text:
Interesting stuff.
The summary below is from Discover, then the whole article, which is open access, is also included below.
This Is Your Brain on Psychedelic Drugs
By Ben Thomas | October 29, 2014 4:16 pm
Left, the stable brain activity in a normal brain. Right, under the influence of psilocybin, diverse brain regions not normally in communication become strongly linked.
Psychedelic substances can change a user's mindset in profound ways — a fact that's relevant even to those who've never touched the stuff, because such altered states of consciousness give scientists a window into how our brains give rise to our normal mental states. But neuroscientists are only beginning to understand how and why those mental changes occur.
Now some mathematicians have jumped into the fray, using a new mathematical technique to analyze the brains of people on magic mushrooms.
Psychedelic Puzzles
Scientists have known for decades that many of psychedelic drugs' most famous effects — visual hallucinations, heightened sensory and emotional sensitivity, etc. — are linked to elevated levels of the neurotransmitter serotonin.
But increasingly neuroscience researchers are interested not just in single chemicals but also in overall brain activity, because the most complicated brain functions arise from lots of different regions working together. Over the last several years, a branch of mathematics known as network theory has been applied to study this phenomenon.
Paul Expert, a complexity researcher at the Imperial College London, and his team took this approach to analyzing fMRI data from people who'd taken psilocybin, the psychedelic chemical in magic mushrooms. The team had recently been working on a new technique for network modeling — one designed to highlight small but unusual patterns in network connectivity.
Brains on Drugs
The team used fMRI data from a previous study, in which 15 healthy people rested inside an fMRI scanner for 12 minutes on two separate occasions. The volunteers received a placebo in one of those sessions, and a mild dose of psilocybin during the other, but they weren't told which was which.
The investigators crunched the data, specifically studying the brain's functional connectivity — the amount of active communication among different brain areas.
They found two main effects of the psilocybin. First, most brain connections were fleeting. New connectivity patterns tended to disperse more quickly under the influence of psilocybin than under placebo. But, intriguingly, the second effect was in the opposite direction: a few select connectivity patterns were surprisingly stable, and very different from the normal brain's stable connections.
This indicates "that the brain does not simply become a random system after psilocybin injection, but instead retains some organizational features, albeit different from the normal state," the authors write in their paper in the Journal of the Royal Society Interface.
Far Out
The findings seem to explain some of the psychological experiences of a psilocybin trip. Linear thinking and planning become extremely difficult, but nonlinear "out of the box" thinking explodes in all directions. By the same token, it can become difficult to tell fantasy apart from reality during a psilocybin trip; but focusing on a certain thought or image — real or imagined — often greatly amplifies that thought's intensity and vividness.
The authors suggest that effects like these may be rooted in the two connectivity traits they spotted, since the connectivity patterns that rapidly disperse may reflect unorganized thinking, while the stable inter-regional connections may reflect information from one sensory domain "bleeding" into other areas of sensory experience. In fact, the researchers also suggest that synesthesia — the sensory blurring that causes users of psychedelics to experience sounds as colors, for example — may be a result of these connectivity changes too.
The researchers hope that the patterns they've found will provide neuroscientists with new approaches for studying the brain on psychedelic drugs, and therefore better understand the strange psychological effects their users report.
* * * * *
Full Citation:
Petri, G, Expert, P, Turkheimer, F, Carhart-Harris, R, Nutt, D, Hellyer, PJ, and Vaccarino, F. (2014, Oct 29). Homological scaffolds of brain functional networks. J. R. Soc. Interface; 11(101). doi: 10.1098/rsif.2014.0873 [Print: 6 December 2014]
Homological scaffolds of brain functional networks
G. Petri [1], P. Expert [2], F. Turkheimer [2], R. Carhart-Harris [3], D. Nutt [3], P. J. Hellyer [4] and
F. Vaccarino [1,5]
1. ISI Foundation, Via Alassio 11/c, 10126 Torino, ItalyAbstract
2. Centre for Neuroimaging Sciences, Institute of Psychiatry, Kings College London, De Crespigny Park, London SE5 8AF, UK
3. Centre for Neuropsychopharmacology, Imperial College London, London W12 0NN, UK
4. Computational, Cognitive and Clinical Neuroimaging Laboratory, Division of Brain Sciences, Imperial College London, London W12 0NN, UK
5. Dipartimento di Scienze Matematiche, Politecnico di Torino, C.so Duca degli Abruzzi no 24, Torino 10129, Italy
Networks, as efficient representations of complex systems, have appealed to scientists for a long time and now permeate many areas of science, including neuroimaging (Bullmore and Sporns 2009 Nat. Rev. Neurosci. 10, 186–198. (doi:10.1038/nrn2618)). Traditionally, the structure of complex networks has been studied through their statistical properties and metrics concerned with node and link properties, e.g. degree-distribution, node centrality and modularity. Here, we study the characteristics of functional brain networks at the mesoscopic level from a novel perspective that highlights the role of inhomogeneities in the fabric of functional connections. This can be done by focusing on the features of a set of topological objects—homological cycles—associated with the weighted functional network. We leverage the detected topological information to define the homological scaffolds, a new set of objects designed to represent compactly the homological features of the correlation network and simultaneously make their homological properties amenable to networks theoretical methods. As a proof of principle, we apply these tools to compare resting-state functional brain activity in 15 healthy volunteers after intravenous infusion of placebo and psilocybin—the main psychoactive component of magic mushrooms. The results show that the homological structure of the brain's functional patterns undergoes a dramatic change post-psilocybin, characterized by the appearance of many transient structures of low stability and of a small number of persistent ones that are not observed in the case of placebo.
1. Motivation
The understanding of global brain organization and its large-scale integration remains a challenge for modern neurosciences. Network theory is an elegant framework to approach these questions, thanks to its simplicity and versatility [1]. Indeed, in recent years, networks have become a prominent tool to analyse and understand neuroimaging data coming from very diverse sources, such as functional magnetic resonance imaging (fMRI), electroencephalography and magnetoencephalography [2,3], also showing potential for clinical applications [4,5].A natural way of approaching these datasets is to devise a measure of dynamical similarity between the microscopic constituents and interpret it as the strength of the link between those elements. In the case of brain functional activity, this often implies the use of similarity measures such as (partial) correlations or coherence [6–8], which generally yield fully connected, weighted and possibly signed adjacency matrices. Despite the fact that most network metrics can be extended to the weighted case [9–13], the combined effect of complete connectedness and edge weights makes the interpretation of functional networks significantly harder and motivates the widespread use of ad hoc thresholding methods [7,14–18]. However, neglecting weak links incurs the dangers of a trade-off between information completeness and clarity. In fact, it risks overlooking the role that weak links might have, as shown for example in the cases of resting-state dynamics [19,20], cognitive control [21] and correlated network states [22].In order to overcome these limits, Rubinov & Sporn [13,23,24] recently introduced a set of generalized network and community metrics for functional networks that among others were used to uncover the contrasting dynamics underlying recollection [25] and the physiology of functional hubs [26].In this paper, we present an alternative route to the analysis of brain functional networks. We focus on the combined structure of connections and weights as captured by the homology of the network. A summary of all the keywords and concepts introduced in this paper can be found in table 1.2. From networks to topological spaces and homology
Homology is a topological invariant that characterizes a topological space X by counting its holes and their dimensions. By hole, we mean a hollow region bounded by the parts of that space. The dimension of a hole is directly related to the dimension of its boundary. The boundary of a two-dimensional hole is a one-dimensional loop; the three-dimensional inner part of a doughnut, where the filling goes, is bounded by two-dimensional surface; for dimensions higher than 2, it becomes difficult to have a mental representation of a hole, but k-dimensional holes are still bounded by (k − 1) dimensional faces. In our work, we start with a network and from it construct a topological space. We now use figure 1 to show how we proceed and make rigorous what we mean by boundaries and holes.In a network like that of figure 1a, we want the ring of nodes (a,b,c,d) to be a good candidate for a one-dimensional boundary, whereas the other rings of three nodes should not constitute interesting holes. The reason for this choice comes from the formalization of the notion of hole. One way to formalize this is by opposition that is we define what we mean by a dense subnetwork in order to highlight regions of reduced connectivity, i.e. holes. The most natural and conservative definition we can adopt for a dense subnetwork is that of clique, a completely connected subgraph [27]. Moreover, cliques have the crucial property, which will be important later, of being nested, i.e. a clique of dimension k (k-clique) contains all the m-cliques defined by its nodes with m < k. Using this definition and filling in all the maximal cliques, the network in figure 1a can be represented as in figure 1b: 3-cliques are filled in, becoming tiles, and the only interesting structure left is the square (a,b,c,d). It is important at this point to note that a k-clique can be seen as a k − 1 simplex, i.e. as the convex hull of k-points. Our representation of a network can thus be seen as a topological space formed by a finite set of simplices that by construction satisfy the condition that defines the type of topological spaces called abstract simplicial complexes [28]: each element of the space is a simplex, and each of its faces (or subset in the case of cliques) is also a simplex.This condition is satisfied, because each clique is a simplex, and subsets of cliques are cliques themselves, and the intersection of two cliques is still a clique.The situation with weighted networks becomes more complicated. In the context of a weighted network, the holes can be thought of as representing regions of reduced connectivity with respect to the surrounding structure.Consider, for example, the case depicted in figure 2a: the network is almost the same as figure 1 with the two exceptions that it now has weighted edges and has an additional very weak edge between nodes a and c. The edges in the cycle [a,b,c,d] are all much stronger than the link (a,c) that closes the hole by making (a,b,d) and (b,c,d) cliques and therefore fills them. The loop (e,f,g,h,i) has a similar situation, but the difference in edge weights between the links along the cycle and those crossing, is not as large as in the previous case. It would be therefore useful to be able to generalize the approach exposed earlier for binary networks to the case of weighted networks in such a way as to be able to measure the difference between the two cases (a,b,c,d) and (e,f,g,h,i). As shown by figure 2b, this problem can be intuitively thought of as a stratigraphy in the link-weight fabric of the network, where the aim is to detect the holes, measure their depth and when they appear as we scan across the weights' range.From figure 2b, it becomes clear that the added value of this method over conventional network techniques lies in its capability to describe mesoscopic patterns that coexist over different intensity scales, and hence to complement the information about the community structure of brain functional networks. A way to quantify the relevance of holes is given by persistent homology. We describe it and its application to the case of weighted networks in full detail in §3.3. A persistent homology of weighted networks
The method that we adopt was introduced in references [29,30] and relies on an extension of the metrical persistent homology theory originally introduced by references [31,32]. Technical details about the theory of persistent homology and how the computation is performed can be found in the works of Carlsson, Zomorodian and Edelsbrunner [28,31–35]. Persistent homology is a recent technique in computational topology developed for shape recognition and the analysis of high dimensional datasets [36,37]. It has been used in very diverse fields, ranging from biology [38,39] and sensor network coverage [40] to cosmology [41]. Similar approaches to brain data [42,43], collaboration data [44] and network structure [45] also exist. The central idea is the construction of a sequence of successive approximations of the original dataset seen as a topological space X. This sequence of topological spaces X0, X1, … , XN = X is such that whenever i < j and is called the filtration. Choosing how to construct a filtration from the data is equivalent to choosing the type of goggles one wears to analyse the data.In our case, we sort the edge weights in descending order and use the ranks as indices for the subspaces. More specifically, denote by the functional network with vertices V, edges E and weights . We then consider the family of binary graphs Gω = (V, Eω), where an edge e ∈ E is also included in Gω if its weight ωe is larger than ω ().To each of the Gω, we associate its clique, or flag complex Kω, that is the simplicial complex that contains the k-simplex [n0, n1, n2, … nk − 1] whenever the nodes n0, n1, n2, … nk −1 define a clique in Gω [27]. As subsets of cliques and intersections of cliques are cliques themselves, as we pointed out in §2, our clique complex is thus a particular case of a simplicial complex.The family of complexes {Kω} defines a filtration, because we have for ω > ω′. At each step, the simplices in Kω inherit their configuration from the underlying network structure and, because the filtration swipes across all weight scales in descending order, the holes among these units constitute mesoscopic regions of reduced functional connectivity.Moreover, this approach also highlights how network properties evolve along the filtration, providing insights about where and when lower connectivity regions emerge. This information is available, because it is possible to keep track of each k-dimensional cycle in the homology group Hk. A generator uniquely identifies a hole by its constituting elements at each step of the filtration process. The importance of a hole is encoded in the form of 'time-stamps' recording its birth βg and death δg along the filtration {Kω} [31]. These two time-stamps can be combined to define the persistence πg = δg − βg of a hole, which gives a notion of its importance in terms of it lifespan. Continuing the analogy with stratigraphy, βg and δg correspond, respectively, to the top and the bottom of a hole and πg would be its depth. As we said above, a generator , or hole, of the kth homology group Hk is identified by its birth and death along the filtration. Therefore, is described by the point . A standard way to summarize the information about the whole kth persistent homology group is then to consider the diagram obtained plotting the points corresponding to the set of generators. The (multi)set {(βg,δg} is called the persistence diagram of Hk. In figure 2c, we show the persistence diagram for the network shown in figure 2a for H1. Axes are labelled by weights in decreasing order. It is easy to check that the coordinates correspond exactly to the appearance and disappearance of generators. The green vertical bars highlight the persistence of a generator along the filtration. The further a point is from the diagonal (vertically), the more persistent the generator is. In §4, we introduce two objects, the persistence and the frequency homological scaffolds, designed to summarize the topological information about the system.4. Homological scaffolds
Once one has calculated the generators of the kth persistent homology group Hk, the corresponding persistence diagram contains a wealth of information that can be used, for example, to highlight differences between two datasets. It would be instructive to obtain a synthetic description of the uncovered topological features in order to interpret the observed differences in terms of the microscopic components, at least for low dimensions k. Here, we present a scheme to obtain such a description by using the information associated with the generators during the filtration process. As each generator, is associated with a whole equivalence class, rather than to a single chain of simplices, we need to choose a representative for each class, we use the representative that is returned by the javaplex implementation [46] of the persistent homology algorithm [47]. For the sake of simplicity in the following, we use the same symbol to refer to a generator and its representative cycle.We exploit this to define two new objects, the persistence and the frequency homological scaffolds and of a graph G. The persistence homological scaffold is the network composed of all the cycle paths corresponding to generators weighted by their persistence. If an edge e belongs to multiple cycles g0,g1, … ,gs, its weight is defined as the sum of the generators' persistence:4.1Similarly, we define the frequency homological scaffold as the network composed of all the cycle paths corresponding to generators, where this time, an edge e is weighted by the number of different cycles it belongs to4.2where is the indicator function for the set of edges composing gi. By definition, the two scaffolds have the same edge set, although differently weighted.The construction of these two scaffolds therefore highlights the role of links which are part of many and/or long persistence cycles, isolating the different roles of edges within the functional connectivity network. The persistence scaffolds encodes the overall persistence of a link through the filtration process: the weight in the persistence scaffold of a link belonging to a certain set of generators is equal to the sum of the persistence of those cycles. The frequency scaffold instead highlights the number of cycles to which a link belongs, thus giving another measure of the importance of that edge during the filtration. The combined information given by the two scaffolds then enables us to decipher the nature of the role different links have regarding the homological properties of the system. A large total persistence for a link in the persistence scaffold implies that the local structure around that link is very weak when compared with the weight of the link, highlighting the link as a locally strong bridge. We remark that the definition of scaffolds we gave depends on the choice of a specific basis of the homology group, and the choice of a consistent basis is an open problem in itself, therefore the scaffolds are not topological invariants. Moreover, it is possible for an edge to be added to a cycle shortly after the cycle's birth in such a way that it creates a triangle with the two edges composing the cycle. In this way, the new edge would be part of the shortest cycle, but the scaffold persistence value would be misattributed to the two other edges. This can be checked, for example, by monitoring the clustering coefficient of the cycle's subgraph as edges are added to it. We checked for this effect and found that in over 80% of the cases the edges do not create triangles that would imply the error, but instead new cycles are created, whose contribution to the scaffold is then accounted for by the new cycle. Finally, we note also that, when a new triangle inside the cycle is created, the two choices of generator differ for a path through a third strongly connected node, owing to the properties of boundary operators. Despite this ambiguity, we show in the following that they can be useful to gain an understanding of what the topological differences detected by the persistent homology actually mean in terms of the system under study.5. Results from fMRI networks
We start from the processed fMRI time series (see Methods for details). The linear correlations between regional time series were calculated after covarying out the variance owing to all other regions and the residual motion variance represented by the 24 rigid motion parameters obtained from the pre-processing, yielding a partial-correlation matrix χα for each subject. The matrices χα were then analysed with the algorithm described in the previous sections. We calculated the generators of the first homological group H1 along the filtration. As mentioned before, each of these generators identifies a lack of mesoscopic connectivity in the form of a one-dimensional cycle and can be represented in a persistence diagram. We aggregate together the persistence diagrams of subjects belonging to each group and compute an associated persistence probability density (figure 3). These probability density functions constitute the statistical signature of the groups' H1 features.We find that, although the number of cycles in the groups are comparable, the two probability densities strongly differ (Kolmogorov–Smirnov statistics: 0.22, p-value less than 10−10).The placebo group displays generators appearing and persisting over a limited interval of the filtration. On the contrary, most of the generators for the psilocybin group are situated in a well-defined peak at small birth indices, indicating a shorter average cycle persistence. However, the psilocybin distribution is also endowed with a longer tail implying the existence of a few cycles that are longer-lived compared with the placebo condition and that influences the weight distribution of the psilocybin persistence scaffold. The difference in behaviour of the two groups is made explicit when looking at the probability distribution functions for the persistence and the birth of generators (figure 4), which are both found to be significantly different (Kolmogorov–Smirnov statistics: 0.13, p-value < 10−30 for persistence and Kolmogorov–Smirnov statistics: 0.14, p-value < 10−35 for births). In order to better interpret and understand the differences between the two groups, we use the two secondary networks described in §4, and for the placebo group and and for the psilocybin group. The weight of the edges in these secondary networks is proportional to the total number of cycles an edge is part of, and the total persistence of those cycles, respectively. They complement the information given by the persistence density distribution, where the focus is on the entire cycle's behaviour, with information on single links. In fact, individual edges belonging to many and long persistence cycles represent functionally stable 'hub' links. As with the persistence density distribution, the scaffolds are obtained at a group level by aggregating the information about all subjects in each group. These networks are slightly sparser than the original complete χα networks5.1and 5.2and have comparable densities. A first difference between the two groups becomes evident when we look at the distributions for the edge weights (figure 5a). In particular, the weights of display a cut-off for large weights, whereas the weights of have a broader tail (Kolmogorov–Smirnov statistics: 0.06, p-value < 10−20; figure 5a). Interestingly, the frequency scaffold weights probability density functions cannot be distinguished from each other figure 5a (inset) (Kolmogorov–Smirnov statistics: 0.008, p-value = 0.72). Taken together, these two results imply that while edges statistically belong to the same number of cycles, in the psilocybin scaffold, there exist very strong, persistent links.The difference between the two sets of homological scaffolds for the two groups becomes even more evident when one compares the weights between the frequency and persistence scaffolds of the same group. Figure 5b is a scatter plot of between the weights of edges from both scaffolds for the two groups. The placebo group has a linear relationship between the two quantities meaning that edges that are persistent also belongs to many cycles (R2 = 0.95, slope = 0.23). Although the linear relationship is still a reasonable fit for the psilocybin group (R2 = 0.9, slope = 0.3), the data in this case display a larger dispersion. In particular, it shows that edges in can be much more persistent/longer-lived than in but still appear in the same number of cycles, i.e. the frequency of a link is not predictive of its persistence or simply put: some connections are much more persistent in the psychedelic state. Moreover, the slopes of linear fits of the two clouds are statistically different (p-value < 10−20, npla = 13 200 and npsi = 13 275 [48]) pointing to a starkly different local functional structure in the two conditions.The results from the persistent homology analysis and the insights provided by the homological scaffolds imply that although the mesoscopic structures, i.e. cycles, in the psilocybin condition are less stable than in the placebo group, their constituent edges are more stable.6. Discussion
In this paper, we first described a variation of persistent homology that allows us to deal with weighted and signed networks. We then introduced two new objects, the homological scaffolds, to go beyond the picture given by persistent homology to represent and summarize information about individual links. The homological scaffolds represent a new measure of topological importance of edges in the original system in terms of how frequently they are part of the generators of the persistent homology groups and how persistent are the generators to which they belong to. We applied this method to an fMRI dataset comprising a group of subjects injected with a placebo and another injected with psilocybin.By focusing on the second homology group H1, we found that the stability of mesoscopic association cycles is reduced by the action of psilocybin, as shown by the difference in the probability density function of the generators of H1 (figure 3).It is here that the importance of the insight given by the homological scaffolds in the persistent homology procedure becomes apparent. A simple reading of this result would be that the effect of psilocybin is to relax the constraints on brain function, ascribing cognition a more flexible quality, but when looking at the edge level, the picture becomes more complex. The analysis of the homological scaffolds reveals the existence of a set of edges that are predominant in terms of their persistence although they are statistically part of the same number of cycles in the two conditions (figure 5). In other words, these functional connections support cycles that are especially stable and are only present in the psychedelic state. This further implies that the brain does not simply become a random system after psilocybin injection, but instead retains some organizational features, albeit different from the normal state, as suggested by the first part of the analysis. Further work is required to identify the exact functional significance of these edges. Nonetheless, it is interesting to look at the community structure of the persistence homological scaffolds in figure 6. The two pictures are simplified cartoons of the placebo (figure 6a) and psilocybin (figure 6b) scaffolds. In figure 6a,b, the nodes are organized and coloured according to their community membership in the placebo scaffold (obtained with the Louvain algorithm for maximal modularity and resolution 1 [50]). This is done in order to highlight the striking difference in connectivity structure in the two cases. When considering the edges in the tail of the distribution, weight greater than or equal to 80, in figure 5a, only 29 of the 374 edges present in the truncated psilocybin scaffold are shared with the truncated placebo scaffold (165 edges). Of these 374 edges, 217 are between placebo communities and are observed to mostly connect cortical regions. This supports our idea that psilocybin disrupts the normal organization of the brain with the emergence of strong, topologically long-range functional connections that are not present in a normal state.
Figure 6. Simplified visualization of the persistence homological scaffolds. The persistence homological scaffolds (a) and (b) are shown for comparison. For ease of visualization, only the links heavier than 80 (the weight at which the distributions in figure 5a bifurcate) are shown. This value is slightly smaller than the bifurcation point of the weights distributions in figure 5a. In both networks, colours represent communities obtained by modularity [49] optimization on the placebo persistence scaffold using the Louvain method [50] and are used to show the departure of the psilocybin connectivity structure from the placebo baseline. The width of the links is proportional to their weight and the size of the nodes is proportional to their strength. Note that the proportion of heavy links between communities is much higher (and very different) in the psilocybin group, suggesting greater integration. A labelled version of the two scaffolds is available as GEXF graph files as the electronic supplementary material. (Online version in colour.)The two key results of the analysis of the homological scaffolds can therefore be summarized as follows (i) there is an increased integration between cortical regions in the psilocybin state and (ii) this integration is supported by a persistent scaffold of a set of edges that support cross modular connectivity probably as a result of the stimulation of the 5HT2A receptors in the cortex [51].We can speculate on the implications of such an organization. One possible by-product of this greater communication across the whole brain is the phenomenon of synaesthesia which is often reported in conjunction with the psychedelic state. Synaesthesia is described as an inducer-concurrent pairing, where the inducer could be a grapheme or a visual stimulus that generates a secondary sensory output—like a colour for example. Drug-induced synaesthesia often leads to chain of associations, pointing to dynamic causes rather than fixed structural ones as may be the case for acquired synaesthesia [52]. Broadly consistent with this, it has been reported that subjects under the influence of psilocybin have objectively worse colour perception performance despite subjectively intensified colour experience [53].To summarize, we presented a new method to analyse fully connected, weighted and signed networks and applied it to a unique fMRI dataset of subjects under the influence of mushrooms. We find that the psychedelic state is associated with a less constrained and more intercommunicative mode of brain function, which is consistent with descriptions of the nature of consciousness in the psychedelic state.7. Methods
7.1. DatasetA pharmacological MRI dataset of 15 healthy controls was used for a proof-of-principle test of the methodology [54]. Each subject was scanned on two separate occasions, 14 days apart. Each scan consisted of a structural MRI image (T1-weighted), followed by a 12 min eyes-close resting-state blood oxygen-level-dependent (BOLD) fMRI scan which lasted for 12 min. Placebo (10 ml saline, intravenous injection) was given on one occasion and psilocybin (2 mg dissolved in 10 ml saline) on the other. Injections were given manually by a study doctor situated within the scanning suite. Injections began exactly 6 min after the start of the 12-min scans, and continued for 60 s.7.1.1. Scanning parameters
The BOLD fMRI data were acquired using standard gradient-echo EPI sequences, reported in detail in reference [54]. The volume repetition time was 3000 ms, resulting in a total of 240 volumes acquired during each 12 min resting-state scan (120 pre- and 120 post-injection of placebo/psilocybin).7.1.2. Image pre-processing
fMRI images were corrected for subject motion within individual resting-state acquisitions, by registering all volumes of the functional data to the middle volume of the acquisition using the FMRIB linear registration motion correction tool, generating a six-dimension parameter time course [55]. Recent work demonstrates that the six parameter motion model is insufficient to correct for motion-induced artefact within functional data, instead a Volterra expansion of these parameters to form a 24 parameter model is favoured as a trade-off between artefact correction and lost degrees of freedom as a result of regressing motion away from functional time courses [56]. fMRI data were pre-processed according to standard protocols using a high-pass filter with a cut-off of 300 s.
Structural MRI images were segmented into n = 194 cortical and subcortical regions, including white matter cerebrospinal fluid (CSF) compartments, using Freesurfer (http://surfer.nmr.mgh.harvard.edu/), according to the Destrieux anatomical atlas [57]. In order to extract mean-functional time courses from the BOLD fMRI, segmented T1 images were registered to the middle volume of the motion-corrected fMRI data, using boundary-based registration [58], once in functional space mean time-courses were extracted for each of the n = 194 regions in native fMRI space.7.1.3. Functional connectivity
For each of the 194 regions, alongside the 24 parameter motion model time courses, partial correlations were calculated between all couples of time courses (i,j), non-neural time courses (CSF, white matter and motion) were discarded from the resulting functional connectivity matrices, resulting in a 169 region cortical/subcortical functional connectivity corrected for motion and additional non-neural signals (white matter/CSF).
7.2. Persistent homology computationFor each subject in the two groups, we have a set of persistence diagrams relative to the persistent homology groups Hn. In this paper, we use the H1 persistence diagrams of each group to construct the corresponding persistence probability densities for H1 cycles.Filtrations were obtained from the raw partial-correlation matrices through the Python package Holes and fed to javaplex [46] via a Jython subroutine in order to extract the persistence intervals and the representative cycles. The details of the implementation can be found in reference [30], and the software is available at Holes [59].Funding statement
G.P. and F.V. are supported by the TOPDRIM project supported by the Future and Emerging Technologies programme of the European Commission under Contract IST-318121. I.D. P.E. and F.T. are supported by a PET methodology programme grant from the Medical Research Council UK (ref no. G1100809/1). The authors acknowledge support of Amanda Feilding and the Beckley Foundation and the anonymous referees for their critical and constructive contribution to this paper.© 2014 The Authors. Published by the Royal Society under the terms of the Creative Commons Attribution License http://creativecommons.org/licenses/by/4.0/, which permits unrestricted use, provided the original author and source are credited.References at the Journal of the Royal Society Interface site


text:
Now I'm not adding my opinion to the bandwagon of press reviews flying around the place and I'm not even saying that you might feel jealousy pangs knowing that the wardrobe for the movie reportedly cost $10 million!!! (Carrie alone has over 40 costume changes and SJP even gets to keep most of her outfits).
I don't even think it'll hurt too much to know that in these tough economic times (when most of us are pinchin' the pennies rather than treating ourselves) that in one single outfit, during the karaoke scene, Carrie's mix of Vintage Chanel and The Blonds cost a whopping $50,000!
|SATC 2 Fashionistas From L-R, Miranda wears Vintage Halston, Carrie wears vintage Chanel over jeans by The Blonds, Samantha wears The Blonds & Charlotte wears vintage Yves Saint Laurent.
Keen SATC followers will remember episode 59 of series 4 where Samantha used the name of her client Lucy Liu just to get on the infinitely long waiting list for the, (and I quote - ahem): "It's not a bag, it's a f****ing Birkin!"
But, despite this piece of fashion sacrilege, the clothes continue to be the fifth character, just as in the TV series.
The reason why the outfits continue to receive such undivided attention is legendary stylist Patricia Field's unique vision and green-monster-inducing personal collection. The heap of items that she has picked up over the years and miles appear regularly in the film.
|SATC 2 Stylist Patricia Field.
This opened a whole new range of possibilities for the SATC 2 Stylist, who was able to bring in huge wide-brimmed hats, fascinators and vintage Chanel silk scarves and boasts "Lighting and camera just had to deal with it!"
|SATC 2 Carrie wears Mykita Franz sunglasses, Solange Azugary-Partridge gemstone necklace, white Halston Heritage v-neck dress, Christian Leboutin heels and Gold Chanel clutch bag.
|SATC 2 Carrie wears blue pleated dress by Halston Heritage, Jee Vice sunglasses, cerise pink bag and gold Mary-Janes by Christian Leboutin.
|SATC 2 Fashionistas From L-R, Miranda wears Bottega Veneta knee-length dress and Kara Ross Amo lizard clutch in honey, Samantha holds a VBH palm clutch worth $1,300 and Charlotte embraces the color-blocking trend with Christian Dior pink suit and leather bag.
So…With all those clutches, totes, vintage luggage pieces, silk scarves and sun hats featured in the movie, I can tell you it'd be near-on impossible to analyze each and every one of 'em.
But, from the laid-back, utilitarian chic of Carrie's simple embroidered cotton tote by Shelley Steefee that she carries when taking a walk with Miranda, to Samantha's VBH clutch that she teams with a stunning black body-con dress in the wedding gift-list scene (pictured above), it's easy to say that if you want to copy any of the styles featured in the movie, you'll need a budget as big as a Birkin!
Thanks so much for inviting me to be a guest blogger on the Chic Alert, Sally.
Pauline Goodman
Mamma Figlia

subset: commoncrawl


text:
Editor's Note: Benjamin Habib is a Lecturer in Politics and International Relations at La Trobe University, Melbourne, Australia. Habib is an internationally published scholar with research and teaching interests including the political economy of North Korea's nuclear program, East Asian security, international politics of climate change.
Story highlights
Report: North Korea launches long-range rocket Wednesday
Habib: Timing of North Korean regime rocket launch is out of ordinary
Habib: Successful launch would be sterling commemoration of Kim Jong Il's death
The curious timing of North Korea's Unha-3 rocket launch, outside of its usual spring-summer launch window, raises questions about the political motivations behind Pyongyang's attention-grabbing move.
On Wednesday morning, just before 10 a.m. local time, South Korean news agency Yonhap and the Japanese government reported that the rocket had been launched. It came just days after North Korea extended the launch window due to technical issues.
Read more: North Korea rocket breaks up in flight
Taking heed of launch and the usual caveats about reading North Korean government behavior, we can discern three motives underlying Pyongyang's latest move: international bargaining, domestic legitimacy and strategic leverage.
This year, Northeast Asia is experiencing a unique convergence of elections and leadership transitions in the United States, China, Japan and South Korea. This follows the change of leadership in North Korea in December 2011.
Read more: Photos of North Korea's newest rocket
With Barack Obama's re-election in Washington and Xi Jinping named as the new Chinese President, the region awaits the outcomes of the Japanese election on December 16 and the South Korean presidential poll on December 19. Proliferation-related negotiating activity is on hold, leaving a diplomatic vacuum until the new governments are settled.
While North Korea appears to have no intention of relinquishing its nuclear or missile capabilities, its habitual tactic of engineering crises to leverage aid from the international community in exchange for de-escalation or proliferation freeze agreements is predicated on negotiations actually taking place.
Read more: The limits of North Korea's media openness
External aid fills gaps in the domestic economy and satisfies vital needs such as food and energy that the regime cannot provide for indigenously. The gambit fails if there are no negotiations.
A December rocket launch sends a strong signal from Pyongyang to its regional interlocutors to ensure that North Korea does not get overlooked amid the bureaucratic maelstrom that usually follows changes in government.
It will test the resolve of the new leadership teams and yield clues as to how they are likely to react individually and coordinate together in relation to North Korea in future.
Read more: One week in North Korea
Whichever candidate wins the election in Seoul is likely to move away from Lee Myung-bak's disastrous "reciprocity" policy toward greater engagement with Pyongyang. Japan is likely to adopt a more hawkish approach to North Korea if the Liberal Democratic Party wins the election, as polls currently suggest. How North Korea fits within the Sino-American relationship will also be of interest to Pyongyang, with Xi Jinping and his new Politburo Standing Committee at the helm in Beijing.
A successful rocket launch would also represent a sterling commemoration of the first anniversary of Kim Jong Il's death on December 17, much as the unsuccessful April launch was intended for propaganda purposes as a celebration of Kim Il Sung's centenary.
By demonstrating technological prowess, it would legitimize the regime's "strong and prosperous country" rhetoric and bestow prestige on North Korea's young new ruler, Kim Jong Un.
Similarly, Washington's prickly reactions to Pyongyang's provocations play into the Kim regime's anti-imperialist ideology, the staple of its propaganda output.
Read more: Witness to the cult of North Korea's Kim dynasty
Kim Jong Un's domestic legitimacy will grow if Pyongyang proceeds with tentative and embryonic economic reforms hinted at during the past year – the 6.28 policy –in North Korea's agricultural sector.
Any economic reform program in North Korea risks creating new socio-economic cleavages – grassroots entrepreneurialism and linkages to the global economy could foster powerful domestic actors who may develop interests that differ to those of the ruling regime.
For Kim Jong Un, legitimacy and prestige will be paramount if his government chooses to walk the path of economic adjustments.
One should also not discount the strategic motivations for the timing of the launch. In the past year South Korea has announced its deployment of cruise missiles with a range of 1,000 kilometers, capable of hitting targets anywhere in North Korea, along with tactical ballistic missiles and drones with a range of 300 kilometers.
It's no stretch to interpret North Korea's rocket launch in terms of a classic arms race, as a missile test in response to its adversary's upgraded missile systems.
The demonstration of a viable long-range rocket will add another piece to North Korea's nuclear deterrence posture. Pyongyang has yet to master long-range, multi-stage missile technology, despite a long developmental phase punctuated by a number of unsuccessful tests.
A successful launch may herald a movement from the developmental phase of the long-range missile program closer to deployment. This would increase Pyongyang's strategic and diplomatic leverage in relation to its northeast Asian neighbors and its ability to use this event as a bargaining chip to extract further aid from the international community.
Foreign policy decisions are generally arise from a mixture of motivations.
The unique confluence of leadership transitions across the region in late 2012 coincides with a North Korean state at an interesting point in its evolution.
North Korea's rocket launch suggests important clues about the manner in which Kim Jong Un and his government are attempting to navigate the swirling regional, strategic and domestic currents.


text:
secret objects let you store and manage sensitive information, such
as passwords, OAuth tokens, and ssh keys. Putting this information in a
is safer and more flexible than putting it verbatim in a
Pod LifecycleA high-level summary of what phase the Pod is in within its lifecyle.
definition or in a container imageStored instance of a container that holds a set of software needed to run an application.
. See Secrets design document for more information.
A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. Such information might otherwise be put in a Pod specification or in an image; putting it in a Secret object allows for more control over how it is used, and reduces the risk of accidental exposure.
Users can create secrets, and the system also creates some secrets.
To use a secret, a pod needs to reference the secret. A secret can be used with a pod in two ways: as files in a volumeA directory containing data, accessible to the containers in a pod. mounted on one or more of its containers, or used by kubelet when pulling images for the pod.
Kubernetes automatically creates secrets which contain credentials for accessing the API and it automatically modifies your pods to use this type of secret.
The automatic creation and use of API credentials can be disabled or overridden if desired. However, if all you need to do is securely access the apiserver, this is the recommended workflow.
See the Service Account documentation for more information on how Service Accounts work.
Say that some pods need to access a database. The
username and password that the pods should use is in the files
./username.txt and
./password.txt on your local machine.
# Create files needed for rest of example.
echo -n 'admin' > ./username.txt
echo -n '1f2d1e2e67df' > ./password.txt
kubectl create secret command
packages these files into a Secret and creates
the object on the Apiserver.
kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt
secret "db-user-pass" created
Note: Special characters such as
\*, and
!require escaping. If the password you are using has special characters, you need to escape them using the
\\character. For example, if your actual password is
S!B\*d$zDsb, you should execute the command this way: kubectl create secret generic dev-db-secret –from-literal=username=devuser –from-literal=password=S\!B\*d\$zDsb
You do not need to escape special characters in passwords from files (
You can check that the secret was created like this:
kubectl get secrets
db-user-pass Opaque 2 51s
kubectl describe secrets/db-user-pass
Name: db-user-pass
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
password.txt: 12 bytes
username.txt: 5 bytes
kubectl getand
kubectl describeavoid showing the contents of a secret by default. This is to protect the secret from being exposed accidentally to an onlooker, or from being stored in a terminal log.
See decoding a secret for how to see the contents of a secret.
You can also create a Secret in a file first, in json or yaml format, and then create that object. The Secret contains two maps: data and stringData. The data field is used to store arbitrary data, encoded using base64. The stringData field is provided for convenience, and allows you to provide secret data as unencoded strings.
For example, to store two strings in a Secret using the data field, convert them to base64 as follows:
echo -n 'admin' | base64
echo -n '1f2d1e2e67df' | base64
Write a Secret that looks like this:
apiVersion: v1
kind: Secret
name: mysecret
type: Opaque
username: YWRtaW4=
password: MWYyZDFlMmU2N2Rm
Now create the Secret using
kubectl apply:
kubectl apply -f ./secret.yaml
secret "mysecret" created
For certain scenarios, you may wish to use the stringData field instead. This field allows you to put a non-base64 encoded string directly into the Secret, and the string will be encoded for you when the Secret is created or updated.
A practical example of this might be where you are deploying an application that uses a Secret to store a configuration file, and you want to populate parts of that configuration file during your deployment process.
If your application uses the following configuration file:
apiUrl: "https://my.api.com/api/v1"
username: "user"
password: "password"
You could store this in a Secret using the following:
apiVersion: v1
kind: Secret
name: mysecret
type: Opaque
config.yaml: |-
apiUrl: "https://my.api.com/api/v1"
username: {{username}}
password: {{password}}
Your deployment tool could then replace the
{{username}} and
template variables before running
kubectl apply.
stringData is a write-only convenience field. It is never output when retrieving Secrets. For example, if you run the following command:
kubectl get secret mysecret -o yaml
The output will be similar to:
apiVersion: v1
config.yaml: YXBpVXJsOiAiaHR0cHM6Ly9teS5hcGkuY29tL2FwaS92MSIKdXNlcm5hbWU6IHt7dXNlcm5hbWV9fQpwYXNzd29yZDoge3twYXNzd29yZH19
kind: Secret
creationTimestamp: 2018-11-15T20:40:59Z
name: mysecret
namespace: default
resourceVersion: "7225"
selfLink: /api/v1/namespaces/default/secrets/mysecret
uid: c280ad2e-e916-11e8-98f2-025000000001
type: Opaque
If a field is specified in both data and stringData, the value from stringData is used. For example, the following Secret definition:
apiVersion: v1
kind: Secret
name: mysecret
type: Opaque
username: YWRtaW4=
username: administrator
Results in the following secret:
apiVersion: v1
username: YWRtaW5pc3RyYXRvcg==
kind: Secret
creationTimestamp: 2018-11-15T20:46:46Z
name: mysecret
namespace: default
resourceVersion: "7579"
selfLink: /api/v1/namespaces/default/secrets/mysecret
uid: 91460ecb-e917-11e8-98f2-025000000001
type: Opaque
YWRtaW5pc3RyYXRvcg== decodes to
The keys of data and stringData must consist of alphanumeric characters, '-', '_' or '.'.
Encoding Note: The serialized JSON and YAML values of secret data are
encoded as base64 strings. Newlines are not valid within these strings and must
be omitted. When using the
base64 utility on Darwin/macOS users should avoid
using the
-b option to split long lines. Conversely Linux users should add
the option
-w 0 to
base64 commands or the pipeline
base64 | tr -d '\n' if
-w option is not available.
Kubectl supports managing objects using Kustomize
since 1.14. With this new feature,
you can also create a Secret from generators and then apply it to create the object on
the Apiserver. The generators
should be specified in a
kustomization.yaml inside a directory.
For example, to generate a Secret from files
./username.txt and
# Create a kustomization.yaml file with SecretGenerator
cat <<EOF >./kustomization.yaml
- name: db-user-pass
- username.txt
- password.txt
Apply the kustomization directory to create the Secret object.
$ kubectl apply -k .
secret/db-user-pass-96mffmfh4k created
You can check that the secret was created like this:
$ kubectl get secrets
db-user-pass-96mffmfh4k Opaque 2 51s
$ kubectl describe secrets/db-user-pass-96mffmfh4k
Name: db-user-pass
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
password.txt: 12 bytes
username.txt: 5 bytes
For example, to generate a Secret from literals
username=admin and
you can specify the secret generator in
kusotmization.yaml as
# Create a kustomization.yaml file with SecretGenerator
$ cat <<EOF >./kustomization.yaml
- name: db-user-pass
- username=admin
- password=secret
Apply the kustomization directory to create the Secret object.
$ kubectl apply -k .
secret/db-user-pass-dddghtt9b5 created
Note: The generated Secrets name has a suffix appended by hashing the contents. This ensures that a new Secret is generated each time the contents is modified.
Secrets can be retrieved via the
kubectl get secret command. For example, to retrieve the secret created in the previous section:
kubectl get secret mysecret -o yaml
apiVersion: v1
username: YWRtaW4=
password: MWYyZDFlMmU2N2Rm
kind: Secret
creationTimestamp: 2016-01-22T18:41:56Z
name: mysecret
namespace: default
resourceVersion: "164619"
selfLink: /api/v1/namespaces/default/secrets/mysecret
uid: cfee02d6-c137-11e5-8d73-42010af00002
type: Opaque
Decode the password field:
echo 'MWYyZDFlMmU2N2Rm' | base64 --decode
Secrets can be mounted as data volumes or be exposed as environment variablesContainer environment variables are name=value pairs that provide useful information into containers running in a Pod. to be used by a container in a pod. They can also be used by other parts of the system, without being directly exposed to the pod. For example, they can hold credentials that other parts of the system should use to interact with external systems on your behalf.
To consume a Secret in a volume in a Pod:
.spec.volumes[]. Name the volume anything, and have a
.spec.volumes[].secret.secretName field equal to the name of the secret object.
.spec.containers[].volumeMounts[] to each container that needs the secret. Specify
.spec.containers[].volumeMounts[].readOnly = true and
.spec.containers[].volumeMounts[].mountPath to an unused directory name where you would like the secrets to appear.
data map becomes the filename under
This is an example of a pod that mounts a secret in a volume:
apiVersion: v1
kind: Pod
name: mypod
- name: mypod
image: redis
- name: foo
mountPath: "/etc/foo"
readOnly: true
- name: foo
secretName: mysecret
Each secret you want to use needs to be referred to in
If there are multiple containers in the pod, then each container needs its
volumeMounts block, but only one
.spec.volumes is needed per secret.
You can package many files into one secret, or use many secrets, whichever is convenient.
Projection of secret keys to specific paths
We can also control the paths within the volume where Secret keys are projected.
You can use
.spec.volumes[].secret.items field to change target path of each key:
apiVersion: v1
kind: Pod
name: mypod
- name: mypod
image: redis
- name: foo
mountPath: "/etc/foo"
readOnly: true
- name: foo
secretName: mysecret
- key: username
path: my-group/my-username
What will happen:
username secret is stored under
/etc/foo/my-group/my-username file instead of
password secret is not projected
.spec.volumes[].secret.items is used, only keys specified in
items are projected.
To consume all keys from the secret, all of them must be listed in the
items field.
All listed keys must exist in the corresponding secret. Otherwise, the volume is not created.
Secret files permissions
You can also specify the permission mode bits files part of a secret will have.
If you don't specify any,
0644 is used by default. You can specify a default
mode for the whole secret volume and override per key if needed.
For example, you can specify a default mode like this:
apiVersion: v1
kind: Pod
name: mypod
- name: mypod
image: redis
- name: foo
mountPath: "/etc/foo"
- name: foo
secretName: mysecret
defaultMode: 256
Then, the secret will be mounted on
/etc/foo and all the files created by the
secret volume mount will have permission
Note that the JSON spec doesn't support octal notation, so use the value 256 for 0400 permissions. If you use yaml instead of json for the pod, you can use octal notation to specify permissions in a more natural way.
You can also use mapping, as in the previous example, and specify different permission for different files like this:
apiVersion: v1
kind: Pod
name: mypod
- name: mypod
image: redis
- name: foo
mountPath: "/etc/foo"
- name: foo
secretName: mysecret
- key: username
path: my-group/my-username
mode: 511
In this case, the file resulting in
/etc/foo/my-group/my-username will have
permission value of
0777. Owing to JSON limitations, you must specify the mode
in decimal notation.
Note that this permission value might be displayed in decimal notation if you read it later.
Consuming Secret Values from Volumes
Inside the container that mounts a secret volume, the secret keys appear as files and the secret values are base-64 decoded and stored inside these files. This is the result of commands executed inside the container from the example above:
ls /etc/foo/
cat /etc/foo/username
cat /etc/foo/password
The program in a container is responsible for reading the secrets from the files.
Mounted Secrets are updated automatically
When a secret being already consumed in a volume is updated, projected keys are eventually updated as well.
Kubelet is checking whether the mounted secret is fresh on every periodic sync.
However, it is using its local cache for getting the current value of the Secret.
The type of the cache is configurable using the (
ConfigMapAndSecretChangeDetectionStrategy field in
KubeletConfiguration struct).
It can be either propagated via watch (default), ttl-based, or simply redirecting
all requests to directly kube-apiserver.
As a result, the total delay from the moment when the Secret is updated to the moment
when new keys are projected to the Pod can be as long as kubelet sync period + cache
propagation delay, where cache propagation delay depends on the chosen cache type
(it equals to watch propagation delay, ttl of cache, or zero corespondingly).
Note: A container using a Secret as a subPath volume mount will not receive Secret updates.
To use a secret in an environment variableContainer environment variables are name=value pairs that provide useful information into containers running in a Pod. in a pod:
This is an example of a pod that uses secrets from environment variables:
apiVersion: v1
kind: Pod
name: secret-env-pod
- name: mycontainer
image: redis
- name: SECRET_USERNAME
name: mysecret
key: username
- name: SECRET_PASSWORD
name: mysecret
key: password
restartPolicy: Never
Consuming Secret Values from Environment Variables
Inside a container that consumes a secret in an environment variables, the secret keys appear as normal environment variables containing the base-64 decoded values of the secret data. This is the result of commands executed inside the container from the example above:
echo $SECRET_USERNAME
echo $SECRET_PASSWORD
An imagePullSecret is a way to pass a secret that contains a Docker (or other) image registry password to the Kubelet so it can pull a private image on behalf of your Pod.
Manually specifying an imagePullSecret
Use of imagePullSecrets is described in the images documentation
You can manually create an imagePullSecret, and reference it from a serviceAccount. Any pods created with that serviceAccount or that default to use that serviceAccount, will get their imagePullSecret field set to that of the service account. See Add ImagePullSecrets to a service account for a detailed explanation of that process.
Manually created secrets (e.g. one containing a token for accessing a github account) can be automatically attached to pods based on their service account. See Injecting Information into Pods Using a PodPreset for a detailed explanation of that process.
Secret volume sources are validated to ensure that the specified object
reference actually points to an object of type
Secret. Therefore, a secret
needs to be created before any pods that depend on it.
Secret API objects reside in a namespaceAn abstraction used by Kubernetes to support multiple virtual clusters on the same physical cluster. . They can only be referenced by pods in that same namespace.
Individual secrets are limited to 1MiB in size. This is to discourage creation of very large secrets which would exhaust apiserver and kubelet memory. However, creation of many smaller secrets could also exhaust memory. More comprehensive limits on memory usage due to secrets is a planned feature.
Kubelet only supports use of secrets for Pods it gets from the API server.
This includes any pods created using kubectl, or indirectly via a replication
controller. It does not include pods created via the kubelets
--manifest-url flag, its
--config flag, or its REST API (these are
not common ways to create pods.)
Secrets must be created before they are consumed in pods as environment variables unless they are marked as optional. References to Secrets that do not exist will prevent the pod from starting.
References via
secretKeyRef to keys that do not exist in a named Secret
will prevent the pod from starting.
Secrets used to populate environment variables via
envFrom that have keys
that are considered invalid environment variable names will have those keys
skipped. The pod will be allowed to start. There will be an event whose
reason is
InvalidVariableNames and the message will contain the list of
invalid keys that were skipped. The example shows a pod which refers to the
default/mysecret that contains 2 invalid keys, 1badkey and 2alsobad.
kubectl get events
0s 0s 1 dapi-test-pod Pod Warning InvalidEnvironmentVariableNames kubelet, 127.0.0.1 Keys [1badkey, 2alsobad] from the EnvFrom secret default/mysecret were skipped since they are considered invalid environment variable names.
When a pod is created via the API, there is no check whether a referenced secret exists. Once a pod is scheduled, the kubelet will try to fetch the secret value. If the secret cannot be fetched because it does not exist or because of a temporary lack of connection to the API server, kubelet will periodically retry. It will report an event about the pod explaining the reason it is not started yet. Once the secret is fetched, the kubelet will create and mount a volume containing it. None of the pod's containers will start until all the pod's volumes are mounted.
Create a kustomization.yaml with SecretGenerator containing some ssh keys:
$ cp /path/to/.ssh/id_rsa ./id_rsa
$ cp /path/to/.ssh/id_rsa.pub ./id_rsa.pub
$ cat <<EOF >./kustomization.yaml
- name: ssh-key-secret
- id_rsa
- id_rsa.pub
Create the SecretObject on Apiserver:
$ kubectl apply -k .
Caution: Think carefully before sending your own ssh keys: other users of the cluster may have access to the secret. Use a service account which you want to be accessible to all the users with whom you share the Kubernetes cluster, and can revoke if they are compromised.
Now we can create a pod which references the secret with the ssh key and consumes it in a volume:
kind: Pod
apiVersion: v1
name: secret-test-pod
name: secret-test
- name: secret-volume
secretName: ssh-key-secret
- name: ssh-test-container
image: mySshImage
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
When the container's command runs, the pieces of the key will be available in:
The container is then free to use the secret data to establish an ssh connection.
This example illustrates a pod which consumes a secret containing prod credentials and another pod which consumes a secret with test environment credentials.
Make the kustomization.yaml with SecretGenerator
cat <<EOF > kustomization.yaml
- name: prod-db-secret
- username=produser
- password=Y4nys7f11
- name: test-db-secret
- username=testuser
- password=iluvtests
Now make the pods:
$ cat <<EOF > pod.yaml
apiVersion: v1
kind: List
- kind: Pod
apiVersion: v1
name: prod-db-client-pod
name: prod-db-client
- name: secret-volume
secretName: prod-db-secret
- name: db-client-container
image: myClientImage
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
- kind: Pod
apiVersion: v1
name: test-db-client-pod
name: test-db-client
- name: secret-volume
secretName: test-db-secret
- name: db-client-container
image: myClientImage
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
Add the pods to the same kustomization.yaml
$ cat <<EOF >> kustomization.yaml
- pod.yaml
Apply all those objects on the Apiserver by
kubectl apply --k .
Both containers will have the following files present on their filesystems with the values for each container's environment:
Note how the specs for the two pods differ only in one field; this facilitates creating pods with different capabilities from a common pod config template.
You could further simplify the base pod specification by using two Service Accounts:
one called, say,
prod-user with the
prod-db-secret, and one called, say,
test-user with the
test-db-secret. Then, the pod spec can be shortened to, for example:
kind: Pod
apiVersion: v1
name: prod-db-client-pod
name: prod-db-client
serviceAccount: prod-db-client
- name: db-client-container
image: myClientImage
In order to make piece of data 'hidden' (i.e., in a file whose name begins with a dot character), simply make that key begin with a dot. For example, when the following secret is mounted into a volume:
kind: Secret
apiVersion: v1
name: dotfile-secret
.secret-file: dmFsdWUtMg0KDQo=
kind: Pod
apiVersion: v1
name: secret-dotfiles-pod
- name: secret-volume
secretName: dotfile-secret
- name: dotfile-test-container
image: k8s.gcr.io/busybox
- ls
- "-l"
- "/etc/secret-volume"
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
secret-volume will contain a single file, called
.secret-file, and
dotfile-test-container will have this file present at the path
Note: Files beginning with dot characters are hidden from the output of
ls -l; you must use
ls -lato see them when listing directory contents.
Consider a program that needs to handle HTTP requests, do some complex business logic, and then sign some messages with an HMAC. Because it has complex application logic, there might be an unnoticed remote file reading exploit in the server, which could expose the private key to an attacker.
This could be divided into two processes in two containers: a frontend container which handles user interaction and business logic, but which cannot see the private key; and a signer container that can see the private key, and responds to simple signing requests from the frontend (e.g. over localhost networking).
With this partitioned approach, an attacker now has to trick the application server into doing something rather arbitrary, which may be harder than getting it to read a file.
When deploying applications that interact with the secrets API, access should be limited using authorization policies such as RBAC.
Secrets often hold values that span a spectrum of importance, many of which can cause escalations within Kubernetes (e.g. service account tokens) and to external systems. Even if an individual app can reason about the power of the secrets it expects to interact with, other apps within the same namespace can render those assumptions invalid.
For these reasons
watch and
list requests for secrets within a namespace are
extremely powerful capabilities and should be avoided, since listing secrets allows
the clients to inspect the values of all secrets that are in that namespace. The ability to
watch and
list all secrets in a cluster should be reserved for only the most
privileged, system-level components.
Applications that need to access the secrets API should perform
get requests on
the secrets they need. This lets administrators restrict access to all secrets
while white-listing access to individual instances that
the app needs.
For improved performance over a looping
get, clients can design resources that
reference a secret then
watch the resource, re-requesting the secret when the
reference changes. Additionally, a "bulk watch" API
to let clients
watch individual resources has also been proposed, and will likely
be available in future releases of Kubernetes.
secret objects can be created independently of the
pods that use
them, there is less risk of the secret being exposed during the workflow of
creating, viewing, and editing pods. The system can also take additional
precautions with
secret objects, such as avoiding writing them to disk where
A secret is only sent to a node if a pod on that node requires it.
Kubelet stores the secret into a
tmpfs so that the secret is not written
to disk storage. Once the Pod that depends on the secret is deleted, kubelet
will delete its local copy of the secret data as well.
There may be secrets for several pods on the same node. However, only the secrets that a pod requests are potentially visible within its containers. Therefore, one Pod does not have access to the secrets of another Pod.
There may be several containers in a pod. However, each container in a pod has
to request the secret volume in its
volumeMounts for it to be visible within
the container. This can be used to construct useful security partitions at the
Pod level.
On most Kubernetes-project-maintained distributions, communication between user to the apiserver, and from apiserver to the kubelets, is protected by SSL/TLS. Secrets are protected when transmitted over these channels.
Kubernetes v1.13
You can enable encryption at rest for secret data, so that the secrets are not stored in the clear into etcdConsistent and highly-available key value store used as Kubernetes' backing store for all cluster data. .
Was this page helpful?
Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on Stack Overflow. Open an issue in the GitHub repo if you want to report a problem or suggest an improvement.


text:
Despicable Me 2 Teaser Gets Abducted By Aliens
Though you might not know it if you don't have young kids, Despicable Me and its cheerful, blobby yellow minions became huge hits when the movie opened in 2010, and the inevitable sequel is on its way for next summer. Taking advantage of Halloween, Universal has released a new teaser for the sequel with a distinctly spooky flair-- though it's hard to tell if the alien invasion hinted at here is actually part of the new film or just a Halloween peg. You can see it below, or visit Apple.com to see it in beautiful high-res.
It's interesting that, despite the fact that the minions are getting their own spinoff in 2014, they're front and center in this teaser-- with the Steve Carell-voice Gru only appearing for the title card near the end of the trailer. The film's official synopsis gives us no clue as to whether this alien invasion bit at the end actually happens in the movie, saying only that the movie features "the return of Gru, the girls, the unpredictably hilarious minions… and a host of new and outrageously funny characters." Alien abduction seems totally within the realm of possibility, especially since the first film ended on such a resolved note that no matter what, the sequel is going to have to jump off into a new direction.
But is Universal running the risk of wearing people out on these characters before the spinoff even arrives? I'm curious to see a Despicable Me 2 trailer that focuses a bit more on the human characters, and gives us an idea of what the movie will be other than an advance version of the minions spinoff. I get that they're the breakout characters, but are they really going to be the primary focus of two back-to-back films?
Despicable Me is set for release July 3, 2012.
Your Daily Blend of Entertainment News
Staff Writer at CinemaBlend
Most Popular
By Riley Utley
By Mike Reyes
By Riley Utley
By Dirk Libbey
By Mack Rawden


text:
June 8, 2011
beach dog beach dog beach dog kiss
More of the same from this weekend just gone. The first days of winter. Leaving the city is so nice & Ive really been lucking out with so many nice places to visit lately. Thanks, friendly friends!
18 comments:
Perfect title haha! Very very cute dogs you have here.ReplyDelete
well, i never get bored of it!ReplyDelete
BUT...i have the same photo blues. got a roll back yesterday and went, 'food, food, fruit, fruit, veg, veg, food, food'. no kiss though.
oof. and winter's only just begun.
Awww, that last photo is especially adorable. :~)ReplyDelete
oh that last photo melts my heart. what kind of dog is that little cutie??ReplyDelete
- AnonymousThursday, June 09, 2011 5:03:00 AM
so sweet, i love it.ReplyDelete
Nothing beats the beach in winter.ReplyDelete
i never tire of your beach and dog photos. really. #whitegirlReplyDelete
oh i could never tire of this!! these are so fantastic and i love every last one of them.ReplyDelete
Your dog pictures are so good, I can't get enough of them. And these ones have a PUG in them!ReplyDelete
Those dogs are just gorgeous! The second last picture brings back lovely memories of a dear friend's dog, thanks for sharing!ReplyDelete
- AnonymousTuesday, June 14, 2011 11:24:00 PM
yep. i love your blog.ReplyDelete
so in love with your work!ReplyDelete
tee hee, sandy pug!ReplyDelete
loving those pictures, want to go to the beach sooo bad now!!ReplyDelete
Dogs dogs dogs <3 ubercute!ReplyDelete
This comment has been removed by a blog administrator.ReplyDelete
tak ti prostě nemají chybu :o)ReplyDelete


text:
One of the more puzzling arguments made by publishers lobbying against open access is the notion that in some areas, there is a long lag between publication and reading, so a lengthy embargo of multiple years is needed.
If this is the case, it seems obvious to me that if there are other areas – such as keeping up with the latest in my own field of communication, advancing medical research, or finding environmentally sustainable energy solutions – where the needs are more urgent, instead of protecting the publishers of the less-pressing research, why not redirect the research funding?
Not that I am advocating such a step be taken – but doesn't it seem logical?
Addition August 1st: this argument is a part of a larger argument, that is, if there is no compelling public interest in viewing the results of publicly funded research – then why is the public funding the research in the first place?


text:
Mozilla Firefox 4 was officially released on Tuesday, and within just a few short hours the browser had been downloaded more than a million times. To celebrate the browser's launch, Mozilla has opened the digital doors on a new download statistic Website, offering visitors a neat visual way to see Firefox 4 downloads in real-time.
The Firefox 4 Download Stats site, which can be found at glow.mozilla.org, shows a constantly updating counter of all Firefox 4 downloads to date, and as of time of writing the counter stands at well over 2,000,000.
As each download is logged and added to the ever-growing count, it is visualised on a map of the earth, which is currently animating the world over, with each glowing dot representing one single download.
Mozilla details how the real-time counter and global map works on the new download statistic site. They explain that "when someone clicks the download button on mozilla.com, or asks for an upgrade from inside Firefox" a users location is approximated "based on IP address". This information is then stored anonymously as "aggregate location information" in Mozilla's database.
In addition to the global map, Mozilla's download statistic site also serves up download information on a more local level. An additional arc chart module can be found on the site (bottom left), which allows visitors to break down the download data, starting at a continent level and going as deep down as providing statistics on a city-by-city basis. Where does your city stand?
If you have downloaded Firefox 4 today, be sure to let us know what you think of it, and, oh, you may want to tweet about it too.
Get your GeekTech on: Twitter – Facebook – RSS | Tip us off | Follow Chris Brandrick


text:
50°54' / 23°38'
Translation of Uchanie chapter from
Pinkas Hakehillot Polin
Published by Yad Vashem
Published in Jerusalem
Project Coordinator
Morris Gradel z"l
Our sincere appreciation to
Yad Vashem
for permission
to put this material on the JewishGen web site.
This is a translation from:
Pinkas Hakehillot:
Encyclopedia of
Jewish Communities, Poland,
Volume VII, page 44, published by Yad Vashem, Jerusalem
JewishGen, Inc. makes no representations regarding the accuracy of
the translation. The reader may wish to refer to the original material
for verification.
JewishGen is not responsible for inaccuracies or omissions in the original work and cannot rewrite or edit the text to correct inaccuracies and/or omissions.
Our mission is to produce a translation of the original work and we cannot verify the accuracy of statements or alter facts cited.
(District: Hrubieszow; Province: Lublin)
Uchanie (U) is first mentioned in 1485 as a settlement owned by a noble family. In that same year King Kazimir Jagiello granted it urban status and the right to hold a weekly market and annual fairs - privileges which were renewed in 1504 by King Alexander Jagiello. The town was also granted exemption from taxes for 16 years. In the 16th century U grew and was a commercial and crafts centre for its agricultural surroundings. In 1795, after the Third Partition of Poland, U came under Austrian rule; in 1807 it was incorporated into the Grand Duchy of Warsaw; and in 1815 and until the First World War it formed part of the Kingdom of Congress Poland. In 1915 the townlet was occupied by the Austrians until they retreated in 1918.
Jewish inhabitants of U who traded in grain are first mentioned in 1640, but it would seem that Jews had settled there before. The data available on the community and its way of life are sparse. We know only that the Jews formed a majority of the population, and that in the 19th and 20th centuries there was an organised community. On the outbreak of the First World War many of the Jews were expelled from U because of its proximity to the battlefront. Some moved to other places in Poland or to Russia, and others went overseas.
In the inter-war period the life of the community was stable, and there was a rabbi, R. Jehuda Zyndel Lipszyc.
At the end of September 1939 U was occupied by the Germans. The Jews there, as in other parts of Poland, were seized for slave labour, their property systematically confiscated, and they were subject to harsh restrictions - they had to wear a special sign on their clothing, they were forbidden to walk on the pavement, or to have any contact with non-Jews. During this period Jewish refugees from towns and villages in the vicinity arrived in U, including - in the spring of 1942 - 680 from Horodlo. In May of that year the Jews in U numbered 2,025 souls.
On June 10th, 1942, the Germans liquidated the community of U. The Jews were taken to the railway station at Miaczyn and sent in goods wagons to their deaths in Sobibor.
Yizkor Book Project JewishGen Home Page
Copyright © 1999-2023 by JewishGen, Inc.
Updated 09 Aug 2003 by MGH


text:
A July Fourth classic, from the name brand of fireworks everyone grew up with, Black Cat sparklers are the best in the industry. At 8 inches long, these sparklers last about 25 seconds and have a goldish spark when lit. The sparklers themselves are silver with metal handles, and are very popular for birthday cakes and adorning drinks at restaurant. Another option is our larger 10 inch Sparklers which last about 35 seconds.
8 Inch Black Cat Sparklers, 72 Pack
3 reviews
- 8 Inch Sparklers that Last for About 30 Seconds,
- Perchlorate Free,
- Total of 72 Wire Smokeless Gold Sparklers.
- a Great Way to Compliment the Large Sparklers.
Out of stock
SKU: bc8-72 Categories: All Sparklers, Small Sparklers Tags: Birthday, Black Cat, Cake, Diwali, Gold, party GTIN: 751244773138
Customer Reviews
VERY happy with this product & company! Not only did my sparklers come very quickly, but they were cheap, well packaged & very effective.. An amazing deal that this company offered, plus free shipping?! An extremely satisfied customer that has already recommended you to multiple people!!
You may also like…
All Sparklers
122 reviews
25 reviews
34 reviews
Related products
All Sparklers
299 reviews
All Sparklers
1 review


text:
His defense helped shoulder the load once again.
Charles ran for 86 yards and a touchdown, Alex Smith also ran for a score and the scrappy Chiefs held off the banged-up Houston Texans 17-16 on Sunday to remain unbeaten.
The Chiefs were forced to punt the ball to Houston with 1:46 left in the game.
But after Case Keenum threw an incompletion on first down, the young quarterback was stripped by linebacker Tamba Hali at his 2. Derrick Johnson recovered the fumble for the Chiefs.
Smith simply kneeled on it from there as time ran out, allowing Kansas City (7-0) to extend the second-best start in franchise history. The 2003 team began the season 9-0.
Keenum, making his first NFL start in place of the injured Matt Schaub, threw for 271 yards and a touchdown for the Texans (2-4).
But he didn't get much help from his run game after Arian Foster left in the first quarter with a hamstring injury and did not return.
Ben Tate, who also briefly left with an injury, had just 50 yards rushing for Houston.
The Chiefs' defense, which led the NFL in scoring coming into the game, continually made big plays.
They held the Texans to a field goal after facing first-and-goal at the 1-yard line in the third quarter, and then kept turning Houston back on every series in the fourth quarter.
Charles finished with 123 yards from scrimmage, joining O.J. Simpson as the only players in NFL history with at least 100 yards from scrimmage and a touchdown in the first seven games of a season. Simpson did it in the first nine games of the 1975 season.
The Texans opened the scoring on Randy Bullock's 48-yard field goal, but the drive proved costly when Foster left for the locker room. When he emerged a short while later, he was wearing a gray sweatsuit and his afternoon was done.
The Chiefs answered with an 82-yard drive that was helped along by a roughing-the-passer penalty on Texans defensive end Jared Crick. Charles did most of the work on the drive, so it was only fitting that he plunged in from a yard to give Kansas City a 7-3 lead.
Keenum, clearly unperturbed by the crowd inside Arrowhead Stadium, calmly guided Houston back into the lead. He hit DeVier Posey for a 42-yard reception, and then found DeAndre Hopkins - who had run right past cornerback Sean Smith - for a 29-yard touchdown reception.
The Texans still led 10-7 when they pinned Kansas City at its 3-yard line midway through the second quarter. Smith proceeded to guide the Chiefs 97 yards in 15 plays - he was 8 of 8 for 75 yards on the drive - and used all but 56 seconds on the clock to regain the lead.
Smith scored on a 5-yard draw when he froze the defense on a fake handoff to nobody.
Bullock tacked on two more field goals for Houston, and Ryan Succop hit one for the Chiefs, who came within inches of extending their 17-16 lead early in the fourth quarter.
Tight end Anthony Fasano caught a pass at the goal line and was ruled down, and Chiefs coach Andy Reid challenged the spot to no avail - he thought it was a touchdown.
Charles was stuffed on the next play, and Smith's pass to wide open Sean McGrath on fourth down was out of bounds.
It turned out that it didn't matter. The Chiefs' defense made sure of that.
Get a complete wrap-up of this one on Inside the Game tonight at 10:35pm on ABC13.


text:
my website is: http://www.terranartworks.com/testsite/tsv1/index.html
i have some issues acting different for different browsers.
1.the red panel appearing under the grey buttons on bottom,seems only ff,not other browsers.
2.when user clicks one of grey buttons on the bottom,red panel should start under the white panel.but it starts a little bit of its left side.
3. the white panel on the left side on islerimiz.html(which user clicks middle button on bottom) page should be blurred.i added script for this but it is not doing blurring thing.the same script is on the iletisim.html(which user clicks rightest button on bottom) page and it is working truly.
ie6 errors:
1.the red point seems as a rectangle.
2.red panel script is not working.
3.the background of page and the logo's background should be the same but they seems different
4.the blurred panel on islerimiz.html page is not appearing at all.the bottom buttons seems true but the active button's color should be black but it seems grey too.besides little pictures should appear when mouse hover on the grey buttons,appears on open position.
5.the blurred panel on iletisim.html is not appearing.the pictures on the blured panel appears with shadows and shape is rectangle.also the links on that pictures is not clickable.
how can i solve this problems with css.if i couldn't solve with css,i can try jquery but my first choice is css.i have more than one javascript library on index page.but if i remove one of them,some scripts is not working.


text:
In 2010 America, schools, students, and teachers share the pain. The heirs to our mega rich, meanwhile, don't have to share anything.
By Sam Pizzigati
A moment of silence, please, for Dan Duncan. The 77-year-old Duncan, a Houston resident, passed away the end of March. He left behind a spouse, four grown children, four grandkids — and a fortune worth $9 billion.
Duncan also left behind another distinction. He has become the first American billionaire to ever leave his heirs a tax-free fortune.
America's first-ever billionaire — John D. Rockefeller — slid into the hereafter back in 1937. At that time, a federal estate tax had already been in effect for 21 years. John D.'s heirs faced a 70 percent tax rate on the bulk of his estate.
Dan Duncan's heirs face a 0 percent estate tax levy. His son and three daughters have now become instant billionaires.
If Duncan had passed on last year, instead of this one, his heirs would have had to share their new billions, as many as four of them, with the rest of America. But this year, for the first time since 1916, no estate tax graces the tax code.
How much will the absence of an estate tax this year cost the federal treasury? We can't say with any certainty. No one knows, after all, how many other billionaires may kick the bucket between now and December 31. We do know that in 2008, the latest year with figures available, the federal government collected $25.7 billion in estate tax revenue.
That sum, by coincidence, would be enough to fully fund the $23 billion Rep. George Miller from California and Senator Tom Harkin from Iowa want Congress to appropriate, as soon as possible, to avert the nation's worst teacher layoff crisis since the Great Depression.
Two-thirds of the nation's school districts, says a new American Association of School Administrators survey, have already axed educators. In the coming school year, without additional budget help, 90 percent expect to have to let jobs go.
That help, at this point, seems a longshot. The 2009 Obama administration stimulus legislation did save tens of thousands of teacher jobs. But the stimulus dollars earmarked for education are running out, and deficit hawks in Congress say the nation can't afford to appropriate any more.
How can a civilized nation afford to hand the heirs of the super rich billions of dollars tax-free and not afford to keep teachers in classrooms?
We can trace our current budget inanity back to 2001, the year the Bush White House pushed Congress to repeal the federal estate tax. But the White House didn't have the votes needed, under Senate rules, for a costly permanent repeal.
So White House officials cooked the budget books to camouflage the true cost of estate tax repeal. They maneuvered a tax bill through Congress that lowered estate tax rates over the rest of the decade and repealed the estate tax only for 2010. The estate tax, under the 2001 legislation, would then reappear in 2011.
White House strategists, of course, never expected to ever see this reappearance. They figured a future Congress would extend repeal beyond 2010.
But this "breathtakingly cynical" move, as the University of Cincinnati Law School's Paul Caron notes, would prove too clever by half. By 2007, Bush had lost his House of Representatives majority and any realistic shot at making the repeal in 2010 permanent.
Supporters of the estate tax, meanwhile, assumed that the Congress elected in 2008 would legislate away the one-year estate tax repeal slated for 2010. But that didn't happen either. In 2009, lawmakers deadlocked.
The friends of the financially fortunate in Congress, a bipartisan group, wanted any new estate tax set at a rate that would, at worse, merely inconvenience the super rich. Lawmakers less friendly to the fortunate wanted much more: estate tax rates high enough to break up grand concentrations of private wealth, a key goal of the reformers who championed the original estate tax a century ago.
Amid this stalemate, last year ended without any legislative estate tax action, and total estate tax repeal for 2010, as stipulated by the 2001 tax cut legislation, went into effect January 1.
The conventional wisdom on Capitol Hill then shifted. Lawmakers, observers opined, would move expeditiously in 2010 to pass some sort of an estate tax and make the levy retroactive for the entire year.
But no one in Congress, notes legal trade journal editor Scott Martin, apparently expected that a billionaire of Dan Duncan's magnitude would actually go and die without an estate tax on the books. Duncan's death has changed everything.
"Big estates," explains editor Martin, "mean big lawyers ready to fight to see those billions of dollars go to the deceased's heirs."
Those lawyers will likely battle in the courts, to the last billable hour, any move to make the estate tax retroactive for all of 2010. And the longer 2010 goes without an estate tax on the books, the higher the chances the courts will agree.
In the meantime, none of the obituaries for Dan Duncan that have appeared since his death explore his status as America's first estate tax-free billionaire. The obituaries have instead gushed over Duncan's philanthropy. He had contributed, over his last five years, more than $250 million to hospitals and other institutions.
But Duncan, by yardsticks that measure capacity to give, rates as distinctly second tier as a philanthropist. The first tier belongs to philanthropists like Judith Anderson, a teacher in Houston's Almeda Elementary School.
Last week, on the occasion of National Teacher Appreciation Day, a local media outlet in Houston spotlighted Anderson's long philanthropic history. Over the course of her 20-year school career, she has spent thousands of dollars on her students, all without reimbursement.
On one project alone, setting up a school soccer league, Anderson spent $2,000 — on a teacher's salary. By comparison, Duncan's energy pipeline empire now generates $600 million a year in annual cash flow. Next to that, $50 million in annual tax-deductible charitable contributions hardly matches the sacrifice that teachers like Judith Anderson are making year in and year out.
The reward for these sacrifices? Budget cuts that pink slip teachers and overcrowd classrooms, budget cuts that could be avoided if the rich were paying their appropriate tax share.
Dan Duncan, a close friend noted after his death, "really wanted to help everybody." If Dan Duncan's heirs really want to help everybody, they'll troop over to Capitol Hill and demand the immediate reinstatement of a meaningful federal estate tax.
His billionaire heirs, odds are, won't do that. That burden's on the rest of us.
Sam Pizzigati edits Too Much, the online newsletter on excess and inequality published by the Washington, D.C.-based Institute for Policy Studies. Too Much appears weekly. Read the current issue or sign up to receive Too Much in your email inbox.


text:
Square, a startup focused on facilitating credit card transactions at small businesses, began supporting customer loyalty programs in updates of its major apps launched Tuesday.
The Pay With Square app, which works with Android and iPhone, lets customers pay via credit card without producing their card by setting up a tab with merchants who use Square. In the just-launched update, users will also get loyalty cards, the digital version of punch cards that offer deals like buy ten and get one free. The app also includes management tools that help users organize multiple cards.
Merchants who use the Square Register app, which turns an iPad into a sleek point-of-sale register and provides inventory management support, will get tools to create and manage loyalty rewards programs. Because the digital program includes sales reporting, Square touts the feature as a way for businesses to attract new customers and strengthen customer loyalty.
"These features are what our merchants have been asking for and are what are needed to run a business, so I think we will see more Register adoption," spokesman Khobi Brooklyn said in an email.
Square, founded by Twitter co-founder and Executive Chairman Jack Dorsey, launched its first product in early 2010: the dongle that turns an iPhone or iPad into a credit card reader, which has become ubiquitous in San Francisco, where the company is based.
The number of Square users has doubled to 2 million in 2012, according to the company. The dollar amount of the transactions it processes comes to $6 billion a year on an annualized basis, according to Square. The company takes a 2.75 percent fee per swipe from merchants.
Square's success was seen as a motivation behind eBay's spring launch of PayPal Here, a mobile payments app for small businesses that features a dongle.
[Cameron Scott covers search, web services and privacy for The IDG News Service. Follow Cameron on Twitter at CScott_IDG.]


text:
Mathias Boe and Carsten Mogensen avenged their Olympic Men's Doubles gold-medal defeat to Cai Yun/Fu Haifeng of China this afternoon in the CR Land BWF World Superseries Finals.
The Danes (featured image) took the last Group A match 14-21 21-12 21-14 to stay alive in the tournament at Shenzhen Bay Sports Center. Three pairs – the other being Malaysia – each ended with two wins and a loss. Two will advance to tomorrow's semi-finals. In Men's Doubles Group B, second seeds Hiroyuki Endo/Kenichi Hayakawa of Japan battled past the other Chinese duo, Hong Wei/Shen Ye, in a match stretching past an hour, 22-20 12-21 21-18.
Despite these disappointments, home fans had much to celebrate. Men's Singles favourite Chen Long survived a mild scare from Kenichi Tago (Japan) in Group B, 21-15 14-21 21-15, while in Women's Singles, top seed Li Xuerui and third seed Wang Shixian posted contrasting victories. Li took half hour to dismiss Sung Ji Hyun (Korea) 21-9 21-12, while Wang needed three games to withstand the challenge of Japan's Eriko Hirose 21-15 8-21 21-15.
• Du Pengyu (right) finished his preliminary engagements with a perfect three wins out of three matches. Today the Chinese player overcame the tricky Boonsak Ponsana (Thailand), 24-22 21-23 21-8 to top Group A.
• Zhang Nan/Zhao Yunlei condemned Malaysian pair, Chan Peng Soon/Goh Liu Ying, to their third straight loss in Mixed Doubles Group B. The Chinese won 21-17 21-17.
• Muhammad Rijal/Debby Susanto surprised Joachim Fischer Nielsen/Christinna Pedersen at the Denmark Open in October, but the Danes notched their third win in Mixed Doubles Group B with a 21-16 21-16 verdict over the Indonesians.
See day's full results here.