Are image uploads also vulnerable to sql injection?

Question: I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he can upload images only, can he still perfrom sql injections? Please guide.
Comment: All that tells you is that the server is running php, and that there is a script that accepts file uploads of some kind. The presence of an SQL daemon isn't suggested.
Answer: Actually they can be malicious. One of the challenges of the CTF of 29C3 was actually to upload an image and perform SQLi with it.
How did it work? Well images have metadata, after you uploaded the image, the metadata was extracted and put into the database. So the trick to get the flag was to include SQL in the metadata. (the input was not correctly sanitized).
Answer: Yes and no.
Images are just data, and as such, they are no different from form fields, GET parameters, or any other kind of user-supplied data. There really isn't anything special about them, except that most other data you'll receive is textual, and that they typically don't contain anything that "could possibly resemble SQL". The latter is a false assumption though, since most image file formats cater for metadata, which makes it extremely easy to embed SQL in them, and even if they don't, crafting an image file that contains SQL as part of the binary data stream shouldn't be too hard.
Long story short: if you have your query parametrization in order (which you should anyway), then you have exactly as much to fear as with any other user-supplied data: as long as you pass the image blob as a parameter, and the database API's parametrization calls aren't vulnerable, you're good. If, however, you decide to concatenate things into your query that have been extracted from an uploaded file, you have a problem of exactly the same kind as if you had an SQLi vulnerability through a form field.
Another thing you need to look out for with file uploads is remote code execution. If you don't watch out, an attacker can upload a PHP file, disguised as an image, and trick your script into saving it in a location where it can be reached and executed through apache (or, worse, in a location where it gets picked up by a system-local process, in the worst case, one that runs as root). The defense here is to verify and whitelist a file's MIME type, make sure its extension matches the MIME type, sanitize (or just completely replace) the filename, and store it somewhere outside the docroot.
Answer: Image Uploads aren't directly vulnerable to SQL injection, as long as you're verifying that the image is actually an image.  By this, I mean not simply relying on the file name.  It could be possible for someone to upload an "image" that isn't an image at all and contains SQL injection scripts.  If the image contains SQL commands, then am image upload can put you at risk of SQL injection indirectly.
There are a whole host of other potential issues related to image uploads, including preventing users from uploading infected images (several image types can be infected with malware) and, if the website isn't crafted right, they may be able to use image gleaned from uploading images to figure out how to do a Directory Traversal attack.  But these are very different from SQL Injection.
See: (Related attacks)

https://www.owasp.org/index.php/Unrestricted_File_Upload
https://www.owasp.org/index.php/Path_Traversal
https://www.owasp.org/index.php/Path_Manipulation
https://www.owasp.org/index.php/Windows_::DATA_alternate_data_stream
http://php.webtutor.pl/en/2011/05/13/php-code-injection-a-simple-virus-written-in-php-and-carried-in-a-jpeg-image/

and finally, the one below mentions steps to ensure the item being uploaded is actually an image.

https://stackoverflow.com/questions/4166762/php-image-upload-security-check-list
Comment: Try uploading a `malicious.php.jpg` or `malicious.jpg.php` - most filters just check the final extension/presence of `.jpg`, and many common apache configurations will still pass both files to the php engine when they are requested.
Comment: @lynks - good point.  I actually knew that, but spaced it.  Thanks for keeping me honest.  I edited the answer.
Comment: The SO link is for PHP only. In .NET I do something similar using the System.Graphics library, and I'm sure other platforms have similar defenses.
Answer: The image file by itself will not do SQL injection, but the image file does not come alone; it includes a file name. SQL injections are about server code carelessly including character strings within a request to a SQL database, where the included string comes from the potentially hostile remote user. The file name is a string which has been chosen by the remote user. Therefore...
Answer:
"Another thing you need to look out for with file uploads is remote
  code execution. If you don't watch out, an attacker can upload a PHP
  file, disguised as an image, and trick your script into saving it in a
  location where it can be reached and executed through apache"

Yep, this is very common.
Many shell "providers" will actually advise it as a preferred/default upload method in the shell description.
Changing the file name is you best bet here (+1) and some content/file managers will do it out-of-the-box (i.e. K2 for Jommla).


Online resource for names by culture

Question: Looking for resources to find names for a campaign, preferably sorted by language/culture. I like BehindTheName, but am wondering if there are other favorites that people always use.
Comment: I'm voting to close this question as off-topic because undifferentiated list questions are no longer within this site's scope. Could be improved with the addition of more specific information about the context of the request.
Answer: The Onamastikon is superb. Tons of real world historical name lists.
Comment: Be aware that Kate Monk wasn't really striving for accuracy when she put the Onomastikon together.
Comment: I found this the most interesting of those suggested so far. Thanks!
Answer: If you can live with names that simply have the "feel" of a particular culture (same morphemes, etc.), there are good ones at:
Chris Pound's Name Generation Page
http://www.ruf.rice.edu/~pound/
and
squid.org Random Name Generator
http://www.squid.org/rpg-random-generator
If you want names that are actually used in real world cultures, your best bet may be one of the infinitude of "baby name" websites.
Answer: BehindTheName.com is an excellent resource for most Western names, and features a great random name generator.
Comment: +1. I had bookmarked the African names page (that's what I was originally looking for), but *completely* missed the Random Name Generator! Thanks!
Answer: The Story Games Names Project† contains more than 100 lists for different cultures and genres, each one containing at least 20 male, 20 female, and 20 surnames. Many of the lists contain more than that.
The project resulted in a published book as well as the online index of names in PDF and text formats, released under a Creative Commons license. The book is a great offline reference at the table, but the online version is a useful reference accessible from anywhere there's a browser.
†The book/project is confusingly named. It's not a project of names just for story-games, but rather a names project that was organised on story-games.com.
Answer: I've long been a fan of the Random Name Generators at Rinkworks. There's  your basic stuff, plus some more esoteric types of name generation (like the Fake Pokemon Names) and even an advance name generator so you can set up custom random name creation. Pretty sweet.
Answer: SCA name research sites are a BIG source...
Laurel Sovereign At Arms (http://heraldry.sca.org/laurel/names.html)handles all SCA name registry for the Society for Creative Anachronism, and the sites linked to are all fairly well documented, most to historical publication standards.
Don't bother asking for help here, tho'. The resources and time are dedicated to SCA heraldry, and it's a lot of work for the senior heralds, and those senior heralds are busy.
Acadamy of St. Gabriel (http://www.s-gabriel.org/) is pretty much the first source I turn to as an SCA herald; anything they use is documented to SCA standards or better, so I seldom have to go much afield from there.
A word of warning, tho'... contacting them for help with character names is bad form, but using their online resources isn't. They're focused on the SCA and other similar groups, like Acre or Corinthia.
Both, however, are excellent also for researching realistic heraldry.
Both also have links to a number of other sources.

Online resource for names by culture


What are general causes of clumsiness in toddlers?

Question: My 20 month old daughter is particularly clumsy. She is constantly falling, walking into things, stumbling, and even having a hard time getting up after she falls. I would almost describe her walking as a perpetual state of falling. I have 5 kids, so I know that all kids are different, but she is significantly clumsier than any of my others were. What are common reasons why a child would have this issue?
Answer: Has she always been clumsy? I'm not a doctor, but the first thing that comes to my mind is a potential issue with her balance organs, in the ears. There are methods to test for that.
There are simple physiotherapeutical manoeuvres to get rid of any disturbing material in all the loops of the ear, which might resolve it if that's the problem in the first place.
It might also be a virus on the ear. I had that once or twice, it was just like being massively dizzy and seasick.
I'm sure you've already asked your paediatrician, but ask again, and ask to be referred to a specialist.
Comment: Yes, always clumsy, and still ongoing. It's probably a genetic inner-ear issue. We'll look into the maneuvers, that seems promising. Thanks.
Answer: With our three we have noticed that every time they get clumsy they have a growth spurt, so much so that for the youngest one a day of clumsiness is enough warning for us to get the next size box of her elder sister's old clothes down from the attic in preparation.
As their bodies undergo size changes it takes time for their brains to release accurate proprioception.
As per @Torben's answer there may be a medical reason, but it may be nothing more than normal growth.
Answer: Children with ear infections or fluid in the ears often are more "clumsy" than others. The hearing mechanism houses the semicircular canals that are so important for balance.
Ear infections are often called "the silent illness" because fluid can be present with no pain or other symptoms. So sometimes, poorer balance is the only indicator of a problem.
Also, abnormalities of the feet and legs can contribute to stumbling behavior. Toeing in and bowed legs are two examples.
Answer: This is obviously an old question now, but I'd add vision issues to the list of possible causes. Good vision is more than just clarity of sight - I had issues with eye teaming (getting both eyes to focus on the same spot in three-dimensional space) as a kid, and have seen clumsiness as a symptom before. Doing an eye checkup with an eye doctor that does vision training with kids could shed light on whether or not this is a factor.
Answer: I've heard tell that part of this is due to how much infants crawl before they walk, and can't quite confirm with my two boys quite yet, so its sort of anecdotal but here are my suspicions.  Part of it is how kids learn balance, those who don't crawl much or walk assisted seem to be more prone to balance issues later on, my older son seems to be like this and I know one other child about the same age who has the same issues.  My son and our friends son never crawled much as kids, they sort of skipped to walking, sometimes they fall - more noticable to me while being their soccer coach.  My younger is a fast crawler and spends time getting up and down, seems to be more in balance; I'll confirm this to myself in a few years since they are way different kids.
Some things we did to sort of negate issues that it might be physical, get good fitting clothes, my older son needs looser clothes otherwise they tend to pull and he loses balance.  Good fitting shoes, sometimes my wife buys them a little big, which is fine unless they are the slip ons, I've seen those fly across the soccer field more than once.  Give them some exercises to sort of improve their skill, as their bodies grow they need to fit into them, though we haven't had a growth spurt in awhile so its just been more training.  Kung Fu is part of it for us, and sometimes we do obstacle courses while playing which tends to help out my son.  Also make sure the kids are not tired, when my son is winding down he gets more clumsy, but I think that is just natural.


Conformal fields on compactified manifolds? An apparent paradox!

Question: I would appreciate it if someone tells me how a cft on a compactified manifold (e.g. by means of periodic boundary conditions) can be meaningful? The global conformal invariance is broken due to the scale over which the manifold is compactified (e.g. the period). The local conformal invariance of course still classically exists, but for the simple case of a field on a cylinder for instance, the trace of the stress-energy tensor becomes non-zero (in proportion with the central charge); hence apparently compactification of the space-time manifold is in contrast with having conformal symmetry.
Answer: First, if you talk about world sheet CFTs describing compactifications of string theory, as your focus on the "central charge" and "compactifications" suggests, for those we must realize that the world sheet conformal symmetry has nothing to do with the would-be spacetime conformal symmetry. Spacetime transformations are manifested as internal symmetries of the world sheet CFT so they are completely independent from the world sheet conformal transformations that act nonlocally on the world sheet. String theory introduces a preferred distance scale in the spacetime, the string scale (and derived scales dependent on the string coupling, such as the spacetime Planck scale as well), so the spacetime effective theories produced by string theory are never conformal (because they're not scale-invariant).
If you mean compactifications of the world volumes at which CFTs such as those from the AdS/CFT are defined, then it is true of course that they break the conformal symmetry in general. The conformal symmetry is only broken by the global effects, not locally, however. In particular, some compactifications such as your cylinder preserve the conformal symmetry completely. This is particularly well-known for the $N=4$ gauge theory on $S^3\times {\mathbb R}$, a multi-dimensional cylinder, which preserves all the conformal symmetry including the $SO(4,2)$ conformal group.
No, the stress-energy tensor of such a theory still exactly vanishes. The theory is locally the same regardless of the compactification.
Comment: Is your last example similar to the global breaking of conformal symmetry when going from the complex plane to the cylinder (compactifying and so introducing a length scale)? It gives a "vaccum Casimir energy" $E \propto \frac{c}{L^2}$ but still we have $T^{z\bar{z}}=0$, thus tracelessness and local conformal invariance?
Answer: Let me answer in two steps: first of all, and contrary to what you claim, the trace of the stress tensor vanishes also on the cylinder not just on the plane. In fact it is proportional to the Ricci curvature of the world-sheet which vanishes both on the flat plane and on the flat cylinder. On the other hand, what becomes non-vanishing when passing from the plane to the cylinder is the vacuum expectation value of the chiral component $T_{--}$ of the stress tensor (the same is true for the anti-chiral one $T_{++}$). This is a subtle effect which I can explain if I am asked to do so...
Now about your "paradox":  consider first a classical conformal field theory on the Minkowski cylinder, that   is  a theory invariant with respect to the conformal group $G$  of the Minkowski cylinder. (Modulo some covering and discrete factoring the  group  $G$ is just the direct product of two copies of the diffeomorphism group of circle - you can find an elegant  explanation of this fact e.g. in Segal's paper on the axiomatic CFT). It must be stressed, that no subgroup of $G$ acts by rescaling of the standard flat coordinates of the cylinder, however! To be more precise about this crucial point: write the flat metric on the cylinder in the standard Minkowski flat coordinates $t,\sigma$: $$ds^2=dt^2-d\sigma^2.$$
For that matter, $\sigma$ is the angle of the rotation around the cylinder axis; it is not therefore a global coordinate on the cylinder  (although $d\sigma$ makes sense globally). Now you observe that the range of $\sigma$ is the intervale $[0,2\pi[$ hence you cannot scale $t,\sigma$ as $\lambda t,\lambda \sigma$ and indeeed this "transformation" does not belong to the conformal group $G$! Instead, the shifts
$t,\sigma\to t+t_0,\sigma +\sigma_0$ do belong to $G$ and they become the global (complex) scaling transformations when passing from the cylinder to the plane via the standard exponential map!
The moral of the story is the following: the conformal field theories on the cylinder and on the plane are close cousins in the sense that there are transformation rules which transform solution of one into the solution of the other (in quantum version of the theories e.g. the knowledge of the correlation functions on the cylinder makes possible to work out the correlation functions on the plane and vice versa). However, the conformal transformations which are shifts of the natural coordinates on the cylinder become (upon the exponential transformation) the scalings of the natural coordinates on the plane. Since we like to calculate on the plane, we call them always, and somewhat abusively, the  " global scaling transformations".


Are derailluers always or usually compatible with any cassettes?

Question: Is it OK to choose a derailleur without taking into consideration the cassette that will be used with it and vice-versa?
Answer: No.
It's best, though not always entirely necessary, that the number of speeds match. There are some cross-compatible options, but if you're unsure it's better to just stick with a derailleur and cassette that were designed to work together.
It's also important to consider the size of the cassette in comparison to the amount of chain slack that the derailleur is capable of taking up. A road derailleur will often not work with a mountain bike cassette because it can not take up enough slack to account for the size of a mountain bike cassette.
Generally speaking, a cassette and derailleur that are the same number of speeds, made for the same type of bike, and made by the same manufacturer will be just fine.
Answer: No.
I made the mistake of buying a nice looking 8 speed SRAM derailleur, to find that my Shimano 8 speed gear shifters, were incompatible. ie One click of the shifter didn't move the derailleur the correct distance to change one gear on the rear 8 speed cassette


A question about  indecomposable continua.

Question: The term "continuum" is often used to mean a compact and connected metric space. But it is
also used in a broader sense to mean any infinite, complete, separable and connected metric
space-which is not necessarily compact. This is the sense in which we use it here.
A "continuum" is called "indecomposable" if it is not the union of two of its proper infinite subsets, each of which is itself a "continuum". It is known that a compact
"indecomposable continuum" has uncountably many proper infinite subsets that are themselves
"continua".
If C is a non-compact "indecomposable continuum" and S is the set of all its proper infinite subsets that are themselves "continua", what can be said about the cardinal number
of S?
Answer: "Indecomposable continuum" is a bit of a misnomer when you remove compactness.  Standard indecomposable continua will not satisfy this condition.  Such a continuum is the union of an uncountable pairwise disjoint collection of composants, where each composant is equal to the union of all the proper compact subcontinua containing a given point.  If we let $A$ be one of these composants and $B$ be its complement, both $A$ and $B$ will be connected, so we have "decomposed" the space in sense you describe.

In fact, it isn't clear that "indecomposable continua" in the sense you have defined even exist at all.  I suspect that they don't.
Answer: As pointed out by Jeff, the notion you define may not really be what you are after, since indecomposable continua are not 'indecomposable' in your sense. However, we can ask:
Is there a nontrivial connected metric space $X$ such that $X$ cannot be written as the union of two proper connected subsets?
The answer, as Jeff suggested, is no.
Indeed, let $X$ be a nontrivial connected metric space. If $X$ does not have any cut-points, then clearly we can write
$$X = (x\setminus\{x_0\}) \cup (X\setminus\{x_1\})$$
for some $x_0\neq x_1$, and are done.
If $X$ does have a cut-point $x_0$, let $A$ and $B$ be open subsets of $X$ such that
$$A\cap B = \{x_0\}; \quad A\setminus\{x_0\},B\setminus\{x_0\}\neq\emptyset \quad\text{and}\quad A\cup B = X.$$
We claim that $A$ and $B$ are connected. Indeed, if $U\ni x_0$ is relatively open and closed in $A$, then $U\cup B$ is open and closed in $X$, so we must have $U=A$ (since $X$ is connected).
Regarding your question on the number of proper connected subsets, we can still ask the following question:
If $X$ is any nontrivial connected metric space, what can be said about the cardinality of the set $S$ of proper connected subsets of $X$?
It seems plausible that the set $S$ has at least the cardinality of the continuum, but I wasn't able to find a reference (and haven't thought very deeply about it). Certainly the set $S$ must be infinite.
Answer: The above analysis is incorrect. $A$ is not necessarily a continuum. And if it is, its complement cannot be.
There do exist non compact indecomposable continua. The ones I can construct are not metric.
I think, however, there are such continua in any complete metric space that can be represented as the span of an infinite basis of itself, where each element of the basis is a simple curve (ie a locally compact continuum that contains, at most, one non cut point.)
Comment: You are mistaken in your assessment of Jeff's answer. The composant A of a point is always connected, hence a 'continuum' in the sense of the original poster. Furthermore, the complement of a composant is always connected (see e.g. Nadler, Continuum Theory: An Introduction), hence a 'continuum' in the sense of the original poster.
Answer: A continuum is a closed and connected point set. If a composant of an indecomposable continuum is closed and connected, it's complement cannot be both closed and connected.
Proof:
Suppose C is an indecomposable continuum and A is a composant of C. Since A is connected, A plus any Limit point of A is connected.  Thus the closure of A is connected.
C reduced by A (C-A) is connected. Otherwise, C-A is the sum of two point sets, X and Y, having no point or limit point in common. The closure of X excludes all points of Y. Since A is connected, X plus A is connected. Sinc the closure of X lies within X plus A,           X plus A is closed. By the same argument Y is closed and connected. X is not Y. Therefore X plus A and Y plus A would  be two distinct closed and connected proper subsets of C whose sum would be C and thereby contradicting the supposition that C is indecomposable.
A must contain a limit point  of C-A, otherwise C is not connected. So C-A is not closed and therefore cannot be a continuum.
Furthermore, suppose p is a point of A that is not a limit point of C-A. The closure of C-A would be a proper sub continuum of C because it would exclude a point of A. A is a proper sub continuum of C. Thus A and it's complement would be propersubcontinua of C whose sum would be C, contradicting the hypothesis that C is indecomposable
Thus every point of a composant of an indecomposable continuum is limit point of its complement.


How should I do push up to get better chest?

Question: I was told push-ups are good for the chest.
I tried some and don't quite feel it in my chest, the force is on my hands.
How should I do it to focus on the chest?
Answer:
I tried some and don't quite effective to the chest, the force are on my hands.

That's the beauty of push up, we can train various muscles from push ups. I found this video about Chest Workout: Pushups for the Complete Beginner interesting.

How should I do it to focus on the chest?

I would suggest Wide Push ups to focus on our chest.

I took this pic from YAYOG book page 60.
Reference: You Are Your Own Gym. The Bible of BodyWeight Exercises for Men and Women by Mark Lauren.
Answer: Here's a good link with illustrations and videos for doing push ups.
Some simple things to remember:

wide hand position = working the outer chest/pecs
close hand position = working the inner chest/pecs.

You can vary intensity by elevating your hands (easier) or elevating your feet (harder). There are many push up variations including:
dive bombers, which are great for arms and shoulders:

ploymetric, for power

and single arm, for the core:
Answer: For body weight exercises, the push up or the push up using resistance bands is probably your best bet.  Plyometric pushups will help build some explosive power.  If, however, you have access to weights, you can do a lot better.
For a beginner, the barbell bench press will help do a lot of good for the chest as well as the arm muscles.
A bit later, dumbbell bench press will give you a better result as you are forced to bring the dumbbells together giving you a greater range of motion.
I'm not going to tell you what proportion you should shoot for on your bench press, because that proportion changes based on your weight.  The key is to keep increasing weight as best you can.
I would be remiss if I didn't say that only working on the chest and not balancing that by working the upper back as well is a recipe for injury.  A reverse pushup will balance normal pushups, and rows will balance bench presses.
Answer: Ahhh the ole push-up! One point worth adding is the best way to isolate the chest has more to with the angle and direction of arms as you go up and down.
Yes, a wider hand stance is better for the chest overall. You will notice by going wider your arms and elbows form a right angle to your body that is the correct methodology for chest development. As you go and up/down,  your elbows fold directionally away from your body.
If when I lay on the ground, I put my hands on the ground at my shoulders and then as I began my push up, I kept my elbows and arm fold back,  I would be moving stress away from my chest and shifting it primarily to my triceps, shoulders and then chest. If I keep my elbows at a right or 90 degree angle I will maintain the chest and the primary muscle group.
This true of push ups' cousin "the dip" as well!
So, elbows back equals triceps-shoulders-chest. Elbows at a more forward/90 degree/right angle position will emphasize the chest more!
Answer: I would suggest dumbbell flys instead.  They really work the chest muscles.
See Also: Chest Exercises it suggests several chest oriented exercises including push-up techniques.
Comment: Care to summarize some of the exercises in your answer, else you're not really adding much compared to the other answers.
Answer: Your hands are doing very little during a push-up. So while you might feel some force there, don't be concerned by it. Many chest exercises (except the previously mentioned fly) use a combination of chest and tricep muscles. If all you want is a large chest, the bench press is one of the best exercises you can do. Shoot for 1.5x your body weight.
If, however, you're developing your chest for strength in a particular activity, find an exercise that mimicks the activity and use it as your basis.


Intuition for mean curvature

Question: I would like to get some intuitive feeling for the mean curvature. The mean curvature of a hypersurface in a Riemannian manifold by definition is the trace of the second fundamental form.
Is there any good picture to have in mind, when dealing with it?
Answer: Do this experiment: draw a curve in 2D and about some point on that curve, draw a unit normal vector field. Now convince yourself that if you push the curve out along the normal field by a distance $\epsilon$, the length changes by a factor of $1+\epsilon\kappa$ where $\kappa$ is the curvature.

Now consider a 2D surface in 3D. Choose local coordinates so that the first two basis vectors are tangent to the surface and the curvatures along the first two coordinates are the principal curvatures. The infinitesimal change in surface area is $(1+\epsilon\kappa_1)(1+\epsilon\kappa_2)$ -- actually this product is the Jacobian of the normal map, $N_\epsilon$ that pushes the surface out along the normal field a distance epsilon.

In general, for co-dimension one surfaces, the Jacobain of the normal map $N_\epsilon$ is $\Pi_{i=1}^{n-1} (1+\epsilon\kappa_i)$. We can integrate this over the original surface to get the new, n-1 volume of the pushed surface. That is:
$\mathcal{H}^{n-1}(N_\epsilon(W)) = \int_{W} \Pi_{i=1}^{n-1} (1 + \epsilon\kappa_i) d\mathcal{H}^{n-1}$
$ \hspace{1in} = \int_{W} 1 d\mathcal{H}^{n-1} + \epsilon \int_{W} \sum_i \kappa_i d\mathcal{H}^{n-1} + ... +  \epsilon^k \int_{W} \sum_{s\in S(k)}\Pi_{i\in s}\kappa_i d\mathcal{H}^{n-1}$
$ \hspace{1.2in}  +  ... + \epsilon^{n-1} \int_{\partial W} \Pi_{i=1}^{n-1} \kappa_i d\mathcal{H}^{n-1}$
Now we note that the first order term is the integral of the mean curvature. That is, to first order, the change in surface volume is given by the mean curvature. Note that I am using the term mean curvature for what is sometimes called total mean curvature, $\sum_{i=1}^{n-1} \kappa_i$.
(This works in co-dimension $k>1$, but then, because the set of normal directions at any point is $k$-dimensional, it is a bit more involved to get a result that looks like the result here.)
Answer: It gives you a normal field along the hyper surface which describes how you should move the surface to shrink the induced surface volume form. This works also for higher codimension.
EDIT: An explicit formula which generalized the answer of Otis Chodosh is the following:
Let $(N,\bar g)$
be a Riemannian manifold and let $M$ be a compact manifold with $\dim(M)<\dim(N)$.
Let $f(t,\quad)\in Imm(M,N)$ be a smooth curve of immersions, then
$f_t = \partial_t|_0 f\in \Gamma(f^*TN)$ splits into  parts $f_t=Tf.f_t^\top + f_t^\bot$ tangent and normal to $M$. Let also '$g=f^\star\bar g$ be the induced metric.
Then the variation of the mapping
$$
Imm(M,N) \to \Gamma(vol(M)),\qquad
f \mapsto vol(g)=vol(f^*\bar g)
$$
is given by
$$
\partial_t|_0\, vol\Big(f(t,\quad)^\star\bar g\Big) =
Tr^g\big(\bar g(\nabla f_t,Tf)\big) vol(g)=
\Big({div}^{g}(f_t^{\top})-\bar g\big(f_t^{\bot},Tr^g(S)\big)\Big) vol(g).
$$
Here $S$ is the second fundamental form $S\in\Gamma(L^2_{sym}(TM;TM^\bot)$.
So if the variation field $f_t$ is always normal to $f(M)$, the first summand vanishes.
For a proof see 5.7 in:
 Martin Bauer, Philipp Harms, Peter W. Michor: Sobolev metrics on shape space of surfaces. Journal of Geometric Mechanics 3, 4 (2011), 389-438. (pdf)
Answer: First, rather than viewing the mean curvature as "the trace of the second fundamental form,"
it might be more intuitive to view it as the average of the principle curvatures, i.e.,
$$H = \frac{1}{n} \sum_{i=1}^n \kappa_i \;.$$
Second, it may be that the following view of minimal surfaces (those of mean curvature zero)
from
D. Hoffman and W. H. Meeks III,
in their paper, "Minimal surfaces based on the catenoid" [Amer. Math. Monthly 97(8) (1990), 702-730] (ACM link), might help:

"Loosely speaking, one imagines the surface as made up of very many rubber bands, stretched out in all directions; on a minimal surface the forces due to the rubber bands balance out, and the surface does not need to move to reduce tension."

You can see this accords with Peter Michor's more abstract formulation.
Answer: Perhaps a more geometric way of viewing mean curvature (at least for a hypersurface) is as follows:
If $\varphi: \Sigma^n\hookrightarrow (M^{n+1},g)$ is an embedded (oriented) hypersurface, then we can naturally extend a family of embeddings by choosing a unit normal $\nu$ and flowing by unit speed, i.e.
$$\varphi_t(x) := \exp_x(t \nu(x))$$
For small enough $t \in (-\epsilon,\epsilon)$, this still gives an embedding $\varphi_t: \Sigma\to M$. Now, one could pull back the metric $g$ by $\varphi$ to obtain a metric on $\Sigma$. This metric gives a (Riemannian) volume form on $\Sigma$, $d\mu_t$. Then,
$$ \frac{\partial}{\partial t} d\mu_t = nH d\mu_t $$
(I think this matches the normalization in @Joseph O'Rourke's answer, but of course the sign changes with the choice direction of the normal)
This follows from the first variation formula.
In other words, the mean curvature measures how the volume of the submanifold (locally) changes under flowing the surface in the direction of the unit normal.
Answer: Let $M$ be an oriented hypersurface in an oriented euclidean space $E$.
The normal curvature at a point $x_0\in M$ measures how much it is displaced, in the positive normal direction, with respect to the points of $M$ that are near it, in the same way that the Laplacian of a function measures how much the value of a function at a point differs from the average of the points that are near.
In fact, if $M$ is the graph of a nearly constant function $f:\mathbb R^n\to\mathbb R$ (for example, the vibrating membrane of a drum at some instant) then the Laplacian of $f$ is a good approximation of the normal curvature of $M$.
More generally, if $M$ is possibly not nearly flat, then for any $x_0\in M$ you can find the hyperplane $\Pi$ that is tangent to $M$ at $x_0$, and find a parametrization $f:\Pi\to M$ (only defined on a neighbourhood of $x_0$) such that $p\circ f=id_\Pi$, where $p:E\to\Pi$ is the orthogonal projection. This parametrization shows that $M$ is locally the graph of a function $g=q\circ p$ (where $q$ is the projection on the orthogonal complement of $\Pi$) such that $dg(x_0)=0$. Then, the normal curvature of $M$ at $x_0$ equals $\Delta g(x_0)$.

Intuition for mean curvature


Do I need to add 6-Row to my extract + grains dunkelweizen for proper conversion?

Question: Do I need to add some 6-Row or otherwise tweak this recipe? I'm going to be brewing a dunkelweizen later this month. My recipe uses 6 lbs. of wheat extract and 2.5 lbs. of caramel and chocolate wheat, and the yeast is Wyeast's Weihenstephaner (3068). I'm planning to steep the wheat in a mesh bag in 5 gallons of water for at 155F for 45 minutes before the boil. Looking at some all-grain recipes for dunkelweizen I see that some add 6-Row barley to help the wheat convert. Do I need to add some to my recipe or will the liquor I get from steeping + the extract ferment well enough on its own?
Answer: If the reason for doing so is enzymatic conversion, then no.  Malt extract, wheat or otherwise, has already been mashed, and thus already had it's starches converted to sugars, and will ferment just fine.
The reason for doing this in an all-grain batch is because wheat doesn't have enough enzymes in it to self-convert its starches into sugars during the mash.  6-row has a high enzymatic content, and thus will have 'extra' to convert the wheat starches.  This is one reason why you'll see a base barley malt, either 2-row or 6-row, in any wheat beer all-grain recipe.
The caramel and chocolate wheat are there for flavor additions and don't really need to be converted.  The caramel has already been effectively 'mashed' during the process to make that type of malt, so there aren't any starches to convert.
Answer: Wheat malt is easily able to convert itself without further diastatic power form other malts.  Unmalted wheat does need help, though.  And these days, 2 row malt has nearly the same diastatic power as 6 row.  The notion that 6 row is necessary to help other malts convert is outdated.  The reason you see barley malt in most wheat beer recipes is for flavor, not enzymes.  An all wheat beer is very bland and insipid.


WiFi Failing and Keychain crashing

Question: I have a Macbook Pro 13 from about a year ago running OSX Lion.
Whenever I connect to my school's WiFi, I can't seem to get to the WiFi Login page
I was told the problem was probably in Keychain Access, but it crashes as soon as I try to open it whenever this is happening.
Using Safari or Chrome, I can't seem to get to any websites, it just hangs or gives me a page load error.
Firefox works though without any issues.
Answer: A friend of mine had a similar problem. After trying the usual fixes (restarting, removing wi-fi networks, removing wi-fi network interface, resetting PRAM and SMC, deleting login keychain from ~/Library/Keychains/login.keychain), I was able to solve the Keychain Access crashing (and wi-fi issues) using a solution from here: http://www.unsanity.org/archives/security/love_tropicana.php
In short, remove the wi-fi network (from System Preferences > Network > Advanced > Preferred Networks), then open Terminal and type in these two lines:
<code>$ sudo mv /var/db/CodeEquivalenceDatabase
$ /var/db/CodeEquivalenceDatabase.old
</code>
(For more information, read the page I linked to above.)
Then restart, and see if Keychain Access opens - it did for me. You can then delete any passwords or certificates related to your school's wi-fi. Then try connecting to the network again.
Comment: That terminal command should be one long line, not two.
Answer: You have to make sure your keychain is unlocked before removing entries.

WiFi Failing and Keychain crashing


which license fits my needs?

Question: Which license would fit the following requirements the most?

Everyone is welcome to make updates and use the source code
But nobody should sell it or sell an application that is using it, unless they make a deal with owners
Comment: From my research, this sounds like GPL, but perhaps someone more competent will answer..
Comment: You are not asking about an open source license, so ignore most of the answers below which make some incorrect assumptions.  Hire an attorney to write your own proprietary license which allows your desired restrictive use.
Comment: @dr Hannibal Lecter: No, the GPL is both a Free Software license and an Open Source license, and both the Free Software Definition and the Open Source Definition forbid such restrictions.
Answer: I hate to tell you, but no OSI approved license (GPL included) prohibits selling the covered software. This is known as discriminating against a particular field of endeavor, which essentially makes the software non-free when referring to liberty not price.
For what you want, you'd need to write your own license and I strongly urge you not to do that. You'd be contributing to something we call bad license proliferation.
In your case, I'd suggest version 3 of the GNU Affero GPL which specifically addresses software that interacts with a network. This compels anyone using your software (through dynamic linking or directly) to provide the source code to their version of it to anyone accessing the program over a network. If you stop and think about it, that covers quite a bit of software.
This ensures that development continues to stay out in the open, which I believe is what you want. You can then offer people interested in a more 'commercial friendly' license a less restrictive license if they come to an agreement with you.
Note, dual licensing requires that you own 100% of the copyright of your code. A catch to that is you'll have to get a copyright assignment from all contributors. That may or may not be a problem depending on the nature of your community.
Finally, double check everything you read on the Internet with an attorney when it comes to legal matters.
Answer: The only one I can think of, would be the original FreeQT license (one from Qt < 1.45). It's not used anymore, as it was not compatible with any open source definition.
Answer: A Creative Commons Attribution Non-Commercial Share-Alike licence would seem to fit the requirements you specify. It isn't OSI-approved, though, so it arguably isn't an open source licence. In addition, it isn't often used for software (though there is no reason why it couldn't be) so you may find yourself many of the same problems as licence proliferation. You may be better dropping your requirement for no commercial use and going with a GNU licence - that way it'll be easier to do things such as use GPL-ed libraries.
Answer: You can't forbid selling or require a deal with owners and still be open source. The best you can do is forbid selling a closed-source version, as the GNU GPL does.
That may be good enough if your project is a library, you can use the "dual license" business model where you sell people a non-GPL version and everyone else can only sell the GPL one.

which license fits my needs?


Is possible install Eclipse IDE in Honeycomb?

Question: Since Eclipse IDE can run in Linux and the new Honeycomb has a Linux Kernel, can Eclipse IDE run in Android Honeycomb ?
I know that isn't pretty much comfortable coding in a tablet, but I'd want to use for UML modeling.
Comment: FYI - all Android versions have a Linux-based kernel, not just Honeycomb.
Comment: You need much more than a compatible kernel to run most apps. Though it is at least a good base to start from. Best you can hope is that someone is able to use something like the Native Dev Kit to port a version of Eclipse IDE, though I believe much of Eclipse is Java based, so it my be possible to port via Dalvik, though that won't be a small job either.
Answer: No.
As you might know, Eclipse has various problems running in different flavors of Linux (which is why Ubuntu has an official repository version of it, and all that).  Android is even worse -- while based on Linux, it's a completely different operating system.  A similar question would be, "Is is possible to install a *nix version of Eclipse in Mac OS?"
Answer: To expand a bit on the previous 'No' answers, it's not just the kernel, but the rest of the OS which makes a big difference. Applications developed for linux expect a certain set of libraries (shared bits of code) to exist and do what the application expects. They also sometimes expect a certain filesystem structure and other dependencies.
Not all linux distributions include the same libraries, filesystem layout, or have other differences. That's why you'll often see linux applications distributed as a .tar.gz file with a script to compile it yourself; that makes it a bit more cross-platform.
Some executables, like command-line utilities, can be cross-compiled to work on android because they don't have as many complex requirements as a big complex application like Eclipse. Android's different enough that there aren't (yet) straightforward ways to compile standard linux GUI applications to work on it.
Answer: No is the short answer.
The android OS is built on the Linux kernel. There are a lot of differences between the Android OS and the average Linux distro, and some of these differences are critical to installing Eclipse.
Comment: Most notably -- proper JRE/JDK. Android's Dalvik is quite different from all "blessed" Java implementations, both in architecture and bytecode.
Answer: Expanding a little bit on Ben Griffths answer and Martin Tapankov's comment, no, you can't run Eclipse on Android because there isn't a Java Runtime Environment to run Eclipse and there isn't a build of the Java Development Kit for Android. Although most Android apps are written in Java, Android doesn't have a JRE; Android uses Dalvik which is a completely different runtime.
Answer: Best bet, look into running chrooted linux off of your honeycomb tablet (i know it can be done on the motorola xoom - http://www.offensive-security.com/backtrack/backtrack-5-on-a-motorola-xoom/).
Basically its just an arm build of that linux distro running on your xoom. Once in that environment install whatever traditional linux stuff you want. The arm version of backtrack is on the website, its a info security linux distro so theres lots of tools i use at work. Anyway, happy hunting, i know eclipse can be setup in backtrack so less work for you to go, it might even be in the apt-get repo for it as well.
Comment: side note you have to be rooted to do that. and here is a link to the install steps: http://forums.techarena.in/operating-systems/1414534.htm
Answer: Easiest way to install eclipse on android is to install a virtual ubuntu on your android device
Answer: That is a very interesting question! Since sooner or later we'll be running android on our desktops.
If you want Eclipse run on android, you'll need to compile all its dependencies. Linux kernel is not a problem. And even porting Eclipse's Java codebase to run in Dalvik is not a problem. The problem is eclipse's UI.
Eclipse UI is build with SWT - an amazing toolkit that enables native look of a Java program on many plaforms. To start with, you'll have to port SWT on android. http://www.eclipse.org/forums/index.php/mv/msg/246310/736679/#msg_736679
AFAIK, there's currently no plans to port SWT on Android.
So, the only easy solution to this is running both linux distro and android at the same time. This can be done with "any linux distro built for arm"+chroot+vnc.
Answer: Yes you can. Install a regular linux distro on your Android along side whichever AndroidOS you have and run whatever Linux apps you want:
https://play.google.com/store/apps/details?id=org.dyndns.sven_ola.debian_kit


Free program for editing pictures

Question: I'm looking to find a free program that allows me to edit my images.
The ones I have used so far are very limited, so if you have any ideas please let me know.
Answer: There are a few, but two of the best are:
The Gnu Image Manipulation Program (quite powerful)
Paint.NET (not as powerful as the GIMP, but very good)
Comment: +1 Great suggestion, I use these as well. GIMP takes some getting used to though. But is has superb capabilities (similar to Photoshop).
Answer: GIMP and Paint.net are two very good ones, as John has pointed out.
While somewhat limited, Picasa and iPhoto are two other alternatives (the latter being Mac only), which are pretty good.
Answer: XnView. It is good because it is also a photo organizer, has batch editing, scripts etc.
Regularly updated.
Answer: I want to put in a a plug for picasa. I know it's simple, and doesn't adequately "respect the RAW," but it gives me good results for web-based viewing or smallish snapshots (I'm not sure I would want to blow up the prints, but I haven't tried it).
What I really like about Picasa is the ease of use: the controls help you see the changes as you go, and give you a good sense of what they do. Just for making your pictures look better on screen, it does a great job.
Answer: I haven't tried it myself, but Adobe offers a free online editor at photoshop.com  I assume it's not as cool as their for-pay software, but maybe worth checking out.
Answer: Darktable is a very powerful photo processing tool. You cannot "paint" as with Gimp/Photoshop, but you can apply many kinds of filters in a non-destructive way to your photos. The description from their website expresses the features best:

darktable is an open source photography workflow application and RAW
  developer. A virtual lighttable and darkroom for photographers. It
  manages your digital negatives in a database, lets you view them
  through a zoomable lighttable and enables you to develop raw images
  and enhance them.
Comment: However, there are only builds for UNIX-based systems (so, mostly Linux distros and OSX), not Windows.
Answer: If you need to edit raw files consider also RawTherapee or Photivo (wich works also with some not raw file type)
Comment: big plus for photivo - lovely!
Answer: GIMP is free, and available on pretty much any platform, but in the case that you're on a Mac, and willing to fork over 15 USD, Pixelmator is one of the cheapest programs that can handle just about any image you throw at it, anc you don't have to convert your RAW files before editing them.
Answer: I have to agree with everything that's been said so far.  I've been using Picasa considerably and find it to be great for working with simple edits and jpeg images.  Lately I've been using a demo version of Lightroom 3 to see if it might fit my needs better (but it's expensive-ish).  Generally new Nikon and Canon cameras come with their own software, like View NX http://www.nikonusa.com/Find-Your-Nikon/Product/Imaging-Software/NVNX/ViewNX.html for Nikon.  Canon also seems to have lots of free tools for viewing and tweaking their RAW format.
Answer: I really like Microsoft Office Picture Manager...Simple, fast, and just some basic tools for those who don't need a full blown program.
Answer: I started from Picasa, later moved to GIMP.  I love working in GIMP and there is plenty of GIMP tutorials on the web which is very helpful.
Answer: I use GIMP and ImageJ. ImageJ is a free program that allows you to more easily do lower level manipulations on the individual grey values of the pixels than "higher level tools" such as GIMP.
Answer: Gimp is a great tool to use for photo editing, Adobes editing tools that are free are not the latest, and do not always work when you download them

Free program for editing pictures


What is the difference between a penetration test and a vulnerability assessment?

Question: What is the difference between a penetration test and a vulnerability assessment?
Why would you choose one over the other?
What deliverables would you expect to receive and how would you rate the quality of them?
Answer: I'm sure I posted an answer to this previously, but my google-fu must be weak this morning. From my blog post on Penetration Taxonomy, we have a list of testing types that is gaining acceptance. Also, working with the Penetration Testing Execution Standard we hope to further develop this. This list should help explain how to choose one over another.
Deliverables are almost a separate issue - and should be defined by the need and the audience (eg for a governance body you would not expect the same detail as you would provide to a technical remediation team, but you would want to include business risk information). There is also a Reporting stream within PTES development to try and codify this area:
Discovery
The purpose of this stage is to identify systems within scope and the services in use. It is not intended to discover vulnerabilities, but version detection may highlight deprecated versions of software / firmware and thus indicate potential vulnerabilities.
Vulnerability Scan
Following the discovery stage this looks for known security issues by using automated tools to match conditions with known vulnerabilities. The reported risk level is set automatically by the tool with no manual verification or interpretation by the test vendor. This can be supplemented with credential based scanning that looks to remove some common false positives by using supplied credentials to authenticate with a service (such as local windows accounts).
Vulnerability Assessment
This uses discovery and vulnerability scanning to identify security vulnerabilities and places the findings into the context of the environment under test. An example would be removing common false positives from the report and deciding risk levels that should be applied to each report finding to improve business understanding and context.
Security Assessment
Builds upon Vulnerability Assessment by adding manual verification to confirm exposure, but does not include the exploitation of vulnerabilities to gain further access. Verification could be in the form of authorised access to a system to confirm system settings and involve examining logs, system responses, error messages, codes, etc. A Security Assessment is looking to gain a broad coverage of the systems under test but not the depth of exposure that a specific vulnerability could lead to.
Penetration Test
Penetration testing simulates an attack by a malicious party. Building on the previous stages and involves exploitation of found vulnerabilities to gain further access. Using this approach will result in an understanding of the ability of an attacker to gain access to confidential information, affect data integrity or availability of a service and the respective impact. Each test is approached using a consistent and complete methodology in a way that allows the tester to use their problem solving abilities, the output from a range of tools and their own knowledge of networking and systems to find vulnerabilities that would/ could not be identified by automated tools. This approach looks at the depth of attack as compared to the Security Assessment approach that looks at the broader coverage.
Security Audit
Driven by an Audit / Risk function to look at a specific control or compliance issue. Characterised by a narrow scope, this type of engagement could make use of any of the earlier approaches discussed (vulnerability assessment, security assessment, penetration test).
Security Review
Verification that industry or internal security standards have been applied to system components or product. This is typically completed through gap analysis and utilises build / code reviews or by reviewing design documents and architecture diagrams. This activity does not utilise any of the earlier approaches (Vulnerability Assessment, Security Assessment, Penetration Test, Security Audit)
Comment: found your other post here: http://security.stackexchange.com/q/1621/33
Comment: @AviD - cheers - dunno why I couldn't find it...I should have searched for AviD's Law of Regulatory Compliance :-)
Comment: Offhand it seems to me that this is a nice linear flow of possible work with some alternatives. But the naming expects too much of the broad community of users - the terms are just too similar.  Coming up with a standard or brand with defined classes and levels (a b c) would seem easier to promulgate.  Or have people tried categorizing these procedures using orthogonal categories like active/passive manual/automated compliance/unrestricted observe/exploit white-box/black-box broad/focussed etc?
Comment: @Nealmcb - yes, our original plan was laid out as a matrix like that when it was just input from security consultants and vendors, but the next layer of review by buyers and industry persuaded us that this approach was more accessible.
Comment: Thanks Rory great answer. I'll go and have a read of the PTES site.
Comment: Thanks **Rory Alsop** for the answer. but can you just post your **references** (any books, standards or guidelines) to the taxonomy you provided on the identification of 1) discovery 2) vulnerability scan 3) vulnerability assessment 4) security assessment 5)penetration test 6) security audit
Comment: It was a piece of work I started along with some colleagues and clients, which then grew through liaison with CREST and understanding what PTES were trying to do. It effectively comes off over 15 years of doing this stuff and trying to standardise on terminology so that clients understood what they were getting and what they needed.
Answer: In addition to the answers already provided, I'll chip in on why you may choose one over the other.  Vulnerability assessments are more useful if you're not sure of your current security posture and want to get an idea of where your issues may lie.
It's worth noting though that like all security work vulnerability assessments are not all created equal.  For some vendors it may focus purely on tool output, where others will do more manual work to verify and extend those findings.
If that's your goal I'd focus on the "security assessment" type of approach mentioned in @RoryAlsop's answer.
A Penetration test is, classically, designed to replicate the actions of an attacker in attempting to compromise the security of a system or organisation. So this is likely to be more appropriate for orgaisations who are confident about the security controls in place for a given system and want to prove or disprove their efficacy.
There are problems with this approach however, depending on who your attackers are.  If you're looking to design controls that will defend against skilled targeted attackers (eg, organised crime) then it's very hard to effectively use a penetration test to check those, as it won't include some techniques that the attackers can use.
Some examples of areas that penetration testing will have difficulty covering due to legal issues would be  things like targeting staff home PCs to compormise their remote access facilities, attacking 3rd party partners who may have access to the target systems for support purposes, or buying botnets which may have zombies already present in the target environment.
So it's worth being aware of the limitations of both types of testing, but a general rule of thumb is that VA and security assessments are good when you're not sure how secure you are, and penetration tests are good for proving it once you do know.
Answer: To most people -- they are the same. This is why efforts like PTES will fail. You cannot change people who do not want to change.
The correct question is, "What is the difference between penetration testing and ethical hacking?".
The answer to this question is that penetration-testing has a specific prize in mind, with no time limit and usually a long list of rules of engagement (the short list ones ask that nobody be physically harmed or threatened). Ethical hacking is time-boxed activity where as many flaws as possible are uncovered -- typically only using non-physical methods.
"Assessments", "audits", and "tests" are typically interchangeable words in the field of information security. The words "vulnerability", "threat", and a few others are typically misunderstood and misinterpreted. Professionals with 20 years of experience, the same background, and the same certifications will typically argue over these basic terms. It is best to ignore what someone "says" or "thinks" is the right answer -- and instead go with your gut instinct and common sense when applying the term in a conversation with the uninitiated.
Comment: I hope the PTES initiative will work, but my worry is like yours: we need the buyers to want to understand. Security folks pretty much get it, but buyers have to know what they will get from a particular test, expected effort, will it meet requirements from regulator, CEO etc. So typically they want categories where different types fit so they can say "I'd like to buy xxxx please"
Answer: The trouble with this question is that there is not a strict/followed definition for what "penetration test" means in the industry. Some brilliant people from across the community got together to solve that problem, forming the "Penetration Testing Execution Standard."
It attempts to define each stage of a penetration test in order to establish a reasonable expectation on top of which business executives and Penetration Testers can base their interactions.
The stages they list are

Pre-engagement Interactions
Intelligence Gathering
Threat Modeling
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting

Here is a watered down definition of each. To get a clear picture, you should read the linked wiki pages.
Pre-engagement Interactions involves establishing scope and the rules of engagement, along with many business-oriented aspects.
Intelligence Gathering is the reconnaissance phase wherein the attacker learns as much as it can about the target (both human and technical aspects) for use during vulnerability analysis and exploitation.
Threat Modeling involves identifying assets and threats, categorizing them, and finally associating them.
Vulnerability Analysis "is the process of discovering flaws in systems and applications which can be leveraged by an attacker." People often mistakenly assume that this and exploitation is all that penetration testing is about.
Exploitation "focuses solely on establishing access to a system or resource by bypassing security restrictions."
Post-Exploitation is the determination of the compromised machines value and the maintaining of control for later use. In this phase you may gather information that allows you to go deeper (the obvious being credentials).
Reporting "[communicates] the objectives, methods, and results of the testing conducted to various audiences."
Whether they are succeeding in their mission or not is up for debate, but I believe this is a good place to develop start for a thorough understanding.
There is also the "PTES Technical Guidelines" which goes over tactics and tools that might be used during a penetration test.
Answer: I'm not game to write something long for this, but here's a fun one that most pen-testers share:

I have a client that has received passing PCI ASV scans for years (i.e. an external vulnerability assessment with no severe, high, or critical vulnerabilities found).  A "clean" scan according to PCI.
And for the last several years all of their internal databases can be exfiltrated, undetected, via skilled pen-testing (not to even mention client-side attacks, social engineering, physical pen-testing, phishing)

Pen-testing, at least in the corner I hang around in, is intended to simulate an attack by a motivated adversary.  Vulnerability assessments are typically something much less.
Answer: Vulnerability Analysis is the process of identifying vulnerabilities on a network, whereas a Penetration Testing is focused on actually gaining unauthorized access to the tested systems and using that access to the network or data, as directed by the client.
A Vulnerability Analysis provides an overview of the flaws that exist on the system while a Penetration Testing goes on to provide an impact analysis of the flaws identifies the possible impact of the flaw on the underlying network, operating system, database etc.
Vulnerability Analysis is more of a passive process. In Vulnerability Analysis you use software tools that analyze both network traffic and systems to identify any exposures that increase vulnerability to attacks. Penetration Testing is an active practice wherein ethical hackers are employed to simulate an attack and test the network and systems' resistance.
I have written a full post covering this. Read it here: http://www.ivizsecurity.com/blog/penetration-testing/difference-vulnerability-penetration-testing/
Comment: This is way too limited, and not really the accepted meanings of the terms.
This is really very focused on network security, whereas vuln analysis should be focused on business systems. Also pentesting can be for networks, OR for applications.


What is the difference between OpenOffice and the newly created LibreOffice?

Question: What is the difference between OpenOffice and LibreOffice? I understand that LibreOffice is another fork that is going to be developed. I have used OpenOffice since v1 and am wondering if there is a definite advantage to uninstalling and trying LibreOffice.
Answer: As of now there is hardly any changes between LibreOffice and OpenOffice. The former is a fork to free OpenOffice.org from the clutches of Oracle.
Till date Sun has asked for copyright assignment to Sun if you wanted your patch to be merged. This has been a great deterrent and has limited community involvement.
LibreOffice says "Everyone is invited". It is not an office suit which will be controlled by one organization, but many organizations will take part to develop it. The supporters include Google, RedHat, Canonical, Novell and a few more (not sure about the list).
LibreOffice has also brought up a wikipage named "Easy Hacks" to get the community involved in the development. This is a great step as probably people would be excited to look at the code.
From that page I can see that the codebase is a bit messy. There are non-English comments, bogus comments, dead code and what not.
Another good reason for breaking apart was that Oracle does not look interested in taking the development of Open Source ahead. OpenSolaris is nearly gone and if this fork didn't happen, probably OO.o would also have become stagnant.
Comment: This answer is quite dated. As @saji89's answer indicates, responsibility for OpenOffice has been transferred to Apache, so development is moving ahead again to some degree. We're now dealing with Apache OpenOffice vs LibreOffice I believe...
Answer: Oracle bought Sun in 2010 and commercial development of OpenOffice.org was officially terminated shortly thereafter. Then some dedicated members of the OpenOffice.org community pooled their resources and set up The Document Foundation to provide structure and leadership for the continued development of the open source code used by OpenOffice.org. The new product was named Libre Office. Most of the original OpenOffice.org community support is now behind Libre Office.
OpenOffice.org is now part of the Apache incubator project, but it still does have some licensing issues with Oracle.
Read "LibreOffice and OpenOffice.org: One Year After the Schism" to understand more.
I would personally say you should stick with using Libre Office now.
Answer: Libre Office will include the changes from Go-oo, which is the version included in Ubuntu, so I would say that Libre Office from the beginning will be more similar to Go-oo.
You can read more about the difference between OOO and Go-oo here:
http://go-oo.org/
Answer: Libreoffice is a dedicated fork which aims to be free of Oracle's clutches. LibreOffice beta is mostly similar to OpenOffice "as of now", with just a few UI and branding changes, because they are based on the same source. You can expect big changes in the future as the paths are divergent. As for installing it, I'd say you can try LibreOffice without any apprehensions, though I personally recommend you to wait for a Final, stable release for pure goodness. For more details, you can go through the FAQ here. Please excuse me for the mistakes, if any. :)
Comment: I'm trying out [LibreOffice Portable](http://portableapps.com/apps/office/libreoffice_portable) as I don't want to install it along with Office 2013 at work here.
Answer: It's been a couple of months now since this question was asked but I wanted to stress how important it is to get as many contributors doing QA, ie. testing and using LibreOffice everyday and reporting any bugs and problems they may be facing.
Getting on board early also lets you contribute in another way than coding - there are also documentation and translation efforts that can benefit from such early contributions.


What ale yeasts can closely approximate the clean and crisp characteristics of lagers?

Question: I'd like to brew a black lager.  I don't have a temperature control setup yet, so accepting that my fermentation will be around 68-70 F, what ale yeasts would come the closest to mimicking the clean and crisp characteristics of a lager, or is this possible?  Would adjusting pitching rate/aeration help?
Answer: The best choice is Kolsch Yeast.
White Labs: http://www.whitelabs.com/beer/strains_wlp029.html
Wyeast: http://www.wyeastlab.com/rw_yeaststrain_detail.cfm?ID=144
Only downside is 68-70 ambient temps. Those yeasts need to ferment around 65, so try to get the temp down a little more. Put your carboy in a water bath and drop in a few frozen water bottles each day. That should get you down to the mid-60's.
Also, after you bottle, you'll need to let the beer carb up, then "lager" it in your fridge, in maybe a 12-pack at a time, for a few weeks before drinking it. The beer will change a lot in that time. Kolsch's can seem a bit fruity when young, but it drops out to a nice crispness later.
I do a nice clone of Negra Modela with Kolsch yeasts. Here's the recipe:
http://hopville.com/recipe/203557/vienna-lager-recipes/negra-kolschero
Comment: I really appreciate the creative suggestion on temperature control.  Have you done several brews this way?  How do you monitor temperature of the wort?
Comment: Get a big beverage tub from the hardware store, fill it half with water, put your carboy in the water, and add a few frozen freezer packs. I always have a thermometer strip on the side of my bucket/carboy to monitor temps, so I can tell when I need to add fresh freezer packs. If you have the dedication to change the ice packs 2-3 times a day, you should have no problem keeping a carboy in a water bath down in the low 60's at all times during primary fermentation.
Comment: For ease of carrying, you can also consider a rubbermaid storage container.  I used one of those fratboy keg buckets the first few times, but then used a storage container as it was closer and cleaner.
Answer: I'll put in my two cents.
I would say the best analog of the clean, crisp taste of a (pils) lager would be a California Common.
Wyeast's WY2112 is actually listed as a lager yeast, but has a much higher temperature profile than standard lager yeasts.  I do not consider WY2112 a lager yeast, but there it is.
WLP001 is White Labs California Common yeast, considered by them to be an ale yeast.
Both strains produce clean, clear beers that accentuate hop flavor.  Hoppy characteristics are more known for the style of California Commons.  Either yeast can be used in other recipes and styles and still produce a clean, crisp beer.
Graham's suggestion of Kolsch yeasts is also a good one, those yeasts do nice imitation lager as well.
The downside is that with all of these yeasts, Kolsch or California Common, you will need a temperature at most in the mid-60s.  Yeast of any variety simply produce a lot of esters at higher temperatures.
Good Luck, hope this helps!
Comment: WLP810 is White Labs Cal Common yeast. WLP001 is Cal Ale, also known as the Chico strain, from Sierra Nevada. http://www.mrmalty.com/yeast.htm
Comment: +1 for California Common. Brewed a dark beer with this and it was really dry and clean. Fermented at 70.
Answer: There are a number of ale yeasts that stay clean, but you'll be hard pressed to achieve that at those temps.  And then keep in mind that you HAVE to cold condition the beer after fermentation to get anywhere near a lager.  I don't find kolsch (WAY too fruity IMO) or CA common yeasts clean enough for pseudo lagers.  My go to yeast for that is WY1007.  WY1056/WLP001 would be next with US05 after that.  But in order to do what you need to do, you really have to ferment them under 65 and 60 is better.  When they're done, you need to give them a month or 2 around 35 to really condition them and make them crisp.  Unfortunately, adjusting pitching or aeration won't do you much good for this.  There's just really no way around it.
Answer: I've had good luck with WLP008 East Coast Ale yeast for pseudo lagers.  Your attenuation will be a little lower but very clean to my pallet. Works well at 72°F (my brew room temp). It does require a little time to mature in the bottle / keg. Young it has a slight sour taste. To my knowledge Wyeast doesn't have a competitor for the East Coast Ale strain.
Answer: It's hard to find right now, but Charlie Papazian's Cry Havoc yeast from White Labs made just an excellent maibock at about 68F for me. A long, slow, cool aging period was at least partly responsible for it, but the yeast lives up to its purported ability to ferment at ale temperatures.
I detected none of the berry or apple esters described here. That may be because maibock is less restrained than, say, a pilsener.  In any case, if you can find it, give it a try.
Answer: A little FWIW:  After 25+ yr.s of lager brewing (roughly 96% lager to ale ratio) my main lagering unit; circa 1946 died.  I decided to tip-toe back to ales as my mainstay.  I was excited about clean lager like beer without the decoctions and long fermentations.  First yeasts that met my fermentation environment were Calif. Common and Cry Havoc.  For approx. 8 barrels, I split the wort between these two for side by side analysis.
I was struck by the similarities and am convinced if not siblings, these yeast are no further removed than cousins.  I found both to extremely flexible, temperature wise and their behavior, appearance and final results so close, the average Joe can't taste the difference.
I do not have my notes in front of me but I recall:  Both take a really long time to completely ferment out.  Yeah, I could've cut it short and had fine beer; but: given lengthy time in primary (many weeks to months) really provides an ultra clean, clear beer.  Really close to lagering times!
Of course a lot depends on all the key elements to brewing; water, malt bill, mash and boil techniques, hopping; etc, ad nauseam.
But, it is temperature flexible, though most mine w/these strains started warm and ended on the cool end of the range.  If you are patient, I have let these go for many months on the warm end and had clean lager-ish characteristics.
That being said, given your temperature constraints, why not make a clean ale with London Ale or some other old standby?


Is there any benefit to attacking enemies from different angles?

Question: Given enough movement points to adjust the position of my units, I can attack my enemies from different angles. It looks like each enemy unit just turns to face me anyway, so is there really any point in positioning my troops to attack from different angles?
Answer: No, angle itself doesn't make any difference in terms of damage.  Most creatures can only retaliate once per turn though, so there is an advantage to attacking it with multiple creatures during the same turn.  It will retaliate against the first attacker, but the rest will be able to do their damage without getting hit back.
Keep in mind that positioning can have other advantages as well.  Maybe it puts you close enough to attack a different creature next turn, or blocks an enemy's path (especially useful against large creatures).  Or maybe it puts you adjacent to a ranged creature, thus preventing it from using its ranged attack.
Answer: Not directly, but some creatures (like the The Sun Crusader) or skills (I think Charge or something) give you a damage bonus per travelled square.


IPC Code Translations?

Question: Is there a good resource for translating IPC codes into something meaningful? The WIPO site is generally useless: http://www.wipo.int/classifications/ipc/en/
Answer: Would you care to explain in more detail what you are trying to do? What is your problem with the WIPO website?
When you click on Browse and Search in the WIPO website, you can enter the subclass or subgroup as "current symbol" on the left hand side and then click "go to".
For instance, if you want to know what G06F 3/033 means, you simply enter G06F 3/033 on the left and click "go to". You will then find that the code stands for "Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor". Alternatively, you can enter G06F (the subclass), click on "go to", and see the entire list. The WIPO website also offers downloadable PDFs and databases for the IPC symbols and the corresponding definitions in various languages.
What more do you need?
Answer: Another very good source for finding the meaning of (IPC) classification(s) and even searching in the classifications to find classes that relate to your subject is the Espacenet site maintained by the European Patent Office. Here you can search the Cooperative Patent Classification (CPC) which has replaced the European Patent Classification (ECLA) and is since Jan 1st 2013 used by both the USPTO and the EPO to classify patent documents.
However, this CPC comprises all the IPC classes; thus this site can be used to search IPC also.

IPC Code Translations?


What can a 1st gen Apple TV do than a new Apple TV cannot?

Question: I have a 1st gen one and I'm thinking about selling it to get a new one.
People on ebay seem to want the old one.
Why are 1st gen Apple TVs selling on ebay for over $100 while a new Apple TV is sold for $99?
Answer: The only super major differences the 1st Gen Apple TV's has from the new ones is the ability to store Movies, Music, Content, etc because they have a physical hard drive in them for doing those things.  The other things is that they can connect to TV's through Red, Blue, Green Component Cables.  They also do not support Airplay with out a hack or a software fix. Also, the newest Apple TV, the 3rd Gen, allows for 1080p HD playback, where the older ones only support 720p HD playback.
There are also a few other minor differences in size, power consumption, software options/OS and so on.
The new Apple TV's do not have hard drives or Component Cable outputs and support Airplay out of the box. Airplay is probably the biggest feature that makes people who don't want to hack to jump ship to the newer box.  It is pretty cool. The 1080 HD playback is nice, but depending on your TV, may or may not be noticeable/important.
Some people like the older ones also because they can be hacked and used as linux computers (link) with actual storage and since they can also store things on them, you can take it with you and have videos/music on it and not require internet for streaming your content.
Though the biggest reason is most likely the hack-ability of them, they are tiny computers with a decent amount of power. And since they aren't sold any more and are still sought after, that would explain their above average price.
The new Apple TV's require internet of some kind or at least a local network for stream video and movies and data from a computer or the internet.
They are also significantly smaller too, the older Apple TVs are much larger.
You can see all the differences on their wiki page, it lays out the differences in features between the devices and even talks about most of the hacks that are available. Very informative.
http://en.wikipedia.org/wiki/Apple_TV
I hope that this answer helps you out.
Comment: The first gen AppleTV also uses significantly more power (48 Watts vs. 6 Watts).
Answer: de_an777 wrote a pretty solid answer. I'll add that because the underlying CPU is an Intel Pentium-M, the first generation Apple TVs can be hacked to run OS X. The later generation ones are ARM based and are thus restricted to Linux distributions that are ARM-compatible.
Comment: Very good points - intel vs ARM cpu is a big benefit, but having a hard drive seems to make the 1st generation ones valuable to people looking for a compact computer and not just an Apple TV.
Answer: Here is the big reason: The first gen ATV has a wifi card which can be removed in favor of a $40 Broadcom HD Decoder card.  Then, with a customized Linux distribution, you can run XBMC on the device and stream 1080 content from a NAS or another computer.
Since there is no jailbreak currently available for the third gen ATV, this is an easy an inexpensive way to watch HD video on one's HDTV, complete with an IR remote, and it's a full linux install as well.
Answer: The main reason the 1st generation Apple TV first retains it's value is because of the hard drive.  The 2nd generation does not have any built in storage and so everything has to stream to it.
There's nothing worse than hearing that long sigh on the other end of the phone when I have to explain that iTunes needs to be on the computer to stream the Glee album she wants to play.
It has its limitations but the original Apple TV is superior for browsing my music collections.
Answer: I'm impressed that the Apple TV first generation is really an Intel Mac capable of much more than a movie player. The Linux Crystalbuntu OS seems to be a good medium between a video device and an all out Intel Mac.  I purchased the 160 GB 1st generation for under $80 instead of the ATV 3 and think I've got a much better toy.
Answer: It may not be an issue to many, but I prefer the old one because it has analogue audio out which makes it possible to link it with an older amplifier
This is a big issue to anyone who wants audio in Zone 2 or 3 from an AV receiver.
Only very expensive AV receivers can pass digital audio to secondary zones, they only pass analog audio.  Because newer AppleTVs only output digital audio (HDMI or optical), you need a digital to analog converter if you want audio from the AppleTV in secondary zones.
Answer: We have a 1st Gen ATV plus a 2nd Gen ATV. At times either of these have been connected to the same Sony 42" HDTV. There is a money saving difference that no one here mentioned: the first option with all movies on the ATV1Gen is to rent the SD version for a dollar less than the HD version. At least on our ATV 2nd Gen, only the HD version of movies is offered. Since the ATV and our Sony HD television are both capable of up-converting, we usually buy the SD version and save about $50 a year in movie rentals. The SD version is not some crappy, old low quality 4:3 television image. It looks so good on our TV only a video freak would notice the difference without a side-by-side comparison. I know, some of you will say it's big difference to you. Personally, we don't see much difference and we already have the thing so I say "Save the money." We rent a lot of stuff with friends over, and not one has ever asked "What's wrong with the resolution of the movie? Are you up-converting it?"
We also hacked it with RemoteHD to be Airplay capable, and have it connected to the analog inputs of our tuner downstairs. Only the hacked ATV1Gen can accept streams from another Apple TV; later generations of ATV cannot share between each other. So we can stream music to it from any device in the house, even the other ATV, which is nice if you like background music while working or when entertaining.
Although it has a hard drive, even if you pre-fill it with rented movies to take it with you, it still requires an internet connection to authorize the playback, so it's not really "untethered" from the internet for DRM movies. But non-DRM content like MP3 and Home movies play without a network connection. With some effort, you can get around this by converting movies beforehand, but I won't go into that. That's for people with more time than money, or insomniacs going on an extended cruise or something where there's no possibility of reliable internet.
ATV1Gen has proven to be a keeper. I bought it used on eBay for $125 and wouldn't sell it back even for more than that.
Answer: You can also upgrade the HD to 1TB which takes the whole ATV1 to a new level.
Comment: Can you briefly explain how this would work?
Answer: Re: Analog/Digital capabilities
With newer-gen Apple TVs you still can, apparently, hook up to analog with a simple & inexpensive hack - a digital-to-analog converter = $20
I'm just the messenger - not the thinker behind this, so if you want to check it out,  the link is at bottom of my comment
I can't argue anything technically here - I was just looking into this and found the link right after leaving this site (which was helpful - thanks)
Just wanted to share with anyone who comes looking for answer after me...
http://www.technologytell.com/hometech/95077/3rd-gen-apple-tv-multi-room-music-server/
Answer: Floating pictures screensaver
Ah, there is a major void here. The Apple TV Gen 1 is a photographer's dream.  For those of us with thousands of digital images, when do we ever trot them out and look at them? Rarely. Instead, get a 22" flat panel, hook it to your Apple TV generation 1 40GB, and just run the floating pictures screensaver.
Artfully shows several pictures at once
It beats all others that show one picture at a time in a manner that clearly looks like a computer screensaver.
Not one picture at a time
No other device has this floating pictures screensaver. None. And no, there is no other software that can do this even with a PC hooked up to the monitor. If you want a standalone device that shows your photos in a floating screensaver mode, the Apple TV gen 1 is the only way.
Night light
We leave ours on in the kitchen 24/7 as a night light, wall decor, and constant reminder of where we've been and what we've done.
Limit: 2000 photos
I found that about after 1-2000 photos it starts to repeat, regardless of whether there are 10,000 photos on the device.  Thus far, have been unable to find any sites describing the algorithm apple uses for the floating photo screensaver.
Comment: True, but it's not the primary reason: there's other software that can do this.
Answer: I can put it in my car, with all my movies stored on it, and if I need to down load another one, I just connect it in the garage via wifi and purchase in my driveway or in the garage, and the kiddies are happy and quiet on any car ride.


Does blogging with popular cms like wordpress makes my website an authority website in SEO?

Question: Does blogging with popular cms like wordpress makes my website an authority website in SEO?
----OR ----
does blogging on popular cms platform like wordpress helps in SEO as compared to using a proprietary CMS?
Answer:
Does blogging with popular cms like wordpress makes my website an authority website in SEO?

No. It's about quality of your content, uniqueness, trust!, reliability. (You don't have to be the number one search result at any given time, btw.). It's not necessary that your content, your page or site is over-optimized.

does blogging on popular cms platform like wordpress helps in SEO as compared to using a proprietary CMS?

No. There is a lot of fetish out there when it comes to optimization features in different tools. Focus on content, on social signals, avoid black hat techniques and looking spammy. You get no bonus if you use wordpress. There's just a benefit for you as you get lots of documentation and optimization tipps along with some nice plugins.
Answer: If you are using wordpress or other CMS does not mean you have all the way up. You can use a proprietary CMS and achieve almost everything that wordpress does... but, is very hard create a CMS by yourself better than Wordpress.
So, what are the SEO Benefits Of WordPress?

Customizable Permalinks
Clean website code
Robots.txt Optimization
Allows you to easily submit and verify your site to Google Webmaster Tools
Auto Pinging
WordPress Comments
Hundreds of plugins for SEO
Sitemaps

You can find more info about this on the Wordpress Core


Seeking sources about the necessity for finding a מנין

Question: I am looking for sources about the necessity for finding a מנין.  More specifically, whether or not one has to always be in close range of a מנין, or if he can intentionally put himself in a position in which he cannot get to one.
Comment: Is this a question?
Answer: The sefer meishiv nivonim OC siman 13 answers a question about if one could go to kivrei tzadikkim in poland if one knows there won't be a minyan there. He comes out one should not do it but he gets there with many mekors for it. Some sources: Tur siman 89,Minchas Yitzchak 7 siman 6,Igros Moshe OC 2:27,Shulchan Aruch Harav siman 17, Eretz Tzvi siman 22,Yad Eliyahu siman 6,Maharil siman 118,there are more in the sefer.
Answer: A Google search (for "davening with a minyan") turns up:

TEFILLAH B' TZIBUR: HOW IMPORTANT? - From the OU
Davening with a Minyan - From torah.org
To Daven alone or with a Minyan? - from koshertorah.com

...and many other excellent sources (including our very own!), which in turn bring lots of their own sources.
Answer: You might also want to look up sources about the more general question of putting oneself in a position where one is unable to do a mitzvah. This is relevant, among others, to the question of being "on a distant journey" and therefore unable to offer the korban Pesach; see Minchas Chinuch 5 and a great deal of commentary on that. (There is in fact a booklet on Hebrewbooks - חיוב מצוות הזמניות קודם זמן המצוה - that discusses many different issues and sub-issues in this regard.)


printing in java; missing spaces

Question: I'm trying to print a swing component to paper. It's basically an extended JPanel which hosts (among other things) multiple JTextFields. These fields look correct when viewed on the screen, but when printed to paper, the text in the fields is not printed correctly... in some fields, the spaces in between words is quite large, in other fields, it is like there are no spaces at all; every word is jammed right beside the previous word.
I've checked and double / triple checked the component, and the fields all definitely have spaces in them... looks 100% correct when viewed on the screen, just prints incorrectly.
I've played with the FRACTIONALMETRICS hints in the Graphics class, as well as antialiasing and a few other rendering hints, and nothing has any effect on what I'm seeing.
Printing to other printers also has no effect, and this problem appears on Sun's JVM in both windows + linux. Switching fonts will just shuffle which textfields the problem occurs in, but doesn't actually solve the problem.
Any ideas?
Answer: Did you try to resize/scale the components? You may get some hint

printing in java; missing spaces


Parallels window problem

Question: I'm using Parallels on my mac. But when I open a software the font are so small, it's very weird. Can anyone help me out!!!

The picture above is when I open up my chrome, how can I fix it?
Answer: I had the exact same problem. I went a different route, and decided to sacrifice the nice high-DPI of the Retina for a scaled solution that makes everything look right.

In Parallels VM Config → Hardware → Video → Resolution
Use: Scaled
Not: Best for Retina, More Space
Restart VM
Windows Display Settings → Set Resolution: 1280x800 + Apply
Windows Display Settings → "Make text and other items larger or smaller"
Use: Smaller (100%)

Late-2013 rMBP 13.3″ with Parallels 9.0.23350 and Windows 7
Comment: Doesnt it look blurry?
Answer: I've seen this particular problem many times, and a lot of it has to do with how Windows handles DPI scaling.
Since you are using a Retina MBP - which has an extremely high resolution, you'll want Parallels to manage the DPI of your Windows VM. You can do this under your Virtual Machine's configuration, Hardware, Video Options, and select "Best for Retina".

The next time you reboot, Windows will have its DPI set to 199% (why not 200% I'm not sure).
The only trick to this is when you connect to an external display and you want to show your Parallels VM there. Windows can't change it's DPI without a full logout / login - so if you change displays you'll have to log out of Windows and log back in.
The next problem is that Windows does DPI scaling differently - some programs do not respect Windows DPI scaling. It's very bad practices for developers, but some of them always assume a fixed number of points-per-inch, like 96. Windows does its best to fix these issues by bitmap scaling the Window, and translating input, but it won't ever be perfect and it will look like a JPG that's 200% zoomed. It all depends on the program you are using. As unfortunate as it sounds, the best browser on Windows for retina resolution / DPI is Internet Explorer 10.
Comment: I've found out the problem might be the resolution of Retina that windows don't support.  So I've just disabled to let my parallels not to fit my Retina, and it works!

But thanks for your reply!!!! It helps me too.
Comment: @LiJung it sounds like you solved the problem you were having, but I was having the same issue (plus a few others) and fixed it by doing the following: http://apple.stackexchange.com/a/89705/46825
Answer: I have a new solution for this,set the video properties to "Scaled" and the video memory to 256MB.

One's you do this , go back to your windows--> Control Panel --> Display --> Set it to Smaller(100%).
check the Screen Resolution now it shows 1436*756 on a Mac Book pro 15.6 Retina.
This is done automatically , do not set it manually.
Answer: All my coworkers had the same problem. In Parallels 9, you can set for every VM if it should be scaled, best for retina or more space. As DPI scaling under Windows is inherently broken, as application developers have to support this, and many just don't, it's not useful you can configure this at all, which is why more options don't always mean better software (looking at you Parallels). In versions before, Parallels didn't let you choose the wrong things, and didn't have the wrong defaults.

You need to open the VM, go to the Virtual Machine menu item in the Macs menu bar, go to Hardware -> Graphics -> and click on scaled, restart your VM, in the Windows VM, go to Start -> Control Panel -> Display Settings -> click the link "Make text and other items larger or smaller" -> set it to 100%
Answer: The solution of this problem is here... Just forget about all the old advises and read this.
I've MacBook Pro Retina 15"
The problem's started when I've setup Parallel Desktop 9 and installed WIN 8.1, after that I've installed the Parallels Tools .. Than .. on WIN ... the screen resolution is SO high because of the Retina setting on MAC .. and microscopic context menus as will, I cannot use the WIN like this ..
I tried to play with WIN settings and screen resolution and MAC screen resolution  .. nothing gonna be help
I've forced to uninstall Parallels Tools to disconnect the relation between MAC screen resolution   and WIN screen resolution, BUT I've lost the Audio driver and the Networking between MAC and WIN, Until I found the  solution.
I've just get know how to fix this problem 100%
It's So easy ..
1- Uninstall Parallels Tools ( On WIN )
2- Update Parallel 9 to the latest update (13-7-2014) or more "important".
3- Shut down the WIN ( Not logout )
4- Exit full screen of Parallel Desktop BUT don't close the Parallel window
5- On MAC .. select the Parallel window than ..: Virtual Machine .. Configure .. select Hardware page .. Video .. remove the check box of " Enable Retina resolution "
6- Install Parallels Tools again .. and That's it .. Enjoy

Parallels window problem


Can I move content between site templates?

Question: I have multiple sites with different content on them, I found a better template to use, is there an easy way to use the new template and copy the content over to it? Can I keep the content on my current site but change the site template without losing all of my content?
Answer: You cannot change a template once you have created the site.  You can either make the desired changes to the existing site (new lists, libraries, page configuration) or you can create a new site with the desired template and then move existing content.  If it is document content you can use the Explorer view to cut and past documents or use the send to feature to move the content.  It is also possible to use custom or 3rd party tools to copy the documents and content from a source to a destination site.  This may also make it possible to translate any of the meta-data as needed.
Answer: I just want to clarify before I answer.  When you say "Site Template", are you refering to a file with an .wsp extension that lives in the solution gallery?
If that is indeed what you mean, you're going to have a bit of work to change an existing site template. You have to backup your database, save all your subsites as site templates, note your permissions, delete all of the sites, then recreate the site using the template you want, then recreate all it's subsites using your subsite site templates with the right permissions on all.
Not an easy task.


How can you prevent other people from tampering with your flight ticket if they *somehow* get access to your confirmation code?

Question: How can you prevent other people from tampering with your flight ticket if they somehow get access to your confirmation code?
Of course, keeping the confirmation code secret is the most important thing, but I'm just asking just in case someone else got a hold of it and wanted to troll you.
(By "troll" I mean that someone does something like cancel my reservation to cause me grief.)
Comment: Can you clarify what you mean by "troll" in this instance?
Comment: Say, someone got hold of my confirmation code and decided to spontaneously cancel my reservation to cause me grief.
Comment: hopefully the day when you'll be able to scan a biometric for your passport/ticket info is not too far along!
Comment: Read earlier today that 150 million Indian citizens have had their eyes scanned for biometric information. Could be close than we think.
Answer: I don't know which locale this applies to, but with regular airlines (as opposed to budget airlines, where ticket changes are nigh impossible), I can certainly change and perhaps even cancel my ticket without requiring to communicate the associated confirmation code.
So far, my name and date of travel have been enough to make changes on tickets I've purchased in the past, though sometimes a change incurs a fee.
So, to directly answer your question, you can't, but your question also presumes a certain security related to the confirmation code which isn't there.
Note that I'm not talking about changes through some online system, where typically not the confirmation code, but your login secures access, but simply calling up the airline in question, or visiting one of their offices.
Comment: A friend has played this joke on me, accessing my Ryanair travel data. Indeed just date, email, and route is enough (as of March 2013, it's [option 3](https://www.bookryanair.com/SkySales/Booking.aspx#RetrieveBooking)).
Answer: Unfortunately there's not a lot you can do to stop this.  Most (but not all) airline websites will allow you to make at least basic changes to a ticket, such as seat changes, using only the confirmation number and name.  Some will even let you change flights, or even occasionally cancel the reservation using the same details, although that's less frequent.
On at least a few airline websites I've used (but not most of them) you can only do this if the ticket doesn't have a frequent flyer number assigned to it.  If there's an FF number, then you can only make changes if you are logged into the website with the relevant FF details.
Otherwise, about all you can do is try and keep your confirmation number to yourself, and keep an eye on the reservation to make sure that nothing changes.
Answer: @Doc is right about keeping your details safe, the two factor authentication is unlikely to be guessed, therefore make sure your email account has a strong unique password and any printed e-tickets are treat with the same respect you would your passport.
Also make sure not to discard your outbound eticket before taking your return flight as they often have your confirmation code and full name, sometimes they also have your passport number and email address. All of which is handy for general identity theft as well as just messing with your flights.