text:
- Font:
- +
- -
Lisa Myers: We have been told that the CIA analysts believed at the time that they had found a secret hidden message within the Al-Jazeera scroll, the "bar code" specifically.
Tom Ridge, former Secretary of Homeland Security: Correct.
Myers: Were you at all skeptical about that analysis?
Ridge: Well, it was a unique form of potential information and potential intelligence. Incidentally, the form in which it was presented aligned with some very specific information with regard to flights of international aircraft. We were never quite able to determine its credibility at the time. But given the specificity and potential application to air travel, in addition to everything else, it was part of the mix. And — not exclusively on that piece of information. But because it was a significant part of a broader threat reporting, that we certainly did raise the threat level.
Myers: The CIA thought it had found dates and flight numbers hidden in the "bar code" of the Al-Jazeera crawl?
Ridge: Yeah. There was an interpretation based on the information that they had gleaned from their analysis of some broadcast on Al-Jazeera. And as they looked to connect it to the real world they thought that's where the connection existed. Including that information on air flights.
Myers: Did that strike you as a little bit bizarre?
Ridge: Bizarre, unique, unorthodox, unprecedented. And maybe that's very much the reason that you'd be worried about it, because you hadn't seen it before. But again, I think it's very important to state that this was part of a broader reporting stream. But clearly, the most unique we had seen at that point.
Myers: We understand that the president himself was quite excited about the possibility that you might've actually unlocked a key source of al-Qaida communication.
Ridge: Yeah, I'm not going to speak for the president. But I could tell you that given the uniqueness of this potential source — and the source itself, Al-Jazeera— there was a great concern that this was and could in the future be, if we can affirm the credibility, the very, very unorthodox means of communicating threat information or attack information.
Myers: Now, we're told that top officials at the CIA's operations command and the counter-terrorism center thought this analysis was absurd.
Ridge: Well, I can't speak to what they thought. I can only speak to the reaction that I had and some of us had, is that it's unique. We haven't been able to confirm it. Coincidentally—it does appear to align itself with commercial aviation. And 9/11 was all about commercial aviation. The [Richard] Reid shoe bomber was about commercial aviation.
So there were some conclusions that we could draw in retrospect, that may have appeared to be inaccurate. But at the time it was not beyond the realm of possibility. Though, that possibility coupled with other pieces of information caused us to raise the threat level, and canceled flights, as you remember.
Myers: But ultimately, the CIA analysis turned out to be wrong?
Ridge: Correct, I mean and I think it's very appropriate that — we say right now — as I'm talking with you, at the time, there was tremendous amount of effort for weeks and subsequently months to confirm the validity of the reporting, the accuracy of its potential use by al-Qaida as a means of communication.
But at the time since it existed in the context of other information, we had to consider it as serious information with potential application to commercial aviation. 9/11 is still very much on our minds.
Myers: Sure. At what point did you determine that this analysis was simply wrong?
Ridge: We did not make that determination. Again, the traditional intelligence community, they kept working it and working it through multiple sources. And I think internally they drew the conclusion that that bit of information lacked the credibility that we gave it to at the outset.
Myers: Our intelligence sources tell us that this CIA analysis of the allegedly hidden message was really the primary factor in triggering, raising the alert level.
Ridge: Well, it was very significant, in fact. I don't think there's any question about it. But I don't want to trivialize the other bits of pieces of information, and remember, simultaneous. You had attacks in the Arabian peninsula. You've got other sources of information threatening, in a generic way, attacks.
Myers: But by raising the alert level you frightened a lot of people.
Ridge: We informed a lot of people and we acted accordingly based on our best information and best conclusions and the information that we had at the time.
Myers: Looking back, it would appear to have been a mistake?
Ridge: Well, I think 20/20 hindsight is a great luxury that people have a couple of years after the event that you don't have at the time you're making the decisions. Consider all the factors, potential connection to commercial aviation. We've had a couple of incidents — multiple incidents there, other threat reporting — simultaneous attacks going on in the Arabian peninsula and some other sources that talk about attacks during the holiday season. You can't take that piece of information — even though we had not determined it's credibility — out of that broader context.
Myers: Is it fair to call this another intelligence mistake?
Ridge: No, I think it's not fair to second guess people in hindsight when they had to consider it. We had to consider it. I had to consider it — not independently in and of itself — but because of all the other information reporting around it. I just can't stress enough that it was part of a broader context of information. And I think that America should know that on a day in and day out basis, the professionals do their very best to determine how accurate, how credible, how reliable this information is.
Myers: You know, some people would say this is a little bit nutty.
Ridge: Well, it's easy to conclude that after the fact.


text:
There are a few sources you can add to the package manager of Mandrake to get extra software.
Some of them everybody can add, a few ( last two ) are only for Club Members.
See here how it's done:
Bruno, on Tips, said:
Now it should work and get the list . . . be patient, it takes a while.
Then as you get the prompt back, close the console ( Ctrl+d , 2x ).
Now that we have added the source to your software manager, we can have a look at all the packages:
Go to the MCC --> Software Management --> 'RpmDrake helps you install software packages' ( the icon with the + ). Now you will see the text : 'All packages' under the search-box., 'All packages' 'by group' change the by group in: 'by medium repository' and you will get a list with the sources you can choose from: CD1, CD2, CD3 and also the Update source and the just added source. Click in the little triangle in front of the new source, and a list will fold out with all the packages you can choose from . . . . FUN, MAGIC, BLISS !
Here they are: ( Don't click on the links but paste them in a root-console ) YOU HAVE TO BE ON LINE !
urpmi.addmedia contrib ftp://ftp.nluug.nl/pub/os/Linux/distr/Mandrake/Mandrake/9.2/contrib/i586 with ../../i586/Mandrake/base/hdlist2.cz
( sometimes gives an error about a not up to date list after an install, but still does the install fine )
To remove:
urpmi.removemedia contrib_ftp.nluug.nl_i586_9.2
Club Contributions: ( not the same as contrib, free for all )
urpmi.addmedia club.contrib_ftp.join.uni-muenster.de_i586_9.2 ftp://ftp.join.uni-muenster.de/pub/linux/distributions/mandrake-devel/contrib/ppc/../../unsupported/MandrakeClub/9.2/i586/ with hdlist.cz
To remove:
urpmi.removemedia club.contrib_ftp.join.uni-muenster.de_i586_9.2
PLF Link
urpmi.addmedia plf http://mandrakeusers.com/PLF/mandrake/9.2 with hdlist.cz
wget http://plf.zarb.org/plf.asc; rpm --import plf.asc; rm -f plf.asc
To remove:
urpmi.removemedia plf_ftp.easynet.fr_i586_9.2
Thacs RPM's: Link
urpmi.addmedia thacs.rpms http://rpm.nyvalls.se/9.2/RPMS with hdlist.cz
El Buho RPM's Link
urpmi.addmedia BUHO http://www.linuxlots.com/~buho/rpms/ with hdlist.cz
Eshlarc Link
urpmi.addmedia eslrahc http://www.eslrahc.com/9.2/ with hdlist.cz
Chip Cuccio's Link
urpmi.addmedia NORLUG-9.2 http://www.ibiblio.org/pub/mirrors/norlug/mandrake-9.2/RPMS/ with hdlist.cz
lynx -source http://norlug.org/~chipster/public_key.tgz | gunzip -c > norlug_rpms.asc; rpm --import [size=4] norlug_rpms.asc; rm -f norlug_rpms.asc[/size]
Additional pages with links to more sources:
Easy URPMI
- - - - - - - - - - - - - - - -
Only Club Members:
- - - - - - - - - - - - - - - -
Commercial Apps:
urpmi.addmedia club.comm_i586_9.2 http://NICKNAME:firstname.lastname@example.com/downloads2/comm/9.2/ with ./hdlist.cz
To remove:
urpmi.removemedia club.comm_i586_9.2
Test RPM's: ( at your own risk )
urpmi.addmedia Club_test http://NICKNAME:email@example.com/downloads2/test/9.2 with ./hdlist.cz
To remove
urpmi.removemedia Club_test_i586_9.2
For the last two you have to replace "NICKNAME" and "PASSWORD" . . .
Don't forget you have to update your sources on a regular basis with:
# urpmi.update -a
Because frequently new packages are added and updated.

subset: commoncrawl


text:
Updated 5 p.m.
• Why you can't trust tech press to teach you about the tech industry – Lots of tech coverage ignores history and doesn't provide context, says Anil Dash. He's right.
• Oracle: Google execs 'knew this day would come' and Google defends fair use of Java on Android in closing statements
• I'm leaving the internet for a year – Paul Carr's unplugging for 12 months. Good luck with that.
• LG has no immediate plans on making WP handsets due to weak sales – LG may return to using Android.
• Akamai: Global Average Connection Speed Dropped 14% In Q4 2011, Down 5.3% in U.S.
Original post
• Barnes & Noble Spins Off Nook, With Help From Microsoft – Microsoft is taking a 17.6 percent stake in Barnes & Noble's digital and college businesses, which may or may not actually separate from the parent company.
• Navigating a Tightrope With Amazon – A giveaway by Apple and Starbucks of an e-book by the author of Friday Night Lights gets the new title kicked off Amazon.
• Apple Is Doomed: The Phony Sony Parallel – Jean-Louis Gassée effectively deflates the notion put forth last week by Forrester's CEO that Apple is headed inevitably down the same path as Sony.
• Apple responds to tax criticism by highlighting job creation – Apple responds to a New York Times story that highlighted how the company avoids paying taxes on billions in profit.
• Apple, Google could join Dow index: Barron's – But Apple's high valuation would skew the Dow dramatically, given the way the index is calculated.
• Google to court: Galaxy Nexus code is closed just like that of the iPhone – Android is "open", except when Google says it isn't, apparently.
• Is RIM behind the embarrassing Wake Up stunt? – Clues in the code on the Wake Up teaser website indicate RIM may be responsible for the manufactured flash mob initially blamed on Samsung.
• Start-Ups Keep Revenue at Zero to Cash In on Acquisition – Tech startups are being advised to not make any money, which could give a real clue as to what they're worth. And Is it a tech bubble?
• The Dawn of Haiku OS – Volunteer programmers recreate the BeOS from scratch, as open-source code.
• Parliament probes technology price gouge – Australian lawmakers want to know why Apple and Microsoft charge more for games and music in that country than in other nations.
• Bill banning employer Facebook snooping introduced in Congress – As expected, a bill prohibiting employers from demanding your Facebook login is introduced, even though there's not much evidence that this happens frequently.
• Skype Reveals Remote and Local IP Address Of All Online Users – A script has been written that shows the IP of users who are logged into Skype.


text:
Foyle named new Bulls boss
Former Port Vale and York boss Martin Foyle has been appointed as Hereford's new manager.
Last Updated: 30/05/12 12:32pm
Former Port Vale and York boss Martin Foyle has been appointed as Hereford's new manager.
Foyle was chosen from of field of more than 40 candidates to fill the vacancy created by Richard O'Kelly's departure from Edgar Street in the wake of the Bulls' relegation from the Football League.
The 49-year-old's last job was with Northwich Victoria, who finished second in the Evo-Stik Northern Premier this season before being relegated for breaking financial rules, and Hereford chairman David Keyte insists Foyle's non-league pedigree was a key factor in his selection.
"We had been strongly advised by many people to appoint a manager who has Conference experience," he told his club's official website.
"Martin certainly has a wealth of experience as a player, coach, assistant manager and - most importantly - as a manager.
"We'll be looking for him to draw on his experience and his contacts within the game to assemble a squad capable of challenging for promotion."


text:
The Pennsylvania House of Representatives was expected to vote on a gaming reform package (HB 649) this week that would, among other things, legalize online gambling in the Keystone State. The gaming reforms contained in the legislation would then act as one of the funding components of the 2016 Pennsylvania state budget, which the legislature and Governor Tom Wolf are frantically working on finalizing before Christmas. With the reforms in HB 649, most notably online gambling expansion, the state would garner some $300 million in annual revenue, which is why HB 649 is seen by some as a necessary part of the states budget, and a key funding mechanism that could bring the governor and legislature together. Unfortunately, the vote never happened, as a late amendment that added video gaming terminals (VGTs) to the package was added on Wednesday, and appears to have slowed down the bill in the House. The House adjourned on Thursday without voting on HB 649, and will not return until Saturday, when they will hopefully pass HB 649 and send it on to the Senate where the VGT amendment will either be removed or act as a poison pill that kills the bill. The VGT problem The reason the VGT amendment (or some other unknown change) could act as a poison pill is, all of this is taking place at lightning speed. Both the Senate and House have proposed budgets in place (the state budget is nearly six months past due; a historic delay), and in addition to reaching an agreement on the budget, the legislature is also busy passing bills that fund the budget. But with time running out, the slightest hiccup, such as the VGT amendment, could upset the entire process. The amendment passed by a whisker on Wednesday, (96-93) in the House, and by all accounts has even less support in the Senate where it will likely be eliminated. The amendment would allow VGTs in specified private establishments, something the casinos in the state do not support. One possible scenario for HB 649 is for the Senate to remove the VGT amendment from the bill and send their version of HB 649 back to the House for another vote. Considering the small margin by which the amendment was initially passed, the House could simply accept the Senate version in what would likely be another close vote that could go either way. Another option would be a joint committee to quickly craft a compromise and whip up votes in the House and Senate, but there might not be enough time for this to happen. The real concern in the iGaming community is that the Senate might make other adjustments to the bill, such as increasing the tax rate on online gaming operators. This would be very troubling, as there simply isnt enough time remaining before Christmas break for the two legislative bodies to hash out an agreement on multiple issues, and iGaming would likely be taken off the table and replaced by some other funding vehicle. History of HB 649 HB 649, sponsored by House Gaming Oversight Chair John Payne, and cosponsored by House Gaming Oversight Democrat co-chair Nick Kotick, began as an online gambling expansion bill back in February. The bill had broad support in the House and from the states potential iGaming stakeholders, but as the year wore on it was the Senates bill (SB 900) that garnered more attention. SB 900 was a comprehensive gaming reform package, and even though the online gambling component was less appealing to stakeholders due to an exorbitant tax rate, the potential revenue from iGaming and the other reforms pushed HB 649 to the sidelines. However, SB 900 never gained traction, and with budget talks at an impasse, HB 649 was resurrected in November complete with an omnibus amendment package attached with other gaming reforms. The bill easily passed the House Gaming Oversight Committee, was mentioned as one of the funding mechanisms in the House budget, and is waiting for a full floor vote which will hopefully take place on Saturday. Why HB 649 needs to pass The question a lot of people have is; why does the legislature need to pass HB 649 if its going to be included in the state budget anyway? The answer is procedural. Every state (and the federal government) has their own way of doing things, and Pennsylvania is no different. When the Pennsylvania legislature crafts a budget they must explain how much money they need for each department and program and explain precisely where that money is coming from. However, the Pennsylvania budget only appropriates the money to pay for these programs; the funding mechanism, in this case HB 649, must still be passed by the legislature on its own accord. Essentially, the budget outlines where they plan on getting the money from, but the funding source (assuming its a new source) must still be passed by the legislature and signed into law by the governor.
Category: casino88
Sands Bethlehem Fined For Underage Gambling
Sands Bethlehem has been fined $36,000 by the state of Pennsylvania for alleged underage gambling violations. The Sands violations The Pennsylvania Gaming Control Board announced the violations via its website this week. From the PGCB: No other fines for underage gambling were levied against any other Pennsylvania casino. A fine was issued to Rivers Casino in Pittsburgh for an automatic shuffler error. A report at LehighValleyLive.com had more details on the violations, and other Sands Bethlehem violations in the past: Underage violations from an Adelson property? Given the stance of Sheldon Adelson the owner of Sands Bethlehem and a variety of other casinos around the world on online gambling, the fines are pretty ironic. Adelsons lobbyists and politicians who support the Restoration of Americas Wire Act a bill to ban online gaming contend that children could gamble online if it were easily accessible. For instance, from the Coalition to Stop Internet Gambling website: That assessment has little merit based on the experiences of the regulated online poker and casino markets in New Jersey, Nevada and Delaware. Seeing as underage gambling a major point of contention in the fight against allowing regulated online gaming, one would think Adelsons brick-and-mortar gaming establishments would have a sterling track record on the subject. However, that is obviously not the case. Sands Bethlehem is the only property that is opposed to legislation that would allow Pennsylvania online casinos. The latest on online gambling in PA Online gambling appears to be a part of ongoing budget discussions in the state, although to what extent is unknown. At worst, it appears that online gambling will be considered in the spring, apart from budget talks.
New Proposal Would Increase Taxes On Pennsylvania Casinos
A new budget proposal (for the FY 2016/2017 budget) by Pennsylvania Governor Tom Wolf would impose an 8 percent tax on promotional play at the states 12 casinos. Based on 2015 promotional play numbers, this new tax would create an additional $50.9 million in revenue for the state. But the numbers dont tell the entire story. Promotional play vouchers are generally given to active and inactive players in a casinos database to entice them to visit the casino, and can take the form of a free $10 in slot play (or more depending on the persons betting habits), or even a $20 match play on table games, where the casino matches a persons $20 bet. Promotional play is also a huge lure for organized bus trips, where riders receive promotional play dollars that usually exceed the cost of their bus ticket. The governors proposal is universally opposed The states casinos are unlikely to approve of this new proposal, and are already pushing back against the idea. In response to the news, Las Vegas Sands spokesperson Ron Reese, whose Sands Bethlehem Casino is the biggest purveyor of promotional play coupons, told the Morning Call, Any time money is taken out, its going to affect reinvestment in the property and the creation of future jobs. This proposal is bad for jobs in the Lehigh Valley and beyond. Theres certainly no shortage of taxes already being paid. Promotional play is already a loss leader for the casino, and a state-imposed tax will likely curtail a casinos usage of it. With less promotional play, casinos may see a drop in traffic, which would of course lead to a loss in revenue revenue the state collects 54 percent of when it comes to slot machines, and 14 percent of when it comes to table games. Mohegan Suns CEO Michael Bean said as much to the Morning Call, indicating that while only an 8 percent tax, it could be the straw that breaks the proverbial camels back. Its a primary marketing tool for us, but theres a tipping point, Bean said. Its going to cost us $3.7 million on top of the $125 million we already pay. At some point, if its going to be a handicap, youre going to have to spend less. Thats not good for us or the state. Essentially, Wolfs proposal, meant to increase the states tax revenue from casinos, could have the unintended consequence of lessening the amount of money the state collects from gaming overall. A letter, signed by all 12 of the states casinos and sent to the governor last week said as much: Budget problems and other gaming reforms As noted in the opening, this proposal is for the 2016/2017 Pennsylvania budget, but the state still hasnt passed its 2015/2016 budget, which was due back in July of 2015, a stalemate that becomes more and more of a crisis with each passing day. The proposal is also strange considering the state legislature is expected to vote on a massive gaming reform bill that would generate far more tax revenue than Wolfs proposal, and in a less controversial way. Among the states brick and mortar casinos, there is a near unanimous consensus when it comes to the omnibus gaming reform bill, HB 649, which includes the addition of slot machines at designated airports and off-track betting parlors, and the legalization and regulation of online gambling. However, HB 649 has been earmarked to fix the states state pension deficit, and is not being used to solve the states budget stalemate although there have been halfhearted attempts to shift HB 649 into the budget. According to the bills sponsor, Representative John Payne, if HB 649 were shifted to the budget it would lead to the legislature having to vote on tax increases to solve the pension deficit. Payne noted this is something few legislators were likely to do in an election year. Image George Sheldon / Shutterstock.com
AGA Voices Opposition To Proposed Tax On Casino Promotional Credits In PA
The American Gaming Association has come out against a recent proposal by Pennsylvania Governor Tom Wolf that seeks to impose a tax on promotional credits handed out by the states casinos. The AGAs position on the tax In a letter sent to Governor Wolf and key legislators, AGA Senior Vice President of Public Affairs Sara Rayme wrote:
the American Gaming Association (AGA) has serious concerns with your proposal to tax promotional credits, a crucial marketing tool for casinos that generates millions of dollars in tax revenues for the Commonwealth of Pennsylvania each year. The AGA letter goes on to say that the new tax would likely have the opposite effect the Governor intends; a concern I broached when the governors plan was first introduced a week ago. As Rayme notes, While we appreciate the difficult budget deficit facing Pennsylvania, taxing promotional credits would likely lead to a decrease in tax revenue from casinos the exact opposite of the intended result. If Wolfs plan were adopted its likely the value of promotional credits would reach a tipping point, and many casinos would drastically cut down on the amount of promotional credits they give away. As the AGA notes, this could lead to less visitation and traffic in the states casinos and therefore less revenue for the state. The letter also makes note of the already high tax burden Pennsylvania casinos pay, as 55% of slot machine revenue and 14% of all table game revenue goes directly to the state. According to the Morning Call, the casinos that would be hardest hit by Wolfs proposed tax would be AGA members, Las Vegas Sands (Sands Bethlehem), Greenwood Racing (Parx Casino), Rush Street Gaming (Rivers Casino and Sugarhouse Casinos), Penn National (Hollywood Casino), Caesars Entertainment (Harrahs), and the Mohegan Tribal Gaming Authority (Mohegan Sun at Pocono Downs). Two of those entities, Las Vegas Sands and Caesars are among the heavy hitters of the casino industry and the AGA. Wolfs proposal Under Wolfs promotional tax plan, casinos would have to pay an 8% tax on free slot play and match play coupons and vouchers for table games, essentially charging them to run what have historically been considered marketing campaigns to attract customers. These giveaways are seen as the fuel that brings day trippers to the casinos by bus from as far off as New York City. The AGA likened these promotional credits to grocery store coupons, or a BoGo offer sent to specific customers by a shoe store, although I would have compared them to free appetizers at a bar or some other loss-leader. In the letter Rayme made the following case for promotional credits: Promotional credit marketing programs in casinos are no different than grocery store coupons, which are widely used to attract more customers to purchase and consume more goods. Direct marketing, which involves sending promotional free play to patrons, is much like a shoe store sending a customer a buy one, get one free coupon. Promotional credits are a critical part of casino marketing because they:
Incentivize customers to increase their real-money wagering and spur increased visitation;
Empower casino operators to respond to market conditions, customers preferences and the broader economic environment; and
More than triple the return on investment of issuing promotional credits. The bigger picture It should also be noted that this fight is taking place amid a backdrop of a budget stalemate between the governor and the Republican-controlled House of Representatives that has gone on for over six months. Wolfs proposal could very well be the governor throwing every idea against the wall to see if anything sticks, since the longer the stalemate goes, the worse it will be for all Pennsylvanians. The legislature is also considering a massive gaming expansion package that would legalize online gaming in the state; add slot machines to select airports and off-track-betting parlors; make structural changes to casino licenses; and perhaps legalize daily fantasy sports in the Keystone State.


text:
Repeating Patterns: However, "Critical Consciousness" Can Break the Cycle of Abuse
Interview with Gwendolyn Kelso, M.A., and doctoral student on the study "Critical Consciousness, Perceived Racial Discrimination and Perceived Gender Discrimination in Relation to Demographics and HIV Status in African-American Women" at the 19th International AIDS Conference in July 2012 in Washington, D.C.
Enid Vázquez, Positively Aware: Thank you for talking with me on such a short notice. I was fascinated by the information in this session, by your work in particular because of the concept of critical consciousness. For me it's always about, you know, why do people stay in bad situations? Why is it that a history of abuse opens you to more abuse? That is really fascinating to me. Could you explain that to a lay audience? Is this a concept that's come along recently or an old one?
Gwendolyn Kelso, Boston University: Critical consciousness is being aware of social inequality and joining with other people to do things that bring about social change. Paulo Freire first coined the concept of critical consciousness in the early 1970s, so it's not a new concept but was more popular in the 1960s and 1970s during a time when consciousness-raising during the civil rights and women's movement were a larger part of the culture.
For people who are members of groups that have less social power -- like women, people of color, the poor -- having an awareness of how some groups have come to have less power and resources than others can be empowering because this reflects an accurate perception of reality. People may stay in bad situations because they blame themselves for the situation, they don't think things can be different, and/or they don't think that they can do anything to change it, often feeling alone. What may be helpful about having critical consciousness is that one doesn't explain poverty or discrimination by focusing on the poor person or the person being mistreated, but looks at how the system plays a role in poverty and discrimination. If you can identify the things that impact your life and know that you're not the only one, then you can do things to try to change them -- and this may help people out of bad situations.
My research looks at how critical consciousness may relate to health in African-American women with and at risk for HIV. There are so many systems that place them at higher risk for poor health -- as women they may not advocate for their best interests, people with low income are less able to get quality health care, there is HIV stigma that might cause feelings of fear and embarrassment that make it hard to get help or support around HIV and other needs. These are social issues and not issues of personal choice. Critical consciousness involves thinking critically about why things are the way they are, of course taking into account one's personal decisions but also recognizing that these decisions are made within contexts that are not the same for everyone. Not everyone has the same range of choices -- some groups with less power have fewer choices.
EV: I always remember a woman at one of our [TPAN] conferences who attended a session on sexual assault, and said she suffered sexual abuse as a child and became a drug addict as a teenager, but never put the two together until someone, somehow -- a counselor, a support group -- explained that connection to her. She thought she was just weak. Without awareness, people will blame themselves to a degree that's not good for them.
GK: You bring up a really good point. My research is on a macro [large] level, where that consciousness is related to broader social/cultural forces. But it can also be applied at the family systems [micro, or small] level. Adults often blame themselves for abuse that happened when they were children. There is a great deal of pain involved and some will turn to drugs or bad relationships or something else to try to find a way to deal with it. What can be powerful and lead to beginning to heal is looking at the situation itself -- children have no power in their family system. They were children, and there's no way it could have been their fault. There was a big difference in power at play with the abuse -- the adult had all the power, the child had none.
EV: Any take-away messages from the results you presented?
GK: I think it's important for people to talk to each other about racism, about sexism, and other ways that social injustice plays out in their lives, and with these issues up for discussion, people can start thinking about the best ways to start making some changes for a better future.


text:
Handmade holiday gift toppers can add a creative finished touch to your packages this season and dress up even the simplest wrapping paper.
Holiday Gift Toppers
By Patti Milazzo
Difficulty level
Tools used
- Ideal for cutting tight patterns and intricate details on a wide range of fabrics, cutting at awkward angles or in tight spaces or making quick thread snips
- Micro-Tip® blades provide superior cutting precision
- High-grade, precision-ground, stainless-steel blades offer a lasting sharp edge that cuts all the way to the tip
- Double-loop handle accommodates right- and left-handed users
- Length: 4.9"
- Lifetime warranty
- Micro-Tip Scissors (No. 5)
- Traditional design is ideal for punching simple shapes in craft projects for both functional and decorative purposes
- Cushioned grip provides comfortable use
- Confetti catcher holds all clippings
- Color-coded handle makes it easy to find the right punch in your collection
- For best results, use on 65-lb. cardstock and lower
- Lifetime warranty
- Circle Hand Punch (1/8")
- Interchangeable 28 mm blades with a variety of cutting options
- Heat treated hardened stainless steel blades for long-lasting, razor sharp cutting
- For cutting paper, fabric, thin plastic and metals, pictures, leather, light screen and more
- Reusable clam package for blade storage
- Rotary Scalloped Blade (28 mm, Style F)
Choose Micro-Tip® blades for unmatched cutting precision.
A traditional design makes punching simple shapes quick and easy.
Supply list
Patterned Paper
Paper Edgers
Floral Tape
Artificial Berries
Pinwheel Bow
1. For the larger pinwheel, trace and cut 6 pinwheel pieces from double sided pattern paper. Use the Lever Circles Corner Punch on the right angle.
2. Curve each piece and apply adhesive to tabs and press together.
3. Use the .125 Circle Hand Punch to punch a hole in the center of the tabs.
4. Use a large brad to join the pieces together like a pinwheel.
5. For the smaller pinwheel, cut a 3.5 inch square from pattern paper and cut the diagonal of each corner within .5 inch of the center.
6. Trim one side of each cut line with Scallop Paper Edgers.
7. Fold down the straight edge half of each corner and adhere to the center of the pinwheel.
8. Punch a small circle and adhere to the center of the smaller pinwheel.
9. Adhere the smaller pinwheel to the center of the larger and the Pinwheel Bow is ready to be added to your gift.
Streamer Bow
1. Use the Rotary Trimmer with a Scallop Blade to cut 16 or more - .25 inch wide by 12 inch scalloped strips of double sided pattern paper.
2. Use the straight edge of a pair of scissors carefully or a flat edge ruler to curl the paper as you would a piece of ribbon.
3. Hand Punch a .125 inch hole at the end of each piece.
4. Attach all the curled strips together with a large brad.
5. Punch a small circle and adhere it to the center of the bow to cover the brad.
6. Arrange the curled streamers evenly and trim the top center pieces 1 - 2 inches to round it off and then attach it to your gift.
Christmas Berry Pick
1. Cut a 5 inch square from pattern paper and run it through the Paper Crimper diagonally.
2. Accordion fold along every other crimped line across the paper.
3. Fold in half and wrap a piece of floral wire around the center to create a kind of floral pick.
4. Wrap the bottom of the paper fold and the wire in floral tape.
5. Add an artificial berry sprig and also wrap in floral tape.
6. Glue a piece of cinnamon stick to the center.
7. Tie a 6 inch piece of red ribbon around the pick and attach to your gift with adhesive.
Click here for more inspiration on creating Christmas decor, ornaments and gifts.
Sign up today for project inspiration, tips, techniques and product specials.


text:
Improve web application security with jQuery Mobile
Learn how to secure your mobile applications
Before you start
This tutorial is for jQuery Mobile developers interested in securing their applications. It assumes that the reader has basic knowledge related to web application development using PHP, MySQL, JavaScript, XHTML, and CSS. Also, this tutorial is in no way comprehensive; it is intended as an introduction to web application security. For further reading on the issues covered here, plus other relevant topics, check Related topics.
About this tutorial
With the rise of smart phones and similar devices, web application security has been broadened to include mobile applications. Because of the constraints imposed by the interfaces of many such devices, developers sometimes work with the flawed assumption that client-side input validation is sufficient for protection against attacks. However, requests sent by mobile applications can be manipulated in the same way as traditional web applications. Because of this vulnerability, the client cannot be trusted. With sensitive data sometimes stored on devices and the servers that they use, the protection of users from black-hat hackers is critical. This tutorial shows how several types of vulnerabilities occur and some of the countermeasures that can be put in place to mitigate attackers trying to exploit them. The following types of vulnerabilities are covered:
- Cross-site scripting
- Cross-site request forgery
- Broken access control
- SQL injection
- File inclusion
- OS command injection
- Scripting language injection
- Arbitrary file creation
All vulnerabilities and countermeasures are demonstrated using a sample application built with jQuery Mobile, PHP, and MySQL. (See Download for a .zip file with the sample code.)
You will need the following tools to complete this tutorial:
- Web server— You can use any web server with PHP support. Many of the exploits throughout this tutorial are Windows specific, but they can be adapted for other operating systems. Suggested web servers are Apache or the IBM HTTPServer.
- PHP— Because some attacks described do not work against the latest version, PHP 5.3.1 was used. Such incompatibilities are noted throughout the tutorial.
- MySQL— This tutorial uses MySQL, an open source database. Version 5.1.41 was used for this tutorial, but other versions should work fine.
- Web debugging proxy— Because a way of manipulating HTTP requests is necessary, a web debugging proxy is very helpful. Throughout this tutorial, Fiddler v184.108.40.206 is used, but any other web debugger proxy that allows for modification of requests works.
- jQuery Mobile— The front end of the sample application built in this tutorial uses jQuery Mobile 1.0 Alpha 3.
See Related topics for helpful links.
Building an insecure application
You begin this tutorial by creating an insecure example application called the Contrived Mobile Application (CMA), which serves as a testing ground for the different types of attacks covered in the following sections. To achieve this test, CMA has two core pieces of functionality:
- A user profile system for customization
- A calculator for performing basic arithmetic
Each element of the application introduces security holes that attackers can use for their own ends. With each vulnerability covered, CMA is patched appropriately in an attempt to thwart future hackers.
The schema
As a user-centric application, CMA has a simple schema consisting of one table (see Listing 1).
Listing 1. An excerpt of the CMA installation script
CREATE TABLE UserAccount ( Id INT NOT NULL PRIMARY KEY AUTO_INCREMENT, Username VARCHAR(256) NOT NULL, Password VARCHAR(32) NOT NULL, FirstName VARCHAR(256) NOT NULL, LastName VARCHAR(256) NOT NULL ); INSERT INTO UserAccount (Username, Password, FirstName, LastName) VALUES ('Jane', md5('Password1'), 'Jane', 'Smith'); INSERT INTO UserAccount (Username, Password, FirstName, LastName) VALUES ('John', md5('Password1'), 'John', 'Doe');
Two users are created, Jane and John. To keep things simple, permission levels have been left out.
Language selection
The language selection logic is executed every time a page is loaded (see Listing 2).
Listing 2. Improper handling of input passed to require_once
if (isset($_COOKIE['language'])){ require_once($_COOKIE['language'] . ".php"); }
First, a conditional statement checks to see if a language cookie is present. If it
is, the PHP extension is appended to the cookie value and the string is passed to
require_once function to load the appropriate script.
Authentication and authorization
Next you add some rudimentary protection. A login form (see Figure
1) is created along with authentication and authorization logic, and upon
successfully logging in the session value,
CurrentUser is set to the
username of the authenticated user. Authorization logic is implemented by checking
this session value.
Figure 1. The CMA login form
Listing 3 shows the creation of insecure authentication logic.
Listing 3. Insecure authentication logic
<?php function Authenticate($Username, $Password) { $query = "SELECT COUNT(*) FROM useraccount " . "WHERE Username = '" . $Username . "' AND " . "Password = md5('" . $Password . "');"; $result = mysql_query($query); $_SESSION["CurrentUser"] = $Username; return mysql_result($result, 0); } ?>
Listing 4 shows the creation of insecure authorization logic.
Listing 4. Insecure authorization logic
<?php if (!isset($_SESSION["CurrentUser"]) || $_SESSION["CurrentUser"] == NULL) { header("Location: login.php"); } ?>
User search
No user-centric application is complete without the ability to search for other users within the system. The user search feature accepts keywords and returns matches as an unordered list (Figure 2). Listing 5 shows the search logic.
Listing 5. Insecure handling of user-submitted data in the user search implementation
Query: <?php echo $query; ?>
 <?php $query = "SELECT FirstName, LastName " . "FROM UserAccount " . "WHERE FirstName LIKE '%$query%' OR " . "LastName LIKE '%$query%';"; $result = mysql_query($query) or die(mysql_error());; while ($row = mysql_fetch_assoc($result)) { echo "
" . $row["FirstName"] . " " . $row["LastName"] . "
"; } ?>

Listing 5 performs a variety of functions. First, it outputs the
user-submitted query at the top of the page to remind users what they searched for.
Following that, the conditions of a SELECT a statement are dynamically built from
the user-supplied keywords. The SQL statement is passed to
and the script loops through the results, echoing pertinent data as HTML list
Figure 2. The results of a user search
Because users might need to solve basic arithmetic problems on the fly, CMA offers a calculator feature. Calculator consists of three inputs: x, y, and operation. Listing 6 shows the code for solving arithmetic problems and displaying the results.
Listing 6. Insecure handling of user-submitted data in the calculator implementation
<?php $operation = $_GET["operation"] == "operation-add" ? "+" : "-"; $arithmetic = "$_GET[x] $operation $_GET[y]"; echo $arithmetic . " = "; $code = "echo $arithmetic;"; eval($code); ?>
This piece of code first checks the
GET data to determine what operation
the user selected. Next, it builds the arithmetic problem as a string. It then
outputs the complete problem so the user can see it, before interpreting the
dynamically built string as PHP.
Figure 3 shows the calculator in action.
Figure 3. The CMA calculator crunching some numbers
Now that you have seen the CMA calculator, I'll cover the core of the application: user preferences.
User preferences
The personal customizability of CMA is its biggest piece of functionality. It allows users to change personal information and upload a picture for their profile (see Listing 7).
Listing 7. Insecure handling of user-submitted data in the user preferences implementation
<?php $message = "User preferences have been saved."; $validated = TRUE; $update = "UPDATE UserAccount " . "SET " . "FirstName = '$_REQUEST[firstname]', " . "LastName = '$_REQUEST[lastname]' "; $password1 = $_REQUEST["newpassword1"]; $password2 = $_REQUEST["newpassword2"]; if ($password1 != NULL && $password1 != '') { if ($password1 != $password2) $validated = FALSE; $update .= ", Password = md5('$password1') "; } $update .= "WHERE Id = $_REQUEST[userid]"; if ($validated) mysql_query($update) or die(mysql_error()); if (isset($_FILES["picture"])) { $image = $_FILES["picture"]["tmp_name"]; // For this example ping will be used as a mock image // compression tool. $compress_command = "ping $image $_REQUEST[imagecompression]"; exec($compress_command); move_uploaded_file($image, "images/" . $_FILES["picture"]["name"]); } echo $message; ?>
The code in Listing 7 first builds and executes an UPDATE statement for the UserAccount table. If the user uploaded an image, it is processed with a mock image compression utility and then moved into the images directory.
Figure 4 shows the user preferences interface with First Name, Last Name, New Password, Repeat New Password, Profile Picture fields.
Figure 4. The user preferences interface showing the John Doe account
Having gone over relevant CMA functionality, it is time to look more closely at its implementation. The next section covers the vulnerabilities present, how someone can exploit them, and what you can do to prevent that exploitation.
Cross-site scripting (XSS)
A website is vulnerable to XSS when a hacker can inject client-side scripts to attack other users. There are two types of XSS: reflected and persistent. It is a common misconception that XSS is nothing more than a nuisance. In some instances of reflected XSS the threat is minor, but in many cases it leaves users vulnerable to account compromise or worse.
Reflected XSS
Reflected XSS occurs when request data is rendered unencoded and unfiltered in the response. With the help of social engineering, an attacker can trick a user into visiting a page that creates such a request, allowing the attacker to execute JavaScript in the context of the targeted user. What can be done with this varies depending on the nature of the hole, but XSS is generally exploited to hijack sessions, steal credentials, or perform otherwise unauthorized actions.
Usually a greater threat than the reflected type, an XSS vulnerability is considered persistent when the server saves the user-submitted request data. Because the malicious data is persisted within the application, the social engineering aspect of the attack is made simpler or even removed altogether depending on the exploit.
CMA is loaded with XSS vulnerabilities; the user search alone has both the reflected
and persistent types. Exploitation of the reflected type is shown here:
The effects of the reflected XSS attack are visible immediately on navigating to the
link, unless client-side countermeasures are in place:
Anti-XSS features might be built into a browser, such as Microsoft® Internet Explorer® 8, or installed as a plug-in, such as noXSS for Firefox. For your purposes, client-side filters should not be considered as you cannot rely on users to have them installed, and in many cases they protect only against the reflected type. In some instances, client-side filtering actually is counter-productive, introducing universal XSS (UXSS) vulnerabilities. One example of this was in Internet Explorer 8 before Microsoft patched the hole.
To see persistent XSS in action, insert the script tags displayed here into the First
Name or Last Name field of the User Preferences form, then search for the user:
The JavaScript is executed when the user is shown in search results.
Prevent cross-site scripting
Stopping XSS attacks is usually a matter of applying the right encoding to user input
in the server response. For the user search reflected XSS example, applying HTML
entity encoding should be sufficient to prevent malicious actions. You can take this
step with the PHP API by using the
htmlentities function:
<?php echo htmlentities($query); ?>.
Testing the attack against the updated code now yields a different result:
Query:
The less-than and greater-than characters are now HTML entity encoded, preventing the
attacker from injecting markup. The persistent vulnerability is fixed in the same
way (see Listing 8) with the
Listing 8. A CMA modification to prevent persistent XSS
while ($row = mysql_fetch_assoc($result)) { echo "
" . htmlentities($row["FirstName"]) . " " . htmlentities($row["LastName"]) . "
"; }
When user-submitted data is injected into an HTML attribute value, take care to
ensure that string delimiters used to enclose the value are stripped or encoded
within the value itself. Otherwise, attribute injection can take place:
My
Listing 9 shows how attribution injection can take place.
Listing 9. Attribute injection, made possible by the lack of single quote encoding
My Website
As an added layer of security, enabling the
HttpOnly flag of the
Set-Cookie response header prevents client-side scripts from accessing the protected
cookie. You cannot rely on this feature, however, as some browsers do not entirely
support it.
The next section covers another prevalent vulnerability that can be used to launch client-side attacks against other users of a system.
Cross-site request forgery (CSRF or XSRF)
CSRF occurs when an attacker tricks users into performing actions within their
security context. If no security measures are in place, hackers can do this
regardless of whether the form method is
GET or
Between the two, CSRF attacks that use the
GET method are the biggest
threat because the request can be forged using only a URL, which an attacker can use
as the source of an image. If the attack has the ability to arbitrarily set the
source of an image within the system, hackers can leverage it to launch an on-site
request forgery (OSRF) attack.
Almost every action in CMA can be recreated as a CSRF attack. Listing 10 is an example of a
GET-based attack that changes
the targeted user's password to new_password.
Listing 10. Password changing CSRF example

If the GET method does not work, the attacker can attempt to forge the request using
POST (see Listing 11).
11. Password changing CSRF example using the
  <form method="POST" action="http://localhost/CMA/insecure/preferences.php"> <input type="hidden" name="firstname" value="John" /> <input type="hidden" name="lastname" value="Doe" /> <input type="hidden" name="newpassword1" value="new_password" /> <input type="hidden" name="newpassword2" value="new_password" /> <input type="hidden" name="userid" value="2" /> <input type="hidden" name="imagecompression" value="5" /> </form>
The outcome of viewing the rendered HTML in Listing 11 is the creation of a request that is identical to that of a legitimate user updating user preferences, but all form values are controlled by the attacker.
Prevent cross-site request forgery
You can prevent CSRF in a couple of common ways. The easiest way to implement is to check the referrer in the HTTP request (see Listing 12); if the request is not from a trusted source, it should be rejected. The more granular the referrer checking, the better the security.
Listing 12. A basic referrer check implementation
if (strpos($_SERVER["HTTP_REFERER"], $app_host . $app_path) != 0 && strpos($_SERVER["HTTP_REFERER"], $app_path) != 0) die("Invalid request");
This approach, though, is not foolproof. A more secure countermeasure is the employment of a security token. With each protected form, the server includes a long, sufficiently random token value. Each token value is tracked server-side to ensure that it is used only once and expires after a predetermined amount of time. On form submission, if the value is absent, invalid, or expired, the request is rejected on the grounds that it is most likely forged. Without the ability to guess the token value, an attacker is not able to craft an attack. If this security mechanism is applied to every page in the application, it also serves to prevent reflected XSS.
In the upcoming sections, you'll look at several types of server-side vulnerabilities.
Broken access control
Access control issues are often overlooked because, in most cases, access control cannot easily be tested using automated utilities. An application has broken access control when unauthenticated or unauthorized users can access resources to which they should be denied permission. This issue frequently happens when developers try to protect resources intended for authorized users by hiding URLs from unprivileged users. The assumption that this alone protects a resource is flawed; an attacker can still discover the URL through other means, such as inference. Also, users who lose privileges might still be able to access unauthorized resources with URLs that they have saved.
CMA has two access control-related vulnerabilities: authentication bypass and privilege escalation. The authentication bug stems from the failure to terminate execution on finding the user to be unauthenticated. Trying to perform a forbidden action (see Listing 13) in a browser results in seemingly expected behavior: The browser is redirected to the login page.
Listing 13. An unauthenticated request for privileged resources
POST http://localhost/CMA/insecure/preferences.php HTTP/1.1 Host: localhost Connection: keep-alive Content-Length: 107 Cache-Control: max-age=0 Origin: null User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16 Content-Type: application/x-www-form-urlencoded Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8 ,image/png,*/*;q=0.5 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 firstname=John&lastname=Doe&newpassword1=new_password&newpassword2 =new_password&userid=2&imagecompression=5
As Listing 14 shows, examining the traffic using a web debugging proxy such as Fiddler reveals that quite a bit more is happening.
Listing 14. An excerpt from the response showing that the interpreter did not properly terminate execution
HTTP/1.1 302 Found Date: Sat, 19 Mar 2011 23:14:44 GMT Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l mod_autoindex_color PHP/5.3.1 mod_apreq2-20090110/2.7.1 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.1 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: login.php Content-Length: 1138 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">   ...
While the server responded with a 302 status code, the body of the responses contains everything that an authenticated user receives. Further, the password change was successful, and the targeted account has been compromised.
Aside from the authentication bypass vulnerability, CMA contains another access
control issue: privilege escalation. Whenever a user updates his or her profile, the
Id of the user's account, stored in a hidden field of the form as
shown here, is submitted along with the form:
<input type="hidden"
name="userid" id="userid" value="2" />
When the form is posted back to the server, no validation is performed to confirm
that the submitted
Id is that of the actual current user before the
value is used to load the record from the database. A malicious user can use
browser-based web development tools to change the value of the hidden field before
submitting the form or alter the request using a web debugging proxy to specify an
Id, allowing the malicious user to make changes to user
accounts other than their own.
Prevent broken access control
To prevent authentication bypass, ensure that the execution of your protected application logic does not take place if an authentication or authorization check fails. With PHP, it is important to remember that setting the Location field of the response using the header function does not terminate execution. Listing 15 shows authorization code that properly exits.
Listing 15. Improved authorization code
<?php if (!isset($_SESSION["CurrentUser"]) || $_SESSION["CurrentUser"] == NULL) { header("Location: login.php"); exit; } ?>
If the user is determined to be unauthorized, the
exit function is
called after the Location header is set. This step prevents the remainder of the
script from being executed.
To eliminate privilege escalation, ensure that proper authorization is performed for
every privileged action. Avoid storing data client-side when it can be stored
server-side. The user ID in Listing 15 is a good example of
data that can be stored in the session. Part of the fix is shown here:
$update .= "WHERE Id = $_SESSION[userid]";
Next is SQL injection, a well-known vulnerability with a wide range of potential consequences.
SQL injection
Despite growing awareness, SQL injection still remains a problem. Consequences of a successful SQL injection vary depending on the vulnerability. Some of the threats that can be introduced are these:
- Data disclosure
- Modification of existing data
- Insertion of new data
- Arbitrary file system access
- Arbitrary network access
- System compromise
Every query in CMA is vulnerable to SQL injection, so you'll work with several input vectors. By injecting a condition and commenting out the rest of the query through the username field, authentication can be bypassed. Listing 16 shows the query as it was intended.
Listing 16. The select statement when John and Password1 are submitted as user credentials
SELECT COUNT(*) FROM UserAccount WHERE Username = 'John' AND Password = md5('Password1');
Listing 17 shows what the statement looks like when a malicious string is used to inject code into the first condition.
17. The
select statement when
'or 1=1;# and an empty
password are submitted as
SELECT COUNT(*) FROM UserAccount WHERE Username = ''or 1=1;#' AND Password = md5('');
Because 1 is always equal to 1 and the password checking condition is commented out by the number sign character (#), the query in Listing 17 returns the count of all the records in the UserAccount table. If the count is not zero, the return value of the Authenticate function evaluates to true, granting the attacker access.
The user search functionality is vulnerable in a way that can be exploited to extract arbitrary data, among other things. Listing 18 shows the search query as it was intended to work.
Listing 18. The user search query under normal conditions
SELECT FirstName, LastName FROM UserAccount WHERE FirstName LIKE '%John%' OR LastName LIKE '%John%';
By utilizing the UNION operator, attackers can append an entirely new query to
retrieve data of their choosing:
'and 1=0 UNION SELECT Username, Password
FROM UserAccount;#
Listing 19 shows the dynamically generated query after submission of the attack string.
Listing 19. The user search query after SQL injection
SELECT FirstName, LastName FROM UserAccount WHERE FirstName LIKE '%'and 1=0 UNION SELECT Username, Password FROM UserAccount;#%' OR LastName LIKE '%'and 1=0 UNION SELECT Username, Password FROM UserAccount;#'";
The attack yields the user name and password digest for every user in the database (see Figure 5).
Figure 5. The result of successful injection using the UNION operator
Prevent SQL injection
To prevent SQL injection, you must properly escape and validate all user-submitted
input. Most web development APIs come with functions to achieve this. With PHP and
MySQL, use parameterized queries along with
for string values to protect from many attacks (see Listing
Listing 20. Updated authentication code utilizing preventive measures offered by the PHP API
$query = sprintf("SELECT COUNT(*) FROM useraccount " . "WHERE Username = '%s' AND " . "Password = md5('%s');", mysql_real_escape_string($Username), mysql_real_escape_string($Password));
As Listing 21 shows, the authentication bypass no longer works due to the escaping of the delimiter at the start of the attack string.
Listing 21. An injection attempt with the new fix in place
SELECT COUNT(*) FROM useraccount WHERE Username = '\'or 1=1;#' AND Password = md5('');
It is important to use the right type specifier in the format string. Casting to the expected type provides an additional layer of protection (see Listing 22).
Listing 22. Safely creating a query using an untrusted integer
$query = sprintf("SELECT * FROM useraccount WHERE Id = %d", (int)$_GET['id']);
The subsequent section goes into File Inclusion, a type of bug that is common in PHP web applications.
File inclusion
There are two types of file inclusion: remote and local. As the name implies, this
type of vulnerability allows an attacker to arbitrarily include a file. Whether the
result is disclosure of the contents of the file or execution as code depends on the
nature of the exploit. With PHP, remote file inclusion is generally not possible if
allow_url_fopen is disabled in the php.ini file.
The language cookie in CMA is vulnerable to local file inclusion and, if the server is configured to allow opening URLs, remote file inclusion. By passing a series of traversal sequences along with a folder and file outside of the webroot followed by a null byte to terminate the string, arbitrary files can be included. Listing 23 shows a malicious request that includes the win.ini file.
Listing 23. A malicious request that attempts to retrieve the win.ini file of the server
GET http://localhost/cma/insecure/index.php HTTP/1.1 Host: localhost Connection: keep-alive Referer: http://localhost/cma/insecure/index.html User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8, image/png,*/*;q=0.5 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: language=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2fwin.ini%00
Listing 24 shows the server's response.
Listing 24. The server's response showing a successful attack
HTTP/1.1 200 OK Date: Sun, 20 Mar 2011 20:59:41 GMT Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l mod_autoindex_color PHP/5.3.1 mod_apreq2-20090110/2.7.1 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.1 Set-Cookie: PHPSESSID=39q2aarl86t01j697vrb6ekjf2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 6142 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 [MCI Extensions.BAK] m2v=MPEGVideo mod=MPEGVideo [Trimmed]
Note that null byte poisoning of paths no longer works as of PHP 5.3.4. In some instances, though, it is not required, so do not consider this alone as a fix for file inclusion vulnerabilities.
Aside from disclosing arbitrary files, file inclusion can sometimes be used to trick the server into interpreting arbitrary file types (such as jpgs) as code.
Prevent file inclusion
If possible, avoid passing user input to any functions that read or include files. If this approach cannot be avoided, try taking a whitelist approach to validating data, as is done in Listing 25. If the number of valid values is too great for a whitelist, check for any traversal sequences or null bytes and reject (do not attempt to sanitize) the request. Ensure that the server appends the extension of the user-submitted filename.
Listing 25. Updated language selection code that blocks file inclusion attacks
$languages = array( "en-us", "en-ca");if (isset($_COOKIE['language'])) { if (in_array($_COOKIE['language'], $languages) require_once($_COOKIE['language'] . ".php"); else die("Invalid language.");}
Because the updated code allows only cookie values contained within the languages array, users can no longer exploit the language selection functionality to include arbitrary files.
While local file inclusion is a serious threat, the consequences of the attack described in the upcoming sections can be even more severe.
OS command injection
As you might expect, OS command injection is a very serious threat. If user input is passed to a function that executes operating system commands, take great care to ensure that the data is properly escaped.
The mock image compression of the user preferences functionality is vulnerable to OS command injection. Commands can be injected by passing the pipe character (|) followed by a malicious command using the image compression data in the body of the request (see Listing 26).
Listing 26. The body of a malicious request
------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="firstname" John ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="lastname" Doe ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="newpassword1" ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="newpassword2" ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="picture"; filename="x.txt" Content-Type: text/plain ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="userid" 2 ------WebKitFormBoundaryFnGBYVe08wA8NMrs Content-Disposition: form-data; name="imagecompression" 5|calc ------WebKitFormBoundaryFnGBYVe08wA8NMrs-
The value passed to the system function is shown here:
"C:\tools\xampp\tmp\php7533.tmp" 5|calc
Prevent OS command injection
Avoid passing user input to functions that execute OS commands. You usually can use safer API functions to achieve a similar outcome. If a safer approach cannot be taken and untrusted data must be used to create command-line arguments, ensure that the data is properly escaped. The PHP API provides a function for escaping dangerous characters called escapeshellcmd. Listing 27 shows the corrected user preference code.
Listing 27. Use of escapeshellcmd to sanitize user input
$compress_command = "ping $image " . escapeshellcmd($_REQUEST["imagecompression"]);
By passing user input to
escapeshellcmd before passing it to system,
malicious characters such as pipe can be sanitized.
The next vulnerability covered often has an outcome similar to that of OS command injection.
Scripting language injection
A scripting language injection vulnerability is present when user input is interpreted as code. In many cases, this leads to compromise of the server as the attacker is able to execute code within the security context of the interpreter process.
Because user-submitted data is passed to the
eval function, the
calculator functionality of CMA is vulnerable to scripting language injection. Both
the X and Y inputs can be used to execute arbitrary code, but because they are of
the number type, client-side restrictions have to be bypassed. This bypass can be
achieved by using a web debugging proxy:
or by creating the query string manually:
The effects of the scripting injection attacks on the evaluated code are:
echo 1 + 1;system("calc"); and here:
1;system("calc");// + 1;
Prevent scripting language injection
Avoid evaluating user input as code. Relevant functionality can usually be created by using safer API functions (this is the approach taken in Listing 28). If it cannot be avoided, apply strict validation (whitelist if possible), and reject any input that is deemed unsafe. Do not attempt to sanitize user input.
Listing 28. Rewritten calculator logic
<?php $x = $_GET["x"]; $y = $_GET["y"]; $operation = $_GET["operation"] == "operation-add" ? "+" : "-"; // Patched reflected XSS vulnerability $arithmetic = htmlentities("$x $operation $y"); echo $arithmetic . " = "; if ($operation == "+") echo $x + $y; else echo $x - $y; ?>
Because use of
eval is avoided in the updated code, it is secured
against script language injection.
The next section explains how arbitrary file creation can be exploited to a similar effect.
Arbitrary file creation
In many instances, the result of arbitrary file creation is similar to scripting language injection; an attacker can create a file with the appropriate extension and then access it to execute arbitrary code. The attacker can achieve this several ways, and you need to use caution when you work with any functionality that can be leveraged to create files. In some situations, this functionality can be combined with other vulnerabilities, such as directory traversal, allowing the attacker to wreak more damage.
One way to create an arbitrary file is to use the profile picture feature of the user
preferences to upload a PHP file rather than an image. A simple script can provide a
remote shell:
<?php system($_GET["CMD"]); ?>.
After it is uploaded, an attacker can then access the script to run OS commands with ease:
Depending on whether an appropriate SQL injection vulnerability is present and the
configuration of the server, it might be possible to leverage SQL to create a new
script. Depending on the SQL server permissions, it might be possible to utilize
directory traversal to overwrite critical system files, effectively compromising the
SELECT '<?php system($_GET["CMD"]); ?>' FROM dual INTO
OUTFILE '../../htdocs/shell.php'
The first column of the query should look familiar; it is actually a string literal containing the malicious file in Arbitrary file creation (see Listing 29).
Listing 29. The shell creating query injected into CMA using the UNION operator
http://localhost/CMA/insecure/search.php?query='and%201=0%20UNION%20SELECT %20'%3C?php%20system($_GET[%22CMD%22]);%20?%3E',''%20FROM%20dual%20INTO%20OUTFILE %20'../../htdocs/shell.php';%23
You can discover target paths for this type of attack through trial and error or by leveraging an information leakage vulnerability (not covered in this tutorial) that reveals the absolute path of the document root.
Prevent arbitrary file creation
If possible, perform whitelist validation on the extensions of any files that users might create. This approach is the approach used to fix CMA, shown in Listing 30 and Listing 31. If a similar fix cannot be implemented, use blacklist validation to ensure that no malicious extensions are allowed. For Apache and PHP, this approach means rejecting several extensions, such as PHP, PHTML, and HTACCESS. If input is deemed malicious, reject it; do not attempt to sanitize any questionable data.
Listing 30. A helper function used to check for null byte poisoning
function IsNullPoisoned($string) { return strpos($string, "\x00") != NULL; } function IsValidImageExtension($file) { $validExtensions = array( "jpg", "png", "gif" ); if (IsNullPoisoned($file)) return FALSE; $ext = pathinfo($file, PATHINFO_EXTENSION); return in_array($ext, $validExtensions); }
IsNullPoisoned function checks the string for any null bytes and
returns true if the position is not null while the
IsValidImageExtension function checks to ensure that the filename
is not null poisoned and that its extension is in the whitelist.
Listing 31. The CMA user picture functionality with added file extension validation
if (!IsValidImageExtension($_FILES["picture"]["name"])) die("Error uploading image.");
To prevent attacks, the name of the user-submitted file is passed to the
IsValidImageExtension function, and if false is returned, the
script is terminated.
With PHP, I recommend that you avoid regular expression-based extension filters. Listing 32 shows a validation function that can be bypassed.
Listing 32. Insecure extension validation
function IsValidImageExtension($file) { return preg_match('/\.(jpg|png|gif)$/i', $file); }
The implementation in Listing 32 prevents some attacks, but the
preg_match function might be susceptible to null byte poisoning:
As Listing 33 shows counter-measures for this, but because of the added complexity, avoid this route.
Listing 33. Corrected regular expression-based validation
function IsValidImageExtension($file) { return !IsNullPoisoned($file) && preg_match('/\.(jpg|png|gif)$/i', $file); }
Check the filename for null byte poisoning before you use
preg_match to
prevent the attacker from injecting the string-terminating character.
Ensure that all SQL injection vulnerabilities are patched to stop attackers from using database server functionality to manipulate the file system. If the application does not require such functionality, consider disabling the features using database privileges. If possible, run the database server on a separate server than the HTTP server.
For an extra layer of security, store user-uploaded files outside of the document root or forbid access to users by using web server features if direct access is unnecessary. If an attacker is able to bypass file extension filters, this approach makes accessing and executing the malicious script more difficult. Do not give the client control of the upload destination folder; otherwise, an attacker might use directory traversal (covered earlier in this tutorial) to store the file in an unprotected directory.
As already stated, this tutorial is in no way comprehensive. In fact, no such source exists due to the ever-changing landscape of software security. The best protection against continually evolving attackers is to stay current by regularly reading about new security threats. For several excellent sources that examine in depth why vulnerabilities occur and what can be done to prevent them, see Related topics. Remember, just as a system cannot be declared bug free, it cannot be deemed completely secure.
Downloadable resources
- PDF of this content
- Tutorial source code (CMA-Source.zip | 9KB)
Related topics
- Introduction to jQuery Mobile (C. Enrique Ortiz, developerWorks, February 2011): Find more information on developing with jQuery Mobile.
- Packet Storm: Explore an excellent source for exploits, advisories, and tools both old and new.
- The Web Application Hacker's Handbook (Dafydd Stuttard and Marcus Pinto, Wiley, October 2007): Get a broader view of web application security in this practical guide to finding and exploiting security flaws.
- The Open Web Application Security Project (OWASP): Find a lot of relevant information and tools for improving the security of application software.
- Common Vulnerabilities and Exposures (CVE): Explore a good source for information on publicly known information security vulnerabilities and exposures.
- The Open Source Vulnerability Database: Peruse another source of public vulnerability information similar to CVE.
- jQuery Mobile: Visit the home page for a unified user interface system across all popular mobile device platforms, built on the rock-solid jQuery and jQuery UI foundation.
- jQuery Mobile: Demos and Documentation: Access articles, APIs, and demo code for this touch-optimized web framework for smartphones and tablets.
- jQuery.org: Visit the home page of the jQuery open source team.
- Mobile Design and Development (Brian Fling, O'Reilly Media, August 2009): Explore practical guidelines, standards, techniques, and best practices for building mobile products.
- The jQuery Mobile CDN: Get jQuery Mobile quickly with already minified and compressed versions of jQuery Mobile.
- MAMP: Mac - Apache - MySQL - PHP: Get and install a Mac-based Apache, MySQL, & PHP environment local server environment.
- XAMPP: Get a very easy-to-install Apache Distribution for Linux®, Solaris, Windows, and Mac OS X. The package includes the Apache web server, MySQL, PHP, Perl, a FTP server and phpMyAdmin.
- Fiddler: Download and try a web debugging proxy that logs all HTTP(S) traffic between your computer and the Internet.
- developerWorks Open source zone: Find extensive how-to information, tools, and project updates to help you develop with open source technologies and use them with IBM's products.
- IBM XML certification: Find out how you can become an IBM-Certified Developer.
- XML technical library: See the developerWorks XML Zone for a wide range of technical articles and tips, tutorials, standards, and IBM Redbooks. Also, read more XML tips.
- IBM product evaluation versions: Get your hands on application development tools.


text:
James H. Bowen
Civil War (Union)
Conflict Period
Civil War (Union)
Added by: RichardRPhillipsJr
Served For
United States of America
Added by: Fold3_Team
Looking for more information about James H. Bowen?
Find more recordsSearch through millions of records to find out more.
Additional Info
- Owner:
- RichardRPhillipsJr - Anyone can contribute
- Created:
- 10/25/2014
- Modified:
- 10/25/2014
- View count:
- 609 (recently viewed: 1)


text:
When the air in cities becomes so toxic that allergic and sensitive individuals must wear masks and eye shields, there is trouble afoot. When major segments of a population can no longer trust the quality of the local water and resort to using their own filtration systems or buying bottled water, it's time for some serious reevaluation of priorities.
In Greek mythology, the earth was seen as our mother and was called Gaia. The hypothesis that Gaia is a living entity, a single organism, was first suggested by Johannes Kepler hundreds of years ago. James Lovelock developed that concept further in Gaia: A New Look at Life on Earth. Observing that our planet has
systems that closely regulate temperature, oxygen concentration, and at least twenty other variables, Lovelock reasoned that the earth is much more than a hunk of rock with different species of plants and animals living on it. Rather, he proposed that it is a whole system made up of many smaller systems, including humankind.
- Susan Griffin
There is no precise point at which the mind stops and the body starts. Similarly, there is no place where the individual stops and the environment starts, and vice versa. The nuclear accident at Chernobyl in the former Soviet Union affected the agriculture of the entire European continent. We are all interdependent. People no longer have the luxury of thinking of themselves as belonging to separate nations. Just as you cannot expect to find healthy fish in a polluted pond, you cannot expect to remain a healthy human being when you're breathing polluted air, eating devitalized food, and watching the earth being stripped of her resources. Wellness is an illusion if there is no commitment to the health of the whole planet.
Did You Know?
- Edmund Burke
You Can Make a Difference
Contribute to a saner environment by examining your own lifestyle for waste. Start a family recycling program. Take the time to separate newspapers, glass, plastic, and metal items from your trash and send them to a local recycling center. Bring your own boxes or bags to the grocery store, buy in bulk, and buy foods and beverages in containers that can be recycled. Save and reuse mailing envelopes, boxes, packaging of all kinds, wrapping paper, aluminum foil, and so on. Contribute clothing, old furniture, and household
items to charitable organizations that distribute them or prepare them for resale.
There are many other practical, everyday choices you can make that will contribute to your own health and support the earth at the same time.
- Nietzsche
The online version of Dr. Travis' Wellness Inventory may be accessed at (www.WellPeople.com). The Wellness Inventory may also be licensed by coaches, health and wellness professionals, and organizations.


text:
|Yale-New Haven Teachers Institute
Guides to the curriculum units prepared each year consist of synopses written by their authors and contain recommendations of the school courses and grade levels where the units may best apply.
Images that appear in the original printed units are, in most cases, not here online. To obtain a photocopy of a specific portion of a printed unit, please email a detailed request through this Web site's guest book. Manuscripts and Archives, Yale University Library, fills such requests for a nominal charge in the order they are received.


text:
August 25, 2019
|IRONMAN Vichy
|Tier 4: € 540
|The price is currently 540€ +8 % Active Fee for every Tier Pricing
|Please not that price changes can occur at any time!
All the Race Organization required for IRONMAN including transition area, swim course, swim safety cover, traffic management for road closures, stewards and equipment for volunteers; Entry to Welcome Dinner; Entry to Awards Banquet; Race day nutrition at the aid stations; Athlete Backpack; Finisher T-Shirt; Finisher Medal; Athlete Village post-race food; Free Massages after the race.
Athletes who register on or before 2 December 2018 are eligible to defer their 2019 race entry to the 2020 IRONMAN Vichy event free of charge. All deferral requests will be honored until 45 days before 2019 race day regardless of the reason for deferral. The deferral may only be used once. Athletes who elect to defer their entries forfeit any partial refund or insurance refund.
Athletes who register on or before 2 December 2018 may elect to pay via a three-part payment plan. Athletes will be charged the Tier 4 price in three equal instalments. To elect the payment plan, an athlete needs to register under the "Payment Plan" category during the first 90 days of general entries being available and make the initial 180€ + 8% Active Fee payment. All three payments must be completed for an athlete to race – partial payments will not be refunded or honored as race entries. Athletes electing the payment plan may also utilize the deferral option listed above once all three payments have been completed.
Payment 1: At the time of registration.
Payment 2: Will be requested on December 18, 2018 and due by January 1, 2019.
Payment 3: Will be requested on January 17, 2019 and due by January 31, 2019.
IRONMAN Vichy 2019 will offer Tiered Pricing based on slot inventory rather than dates for this event. Once slots are sold at each level the price will go up.
Due to Priority Registration, please note that General Entry Registration may open at Tier 2 Pricing if capacity has been filled for Tier 1 Pricing.
Please click here to read the transfer and withdrawal conditions >>


text:
In an announcement posted Wednesday to its website, UPS said that 51 locations, or around one percent of its 4,470 franchised stores across the country, were found to have been penetrated by a "broad-based malware intrusion." The company recorded approximately 105,000 transactions at those locations, but does not know the precise number of cardholders affected.
UPS did not say precisely how such data was taken, but given the recent breaches at hundreds of supermarkets nationwide, point-of-sale hacks at Target, and other major retailers, such systems would be a likely attack vector. Earlier this month, a Wisconsin-based security firm also reported that 1.2 billion usernames and passwords had been captured by a Russian criminal group.UPS Store spokeswoman Chelsea Lee told Ars that the company was alerted to the potential intrusion based on a government bulletin issued by the Department of Homeland Security. After receiving that bulletin, UPS "retained an IT security firm and conducted a review of its systems and the systems of its franchised center locations."
Ars asked UPS to provide a copy of this bulletin, and Lee said she would look into it. Ars has also filed a Freedom of Information Act request to gain a copy of this bulletin.
The company also said that anyone who used a credit card at any one of the 51 locations between January 20, 2014 and August 11, 2014 may be at risk—the malware was apparently "not present on the computing systems of any other UPS business entities."
"I understand this type of incident can be disruptive and cause frustration," Tim Davis, president of The UPS Store, said in a statement. "I apologize for any anxiety this may have caused our customers. At The UPS Store the trust of our customers is of utmost importance. As soon as we became aware of the potential malware intrusion, we deployed extensive resources to quickly address and eliminate this issue. Our customers can be assured that we have identified and fully contained the incident."
UPDATE 8:11pm CT: One reader sent us a copy of the bulletin, which was distributed by the Department of Homeland Security and the United States Secret Service.
That document precisely matches an online alert dated July 31 and updated on August 18 from the United States Computer Emergency Readiness Team (US-CERT), along with technical analysis from Trustwave SpiderLabs. We were notified of these two links by a second Ars Technica reader.
"The forensic investigations of compromises of retail IT/payment networks indicate that the network compromises allowed the introduction of memory scraping malware to the payment terminals," the bulletin states. "Information security professionals recommend a defense in depth approach to mitigating risk to retail payment systems."


text:
- Features
- Specs
- Manuals & Guides
- Testing
- Reviews
- Media
Features for the JENSEN CD/DVD/MP3/WMA Player in Housing- DIN Mount
- Positive amber colored LCD for improved daylight viewing
- Single DVD / CD playback (Supports DVD, VCD, CD-DA, MP3, WMA formats)
- On-Screen-display menu for status readout and settings control
- Selectable video output aspect ratio (4:3, 16:9)
- Parental lock
- Clock
- Volume and mute controls
- EQ presets classical, pop, rock
- Low-level A/V output (RCA) [variable audio]
- Front & rear A/V inputs (RCA female)
- Compatible with Jensen TV remote controls
- Programmable video output ( PAL/NTSC)
- Full-function wireless remote included
- JENSEN MWR75 Wired remote compatible
- Direct control compatibility with JENSEN PADIN4 & PADIN5 PA/DVD controllers
Specifications for the JENSEN CD/DVD/MP3/WMA Player in Housing
|Weight (Lbs)
|Overall Dimensions
|Maximum Power Output (Watts x Channel)
|Signal-to-Noise Ratio @ 1Watt/4 Ohms (dB)
|Mounting Hole Dimensions (Inches WxH)
|7-1/4 x 2
|Mounting Depth (Inches)
|Watertight Standard Compliant
|Conformal Coated PCB
|Plastic PCB Insulator
|iPod Ready
|Wired Remote Control Ready
|Wireless Remote Control Ready
|Positive LCD Display
|MP3/WMA Playback
|AM/FM Tuner
|USB Input
|Auxiliary Audio Input
|Preamp Line Level Outputs
|Electronic Disc Skip Protection (Seconds)
|Radio Broadcast Data System Text Display
|Non-Volatile Memory for Presets & User Settings 2-Wire Power (Access ACC, GND)
|NOAA Weatherband/Weather Alert
|ASTM B117 Salt Spray Exposure Standard Compliant
|ASTM D4329 UV Exposure Standard Compliant
Manuals & Guides for the JENSEN CD/DVD/MP3/WMA Player in Housing
Product Downloads
|DVDB01Owners Manual (Size: 4.4 MB)
Troubleshooting Guides
|DVDB01 Troubleshooting Guides (Size: 82.8 KB)
Our hands on Engineering Research and Development team builds quality into our JENSEN & Voyager products from the beginning by expertly designing each product from the ground up and validating all designs through extensive testing that is primarily conducted in our own on-site test lab. Therefore, JENSEN Audio & Video products and Voyager Camera Systems offer MORE durability and performance than you would expect from standard electronics.
Temperature/Vibration Chamber
Long duration product exposure to constant random frequency operational vibration and non-operational vibration to simulate rugged road conditions. Simultaneous temperature cycle and vibration exposure are also conducted for additional data that is relevant to detecting potential material/component weaknesses and calculating product life expectancy.
Electrostatic Discharge
The last thing you need is for your radio to quit due to accidental static shock. That's why our products go through the extensive Electrostatic Discharge Test on all exposed control areas as well as I/O connections so they can withstand the most severe static build up. Shocking, isn't it?
Load Dump
Severe electrical environments are relatively common mobile applications. We understand these environments and what it takes to protect electronics that will be exposed to them. That's why all of our products include specific and significant front-end circuit protection and filtering that is proven to withstand the toughest electrical environments. The Load Dump Tests puts destructive pulses (spikes) to simulate the sudden disconnection of the battery from the alternator while the alternator is generating current to load the battery. Such Load Dump pulses are high energy pulses with a high potential of destruction ensuring that our electronics are protected.
DC Voltage Overstress
Uses a power supply, applies 18 VDC for 5 minutes. For Heavy Duty products: Applies 24 VDC for 5 minutes to simulate a vehicle that is jumpstarted.
Reverse Polarity
The Reverse Polarity test uses a car battery to test the durability of the product when the (+) and (–) cables are accidentally reversed.
Power Line Noise Rejection
Test throws noise onto the signal and simulates product reaction to alternator whine.
Simulated Crank Start Voltage
Used to test electronics depreciation and altercations when vehicle is turned on.
High/Low Operating Voltage Test
Both tests used to ensure electronics consistency when vehicle battery goes below or above the normal 12V. Product must remain operational throughout the test.
Shorted I/O
Ensures that product will function when inputs and outputs are connected improperly to the product.
High/Low Operating Temperature
Long-Duration product exposure to operational temperature extremes and rapid temperature cycles that are experienced in outdoor mobile applications. In addition, we test for High humidity introduced at high-temp to test the effectiveness of circuit corrosion protection (conformal coating).
Pushbutton/Hinge/Mechanism Durability Cycle
Inductive Load Switching
Tests product well above and below the average waveform to ensure that it can withstand the extreme fluctuations.
Questions about the JENSEN CD/DVD/MP3/WMA Player in Housing
Ask a Tech Expert Your Question:
- Installation Pictures


text:
Welcome to the Raider Battalion! On behalf of the Raider Battalion Cadets and Cadre, we welcome you to join our ranks. The instructors (Cadre) and staff assigned to the Raider Battalion serve selflessly to provide world-class military and leadership training. We follow a structured program of military history, leadership and national security. The Wright State University Army ROTC Detachment has been in existence since 1970.
The program started as extension program of the University of Dayton. In 1997, the Raider Battalion became a host program establishing its own traditions, history and lineage. The Raider Battalion has commissioned hundreds of officers into the United States Army where they serve proudly in the Regular Army (active duty), in the United States Army Reserve or the National Guard.
The Cadre and staff abide by the Wright State University's foundational principles and the Army Values. The Raider Battalion Cadets are dedicated to succeed and excel physically, academically and in all the dimensions of leadership. We hope you become a part of our team and become part of the less than 1% of the U.S. population who serves our country as a commissioned officer!
Wright State University Raider Battalion
"Wisdom, Strength, Unity...Raiders!"
Have a Question?
Interested in Army ROTC? Fill out the form below and ask about scholarships, career fields, training options, and more.
Wright State values your privacy.


text:
Welfare benefits are payments, including tax credits, which the Government makes to those on who are on low incomes or who meet certain criteria. There have been votes in Parliament on the level of these payments and if they should increase at least in line with prices.Photo: UK Parliament
TheyWorkForYou has automatically calculated this MP's stance based on all of their votes on the topic. You can browse the source data on PublicWhip.org.uk.
Note for journalists and researchers: The data on this page may be used freely, on condition that TheyWorkForYou.com is cited as the source.
For an explanation of the vote descriptions please see the FAQ entries on vote descriptions and how the voting record is decided
Profile photo: © Parliament (CC-BY 3.0)


text:
Susan Gaidos
Contributing Correspondent
Susan Gaidos has been writing about discoveries in areas ranging from biology and neuroscience to physics and technology for more than three decades. Her features, profiles and news stories have appeared in New Scientist, theDallas Morning News, The Scientist, Howard Hughes Medical Institute Bulletin, and Science Careers. She also writes articles on science-related topics for children and is a contributor to Science World and Science News for Kids. She has degrees in journalism and biology from Southern Illinois University at Carbondale, and undertook post-graduate studies in biology at Purdue University while working as a university public information officer. She has received gold and silver awards in medicine and science writing from the Council for Advancement and Support of Education, and received the National Institutes of Health's Plain Language Award in 2009 for contributions to the NIGMS publication Computing Life.
Follow her on Twitter: @Gaidoss


text:
Houses for Rent in Stittsville, Ottawa, ON - 1 Rental available
(613) 836-3005
- Studio
Popular Searches
Renting a house in Stittsville, Ottawa, ON
You know it's time for a change, and snatching your dream house might be the perfect way to start. If you're not sure where to look, we'll give you a tip. Whether you're looking for duplexes, townhouses or single family homes for rent, you're sure to find what you need.
Renting a house. It's a family affair!
Single family homes have long been an attractive option for family oriented people. If you have a big family, 3 bedroom and 4 bedroom properties might be the right fit for you. To find the home of your dreams, don't forget to use the filters on RENTCafé, so you can be sure that you're not wasting any time looking at properties that don't interest you. Soon enough you will be enjoying the privacy and comfort of your new home, without any noises coming from the upstairs neighbors. Don't forget about the added benefit of having a backyard, a safe place for your children and family pet, where you can also try your hand at gardening and, why not, grow your own organic vegetables. Don't forget to ask your landlord for permission in writing before you make any changes to the landscape. If one of the 1 Stittsville, Ottawa, ON home for rent is the right one for you, you can apply for a lease online right here on RENTCafé.
Nearby Neighborhoods


text:
On Stevin McNamara's latest CD, he combines his beautiful acoustic guitar playing with a lively blend of world percussion. The melodies on these songs are based on Rag Malkauns, one of the most beautiful, popular and ancient of the ragas (a melodic framework based on a series of five or more musical notes) in Hindustani Classical music. The music tempo is 108 beats per minute, and there are 108 interwoven musical phrases throughout the 60-minute recording.
108 is a very sacred number in India and reflects the Eastern influences on these compositions, and 108 is also an upbeat tempo that is suited to an active yoga practice or a chill dance session. If you want to create an amazing playlist for a long yoga practice, mix these tracks with some of the mellower tracks from Stevin's excellent Om Guitar CD.
Purchase Prana Groove by Stevin McNamara


text:
Labor Day Pregnancy Announcement Chalkboard Sign
This adorable chalkboard print is the perfect way to announce your pregnancy! You will be emailed a high resolution jpg photo file in your choice of size (8x10, 11x14 or 16x20).
Before adding the item to your cart, please include the following information. The information needed will vary based on the chalkboard sign being purchased. Please use the photo shown as a guide for adding your information for the board.
*Due Month
*Due Year
*Last Name (if applicable)
- CHOOSE FILE SIZE - Select either 8x10, 11x14 or 16x20
- CHOOSE PROCESSING TIME - Choose how quickly you'd like your digital file emailed to you. Standard processing is 2 to 3 business day. Rush processing is 24 hours or less if you need it before the standard processing time
- PERSONALIZE & CHECKOUT - Enter the sign details as requested (due month & year, size, and last name if applicable) then add the sign to your cart and proceed with checkout.
**Printable item sent via email - No printed items will be mailed.** The digital file will be sent to the email address you provide at checkout within the processing time you choose (2 to 3 business days or within 24 hours) after providing all information needed to complete your sign. Please note that failure to provide all of the necessary information may cause a delay in processing.
The sign will be sent in final format, so that if there are no changes needed, you are ready to print immediately. However, if there are changes, please let us know and we will gladly make them and email the revised sign.{PRINTING & PHOTO SUGGESTIONS}
Signs are set up with a .25" bleed/safe area for professional printing.
Print your file at any photo lab (Walmart, Walgreens, etc) as a matte finish photo or poster. For larger poster-size prints, Office Max, Staples & Kinkos work well also. Frame it without the glass, then take your photo. This eliminates the glare of the glass from the photo.
By purchasing this sign, you are acknowledging that you understand that printed colors may vary from one computer monitor to another, as well as from one printer to another; therefore, Social Party & Paper cannot be responsible for color variations. The color displayed on your screen may not be the exact color that is printed. Because there are many variables that may affect printing results, no refunds or revisions of colors may be done if you don't like the color that is printed versus the color you see on your screen.
Copyright © Social Party & Paper. For personal use only.