text:
File strongswan.changes of Package strongswan
------------------------------------------------------------------- Thu May 31 16:08:43 UTC 2012 - email@example.com - Updated to strongSwan 4.6.4 release: - Fixed a security vulnerability in the gmp plugin. If this plugin was used for RSA signature verification an empty or zeroed signature was handled as a legitimate one (bnc#761325, CVE-2012-2388). - Fixed several issues with reauthentication and address updates. ------------------------------------------------------------------- Thu May 10 09:15:38 UTC 2012 - email@example.com - Updated to strongSwan 4.6.3 release: - The tnc-pdp plugin implements a RADIUS server interface allowing a strongSwan TNC server to act as a Policy Decision Point. - The eap-radius authentication backend enforces Session-Timeout attributes using RFC4478 repeated authentication and acts upon RADIUS Dynamic Authorization extensions, RFC 5176. Currently supported are disconnect requests and CoA messages containing a Session-Timeout. - The eap-radius plugin can forward arbitrary RADIUS attributes from and to clients using custom IKEv2 notify payloads. The new radattr plugin reads attributes to include from files and prints received attributes to the console. - Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. - The cmac plugin implements the AES-CMAC-96 and AES-CMAC-PRF-128 algorithms as defined in RFC 4494 and RFC 4615, respectively. - The resolve plugin automatically installs nameservers via resolvconf(8), if it is installed, instead of modifying /etc/resolv.conf directly. - The IKEv2 charon daemon supports now raw RSA public keys in RFC 3110 DNSKEY and PKCS#1 file format. - The farp plugin sends ARP responses for any tunneled address, not only virtual IPs. - Charon resolves hosts again during additional keying tries. - Fixed switching back to original address pair during MOBIKE. - When resending IKE_SA_INIT with a COOKIE charon reuses the previous DH value, as specified in RFC 5996. This has an effect on the lifecycle of diffie_hellman_t, see source:src/libcharon/sa/keymat.h#39 for details. - COOKIEs are now kept enabled a bit longer to avoid certain race conditions the commit message to 1b7debcc has some details. - The new stroke user-creds command allows to set username/password for a connection. - strongswan.conf option added to set identifier for syslog(3) logging. - Added a workaround for null-terminated XAuth secrets (as sent by Android 4). ------------------------------------------------------------------- Sat Mar 3 00:10:34 UTC 2012 - firstname.lastname@example.com - Updated to strongSwan 4.6.2 release: Changes in 4.6.2: - Upgraded the TCG IF-IMC and IF-IMV C API to the upcoming version 1.3 which supports IF-TNCCS 2.0 long message types, the exclusive flags and multiple IMC/IMV IDs. Both the TNC Client and Server as well as the "Test", "Scanner", and "Attestation" IMC/IMV pairs were updated. - Fully implemented the "TCG Attestation PTS Protocol: Binding to IF-M" standard (TLV-based messages only). TPM-based remote attestation of Linux IMA (Integrity Measurement Architecture) possible. Measurement reference values are automatically stored in an SQLite database. - The EAP-RADIUS authentication backend supports RADIUS accounting. It sends start/stop messages containing Username, Framed-IP and Input/Output-Octets attributes and has been tested against FreeRADIUS and Microsoft NPS. - Added support for PKCS#8 encoded private keys via the libstrongswan pkcs8 plugin. This is the default format used by some OpenSSL tools since version 1.0.0 (e.g. openssl req with -keyout). - Added session resumption support to the strongSwan TLS stack. ------------------------------------------------------------------- Wed Feb 15 13:31:40 UTC 2012 - email@example.com - Updated to strongSwan 4.6.1 release: Changes in 4.6.1: - Because of changing checksums before and after installation which caused the integrity tests to fail we avoided directly linking libsimaka, libtls and libtnccs to those libcharon plugins which make use of these dynamiclibraries. Instead we linked the libraries to the charon daemon. Unfortunately Ubuntu 11.10 activated the --as-needed ld option which discards explicit links to dynamic libraries that are not actually used by the charon daemon itself, thus causing failures during the loading of the plugins which depend on these libraries for resolving external symbols. - Therefore our approach of computing integrity checksums for plugins had to be changed radically by moving the hash generation from the compilation to the post-installation phase. Changes in 4.6.0: - The new libstrongswan certexpire plugin collects expiration information of all used certificates and exports them to CSV files. It either directly exports them or uses cron style scheduling for batch exports. - Starter passes unresolved hostnames to charon, allowing it to do name resolution not before the connection attempt. This is especially useful with connections between hosts using dynamic IP addresses. Thanks to Mirko Parthey for the initial patch. - The android plugin can now be used without the Android frontend patch and provides DNS server registration and logging to logcat. - Pluto and starter (plus stroke and whack) have been ported to Android. - Support for ECDSA private and public key operations has been added to the pkcs11 plugin. The plugin now also provides DH and ECDH via PKCS#11 and can use tokens as random number generators (RNG). By default only private key operations are enabled, more advanced features have to be enabled by their option in strongswan.conf. This also applies to public key operations (even for keys not stored on the token) which were enabled by default before. - The libstrongswan plugin system now supports detailed plugin dependencies. Many plugins have been extended to export its capabilities and requirements. This allows the plugin loader to resolve plugin loading order automatically, and in future releases, to dynamically load the required features on demand. Existing third party plugins are source (but not binary) compatible if they properly initialize the new get_features() plugin function to NULL. - The tnc-ifmap plugin implements a TNC IF-MAP 2.0 client which can deliver metadata about IKE_SAs via a SOAP interface to a MAP server. The tnc-ifmap plugin requires the Apache Axis2/C library. - Merged patches, changed strongswan-doc to be a noarch package. - Fixed rpmlint runlevel & fsf warnings, updated rpmlintrc ------------------------------------------------------------------- Mon Feb 6 10:27:00 UTC 2012 - email@example.com - Only glib.h can be included, fix compilation. ------------------------------------------------------------------- Wed Dec 21 10:31:49 UTC 2011 - email@example.com - remove call to suse_update_config (very old work around) ------------------------------------------------------------------- Mon Sep 12 09:26:51 UTC 2011 - firstname.lastname@example.com - remove _service file, too fragile ------------------------------------------------------------------- Mon Sep 12 08:24:36 UTC 2011 - email@example.com - Fixed version in last changelog entry ------------------------------------------------------------------- Thu Sep 8 16:06:46 UTC 2011 - firstname.lastname@example.com - Updated to strongSwan 4.5.3 release, changes overview since 4.5.2: * Our private libraries (e.g. libstrongswan) are not installed directly in prefix/lib anymore. Instead a subdirectory is used (prefix/lib/ipsec/ by default). The plugins directory is also moved from libexec/ipsec/ to that directory. * The dynamic IMC/IMV libraries were moved from the plugins directory to a new imcvs directory in the prefix/lib/ipsec/ subdirectory. * Job priorities were introduced to prevent thread starvation caused by too many threads handling blocking operations (such as CRL fetching). * Two new strongswan.conf options allow to fine-tune performance on IKEv2 gateways by dropping IKE_SA_INIT requests on high load. * IKEv2 charon daemon supports PASS and DROP shunt policies preventing traffic to go through IPsec connections. Installation of the shunt policies either via the XFRM netfilter or PFKEYv2 IPsec kernel interfaces. * The history of policies installed in the kernel is now tracked so that e.g. trap policies are correctly updated when reauthenticated SAs are terminated. * IMC/IMV Scanner pair implementing the RFC 5792 PA-TNC (IF-M) protocol. Using "netstat -l" the IMC scans open listening ports on the TNC client and sends a port list to the IMV which based on a port policy decides if the client is admitted to the network. * IMC/IMV Test pair implementing the RFC 5792 PA-TNC (IF-M) protocol. * The IKEv2 close action does not use the same value as the ipsec.conf dpdaction setting, but the value defined by its own closeaction keyword. The action is triggered if the remote peer closes a CHILD_SA unexpectedly. - Fixed some fmt warnings in libchecksum, adopted paths in the spec file ------------------------------------------------------------------- Sun May 29 16:37:00 UTC 2011 - firstname.lastname@example.com - Updated to strongSwan 4.5.2 release, changes overview since 4.5.1: * The whitelist plugin for the IKEv2 daemon maintains an in-memory identity whitelist. Any connection attempt of peers not whitelisted will get rejected. The 'ipsec whitelist' utility provides a simple command line frontend for whitelist administration. * The duplicheck plugin provides a specialized form of duplicate checking, doing a liveness check on the old SA and optionally notify a third party application about detected duplicates. * The coupling plugin permanently couples two or more devices by limiting authentication to previously used certificates. * In the case that the peer config and child config don't have the same name (usually in SQL database defined connections), ipsec up|route <peer config> starts|routes all associated child configs and ipsec up|route <child config> only starts|routes the specific child config. * fixed the encoding and parsing of X.509 certificate policy statements (CPS). * Duncan Salerno contributed the eap-sim-pcsc plugin implementing a pcsc-lite based SIM card backend. * The eap-peap plugin implements the EAP PEAP protocol. Interoperates successfully with a FreeRADIUS server and Windows 7 Agile VPN clients. * The IKEv2 daemon charon rereads strongswan.conf on SIGHUP and instructs all plugins to reload. Currently only the eap-radius and the attr plugins support configuration reloading. * Added userland support to the IKEv2 daemon for Extended Sequence Numbers support coming with Linux 2.6.39. To enable ESN on a connection, add the 'esn' keyword to the proposal. The default proposal uses 32-bit sequence numbers only ('noesn'), and the same value is used if no ESN mode is specified. To negotiate ESN support with the peer, include both, e.g. esp=aes128-sha1-esn-noesn. * In addition to ESN, Linux 2.6.39 gained support for replay windows larger than 32 packets. The new global strongswan.conf option 'charon.replay_window' configures the size of the replay window, in packets. ------------------------------------------------------------------- Mon Mar 14 10:59:32 UTC 2011 - email@example.com - Updated to strongSwan 4.5.1 release, changes overview since 4.5.0: * Implements RFC 5793 Posture Broker Protocol (BP) * Re-implemented TNCCS 1.1 protocol * Allows to store IKE and ESP proposals in an SQL database * Allows to store CRL and OCSP cert points in an SQL database * New 'include' statement in strongswan.conf allows recursions * Modifications of strongswan.conf parser, cause syntax attr plugin syntax changes. * ipsec listalgs now appends the plugin registering an algo * Adds support for Traffic Flow Confidentiality with Linux 2.6.38 * New af-alg plugin allows to use new primitives in 2.6.38 crypto api and removes the need for additional userland implementations. * IKEv2 daemon supports the INITIAL_CONTACT notify * conftest conformance testing framework * new constraints plugin provides advanced X.509 constraint checking * left/rightauth ipsec.conf keywords accept minimum strengths * basic support for delta CRLs See the NEWS file or http://download.strongswan.org/CHANGES4.txt for a detailed description of the changes. ------------------------------------------------------------------- Mon Nov 22 09:05:30 UTC 2010 - email@example.com - Cleaned up spec file; use with_mysql,sqlite,gcrypt,nm flags - Disabled tests sub-package with load-tester and test-vectors plugins by default using a with_tests flag (causes load error in "ipsec pki" when enabled but the package is not installed). ------------------------------------------------------------------- Tue Nov 16 12:01:46 UTC 2010 - firstname.lastname@example.com - Updated to strongSwan 4.5.0 release, changes since 4.4.1 are: * IMPORTANT: the default keyexchange mode 'ike' is changing with release 4.5 from 'ikev1' to 'ikev2', thus commemorating the five year anniversary of the IKEv2 RFC 4306 and its mature successor RFC 5996. The time has definitively come for IKEv1 to go into retirement and to cede its place to the much more robust, powerful and versatile IKEv2 protocol! * Added new ctr, ccm and gcm plugins providing Counter, Counter with CBC-MAC and Galois/Counter Modes based on existing CBC implementations. These new plugins bring support for AES and Camellia Counter and CCM algorithms and the AES GCM algorithms for use in IKEv2. * The new pkcs11 plugin brings full Smartcard support to the IKEv2 daemon and the pki utility using one or more PKCS#11 libraries. It currently supports RSA private and public key operations and loads X.509 certificates from tokens. * Implemented a general purpose TLS stack based on crypto and credential primitives of libstrongswan. libtls supports TLS versions 1.0, 1.1 and 1.2, ECDHE-ECDSA/RSA, DHE-RSA and RSA key exchange algorithms and RSA/ECDSA based client authentication. * Based on libtls, the eap-tls plugin brings certificate based EAP authentication for client and server. It is compatible to Windows 7 IKEv2 Smartcard authentication and the OpenSSL based FreeRADIUS EAP-TLS backend. * Implemented the TNCCS 1.1 Trusted Network Connect protocol using the libtnc library on the strongSwan client and server side via the tnccs_11 plugin and optionally connecting to a TNC@FHH-enhanced FreeRADIUS AAA server. Depending on the resulting TNC Recommendation, strongSwan clients are granted access to a network behind a strongSwan gateway (allow), are put into a remediation zone (isolate) or are blocked (none), respectively. Any number of Integrity Measurement Collector/Verifier pairs can be attached via the tnc-imc and tnc-imv charon plugins. * The IKEv1 daemon pluto now uses the same kernel interfaces as the IKEv2 daemon charon. As a result of this, pluto now supports xfrm marks which were introduced in charon with 4.4.1. * The RADIUS plugin eap-radius now supports multiple RADIUS servers for redundant setups. Servers are selected by a defined priority, server load and availability. * The simple led plugin controls hardware LEDs through the Linux LED subsystem. It currently shows activity of the IKE daemon and is a good example how to implement a simple event listener. * Improved MOBIKE behavior in several corner cases, for instance, if the initial responder moves to a different address. * Fixed left-/rightnexthop option, which was broken since 4.4.0. * Fixed a bug not releasing a virtual IP address to a pool if the XAUTH identity was different from the IKE identity. * Fixed the alignment of ModeConfig messages on 4-byte boundaries in the case where the attributes are not a multiple of 4 bytes (e.g. Cisco's UNITY_BANNER). * Fixed the interoperability of the socket_raw and socket_default charon plugins. * Added man page for strongswan.conf - Adopted spec file, removed obsolete error range patch. ------------------------------------------------------------------- Tue Aug 10 11:43:38 UTC 2010 - email@example.com - Updated to strongSwan 4.4.1 release, changes since 4.4.0 are: * Support of xfrm marks in IPsec SAs and IPsec policies introduced with the Linux 2.6.34 kernel. For details see the example scenarios ikev2/nat-two-rw-mark, ikev2/rw-nat-mark-in-out and ikev2/net2net-psk-dscp. * The PLUTO_MARK_IN and PLUTO_ESP_ENC environment variables can be used in a user-specific updown script to set marks on inbound ESP or ESP_IN_UDP packets. * The openssl plugin now supports X.509 certificate and CRL functions. * OCSP/CRL checking in IKEv2 has been moved to the revocation plugin, enabled by default. Plase update manual load directives in strongswan.conf. * RFC3779 ipAddrBlock constraint checking has been moved to the addrblock plugin, disabled by default. Enable it and update manual load directives in strongswan.conf, if required. * The pki utility supports CRL generation using the --signcrl command. * The ipsec pki --self, --issue and --req commands now support output in PEM format using the --outform pem option. * The major refactoring of the IKEv1 Mode Config functionality now allows the transport and handling of any Mode Config attribute. * The RADIUS proxy plugin eap-radius now supports multiple servers. Configured servers are chosen randomly, with the option to prefer a specific server. Non-responding servers are degraded by the selection process. * The ipsec pool tool manages arbitrary configuration attributes stored in an SQL database. ipsec pool --help gives the details. * The new eap-simaka-sql plugin acts as a backend for EAP-SIM and EAP-AKA, reading triplets/quintuplets from an SQL database. * The High Availability plugin now supports a HA enabled in-memory address pool and Node reintegration without IKE_SA rekeying. The latter allows clients without IKE_SA rekeying support to keep connected during reintegration. Additionally, many other issues have been fixed in the ha plugin. * Fixed a potential remote code execution vulnerability resulting from the misuse of snprintf(). The vulnerability is exploitable by unauthenticated users. - Removed obsolete snprintf security fix, adopted spec file - Enabled the eap-sim,eap-sim-file,eap-simaka-sql,eap-simaka-reauth, eap-simaka-pseudonym,eap-aka-3gpp2,md4,blowfish,addrblock plugins. - Enabled the mysql, sqlite, load-tester and test-vectors plugins, that are packaged into separate mysql,sqlite,tests sub packages. - Disabled sqlite plugin on SLE-10 -- sqlite3 lib is too old there. - Applied patch by Jiri Bohac fixing error-type range in parsing of NOTIFY payloads (RFC 4306, section 3.10.1). ------------------------------------------------------------------- Fri Jul 2 15:40:17 UTC 2010 - firstname.lastname@example.com - Applied upstream patch fixing snprintf flaws in the strongSwan IKE daemons exploitable by unauthenticated attackers using a crafted certificate or identification payload (bnc#615915). ------------------------------------------------------------------- Fri Jul 2 14:16:18 UTC 2010 - firstname.lastname@example.com - Added README.SUSE to source list in the spec file. ------------------------------------------------------------------- Fri May 14 19:19:04 UTC 2010 - firstname.lastname@example.com - Updated to strongSwan 4.4.0 release, changes since 4.3.6 are: * The IKEv2 High Availability plugin has been integrated. It provides load sharing and failover capabilities in a cluster of currently two nodes, based on an extend ClusterIP kernel module. More information is available at http://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability. The development of the High Availability functionality was sponsored by secunet Security Networks AG. * Added IKEv1 and IKEv2 configuration support for the AES-GMAC authentication-only ESP cipher. Our aes_gmac kernel patch or a Linux 2.6.34 kernel is required to make AES-GMAC available via the XFRM kernel interface. * Added support for Diffie-Hellman groups 22, 23 and 24 to the gmp, gcrypt and openssl plugins, usable by both pluto and charon. The new proposal keywords are modp1024s160, modp2048s224 and modp2048s256. Thanks to Joy Latten from IBM for her contribution. * The IKEv1 pluto daemon supports RAM-based virtual IP pools using the rightsourceip directive with a subnet from which addresses are allocated. * The ipsec pki --gen and --pub commands now allow the output of private and public keys in PEM format using the --outform pem command line option. * The new DHCP plugin queries virtual IP addresses for clients from a DHCP server using broadcasts, or a defined server using the charon.plugins.dhcp.server strongswan.conf option. DNS/WINS server information is additionally served to clients if the DHCP server provides such information. The plugin is used in ipsec.conf configurations having rightsourceip set to %dhcp. * A new plugin called farp fakes ARP responses for virtual IP addresses handed out to clients from the IKEv2 daemon charon. The plugin lets a road-warrior act as a client on the local LAN if it uses a virtual IP from the responders subnet, e.g. acquired using the DHCP plugin. * The existing IKEv2 socket implementations have been migrated to the socket-default and the socket-raw plugins. The new socket-dynamic plugin binds sockets dynamically to ports configured via the left-/rightikeport ipsec.conf connection parameters. * The android charon plugin stores received DNS server information as "net.dns" system properties, as used by the Android platform. - Splitted package into strongswan-ipsec, that install the traditional ipsec service starter scripts, -ikev1 and -ikev2 installing daemons and -libs0, that contains the library and plugins. - Enabled dhcp, farp, ha, socket-dynamic, agent, eap and sql plugins. - Enabled NetworkManager nm plugin in a separate strongswan-nm package. ------------------------------------------------------------------- Tue Mar 2 21:42:10 CET 2010 - email@example.com - Updated to strongSwan 4.3.6 release, changes since 4.3.4 are: * The IKEv2 daemon supports RFC 3779 IP address block constraints carried as a critical X.509v3 extension in the peer certificate. * The ipsec pool --add|del dns|nbns command manages DNS and NBNS name server entries that are sent via the IKEv1 Mode Config or IKEv2 Configuration Payload to remote clients. * The Camellia cipher can be used as an IKEv1 encryption algorithm. * The IKEv1 and IKEV2 daemons now check certificate path length constraints. * The new ipsec.conf conn option "inactivity" closes a CHILD_SA if no traffic was sent or received within the given interval. To close the complete IKE_SA if its only CHILD_SA was inactive, set the global strongswan.conf option "charon.inactivity_close_ike" to yes. * More detailed IKEv2 EAP payload information in debug output * IKEv2 EAP-SIM and EAP-AKA share joint libsimaka library * Added required userland changes for proper SHA256 and SHA384/512 in ESP that will be introduced with Linux 2.6.33. The "sha256"/"sha2_256" keyword now configures the kernel with 128 bit truncation, not the non-standard 96 bit truncation used by previous releases. To use the old 96 bit truncation scheme, the new "sha256_96" proposal keyword has been introduced. * Fixed IPComp in tunnel mode, stripping out the duplicated outer header. This change makes IPcomp tunnel mode connections incompatible with previous releases; disable compression on such tunnels. * Fixed BEET mode connections on recent kernels by installing SAs with appropriate traffic selectors, based on a patch by Michael Rossberg. * Using extensions (such as BEET mode) and crypto algorithms (such as twofish, serpent, sha256_96) allocated in the private use space now require that we know its meaning, i.e. we are talking to strongSwan. Use the new "charon.send_vendor_id" option in strongswan.conf to let the remote peer know this is the case. * Experimental support for draft-eronen-ipsec-ikev2-eap-auth, where the responder omits public key authentication in favor of a mutual authentication method. To enable EAP-only authentication, set rightauth=eap on the responder to rely only on the MSK constructed AUTH payload. This not-yet standardized extension requires the strongSwan vendor ID introduced above. * The IKEv1 daemon ignores the Juniper SRX notification type 40001, thus allowing interoperability. * The IKEv1 pluto daemon can now use SQL-based address pools to deal out virtual IP addresses as a Mode Config server. The pool capability has been migrated from charon's sql plugin to a new attr-sql plugin which is loaded by libstrongswan and which can be used by both daemons either with a SQLite or MySQL database and the corresponding plugin. * Plugin names have been streamlined: EAP plugins now have a dash after eap (e.g. eap-sim), as it is used with the --enable-eap-sim ./configure option. Plugin configuration sections in strongswan.conf now use the same name as the plugin itself (i.e. with a dash). Make sure to update "load" directives and the affected plugin sections in existing strongswan.conf files. * The private/public key parsing and encoding has been split up into separate pkcs1, pgp, pem and dnskey plugins. The public key implementation plugins gmp, gcrypt and openssl can all make use of them. * The EAP-AKA plugin can use different backends for USIM/quintuplet calculations, very similar to the EAP-SIM plugin. The existing 3GPP2 software implementation has been migrated to a separate plugin. * The IKEv2 daemon charon gained basic PGP support. It can use locally installed peer certificates and can issue signatures based on RSA private keys. * The new 'ipsec pki' tool provides a set of commands to maintain a public key infrastructure. It currently supports operations to create RSA and ECDSA private/public keys, calculate fingerprints and issue or verify certificates. * Charon uses a monotonic time source for statistics and job queueing, behaving correctly if the system time changes (e.g. when using NTP). * In addition to time based rekeying, charon supports IPsec SA lifetimes based on processed volume or number of packets. They new ipsec.conf paramaters 'lifetime' (an alias to 'keylife'), 'lifebytes' and 'lifepackets' handle SA timeouts, while the parameters 'margintime' (an alias to rekeymargin), 'marginbytes' and 'marginpackets' trigger the rekeying before a SA expires. The existing parameter 'rekeyfuzz' affects all margins. * If no CA/Gateway certificate is specified in the NetworkManager plugin, charon uses a set of trusted root certificates preinstalled by distributions. The directory containing CA certificates can be specified using the --with-nm-ca-dir=path configure option. * Fixed the encoding of the Email relative distinguished name in left|rightid statements. * Fixed the broken parsing of PKCS#7 wrapped certificates by the pluto daemon. * Fixed smartcard-based authentication in the pluto daemon which was broken by the ECDSA support introduced with the 4.3.2 release. * A patch contributed by Heiko Hund fixes mixed IPv6 in IPv4 and vice versa tunnels established with the IKEv1 pluto daemon. * The pluto daemon now uses the libstrongswan x509 plugin for certificates and CRls and the struct id type was replaced by identification_t used by charon and the libstrongswan library. - Removed obsolete load_secrets patches, refreshed modprobe patch. - Corrected a time_t cast reported by rpmlint (timer.c:51) - Disabled libtoolize call and the gcrypt plugin on SLE 10. ------------------------------------------------------------------- Fri Sep 4 12:56:59 CEST 2009 - email@example.com - Fixed open failure debug message in load_secrets ------------------------------------------------------------------- Thu Sep 3 23:44:37 CEST 2009 - firstname.lastname@example.com - Applied patch fixing locking in ipsec.secrets inclusion. ------------------------------------------------------------------- Mon Aug 31 16:06:13 CEST 2009 - email@example.com - Updated to strongSwan 4.3.4 release: * IKEv2 charon daemon ported to FreeBSD and Mac OS X. Installation details can be found on wiki.strongswan.org. * ipsec statusall shows the number of bytes transmitted and received over ESP connections configured by the IKEv2 charon daemon. * The IKEv2 charon daemon supports include files in ipsec.secrets. - Removed obsolete ipsec.secrets include patch (bnc#524799) and patch to avoid libchecksum version. ------------------------------------------------------------------- Fri Aug 7 11:44:30 CEST 2009 - firstname.lastname@example.com - Applied patch implementing ipsec.secrets "include" directive support in charon (http://wiki.strongswan.org/issues/show/82, bnc#524799). ------------------------------------------------------------------- Mon Jul 27 13:40:57 CEST 2009 - email@example.com - Updated to strongSwan 4.3.3 release: * The configuration option --enable-integrity-test plus the strongswan.conf option libstrongswan.integrity_test = yes activate integrity tests of the IKE daemons charon and pluto, libstrongswan and all loaded plugins. Thus dynamic library misconfigurations and non-malicious file manipulations can be reliably detected. * The new default setting libstrongswan.ecp_x_coordinate_only=yes allows IKEv1 interoperability with MS Windows using the ECP DH groups 19 and 20. * The IKEv1 pluto daemon now supports the AES-CCM and AES-GCM ESP authenticated encryption algorithms. * The IKEv1 pluto daemon now supports V4 OpenPGP keys. * The RDN parser vulnerability discovered by Orange Labs research team was not completely fixed in version 4.3.2. Some more modifications had to be applied to the asn1_length() function to make it robust. - Enabled --enable-integrity-test configure option (new feature). - Removed patch to avoid plugin versions (accepted by upstream) and added patch to avoid version for new libchecksum library. - Added -Wno-pointer-sign -Wno-strict-aliasing CFLAGS in the spec. ------------------------------------------------------------------- Wed Jun 10 11:04:44 CEST 2009 - email@example.com - Updated to strongSwan 4.3.2 release, that fixes two asn1 parser DoS vulnerabilities and provides several new features, e.g.: * The new gcrypt plugin provides symmetric cipher, hasher, RNG, Diffie-Hellman and RSA crypto primitives using the LGPL licensed GNU gcrypt library. * libstrongswan features an integrated crypto selftest framework for registered algorithms. The test-vector plugin provides a first set of test vectors and allows pluto and charon to rely on tested crypto algorithms. * pluto can now use all libstrongswan plugins with the exception of x509 and xcbc. Thanks to the openssl plugin, the ECP Diffie- Hellman groups 19, 20, 21, 25, and 26 as well as ECDSA-256, ECDSA-384, and ECDSA-521 authentication can be used with IKEv1. * Applying their fuzzing tool, the Orange Labs vulnerability research team found another two DoS vulnerabilities, one in the rather old ASN.1 parser of Relative Distinguished Names (RDNs) and a second one in the conversion of ASN.1 UTCTIME and GENERALIZEDTIME strings to a time_t value. * The nm plugin now passes DNS/NBNS server information to NetworkManager, allowing a gateway administrator to set DNS/NBNS configuration on clients dynamically. * The nm plugin also accepts CA certificates for gateway authentication. If a CA certificate is configured, strongSwan uses the entered gateway address as its idenitity, requiring the gateways certificate to contain the same as subjectAltName. This allows a gateway administrator to deploy the same certificates to Windows 7 and NetworkManager clients. * The command ipsec purgeike deletes IKEv2 SAs that don't have a CHILD SA. The command ipsec down <conn>{n} deletes CHILD SA instance n of connection <conn> whereas ipsec down <conn>{*} deletes all CHILD SA instances. The command ipsec down <conn>[n] deletes IKE SA instance n of connection <conn> plus dependent CHILD SAs whereas ipsec down <conn>[*] deletes all IKE SA instances of connection <conn>. * Fixed a regression introduced in 4.3.0 where EAP authentication calculated the AUTH payload incorrectly. Further, the EAP-MSCHAPv2 MSK key derivation has been updated to be compatible with the Windows 7 Release Candidate. * Refactored installation of triggering policies. Routed policies are handled outside of IKE_SAs to keep them installed in any case. A tunnel gets established only once, even if initiation is delayed due network outages. * Improved the handling of multiple acquire signals triggered by the kernel. * Fixed two DoS vulnerabilities in the charon daemon that were discovered by fuzzing techniques: 1) Sending a malformed IKE_SA_INIT request leaved an incomplete state which caused a null pointer dereference if a subsequent CREATE_CHILD_SA request was sent. 2) Sending an IKE_AUTH request with either a missing TSi or TSr payload caused a null pointer derefence because the checks for TSi and TSr were interchanged. The IKEv2 fuzzer used was developped by the Orange Labs vulnerability research team. The tool was initially written by Gabriel Campana and is now maintained by Laurent Butti. * Added support for AES counter mode in ESP in IKEv2 using the proposal keywords aes128ctr, aes192ctr and aes256ctr. * Further progress in refactoring pluto: Use of the curl and ldap plugins for fetching crls and OCSP. Use of the random plugin to get keying material from /dev/random or /dev/urandom. Use of the openssl plugin as an alternative to the aes, des, sha1, sha2, and md5 plugins. The blowfish, twofish, and serpent encryption plugins are now optional and are not enabled by default. - Enabled new gcrypt plugin - Adopted spec file and modprobe to syslog patch - Removed obsolete getline glibc collision patch - Added patch to avoid library version for plugins (rpmlint). - Replaced update-dns-server patch with a --with-resolv-conf. - Removed restart_on_update from spec file (see bnc#450390). ------------------------------------------------------------------- Mon Jun 8 00:21:13 CEST 2009 - firstname.lastname@example.com - rename getline to my_getline to avoid collision with function from glibc ------------------------------------------------------------------- Tue Jun 2 09:56:16 CEST 2009 - firstname.lastname@example.com - Applied fix for a Denial-of-Service vulnerability where receiving a malformed IKE_SA_INIT request leaves an incomplete state which causes a crash of the IKEv2 charon while dereferencing a NULL pointer if a subsequent CREATE_CHILD_SA is received (bnc#507742). - Applied fix for a Denial-of-Service vulnerability where receiving a malformed IKE_AUTH request with either a missing TSi or TSr traffic selector payload causes a crash of the IKEv2 charon while dereferencing a NULL pointer because the NULL pointer checks of TSi and TSr before destruction were erroneously swapped (bnc#507742). ------------------------------------------------------------------- Tue Mar 31 11:19:03 CEST 2009 - email@example.com - Updated to strongSwan 4.2.14 release that fixes a grave DPD denial of service vulnerability registered as CVE-2009-0790, that had been slumbering in the code for many years: * A vulnerability in the Dead Peer Detection (RFC 3706) code was found by Gerd v. Egidy <email@example.com> of Intra2net AG affecting all Openswan and strongSwan releases. A malicious (or expired ISAKMP) R_U_THERE or R_U_THERE_ACK Dead Peer Detection packet can cause the pluto IKE daemon to crash and restart. No authentication or encryption is required to trigger this bug. One spoofed UDP packet can cause the pluto IKE daemon to restart and be unresponsive for a few seconds while restarting. This DPD null state vulnerability has been officially registered as CVE-2009-0790 and is fixed by this release. * The new server-side EAP RADIUS plugin (--enable-eap-radius) relays EAP messages to and from a RADIUS server. Succesfully tested with with a freeradius server using EAP-MD5 and EAP-SIM. * ASN.1 to time_t conversion caused a time wrap-around for dates after Jan 18 03:14:07 UTC 2038 on 32-bit platforms. As a workaround such dates are set to the maximum representable time, i.e. Jan 19 03:14:07 UTC 2038. * Distinguished Names containing wildcards (*) are not sent in the IDr payload anymore. ------------------------------------------------------------------- Mon Oct 20 09:27:06 CEST 2008 - email@example.com - Updated to 4.2.8 release: * IKEv2 charon daemon supports authentication based on raw public keys stored in the SQL database backend. The ipsec listpubkeys command lists the available raw public keys via the stroke interface. * Several MOBIKE improvements: Detect changes in NAT mappings in DPD exchanges, handle events if kernel detects NAT mapping changes in UDP-encapsulated ESP packets (requires kernel patch), reuse old addesses in MOBIKE updates as long as possible and other fixes. * Fixed a bug in addr_in_subnet() which caused insertion of wrong source routes for destination subnets having netwmasks not being a multiple of 8 bits. Thanks go to Wolfgang Steudel, TU Ilmenau for reporting this bug. ------------------------------------------------------------------- Tue Oct 14 16:29:59 CEST 2008 - email@example.com - Applied fix for addr_in_subnet() extracted from strongswan-4.2.8 which caused insertion of wrong source routes for destination subnets having netwmasks not being a multiple of 8 bits. Thanks go to Wolfgang Steudel, TU Ilmenau for reporting this bug. (bnc#435200) ------------------------------------------------------------------- Fri Oct 10 08:08:35 CEST 2008 - firstname.lastname@example.com - Applied fix for a Denial-of-Service vulnerability where an IKE_SA_INIT message with a KE payload containing zeroes only can cause a crash of the IKEv2 charon daemon due to a NULL pointer returned by the mpz_export() function of the GNU Multi Precision (GMP) library. Thanks go to Mu Dynamics Research Labs for making us aware of this problem. (bnc#435194) ------------------------------------------------------------------- Thu Aug 28 14:31:49 CEST 2008 - email@example.com - Fixed to use --enable-curl instead of --enable-http as before - Enabled the OpenSSL crypto plugin in the spec file. ------------------------------------------------------------------- Thu Aug 28 09:48:14 CEST 2008 - email@example.com - Updated to 4.2.6 release, fixing bugs and offering a lot of new features comparing to the last version provided by this package. Most important are: * A NetworkManager plugin allows GUI-based configuration of road-warrior clients in a simple way. It features X509 based gateway authentication and EAP client authentication, tunnel setup/teardown and storing passwords in the Gnome Keyring. * A new EAP-GTC plugin implements draft-sheffer-ikev2-gtc-00.txt and allows username/password authentication against any PAM service on the gateway. The new EAP method interacts nicely with the NetworkManager plugin and allows client authentication against e.g. LDAP. * Improved support for the EAP-Identity method. The new ipsec.conf eap_identity parameter defines an additional identity to pass to the server in EAP authentication. * Fixed two multithreading deadlocks occurring when starting up several hundred tunnels concurrently. * Fixed the --enable-integrity-test configure option which computes a SHA-1 checksum over the libstrongswan library. * Consistent logging of IKE and CHILD SAs at the audit (AUD) level. * Improved the performance of the SQL-based virtual IP address pool by introducing an additional addresses table. The leases table storing only history information has become optional and can be disabled by setting charon.plugins.sql.lease_history = no in strongswan.conf. * The XFRM_STATE_AF_UNSPEC flag added to xfrm.h allows IPv4-over-IPv6 and IPv6-over-IPv4 tunnels with the 2.6.26 and later Linux kernels. * management of different virtual IP pools for different network interfaces have become possible. * fixed a bug which prevented the assignment of more than 256 virtual IP addresses from a pool managed by an sql database. * fixed a bug which did not delete own IPCOMP SAs in the kernel. * The openssl plugin supports the elliptic curve Diffie-Hellman groups 19, 20, 21, 25, and 26 and ECDSA authentication using elliptic curve X.509 certificates. * Fixed a bug in stroke which caused multiple charon threads to close the file descriptors during packet transfers over the stroke socket. * ESP sequence numbers are now migrated in IPsec SA updates handled by MOBIKE. Works only with Linux kernels >= 2.6.17. * Fixed a number of minor bugs that where discovered during the 4th IKEv2 interoperability workshop in San Antonio, TX. * Plugins for libstrongswan and charon can optionally be loaded according to a configuration in strongswan.conf. Most components provide a "load = " option followed by a space separated list of plugins to load. This allows e.g. the fallback from a hardware crypto accelerator to to software-based crypto plugins. * Charons SQL plugin has been extended by a virtual IP address pool. Configurations with a rightsourceip=%poolname setting query a SQLite or MySQL database for leases. The "ipsec pool" command helps in administrating the pool database. See ipsec pool --help for the available options * The Authenticated Encryption Algorithms AES-CCM-8/12/16 and AES-GCM-8/12/16 for ESP are now supported starting with the Linux 2.6.25 kernel. The syntax is e.g. esp=aes128ccm12 or esp=aes256gcm16. - Added patch disabling direct modifications of resolv.conf; has to be replaced by a netconfig call. - Added patch adding a missed file name argument in printf call in the scripts/thread_analysis.c file -- resulting binary is not installed. - Removed obsolete patches crash_badcfg_reload and old-caps-version. ------------------------------------------------------------------- Mon Jun 30 22:40:31 CEST 2008 - firstname.lastname@example.com - Added fix that explicitly enables version 1 linux capabilities on version 2 systems to aviod that the charon and pluto daemons exit because of failed capset call (bnc#404989). ------------------------------------------------------------------- Mon May 19 16:17:16 CEST 2008 - firstname.lastname@example.com - Applied fix (strongswan_crash_badcfg_reload.dif) to avoid a crash after reloading with bad config (bnc#392062). ------------------------------------------------------------------- Wed Apr 23 14:28:41 CEST 2008 - firstname.lastname@example.com - Updated to 4.2.1 release. A lot of code refactoring in the 4.2 release provides much more modularity and therefore much more extensiblity and offers the following new features: * libstrongswan has been modularized to attach crypto algorithms, credential implementations (secret and private keys, certificates) and http/ldap fetchers dynamically through plugins. * A relational database API that uses pluggable database providers was added to libstrongswan including plugins for MySQL and SQLite. * The IKEv2 keying charon daemon has become more extensible. Generic plugins can provide arbitrary interfaces to credential stores and connection management interfaces. Also any EAP method can be added. * The authentication and credential framework in charon has been heavily refactored to support modular credential providers, proper CERTREQ/CERT payload exchanges and extensible authorization rules. * Support for "Hash and URL" encoded certificate payloads has been implemented in the IKEv2 daemon charon. * The IKEv2 daemon charon now supports the "uniqueids" option to close multiple IKE_SAs with the same peer. * The crypto factory in libstrongswan additionally supports random number generators. Plugins may provide other sources of randomness. * Extended the credential framework by a caching option to allow plugins persistent caching of fetched credentials. * The new trust chain verification introduced in 4.2.0 has been parallelized. Threads fetching CRL or OCSP information no longer block other threads. * A new IKEv2 configuration attribute framework has been introduced allowing plugins to provide virtual IP addresses, and in the future, other configuration attribute services (e.g. DNS/WINS servers). * The stroke plugin has been extended to provide virtual IP addresses from a simple pool defined in ipsec.conf. * Fixed compilation on uClibc and a couple of other minor bugs. * The IKEv1 pluto daemon now supports the ESP encryption algorithm CAMELLIA with key lengths of 128, 192, and 256 bits, as well as the authentication algorithm AES_XCBC_MAC. - Applied a small patch defining _GNU_SOURCE for struct in6_pktinfo and adding inclusion of limits.h for PATH_MAX availability. - Added rpmlintrc file and a libtoolize call to the spec file. ------------------------------------------------------------------- Tue Feb 19 11:44:03 CET 2008 - email@example.com - Updated to 4.1.11 maintenance release, providing following fixes: * IKE rekeying in NAT situations did not inherit the NAT conditions to the rekeyed IKE_SA so that the UDP encapsulation was lost with the next CHILD_SA rekeying. * Wrong type definition of the next_payload variable in id_payload.c caused an INVALID_SYNTAX error on PowerPC platforms. * Implemented IKEv2 EAP-SIM server and client test modules that use triplets stored in a file. For details on the configuration see the scenario 'ikev2/rw-eap-sim-rsa'. - The 4.1.10 final version, declared upstream as "Fully tested support of IPv6 IPsec tunnel connections", fixes ordering error in oscp cache, IPv6 defaults of the nexthop parameter, adds support for new EAP modules [disabled in this build] and obsoletes our strongswan_path and strongswan_ipsec_script_msg patches. - Removed a sed call from init script. ------------------------------------------------------------------- Sat Dec 8 13:03:42 CET 2007 - firstname.lastname@example.com - Updated to 4.1.9 final, including all our patches. - Changed init script to use ipsec cmd using LSB codes now. - Added strongswan_path.dif setting a PATH in scripts (updown). - Added strongswan_ipsec_script_msg.dif for consistent look of ipsec script messages. - Added strongswan_modprobe_syslog.dif redirecting modprobe output to syslog. ------------------------------------------------------------------- Mon Nov 26 10:19:40 CET 2007 - firstname.lastname@example.com - Renamed charon plugins to avoid rpm conflicts with existing libraries (libstroke). Patch: strongswan-libconflicts.dif - Added init script. Template file: strongswan.init.in ------------------------------------------------------------------- Thu Nov 22 10:25:56 CET 2007 - email@example.com - Initial, unfinished package


text:
The Council of Michigan Foundations is a community of philanthropists committed to improving outcomes for Michigan, and beyond. Through investing in the state's charitable organizations, convening business, government and nonprofit leaders, collaborating on critical issues, seeking innovative solutions, sharing knowledge and advocating, we leverage our collective voice to increase the impact of Michigan philanthropy.
The Council of Michigan Foundations brings together a diverse community of philanthropists who, through individual and collective efforts, are growing the impact of Michigan philanthropy. Whether connecting peer-to-peer or directly with CMF, we can find you what you need.

subset: commoncrawl


text:
A High Performance Model for State and Caching
Every Web application has to deal with session state in one way or another. Most default to the state management built into the environment of the language they're using. It's simple, quick, and in many cases effective.
The problem comes in when you're trying to build a high volume site and the standard way of doing things just won't cut it. Dumping everything into session state just doesn't work; caching becomes a necessity. You're forced to start bringing more things into memory per user—while simultaneously keeping your per-user memory utilization down. It is when caching is added to the performance mix that you begin to really see how your fundamental views of session state and caching need to shift.
In this article, I present a model for creating different pools of information tied to both, how the information is used and how expensive that information is to reproduce. I'll detail a method for improving performance using careful management of state and cache.
A Tale of Three Pools
In the Web application world, there are three basic pools of information related to state and caching. They are:
- Cache: Information that can be reproduced by persistent storage. Cache exists only because it improves performance. Cache, although a time proven technique, has the problem of cache coherency, as discussed later. Cache information is necessarily memory based and not persisted. It's designed for speed, so the performance impact of reading it from a database is nearly always not worth it.
- Session: Information that the user has entered during the session or data specific to the current session. This information isn't available from other sources but doesn't need to be persisted for long. It is disposable once the user's session has ended. Sessions should have a short term persistence strategy—although many are still memory based and don't have a persistence strategy at all.
- User: User information is information that is related to the user, which may need to be accessed during a session but it's different in that it is persisted for long periods of time. User information including user attributes, histories of orders, settings, and so on is stored with the user for the life of their account.
The key in any effort to manage session state is to determine what kind of information is really being managed. This is true because often cache information and session information are intermingled. Some of the information traditionally stored in a session is really cached information that can be regenerated if necessary.
Load Balancers Impact on Session
The most shocking experience that developers have when they first start to develop applications that need to be placed on a Web farm is the experience of a session shifting from one server to another server. This is because, even though they often believe that they've carefully stored away everything into a persisted storage, they are often see places where seemingly innocuous things have caused problems. All of a sudden, a two-page form breaks because the user was shifted from one server to another during the middle of the form.
Of course, there are settings on load balancers that anchor a user's session to one server or another for the length of the session; however, these settings come at a cost of the load balancer not being able to truly balance the load well. Generally, it's accepted that it's a bad idea to lock a user's session to one server or the other from a performance standpoint. This, of course, ignores what happens to the sessions should the server servicing a user go down—the user's session is thrown away.
Load balancers, when set to distribute activity evenly across the servers, will quickly show places where session variables were not persisted and were accidentally shoved off into some sort of cache. Unfortunately, there isn't anything that will show the reverse off so easily—it's difficult to find the places where you've added cached data to the persisted session storage.
Load balancers are tremendously effective at spreading load if you've been able to properly plan for the kinds of data that you store, and can be really difficult to get working if you don't.
Cache Characteristics
As mentioned above, cache is designed to be fast access to information that can be regenerated if necessary. That "if necessary" part may mean that the server becomes memory starved and needs the memory back for operations; it may mean the user has transitioned to a new server and the cached information doesn't exist, an application pool was reset, or a variety of other reasons.
To make effective use of cache, you need to make it an integral part of the way the objects work. One of the most effective ways to do this is to use a singleton pattern where objects are constructed through a static method on the class rather than 'new'ing an object. This is important because an object that has been instantiated is necessarily a new object. However, the object that you are handed back from a static method may be new, or it may be an object from cache.
Take, for instance, a catalog where you have products. It's likely that the system will need a product several times. The object itself is mostly initiated from the database. During the execution, the user views the product, they add it to their cart, and they check out. In this most streamlined example, the user makes three state transitions (view, want to purchase, agree to purchase) and potentially many more pages as they put other items in their cart and they browse around the site, coming back to what they've already put in their cart to compare it.
Rather than creating a product object each time, you can create one product object, store it in cache, and fetch it each time that the application needs it. The static "GetProduct" method on the catalog class can look it up in cache and, if found, return it. If the product isn't found in cache, the static method can create it and put it in the cache for next time.
This has the side benefit that, in this case, it's possible to share the product object among multiple users so there may be 100 people with the new widget in their cart, but there will only be one copy of the object in memory at any one time. Of course, when you put it in cache you can decide whether or not you want it to be shared across all users.
This works really well for read-only objects, the kind that you don't update, or you don't update often. However, there's a problem called cache coherency that occurs when the data can be updated. It is when the data in the cached copy of the object is out of sync with the real source of the data.
There are a few ways to approach this problem. Three are listed below:
- Ignore it: Although, on the surface, ignoring the problem may seem like a silly idea, it does have its place. Some problems aren't worth fixing because the probability that they will cause a problem is too low. For instance, if you're talking about updating the cache for the friendly name displayed on the site, there's low chance of the data changing, there's low impact of the data being out of sync causing real harm. It may not be worth fixing. Once of the techniques used to mitigate the problems is to reduce the cache time on cached objects so they don't stay in cache that long. Because they aren't in cache that long, the chances of a cache coherency problem is low. However, it limits the effectiveness of your cache as well because objects may expire before they can be used.
- Session Based Clearing: If the cached data relates specifically to the user, write a date/time to the session. Any cached data created before that date and time is invalidated when a check is performed. This is relatively straightforward to implement, but requires that the user initiate the change in the data. This isn't always the case. For instance, in the product example above, the user isn't likely to change pricing on a product they are using, but that change should be reflected.
- Farm Based Clearing: Somewhat more complicated is a technique that synchronizes all of the servers in the farm with one another. One approach to this is to expose a service for clearing the cache of an item. This service is called on every server in the farm every time an update is made to cached data. Alternatively, the caching system checks a centralized database to see whether the data has changed, or some other method that synchronizes the data. This is substantially more complicated, but may be necessary if cache coherency is a real problem.
Developing a strategy for how you deal with cache coherency issues is an important part of using cache.
Session Selections
Session data, data about the user's current session isn't necessarily something persistent, however, it is very important to the user for the short period of time that they are in the session. Because session data must be sticky even if the back end server is switched by a load balancer, it needs either to be persisted by a key held by the browser that leads to a database, or the browser needs to hold on to all of the data.
Most use the technique of the user holding on to a session key which leads them to the database. This is the approach that ASP.NET uses in its session management. It's a good, safe way to manage session data but will be slightly slower than having direct memory access to the data. Of course, you can keep session data in process in memory if your storage requirements aren't large and you don't have more than one server—this won't demonstrate the performance issues that may become apparent when you move to multiple servers. So, it may leave you with a nasty surprise down the road.
The alternative is to have the user's browser store all of the information in the session. In other words, you make it the browser's responsibility to store the information—in the form of a cookie. There are two primary issues with this approach. First, cookies are limited in their size. You won't be able to store large amounts of data in cookies. Small bits of information are fine, but sizes larger than 8K are not supported, and more than about 2K of information isn't recommended. The second issue is that this information may be stored unencrypted on the user's disk. The problem here is that any sensitive data could be picked up by a malicious party.
Most people must settle on a key-based session because the performance impact is more than made up for by the extra security. However, one hybrid approach uses cookie-based session information for signaling the cache system to reset and key-based for the rest of the items.
User Profile
The final type of data is the user profile data. This is the standard information about the user. It doesn't change whether they're in one Web browser session or another; it's about who the user is. User profile data is always persisted to a back end database. Most systems today have pre-built profile systems that can be integrated so the "heavy lifting" of profiles have largely been removed from the purview of the average developer. (Profile systems are so integrated into the way things work that ASP.NET 2.0 has a complete system built in.)
Putting objects in the right place can help performance in the short term, allowing your existing configuration to do more, as well as setting you up for larger horizontal scaling options with server farms. Learning how to effectively use caching as a technique can make your applications support more users and have better response times. Give some thought to what data you're putting and where you are putting it the next time you design or build a system.
Robert Bogue, MCSE (NT4/W2K), MCSA:Security, A+, Network+, Server+, I-Net+, IT Project+, E-Biz+, CDIA+ has contributed to more than 100 book projects and numerous other publishing projects. He was recently honored to become a Microsoft MVP for Microsoft Commerce Server and before that Microsoft Windows Servers-Networking. Robert blogs at http://www.thorprojects.com/blog. You can reach Robert at firstname.lastname@example.com.
This article was originally published on March 22, 2006


text:
July 2006 Survey: The Bitter Truth About ROI
After running surveys on ROI in 2003 and 2004, we decided to take a sabbatical. Despite the ongoing pressure to demonstrate the business value of IT, progress doesn't come swiftly in the field of measurement. So it made sense to wait to see if we could spot real improvement.
For more data and analysis, see CIO Insight's Research Center blog at go.cioinsight.com/researchcentral
Yet after two years, truth be told, there's little change in how, or how well, IT's value is measured. True, most firms now try to use metrics such as internal rate of return, return on assets, net present value, or activity-based costing. But besides customer satisfaction there's no consensus or consistency on which measures to use. It's still not a given that ROI should be measured both before and after a project. And half of all executives surveyed, whether IT or business executives, doubt that the measures are even accurate. Consider productivity: IT executives are projecting significantly greater productivity increases than the figures tracked by the federal government. Somebody's not measuring productivity properly, and it's probably not the Bureau of Labor Statistics.
Yes, measuring IT's value is difficult. But why haven't more companies found a satisfactory way to do it? Is it that companies just don't feel the need to calculate IT's value accurately? The motivation ought to be there, given that three-quarters of our respondents are under greater pressure to put a dollar value on IT's intangible benefits.
But, judging by how few measure ROI after a project, it seems that for many IT executives, what really matters isn't whether the valuation is correct, but that it's convincing.
Story Guide:
What's the Value of IT? At Many Companies, It's Just Guesswork
IT Value, Productivity Metrics Still Not Trustworthy
Most Companies Struggle to Measure the Value of IT
IT Is Delivering Business Value, But Some Technologies Succeed More Often Than Others
How the survey was done: CIO Insight editors designed the 2006 Business Value of IT Survey together with Equation Research, LLC (www.equationresearch.com), an Estes Park, Colo.-based supplier of custom research services. IT executives gathered from Ziff Davis Media publication lists were invited to participate in the study by e-mail. The questions were posted on a password protected Web site, and 303 qualified respondents (83 from companies with revenues in calendar 2005 below $100 million, 130 from companies with revenues between $100 million and $999 million, and 90 from companies with revenues of $1 billion or more) replied from May 3 to May 22, 2005. Of the respondents, 156 were the top IT executive of their company, 89 held senior IT executives titles, and 58 were executives from outside the IT function.
Read our previous surveys on ROI and business value:
Related stories:
This article was originally published on 08-04-2006


text:
First, let me make sure I understand the problem. Our client specializes in sugar cereals traditionally distributed through grocery stores. Sales to Big M Mart, a discount chain, have been growing at 15 percent per year, and the chain has recently become the largest distributor of the client's product nationwide. We are here to help evaluate the distribution strategy in light of Big M Mart's growth.
That is correct.
Could you explain to me how grocery stores differ from discount stores?
Sure. Grocery stores generally specialize in food, as well as selling some household goods and over-the-counter pharmaceuticals. Discount stores, on the other hand, offer food alongside a wide variety of merchandise, including clothing, home electronics, and housewares.
Does Big M Mart market its food products differently than do grocery stores?
Discount stores advertise lower prices for a wide variety of foods, particularly staple, nonperishable foods.
Could I take a moment to write a few notes to myself?
Please feel free.
Before making recommendations, I think we would need to evaluate whether sales growth at Big M Mart is good or bad for Foods, Inc. To do that, I would first look at how its sugar cereal performance at Big M Mart compares with that in other distribution channels. Second, I would look at its performance at Big M Mart in relation to competitors' performance. Next, I would determine what drives customer purchases. Finally, I would want to understand the supply chain.
That certainly sounds like a reasonable approach. Let's proceed.
First, I would like to get a better sense of where Big M Mart stands in relation to our client's other distribution channels by examining the client's sales data and margins, by distributor.
The marketing department does not have margins by channel, but tracks sales and volume for its top five distributors.
What does this imply about Big M Mart as a distribution outlet?
It looks as if the top distributors have been growing more important, but particularly Big M Mart, which is growing faster than all the others. This is particularly true when we look at volume, where Big M Mart's growth is much higher than that of the other four channels.
And how could you interpret what these data says about margins?
While the client's sales through other distribution channels are growing faster than volume, Big M Mart volume and sales growth are the same, so the average price paid by Big M Mart has remained constant. That implies that sales growth at Big M Mart could have negative implications for our client's margins. Next, I would like to look at how our client is doing in relation to the competition within Big M Mart. Have they been gaining or losing market share?
How might you find that out?
I would try to interview Big M Mart's purchasing personnel, since they would probably track those data for their own purposes.
Why would they want to talk to you? How might you approach such an interview?
I would approach the purchasing personnel and suggest that our client and Big M Mart work together to identify best practices to reduce costs and increase sales of sugar cereals at Big M Mart. Let's say in a perfect world you could get a breakdown of Big M Mart sales for the four largest competitors (see market shares below).
What can we infer about our client's competitors within this channel? Who should they be worried about?
It looks like our client is losing market share, as is Tasty Breakfast, while Cereal Co. and Private Label are gaining share. Private Label, however, looks to be growing from a very small base. I would like to explore why our client is losing market share to Cereal Co. at Big M Marts. Are their prices better than those of our client?
After a period of price wars six to seven years ago that lowered industry margins, the cereal companies have refrained from price competition within the same channel.
If prices are not driving the difference, I would look at other factors such as brand selection, percentage of shelf space, product placement, and in-store promotions.
Well, I suspect that children are a large target market for the sugar cereal manufacturers. The lower shelf placement could be especially important to children who are looking at the different types of cereals. Are there any other promotions?
Visits to Big M Marts indicate that each name-brand company holds 30 percent of the shelf space, while private label has 10 percent. Cereal Co. brands, however, tend to be placed lower on the shelf than your client's products.
So, even if all the companies are maintaining product prices, maybe Cereal Co. is strategically discounting prices to gain market share. It seems as if there is evidence of cooperation between Cereal Co. and Big M Mart. Do we know anything about their relationship?
Some Cereal Co. brands have sales promotion tags, and the team notes that store flyers advertise specials on Cereal Co. brands for Big M Mart customer cardholders.
During earlier discussions with Big M Mart, you discovered that your client's competitors have 50 sales representatives dedicated to the Big M Mart account. Your client has seven.
Cereal Co. appears to be dedicating more resources to its relationship with Big M Mart than our client is. This may explain its better product placement and promotion programs. I think I have a good sense of distribution and competition. I would now like to look at the customers and understand why they select the products they do. One hypothesis I have is that shifting brand loyalties are hurting our client's market share at Big M Mart.
That's interesting. What do you think might motivate purchases of sugar cereals?
There are lots of factors, such as the games in the boxes, the price of the cereal itself, how it tastes. To better understand consumer behavior, we might conduct market research, possibly through focus groups, customer observation, and price sensitivity studies.
For the brand-loyal shopper, the priority would be product availability, while product placement would be important for consumers who like to shop around. Within these groups, are consumers price sensitive such that one brand can lure shoppers loyal to another brand?
BCG teams often do such research. Let's assume your team conducts some analysis. Your research concludes that most buyers tend to fall into two categories. Approximately 60 percent of buyers go straight to one cereal and grab it. We can call this group the "brand-loyal" shoppers. Another 40 percent of shoppers look at all the cereals and then select one that interests them. Let's call this group the "impulse" buyers.
Well, from that information, it appears that price is not a major driver of purchases unless the preferred cereal is out of stock. In these stock-out situations, you said, brand-loyal customers will purchase discounted cereals 35 percent of the time. What happens when the customer does not purchase a discounted cereal?
In general, your research indicates that consumers are not price sensitive and are extremely loyal to their preferred brand. But when the preferred cereal is unavailable, the brand-loyal customers will purchase discounted cereals approximately 35 percent of the time.
Interesting. It seems as if product availability could be a major driver of total cereal volume for Big M Mart. Of course, we would need to know how often stock-outs occur that cause consumers to walk away without purchasing cereal occur. Since I have a pretty good understanding of customer motivation, I'd now like to ask a few questions about the client's supply chain. I would want to talk to our client's distribution personnel to understand the distribution process and to determine how often stock-outs occur. Can you describe how our client's cereal is distributed at Big M Mart?
In approximately 25 percent of cases, the customer walks away without purchasing any cereal at all. In the remaining 40 percent of cases, the brand-loyal customer will act like an impulse shopper and select another brand.
Do we have any knowledge about when the individual stores are out of stock?
Cereals are distributed from the factory to the distributor's warehouse twice monthly. The retailer then stocks the shelves itself.
Since we identified product availability as a key success factor earlier on, I would want to make sure that the stores were stocking the product correctly.
No, we do not, since our client only delivers to the warehouses and has no direct access to in-store inventory information.
Let's say that in your earlier in-store investigations, you found out that Big M Mart stores averaged 15 percent of sugar cereal brands out-of-stock, across all brands.
Stock-outs would be a major problem for our client, since 60 percent of customers look for a specific brand of cereal and 35 percent of them would buy a discounted brand in a stock-out situation. Big M Mart would also have an incentive to reduce out-of-stock incidents, since 25 percent of the time, a brand-loyal customer will walk away without buying anything.
Big M Mart is our client's leading customer, accounting for more than 20 percent of our client's sugar cereal revenue. Although sales to Big M Mart are increasing on an absolute basis, our client's margins there are lower than in its other channels and its competitive position is eroding in that channel. At Big M Mart, our client faces competition from both private label and Cereal Co., although the latter appears to be the greater threat. There appears to be a relationship between Big M Mart and Cereal Co. as evidenced by their joint promotions, the superior placement of the Cereal Co. product, and the substantial resources that Cereal Co. has dedicated to the Big M Mart account. We learned that 60 percent of customers are brand-loyal, implying product availability is most important. However, 40 percent like to try different kinds of cereal, indicating product placement is also important. Purchasers do not appear to be price conscious, unless the type of cereal they are looking for is out of stock, in which case there is a stronger tendency to base purchases on price promotions. In terms of distribution, our client is making deliveries twice a month to Big M Mart's warehouses. Big M Mart, in turn, is responsible for stocking the shelves. We currently have no direct knowledge of when our client's items are out of stock at the individual stores, but there is evidence that stock-outs do occur with some frequency.
Well, it sounds as if you understand the situation. What would you recommend the client do?
The sales through Big M Mart appear to have a negative impact on the bottom line, as they have lower margins than sales through grocery stores. The client could work with grocery stores to ensure that they are able to compete effectively with Big M Mart in the sugar cereal market. This strategy could be risky, however, since Big M Mart is a large and important customer. Therefore, I would recommend that our client work more collaboratively with Big M Mart. To defend its current position at Big M Mart stores, the client should move toward a partnership with Big M Mart and dedicate more resources to the relationship. The customer and competitor data indicate that our client's first priority should be to improve distribution to ensure better product availability. In addition, it should push for product placement equal to, if not better than, that of its competitors.
Why would Big M Mart be willing to enter into a partnership with Foods Inc?
Foods Inc could offer to share its information about customer behavior to help increase revenues for both itself and Big M Mart. Stock-outs hurt Big M Mart in two ways. First, some brand-loyal customers simply walk away without purchasing cereal whenever their preferred brand is unavailable. Second, we know that other brand-loyal customers purchase lower-priced cereal whenever they encounter a stock-out of their preferred brand. Both of these instances lower Big M Mart's revenue. By eliminating stock-outs, Big M Mart could increase its sales by simply ensuring that customers don't walk away without making a purchase. Converting these purchase occasions to sales would increase Big M Mart's sales of sugar cereals by more than 2 percent(1). Better availability also helps Big M Mart and our client increase their revenue by deterring the brand-loyal shoppers from trading down to lower-priced cereals. Recall that 35 percent of the brand-loyal shoppers purchase a discounted cereal if their preferred brand is not available. If improved distribution now makes the preferred brands more consistently available, the customers will pay a higher price for these products. Finally, we could use the information about consumer purchase behavior to help persuade Big M Mart to share information about product availability in its individual stores. We could work with our client and Big M Mart to improve the current distribution system to allow for more economical deliveries, while at the same time ensuring that our client's product is consistently available in the store.
Thank you. Those sound like solid recommendations, but I would suggest that you fully understand the root cause of the stock-out situations and the cost to eliminate them before moving ahead. (1) 15 percent out of stock x 60 percent brand-loyal customers x 25 percent willing to forgo purchase = 2.25 percent


text:
A collection of scholarly works about individual liberty and free markets. A project of Liberty Fund, Inc.
Ireland: Social, Political, and Religious, ed. W.C. Taylor (London: Richard Bentley, 1839). 2 vols. https://oll.libertyfund.org/titles/2430,
A 2 volume work on the history and current economic and political problems of Ireland. Vol. 1 contains the historical section and his analysis of the Irish aristocracy. Vol. 2 continues Beaumont's discussion of the Irish aristocracy. This book seems to have been hastily translated into English in the same year it was originally published in French, and rearranged and edited for the English edition. It is missing some of the footnotes which can only be found in the French edition.
The text is in the public domain.
This material is put online to further the educational goals of Liberty Fund, Inc. Unless otherwise stated in the Copyright Information section above, this material may be used freely for educational and academic purposes. It may not be used in any way for profit.


text:
You are currently viewing the beta version of the new AMM site.
Click here
to return to the current site.
To include more than one recipient, please separate each email address with a semi-colon
';', to a maximum of
By submitting this article to a friend we reserve the right to contact them regarding Fastmarkets AMM subscriptions. Please ensure you have their consent before giving us their details.
When Leo Gerard starts praising Ronald Reagan, you know the world is changing.
Gerard, the United Steelworkers union president best known for his tough support of workers' rights, and Reagan, the darling of the Republican right, would normally make unlikely bedfellows. But on one issue—the need to defend the U.S. economy from the impact of an undervalued foreign currency—Gerard seems to have more in common with Reagan than with the current President.
It was Reagan who took action in 1985 to depreciate the dollar vs. the Japanese yen—or, as Gerard put it at a recent conference, "called (Japan) in and said it was unacceptable" for them to continue to maintain the yen at an artificially weak level, so boosting their exports and swelling the U.S. current account deficit. The resulting deal, most economists agree, helped pull the U.S. economy out of recession.
Gerard, and many others in the steel and manufacturing industries, would like to see Obama take a leaf out of the Gipper's book. The villain now is China, not Japan, and the problem is of a hugely different scale. Japan was running a trade surplus with the U.S. of just over $50 billion in 1985; last year alone, in a recession, the U.S. trade deficit with China was more than $226 billion.
Domestic manufacturing groups have been trying for some time to draw attention to the consequences of this trade imbalance: the lost jobs, the industries that have migrated to China. In recent months, as unemployment rose to around 10 percent, the issue has gained ground in Congress, notably with the revival of legislation that would put a tariff on Chinese imports. In April, the Treasury Department will have another opportunity to label China a "currency manipulator," which would indicate that Obama believes China's undervalued currency is becoming a real problem.
Ironically, China's leaders might well agree. Despite seemingly tougher rhetoric in China against what top government officials there describe as "protectionist" calls for a revaluation of the yuan, there is clearly a growing realization that strengthening the currency would be one of the most effective ways of slowing the country's economy, which some fear is overheating.
China's exporters make up a sizeable chunk of gross domestic product and undoubtedly have been lobbying hard against a revaluation. But after pouring $1.4 trillion of credit into the economy last year, Beijing is looking for a way to apply the brakes; if there's one thing guaranteed to give China's leaders worse nightmares than upsetting exporters, it's the prospect of out-of-control inflation causing discontent among its billion-plus population.
So Beijing may well be reaching a conclusion similar to U.S. manufacturers: that a revaluation is in its best interest. The chances of China making a one-off appreciation of 25 to 40 percent, the amount some economists say is justified, is zero, but a 5- to 10-percent rise looks possible.
But whether turning up the heat on China is the best way of guaranteeing that outcome is another matter. China's leaders don't like to be pushed around in public, and it can be argued that the more vocal the calls for change from the United States, the less room it gives China's leaders to maneuver. That school of thought may well appeal to Obama, who by temperament and conviction appears to take a very different approach to world affairs than, say, Reagan. "Currency manipulator" doesn't quite have the ring of Reagan's famous "Evil Empire," but don't be surprised if Obama backs off from using even the less inflammatory of the two phrases.
An unspoken deal not to push China into a corner in return for an appreciation of the yuan—albeit smaller than many want—may be the likeliest outcome over the next few months. Whether that will prove to be enough for U.S. manufacturing and steel is doubtful, but that may be all that's on offer.
All comments are subject to editorial review.
All fields are compulsory.
Every month American Metal Market takes a statistical look inside the marketplace.
We actually don't know who his investors are. At the point when we are ready, we will investigate further. There are just so many things to handle and there are a lot of items to be considered with the project."
-- Charles C. Mitchell, Barstow city manager


text:
SuicideGirl of the Day — Chrysis [PICS]
Meet Chrysis, a SuicideGirl who hates shower curtains and liars and can't live with espresso.
Name: Chrysis
Location: Ohio
Occupation: Perpetual Accidental Melter of Things. Veterinary technician. Facebook creeper.
Stats: Loved it. You can borrow my notes.
Heroes: My brother. Anderson Cooper. Henry Rollins. Kay Redfield Jamison. Elizabeth Warren.
Favorite position: Little spoon.
Sign: Slow down.
Cigarettes: Nope
My diet: Omnivore
Alcohol: Nope
My drug use: Drug Free
My kink factor: I'll try anything once, especially if you beg for it.
My politics: Bleeding-heart Liberal.
My status: Single
My idea of a good time: Reading at the coffeeshop.
Into: World events, social avoidance, grammar, straight-edge, going fast, veterinary medicine, coffee, sushi, old dogs, smarties — and not the candy, baking a cake for every reason, stirring up trouble, brain-stretches, language, truth, blood, bruises, scars and being left to my devices.
Not into: People who prey on others, liars, forward boys, fatty foods, the "party scene," the Tea Party, pollution [environmental and mental], second-hand smoke, prejudice and shower curtains.
Hobbies: Cycle of self-destruction & self-improvement, fueled by coffee.
5 things I can't live without: Heavy eyeliner, unlimited texting, espresso, sunlight and a reliable pen.
I spend most of my free time: Neurotically making lists. Overanalyzing. Daydreaming.
SuicideGirls is a community that celebrates alternative beauty and alternative culture from all over the world. Since 2001, tens of thousands of models have submitted millions of photos to their website hoping to become SuicideGirls.


text:
- Did you mean
- relatedness ohio dairy day september 14 wooster
Search results
4-H Achievement Form Workshop
November 14, 2020. This is an in depth session geared toward individuals that have already completed the ... Ohio 4-H Teen Leadership Council will host a free 4-H Achievement Form Workshop on Saturday, ... form. COST: Free LOCATION: Zoom! (a link will be sent a few days before the event to those who ...
Find out what's in store for farmers in 2021
) Community Crops Faculty and Academics Wooster area (Ohio) Alayna DeMartini firstname.lastname@example.com 614-292-9833 ... Alayna DeMartini COLUMBUS, Ohio—Farmers in Ohio and across the Midwest might have reason to be ... an assistant professor of agricultural risk management at the The Ohio State University College of ...
Urban Farmer Meet-up to Provide Input for Columbus Zoning Code Revision
Join us on November 16th at 7PM for the Urban Farmer Meet-up to Provide Input for Columbus Zoning ... about how other City of Columbus code issues are being addressed. WHEN: Monday, November 16, 2020, ...
Workday Updates
Business Differently The lab tenant is a Workday environment that you can access using your Ohio State ... Dates Begin November 9th As part of the university's continued HR Service Delivery initiative, we are ... university level orientation will introduce new Ohio State employees to being a Buckeye and set them up for ...
COVID-19 spiking in rural Ohio
Events/Announcements Columbus area (Ohio) Community Faculty and Academics Health and Nutrition Wooster area (Ohio ... Alayna DeMartini COLUMBUS, Ohio—During one of the most significant COVID-19 surges in Ohio, the ... state's rural counties have the highest rates of new cases. Counties in northwest Ohio lead the uptick. ...
Chow Line: Kale can be a crunchy, healthy snack
McDermott, an educator with Ohio State University Extension, the outreach arm of The Ohio State University ... choice. Chow Line is a service of The Ohio State University College of Food, Agricultural, and ... Environmental Sciences and its outreach and research arms, Ohio State University Extension and the Ohio ...
EPN Webinar- November 10, 2020: Cooperating for Sustainable Development
Program Partners: CFAES Center for Cooperatives and Sustainability Institute at Ohio State. ... Ryan Schmiesing, PhD, vice provost for outreach and engagement, The Ohio State University provide ... be facilitated by Kip Curtis, PhD, associate professor, Department of History, The Ohio State ...
Focus on Photography 4-H SPIN Club
TUESDAY, NOVEMBER 10 – DECEMBER 15 @ 4:00 P.M.- Join Tony Staubach, Extension Educator, 4-H Youth ...
Naming of Ohio State center cements Lal's legacy
) Crops Faculty and Academics Natural Resources and Environment Wooster area (Ohio) Sherrie R. Whaley ... with the addition of his name to a center at The Ohio State University. The honor was bestowed on Oct. ... 15, in a virtual ceremony hosted by Ohio State, Nationwide Insurance, and Ohio Farm Bureau. Earlier in ...
Farming and parenting—a tough juggling act
Academics Home Family and Youth Wooster area (Ohio) Alayna DeMartini email@example.com 614-292-9833 ... Alayna DeMartini COLUMBUS, Ohio — Raising children on a farm might sound idyllic, but in ... Shoshanah Inwood, an assistant professor at The Ohio State University College of Food, Agricultural, and ...


text:
Undertaking the Mobility Challenge
There are numerous studies on Mobility and Innovation and the purpose of this document isn't to offer yet another one! The eStory Business Initiative is an invitation to a place where the concept of 'Impossible' doesn't exist.
Humans are infinitely resourceful. By working together intelligently, we can create truly great things - as big as we want them to be.
The Founding Partners of Formula E decided that the event would be a platform to boost sustainable innovations, a gateway to the cities of tomorrow and alternative transport. After the very first Formula E season in 2014-2015, this dream is already becoming a reality – and the best is yet to come.
Without fear or favor, we start the second Formula E season with a critical and (more importantly) enthusiastic attitude. You will find in here examples of innovations developed at Formula E, or for which Formula E is a fast-track to growth. The set up of such a race is in itself an exceptional event. Here we chose to focus on what is happening behind the scenes. As you will see, Formula E is (much) more than a race. Year after year, we will update this paper with new innovations and new exciting partnerships.
We are not documenting history, we are writing it... enthusiastically!


text:
Show your love for your Sheltie!
If you have a Sheltie you have to have a pair of these socks. These socks also make great gifts for anyone in your family and friends.
- Our socks are made from the finest quality cotton
- We use 200 Needle count machines to make them while most other companies only go up to 144 needle count
- Unisex socks
- Fits Women's sizes 5-11 and Men's sizes 6-10
- A portion of the proceeds supports animal shelters to find new homes for pets in need.
- There are 20 to 24 Sheltie faces woven on each pair of socks
- Best of all, these socks are super soft and comfortable
- Machine wash cold
- Tumble dry medium heat
- Do not bleach


text:
Justin Bieber responsible for Miranda Kerr, Orlando Bloom split?
Supermodel Miranda Kerr's flirting with pop singer Justin Bieber reportedly jeopardised her marriage with Orlando Bloom.
Kerr, 30, and Bloom recently ended their three-year marriage and in a joint statement announced that it was an amicable decision. They have a two-year-old son Flynn.
Kerr is said to have spent time with Bieber, 19, at a party in New York nearly a year ago, reports dailymail.co.uk.
She was pictured snuggling up to the singer in an eye-popping gem-encrusted green corset after a Victoria's fashion show in 2012.
"Orlando heard that there had been some flirting going on and he wasn't exactly thrilled about it," said a source.
"Miranda had always claimed that she was a fan of Justin's music. She has taught her son how to say Bieber fever but it is supposed to have caused an issue," the source added.
Sign up for all the latest news, top galleries and trending videos from Mid-day.comSubscribe


text:
With deep musical influences from gypsy jazz innovator Django Reinhardt and interests in the world of electronic music, Alouette has found an outlet for her love of the gypsy culture.
Born and raised in Maryland and musically refined in the Washington DC classical opera scene, she has spent much of her young life, now just 27, traveling through Canada, the vineyards and hills of Italy and throughout South of France before winding up and embedding herself into the Williamsburg music scene.
Just one day before our interview last week at the House of Small Wonder at 77 N. 6th St., Alouette tweeted that she was crossing the English Channel after camping with manouche (gypsies) at Samois-sur-Seine, several miles south of Paris.
Now back in New York after a near month abroad, she is in the studios again preparing for an album release followed by several more shows throughout the city.
While her living is made on playing her music on the road, she is also scheduled to play the Glasslands, located at 289 Kent Ave. with Pure Bathing Culture on Aug. 28 at 8:30 p.m. On Aug. 24 and 25, she will also perform with the djangOrchestra at the Nitehawk Cinema, located at 136 Metropolitan Ave., with a live score for the 1927 silent romantic comedy film, "It".
While in between her trip from Europe and arriving back in Brooklyn for recording sessions and meetings with public relations and record executives, I had a chance to sit down with Alouette to discuss her busy life and her plans for the future.
So, what brings you to Brooklyn?
Well, I was living in Montreal and I was studying opera singing at McGill (University), and I wanted to stay there because I loved the music scene there. I was doing opera but I like electronic music and different types of world music and gypsy jazz, but I couldn't stay because of visa reasons.
I was like, well what am I going to do? And I didn't want to move back to Maryland, so I moved here.
Can you explain your background in Opera?
I studied at McGill University, and in the summers I would also study in Italy and in Austria. I did some small concerts, but also when I was growing up, I also studied with the Washington Opera when Plàcido Domingo was their conductor at the time. We performed at the Kennedy Center and did a choral performance at Carnegie Hall.
So I grew up with a lot of classical theater and Opera background, but I always felt a little bit narrow with just doing that at McGill because I have a lot of other musical interests.
While I was studying opera I would be going out to raves.
What took you towards the next step in making your own music?
Well I was back up in Montreal doing just gypsy jazz, and not opera, and even though I still practiced in opera I wasn't performing. Then I couldn't stay, and then I came to New York, and I wanted to get more into the electronic scene.
How did you do that?
I started recording in the studio, ishlab studio, which is where I record the albums and the new one that I released last year.
What got you interested in the electronic music?
I always listened to it. I tried to get into it when I was studying opera by combining the two; by working with the digital music composition studios at McGill, where I'd do stuff with live computer interaction and opera singing.
What is the style of music that you play now?
To explain the style of music, it was started by this musician, Django Reinardt, and he was really big in the 30s and 40s. Now it is sort of making a comeback in London, New York and Paris. Django was a gypsy, and there was a lot of influences in early jazz in New Orleans. He played with Louis Armstrong and Duke Ellington and even later on he toured and played at Carnegie Hall, and he just combined gypsy rhythms with New Orleans jazz.
So I've been doing that here. I'm primarily a singer and I decided I don't want to do opera too much. I just kind of stumbled into this style of music because I never really listened to it before.
What got you interested in this culture?
It started because I really liked the ambiance of the sound when someone in Montreal turned me on to Django. I didn't really think too much of it, but I really liked listening to it. I really think people can either really love it, or people can like it, but I don't really know anyone who doesn't like this style of music.
It's easy listening, but it's not really "easy listening." It's fun to listen to.
What is some of the most inspiring music to you?
I like Billy Holiday's singing, Django Reinhardt, opera singers like Maria Callas. I like the discipline and the grand epicness of the classical music impression music.
I like modern bands like Hiatus Caiyote, and they're like neo soul, but they incorporate a lot of these in their music as well. I like them because they put it together very well, and they have a variety of influences and they have a lot of groove and really progressive beats.
I love beats.
I also listen to a lot of hip-hop and UK producers like James Blake, Jaime Lidell, and a lot of Berlin Techno, which is a lot of the rave influence.
In modern pop music, there is a movement that combines electronic music with things that are more traditional. Is this something that you see happening?
That's what I want to do, ultimately. I really love James Blake's music and I want to do something that's similar to his style with electronic beats and production elements and vocals.
The reason why I also like this music is because I can sing with it. The singing is first and foremost my instrument. I'm trying to find a vehicle to create a sound of music that creates a vibe that's forward looking with beats, but at the same time is rooted in the gypsy jazz that is more melodic and creates a vibe.
So, I will use the soloing guitar as a texture, but definitely staying progressive.
How do you develop new styles of your music?
I want to do something that's current, that's also forward thinking and that's also creatively challenging.
I've been working on this idea in the back of my head for a song that is kind of taken from gyspy jazz from one song. I reworked it and it was inspired by this one song.
Then, at ishlab, they're showing me new music and this trend of slowing music down. For instance, they took a song and slowed it down by 800 percent and then they build beats on top of it.
After the tour, you are scheduled to play at the Nitehawk Cinemas in Williamsburg with your group djangOrchestra. What is the stage set up going to be like at that show?
It's going to most likely be two gypsy jazz guitarists, a double bass, either horns or violin; like clarinet or saxophone and vocals. Now I am also considering adding more of the electronic elements of this as well to make it a little bit more modern but definitely with the gypsy jazz vibe.
I've been wanting to give this new sound to the gypsy jazz music.
When I was Samois for this festival where they played traditional gypsy jazz, I felt like even though people are purists, it's also nice to do something contemporary with it.
Catch Mary Alouette at her album release party for the The Lark EP on July 30 at the Cameo Gallery, located at 93 N. 6th St. in Williamsburg.


text:
Snow White Fantasy ladies Costume
All Fancy Dress items are on sale until stock runs out!
Only 1 left
Snow White Fantasy ladies Costume is available to buy in increments of 1
Sexy Snow White!
Costume includes dress with lace-up detail & Bows
Ruffle skirts are sold seperately.
|One Size
Write Your Own Review
Moulded Cup Conversion Chart
This chart is to be used as a guide only as fit is dependant on the product you are making and the individual. Boost cups may require a 1 size increase
Bra Conversion Chart
Size Conversion Chart


text:
Enter a magazine title or keyword
We have subscribed to TPW magazine for over 10 years. It have been the one place we go to choose a hike or road trip every month. Each month, one family member gets to pick a weekend road trip or hike. There is no need to ever leave the state. The Great State of Texas has everything to offer every kind of outdoor enthusiast, of any age. I have lived here more than 35 years and still learn something new every month.
This is a great magazine to know what to do and where to go in Texas. Even as a native, I very much enjoy the highlights of all the places around Texas to visit.
I just wish there was a digital version of the magazine!
I totally enjoyed the articles withing the magazine; the photos are great and the writing is outstanding. Please keep up the good work and congratulate the class of Rangers that just graduated. You should also include an article wherein the requirements and etc. to become a Ranger can be stated. Who knows some young/qualified people may be looking for an exciting job.
Join Us:
Accepted Cards: