receive payment.
I own more than one Net Energy Metered property, does this program affect just me as the property owner or each property I own?
Each NEM account is treated separately, and you cannot combine accounts. Also, you must be the PG&E customer of record to participate in the NEM program.
What happens if I sold my house and moved out of an area served by PG&E before my 2011 true-up? Will I still receive partial payment?
The legislation does not make a provision for pre-2011 payment. If you moved prior to January 1, 2011 your account would be trued-up under the pre-AB 920 program rules and you would not receive payment for any surplus electricity you exported up to that time.
What happens if I sell my house and move out of an area served by PG&E after the 2011 true-up? Will I still be paid for the time that I generated surplus electricity?
Should you close your PG&E electric account starting in 2011, your account will be trued-up, just like any other true-up, under the new program, and you will be eligible to receive any payment due, should you generate surplus electricity.
I am a direct access customer. Can I still take advantage of this program?
You are not eligible for this program. You will need to contact your energy service provider or community choice aggregator directly for information about programs they offer.
Credits and Payments
How will I receive my compensation credit?
If you qualify, the Net Surplus Compensation (NSC) you've earned will show on your Net Energy Metering (NEM) annual true-up statement in the "Net Surplus Compensation" box on the first page, The NSC amount reflected will be factored into your billing at the time of your annual true-up and will be incorporated into the line item for "Electricity" on your PG&E blue bill. If a negative balance exists on your PG&E bill after this credit is applied, you may leave the credit on your bill. The credit will never expire but will be used towards future energy charges or if you prefer, you may contact PG&E to request a check if the credit is over $1.00.
How will my Net Surplus Compensation (NSC) rate be determined at the time of my true-up?
The Net Surplus Compensation rate may fluctuate monthly, as it is based on a rolling 12-month average of spot market prices. Your Net Surplus Compensation rate is determined by using the average day-ahead spot market prices (between 7 am and 5 pm) of procuring electricity for the previous 12 months from the time of your true-up. For example, if your true-up is in the month of October, prices from September of the previous year to the September of the current year will be used to calculate the rate that will then be applied for customers truing-up in the month of October. Given fluctuations in energy costs over time, your Net Surplus Compensation rate will also vary from year to year, possibly rising or falling along with market costs of energy. Based on current market prices, the rate would be approximately 4 cents per kWh.
View this month's Net Surplus Compensation (PDF, 92 KB) rate information.
Sometimes I have a monetary credit at the time of my true-up. Does this mean I will get the credit?
No. Payment is issued only if the customer has surplus electricity (i.e., exports more kilowatt-hours to the grid than they use over their true-up period). It's not uncommon for a customer to have a monetary NEM credit, which is calculated using the full retail rate for energy. Several components make up this rate, including generation, transmission, distribution, and the funding of public purpose programs. These credits may show throughout the true-up period and at the time of their annual true-up, even if there is not actual surplus electricity. This can happen especially with solar energy, which is often exported to PG&E during peak periods when electricity is more expensive, and energy used is often supplied by PG&E's grid during off-peak periods when electricity costs less. To understand more about the NEM billing process, refer see our how it works page.
Will I be able to get a credit for energy I generated before this new legislation took effect?
No, credits are not available for excess generation prior to January 1, 2011.
Is there a minimum amount that PG&E will compensate me for?
No. However, if your payment is less than $1 you will not be eligible for a cash payment, but will receive a credit on your next bill.
When will I see this payment?
Customers will begin receiving their Net Surplus Compensation on their bill at the end of October 2011. Bill credits will be applied to all eligible customers' statements and if, after all charges are factored in, a credit over $1 remains, customers may request a check.
Miscellaneous Questions
What other incentives are available to me to increase my Net Generation Capacity?
You could take advantage of any of PG&E's many energy efficiency program options. More information about these programs is available at www.pge.com.
Does this affect all electric utilities in California or just PG&E?
All investor-owned utilities in California are required to provide this program.
What are RECs? Will I be able to receive payment for my RECs?
REC stands for Renewable Energy Credits and represents the renewable attributes of your solar or wind energy generation. The California Energy Commission has been charged with setting up a process for verifying and tracking these RECs. Once the REC program is in place, you may be able to receive a subsequent payment, in addition to the payment you receive for any surplus electricity you generate, based on the value of your RECs.
Will this new program increase my rates?
It is not known at this time how this program will impact electric rates.
If you have specific questions about your account or would like to request a check, please contact the PG&E Solar Center at 1-877-743-4112, Monday through Friday from 8 a.m. to 5 p.m.
To opt-out of your Net Surplus Compensation payment, use the Request to Opt-out of/ Opt-in to Compensation for Surplus Electricity form (PDF, 155 KB).
View this month's Net Surplus Compensation (PDF, 92 KB) rate information.
Contact Us
or Email us


text:
WASHINGTON (AP) — The U.S. economy grew at a solid 4.1 percent annual rate from July through September, the fastest pace since late 2011 and significantly higher than previously believed. Much of the upward revision came from stronger consumer spending.
The Commerce Department's final look at growth in the summer was up from a previous estimate of 3.6 percent. Four-fifths of the revision came from stronger consumer spending, primarily in the area of health care.
The 4.1 percent third quarter growth rate came after the economy expanded at a 2.5 percent rate in the second quarter. Much of the acceleration reflected a buildup in business stockpiles.
Economists believe growth has slowed to between 2 percent and 2.5 percent in the current quarter, in part because they believe inventory growth has slowed.
Copyright 2013 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


text:
I got a small pack of this tea and fell in love with it. This tea is called "white plum flower mountain peak" (白梅花尖), name after its production area, which is a mountain top with a lot of white plum flower trees. It's a beautiful name for both tea and a place! And you know I love plum flowers!
This tea is from an area right next to the producing region of Huang Shan Mao Feng. The appearance of this tea is quite similar to Huang Shan Mao Feng too, due to the similar processing techniques used. But this tea has a lot of nice nuances, floral, herbal, incense, and something subtle and mysterious that I had never experienced before. I only got a small pack of the first flush harvest. Then the friend who gave it to me said he thought 2nd flush is the best. This just kills me, as I don't know yet if I can get more of this tea next year.
Probably we have to face a fact that there are more teas in this world than we could ever get hold of... So what can we do? Enjoy what we have and keep dreaming for more...
1 year ago


text:
If you want to spice up your magic routines, or just add flavor to your act, join Nicholas Byrd and James Coats as they cater to all your being needs. You will be shown how to bend metal and plastic spoons and forks, wooden items, keys, nails pens, and paper clips.
Do you own this product? Write a review.


text:
The first time I tried to load the #replacebandnameswithrape hashtag, my computer browser warned me that the page contained insecure content. "Insecure" doesn't even begin to describe it. I'd be offended if I wasn't so depressed. You know people fought in wars to protect our freedom of speech, right? And this is how we're using that freedom? Okay.
Here's the idea (and feel free to pause as often as you need so that you can laugh or fall asleep or puke on yourself): you take a band name — say, The Rolling Stones — and you replace one of the words with rape! The Rolling Rape! And then you laugh until you accidentally shoot Surge out of your nose, because it's 1996 and you're at a slumber party and you're 12 and you think this is hilarious. Other entries in the hashtag's page include My Chemical Rapemance ("Ro" isn't a word, dumbass) and 1Rape. Shouldn't you kids be in school?
While it appears that the overall reaction from most Twitter users is a quick eye roll and dismissal of the trend as yet another idiotic thing Twitter has shat out, the trend has now evolved, as trends tend to do, into commentary about the trend, which ranges from earnestly horrified — "Did you know 54% of sexual assaults are never reported? This hashtag is part of the reason why." — to ironically self conscious but noncommittal in a sort of hipster type way — "Insert tweet about the trend #ReplaceBandNamesWithRape being disgusting here" — to irritated and bored — "#ReplaceBandNamesWithRape might just take the award for stupidest trend of all time." — to girls weirdly defensive insistance that your participation in the trend means you're cool and down with the dudes — "Its funny 'cause if you look at the tweet results for #ReplaceBandNamesWithRape there are dickheads with no sense of humour, moaning."
This last subcategory of responses to the trend, the girls-defending-jerks-who-hate-girls responses that are sort of inevitable when any misogyny pops up on any social networking site, are always the responses that make me want to light the internet on fire. Ladies! Girls! Women! For the fuck of shit, we should know better!
It's not that I cut men slack here; it's just that I have higher expectations for women when it comes to having a basic amount of human empathy for other women. Men don't run around kicking other men in the balls to prove to women how down they are; women and girls need to stop acting like assholes to other girls in order to prove to douchebags that they can hang. Rape jokes at the expense of rape victims aren't really jokes at all. And I understand (or hope) that the pro- #replacebandnameswithrape entries were crafted by kids who just don't know any better, but Jesus Chris Brown Defending Christ, I wish it didn't start this early. I wish girls didn't have to be trained out of thinking stupid, pointless rape jokes are hilarious. I wish this wasn't the default for so many people.


text:
An ultra-thin electronic device attaches to the skin like a temporary tattoo and measures heart rate and other vital signs without the bulky electrodes used in current hospital monitoring, reports a new study in the 11 August issue of the journal Science.
The device could also potentially be used as an electronic bandage to speed up healing in wounds, burns, and other skin conditions, and it could even provide touch sense to prosthetic devices such as artificial legs or arms.
The complicated wiring involved in current hospital monitoring can be inconvenient and distressing for both patients and doctors. For example, a patient with heart disease is usually required to wear a bulky monitor for a month or more in order to capture abnormal but rare cardiac events.
The current best electrodes for these monitors are gel-coated adhesive pads. Many people, particularly those who have sensitive skins, will develop a rash from the adhesive. The electronic skin designed by John Rogers at the University of Illinois at Urbana-Champaign and colleagues sits on a layer of rubbery polyester engineered to have mechanical properties well matched to those of natural skin.
"Our goal was to develop an electronic technology that could integrate with the skin in a way that is mechanically and physiologically invisible to the user," Rogers said. "It's a technology that blurs the distinction between electronics and biology."
An epidermal electronic system, mounted on a commercial temporary transfer tattoo, shows extreme flexibility and deformation after being attached to the skin. | Video courtesy of John A. Rogers
Applied like a temporary tattoo, the device sticks to the skin by sheer attraction. Weak forces called van der Waals forces that exist between molecules of the same substance hold the device in place but do not interfere with normal skin motion. The device can bend, wrinkle, and stretch without being damaged.
The middle layer of the device consists of the metal, semiconductor, and insulator components needed for sensors, electronics, power supply, and light-emitting components. The design squeezes all of the necessary components in an ultra-thin layer about the thickness of a human hair.
"There are a couple of large steps in manufacturing that are unique," Rogers said in a 10 August Webcast discussing the research, "but most of it relies on established tools that are embedded in silicon IT factories."
The researchers tested the electronic skin on participants and showed that the device works for up to 24 hours or more on the arm, neck, forehead, cheek, and chin, and that it does not irritate the skin.
The team also used the device to take measurements of the electrical activity produced by the leg muscles and heart of participants, and found that the device's signals matched signals taken simultaneously with the conventional setup of bulk electrodes, conductive gel, and tape.
The results suggest that electronic skins could one day replace conventional hospital monitoring techniques, and the researchers are exploring commercial partnerships to develop the technology.
"Our ultimate goal is to generate commercial products that can be a broad benefit to society," Rogers said. "We will judge success by the extent to which this technology makes it into the wider world."
Watch a 10 August Webcast discussing the Science research.
Listen to a Science Podcast interview with John Rogers.
Read the abstract, "Epidermal Electronics," by John Rogers and colleagues.


text:
Afterthought wrote:Looks awesome. If this is the same car I saw on FB you must be pretty close to me. I'm north of Seattle.
That car looks really clean, paint and body wise! Suspension looks good low like that.
Look forward to seeing it when it's done.
PRY4SNO wrote:Looks like you've got a really nice platform to start from, all those parts gives a guy a good head start.
Curious why you picked the EFR7064? That's older tech, relatively speaking. Have you tried BorgWarner's MatchBot? It's incredible for matching your engine to their compressor maps. When I spent a lot of time with that tool I found the 7163 was optimal for a 2.5L. Any plans to use a QSV? I'd say a 6758 or 7163, either with or without a QSV, and some water-meth injection, would really do a nice job in your application (street/rallyx/hillclimb).
Per Hank when he was using my turbo as a sort of beta-test rig, the 7163 should be good for full boost from 3400 rpm to redline... on 91 pump gas. By memory he said it makes decent boost as early as 3000 rpm. Good for 450 bhp on pump gas, 600+ on race fuel / e85 (not including w/m injection). And that's on the old-school 2.5L 20v I5, not even accounting for the awesome flowing heads on the 07k.
Afterthought wrote:The Kw setup looks awesome and what do you think of the ride? I'm Trying to decide between that and Ground control / Koni for a future setup on URQ.
FWIW another cool option to consider , My buddy who is in the area just had his car built (old school 20VT AAN, 2.6. With a port job on the head and wiseco pistons , etc ) running a Wagner exhaust manifold and Xona 65-64 turbo. He's on break in tune at 15 psi and made over 410 Wheel, but with the "full" 15 psi before 3100 rpm. It's crazy quick spool time . Dyno tune was done locally but he is running Motronic . I'd definitely start by talking to Marc @ EFI express in the tuning/hardware area
Afterthought wrote:Nateflix56 wrote:Your buddies car wouldn't happen to be one of the ones recently posted by AMD would it?
Yes sir the engine was built by AMD and he's got some dyno tuning in on it so far but not many miles. Maybe 800 or so yet so he hasn't turned the boost up. It's at 415 WHP now and I think he just wants 450-500 or so.
He is a good friend and came by the other day and let me take it for a drive . He feels my pain since I've been driving a 10V 80Q. I was real impressed with how quick that boost comes on in the 2.5 but I don't know what the top end is on it .
Depending on what you go with for ECU maybe Jason can tune it , I'm not sure if he deals with VEMS or not I think he's mostly Motronic . I wasn't up to doing a harness so Marc made me one for my swap , a full custom VEMS harness that's plug and play and only requires a few terminations to be done at the fusebox . If you get there and need help with that I have been In the fusebox a few times and I do have some diagrams .
Afterthought wrote:I like it. Good progress . She did good on the Dolly's, I got the cheaper ones and had to weld a couple of the wheels on after first use .
I'm sure you know the head, oil pan, valve cover, and some of those parts are good for a 20V/20VT enthusiast . Don't know what you're doing with them.
Also... nice Denali, L5P? LML?
Afterthought wrote:Definitely if you have someone interested in the whole thing take it. its easier.
The brakes- definitely 10x easier to get all this sorted now before the engine is in.
For the booster swap, you can get a booster new for around 275.00 or fund a used 4K setup or similar (ebay or junkyard) I found a 4000 Quattro donor and grabbed the whole thing (booster, MC , PS pump/rack/lines)
If you want to replace the little proportioning valve, There is a Tilton brand metric proportioning valve that I have which was a direct fit and did not require anything to be changed with the lines
I don't know if you're planning electric or otherwise for the power steering, but once the booster is gone you will have a supply and return line coming from your power track to the booster that is not used. You could tie it back together and make a loop or change racks to make it cleaner. The stock pump has too high of pressure and needs to be modified (delete a piston from it) or changed with one from a booster-less car.
Users browsing this forum: No registered users and 1 guest


text:
The following Love in Contract (2022) Episode 6 Eng Sub has been released. Love in Contract (2022) Ep 6 English Sub Dramacool And Myasiantv will always be the first to have the episode so please Bookmark and visit daily for the latest updates!!! Enjoy a free download.
About admin
Related Articles
Destined With You (2023) Episode 13 Eng Sub
4 hours ago


text:
Have Questions? Call Us: 1-800-574-4265
We strive to deliver a level of service that exceeds the expectations of our customers.
If you have any questions about our products or services, please do not hesitate to contact us. We have friendly, knowledgeable representatives available seven days a week to assist you. Read More About Us!
24/7 Booking line!
Click to view all
Help us improve!
Have questions or need help?
Showing all 6 results
Riviera Maya, Mexico.
Riviera Maya-Cancun-Mexico
Cap d'Agde, France


text:
A quick change of plan:Rather than stand outside the Civic Suite for too long, our lobby for the Safer Stronger Select Committee will start at the same time as the meeting - 7pm!
Maximum impact for minumum time in the cold. We had a great Saturday with campaigners, poets and storytellers out on the streets collecting loads of signatures in Catford and Lewisham. Special thanks to Library Tales Lewisham, Lewisham Writer-in-Residence Chrissie Gittins and all the others who told a tale or two.
Let's get this week off to a good start too, see you there at 7pm!
Save Lewisham Libraries Campaign <firstname.lastname@example.com>


text:
This website template has been designed by Free Website Templates for you, for free. You can replace all this text with your own text. You can remove any link to our website from this website template, you're free to use this website template without linking back to us.
If you're having problems editing this website template, then don't hesitate to ask for help on the Forums.
Classes And
Tutorials For Kids
Private Or Group
Choose between private and group classes for kids or adults. It's never too late to learn how to play chess!Learn More
The Exclusive Club
Chess Set
Carved from hard wood by hand and finished off with italian varnish. Only 10 sets made in the world.Go to Blog
Cras et velit auctor urna posuere dignissim. Vivamus nec enim elementum massa lacinia congue a nec diam. Integer egestas, ipsum vel viverra euismod, diam tellus imperdiet nulla, condimentum bibendum lorem lacus in lacus.More Tips


text:
Moore writes: "There comes a point about two-thirds of the way through Zero Dark Thirty where it is clear something, or someone, on high has changed."
Portrait, Michael Moore, 04/03/09. (photo: Ann-Christine Poujoulat/Getty Images)
In Defense of Zero Dark Thirty
25 January 13
here comes a point about two-thirds of the way through Zero Dark Thirty where it is clear something, or someone, on high has changed. The mood at the CIA has shifted, become subdued. It appears that the torture-approving guy who's been president for the past eight years seems to be, well, gone. And, just as a fish rots from the head down, the stench also seems to be gone. Word then comes down that - get this! - we can't torture any more! The CIA agents seem a bit disgruntled and dumbfounded. I mean, torture has worked soooo well these past eight years! Why can't we torture any more???
The answer is provided on a TV screen in the background where you see a black man (who apparently is the new president) and he's saying, in plain English, that America's torturing days are over, done, finished. There's an "aw, shit" look on their faces and then some new boss comes into the meeting room, slams his fist on the table and says, essentially, you've had eight years to find bin Laden - and all you've got to show for it are a bunch of photos of naked Arab men peeing on themselves and wearing dog collars and black hoods. Well, he shouts, those days are over! There's no secret group up on the top floor looking for bin Laden, you're it, and goddammit do your job and find him.
He is there to put the fear of God in them, probably because his boss, the new president, has (as we can presume) on his first day in office, ordered that bin Laden be found and killed. Unlike his frat boy predecessor who had little interest in finding bin Laden (even to the point of joking that "I really just don't spend that much time on him"), this new president was not an imbecile and all about business. Go find bin Laden - and don't use torture. Torture is morally wrong. Torture is the coward's way. C'mon - we're smart, we're the USA, and you're telling me we can't find a six-and-a-half-foot tall Saudi who's got a $25 million bounty on his head? Use your brains (like I do) and, goddammit, get to work!
And then, as the movie shows, the CIA abruptly shifts from torture porn to - are you sitting down? - detective work. Like cops do to find killers. Bin Laden was a killer - a mass killer - not a general of an army of soldiers, or the head of a country call Terrorstan. He was a crazed religious fanatic, a multi-millionaire, and a punk who was part of the anti-Soviet mujahideen whom we trained, armed and funded in Afghanistan back in the '80s. But he was a godsend and a very useful tool to the Dick Cheneys and Don Rumsfields of the world. They could hold him up to a frightened American public and scare the bejesus out of everyone - and everyone (well, most everyone) would then get behind the effort to declare war on, um ... well ... Who exactly do we declare war against? Oh, right - terrorism! The War on Terrorism! So skilled were the men from Halliburton, et al. that they convinced the Congress and the public to go to war against a noun. Terrorism. People fell for it, and these rich men and their friends made billions of dollars from "contracting" and armaments and a Burger King on every Iraqi base. Billions more were made creating a massive internal spying apparatus called "Homeland Security." Business was very, very good, and as long as the bogeyman (Osama) was alive, the citizenry would not complain one bit.
I think you know what happens next. In the final third of Zero Dark Thirty, the agents switch from torture to detective work - and guess what happens? We find bin Laden! Eight years of torture - no bin Laden. Two years of detective work - boom! Bin Laden!
And that really should be the main takeaway from Zero Dark Thirty: That good detective work can bring fruitful results - and that torture is wrong.
Much of the discussion and controversy around the film has centered on the belief that the movie shows, or is trying to say, that torture works. They torture a guy for years and finally, while having a friendly lunch with him one day, they ask him if he would tell them the name of bin Laden's courier. Either that, or go back and be tortured some more. He says he doesn't know the guy but he knows his fake name and he gives them that name. The name turns out to be correct. Torture works!
But then we learn a piece of news: The CIA has had the name of this guy all along! For ten years! And how did they get this name ten years ago? From "a tip." A random tip! No torture involved. But, as was the rule during those years of incompetency and no desire to find bin Laden, the tip was filed away somewhere in some room - and not discovered until 2010. So, instead of torturing hundreds for eight years to find this important morsel of intelligence, they could have found it in their own CIA file cabinet in about eight minutes. Yeah, torture works.
In the movie, after they have the name of the courier, they then believe if they find him, they find bin Laden. So how do they find him? They bribe a Kuwaiti informant with a new car. That's right, they find the number of the courier's family by giving the guy a Lamborghini. And what do they do when they find the courier's mother? Do they kidnap and torture her to find out where her son is? Nope, they just listen in on his weekly call home to Mom, and through that, they trace him to Pakistan and then hire a bunch of undercover Pakistani Joe Fridays to follow this guy's every move - which, then, leads them to the infamous compound in Abbottabad where the Saudi punk has holed up.
Nice police work, boys!
Oh - and girl. 'Zero Dark Thirty - a movie made by a woman (Kathryn Bigelow), produced by a woman (Megan Ellison), distributed by a woman (Amy Pascal, the co-chairman of Sony Pictures), and starring a woman (Jessica Chastain) is really about how an agency of mostly men are dismissive of a woman who is on the right path to finding bin Laden. Yes, guys, this is a movie about how we don't listen to women, how hard it is for them to have their voice heard even in these enlightened times. You could say this is a 21st century chick flick - and it would do you well to see it.
But back to the controversy and the torture. I guess where I part with most of my friends who are upset at this film is that they are allowing the wrong debate to take place. You should NEVER engage in a debate where the other side defines the terms of the debate - namely, in this case, to debate "whether torture works." You should refuse to participate in that discussion because the real question should be, simply, "is torture wrong?" And, after watching the brutal behavior of CIA agents for the first 45 minutes of the film, I can't believe anyone of conscience would conclude anything other than that this is morally NOT right. You will be repulsed by these torture scenes because, make no mistake about it, this has been done in your name and mine and with our tax dollars. We funded this.
If you allow the question to be "did torture work?" then you'll lose because yes, if you torture someone who actually has the information, they will eventually give it to you. The problem is, the other 99 who don't know anything will also tell you anything to get you to stop torturing - but their information is wrong. How do you know which one of the 100 is the man with the goods? You don't.
But let's grant the other side that maybe, occasionally, torture "works." Here's what else will work: castrating pedophiles. Why don't we do that? Probably because we think it's morally wrong. The death penalty sure works. Put a murderer in a gas chamber and I can guarantee you he'll never murder again. But is it right? Do we accomplish the ends we seek by becoming the murderers ourselves? That should be our only question.
After I saw Zero Dark Thirty, a friend asked me, "During the torture scenes, who did you feel empathy for the most - the American torturer or the Arab suspect?" That was easy to answer. "Oh, God, the poor guy being waterboarded. The torturer was a sadist."
"Yes, that's the answer everyone gives me afterward. The movie actually makes you care for the tortured guys who may have, in fact, been part of 9/11. Like rooting for the Germans on the submarine to make it back to port in Das Boot, that's the sign of some great filmmaking when the writer and director are able to get you to empathize with the person you've been told everywhere else to hate."
Zero Dark Thirty is a disturbing, fantastically-made movie. It will make you hate torture. And it will make you happy you voted for a man who stopped all that barbarity - and who asked that the people over at Langley, like him, use their brains.
And that's what worked.
P.S. One final thought. I've heard fellow lefties say that even if the filmmakers didn't intend to endorse torture (Bigelow called torture "reprehensible" on Colbert the other night), the average person watching the movie is going to take it the wrong way. I believe it is the responsibility of the filmmaker attempting to communicate something that they do so clearly and skillfully (and you can decide for yourself if Bigelow and Boal did so. For me, they did.). But I never blame the artist for failing to dumb down their work so that the lesser minds among us "get it." Should Springsteen not have named his album Born in the USA because some took it to be as a salute to patriotism (Reagan wanted to use it in his 1984 reelection campaign but Bruce said no)?
THE NEW STREAMLINED RSN LOGIN PROCESS: Register once, then login and you are ready to comment. All you need is a Username and a Password of your choosing and you are free to comment whenever you like! Welcome to the Reader Supported News community.


text:
The Women's Defend Fire Pant offers abrasion and weather protection to mountain bikers. The extra-durable Cordura panels on the seat and knee areas enhance the garment's strength in high-wear zones. The bonded fleece lining provides excellent warmth while also wicking moisture off of your skin to keep you dry and comfortable. The tapered leg and elastic cuff keep the pant away from your drive train. The proven Fly Cam ratchet waist closure and a high-stretch fabric blend provide comfort and efficient pedaling.
- Water-resistant, fleece-lined pant
- Cordura seat and knee panels provide extra abrasion resistance
- Durable Water Repellent finish sheds water, dirt, and debris
- Bonded fleece lining for comfort, warmth, and mobility
- Podium proven Race Ratchet closure for adjustment on the fly
- Tapered leg with elastic cuff
- Inseam: 30.5"
- Main body: 94% polyester / 6% spandex
- Panel: 63% Cordura / 31% nylon / 6% spandex


text:
Game Description
Awakening: The Skyward Castle tells the tale of young Princess Sophia, who awakens from a magical century-long slumber into a land threatened by an ancient evil. Braving the dangers of an unfamiliar world, Princess Sophia has travelled far to discover the fate of her exiled kingdom. Having no magic of her own in a land built with living magic, she must overcome the many foes, perils and obstacles with her wit, skill and allies. Can Princess Sophia lift the curse that plagues her people? Find out in this epic conclusion!
This special Collector's Edition includes:
-Integrated strategy guide
-Bonus gameplay
-Beautiful concept art