text:
Bailey expected to rejoin 'pen Monday in Chicago
Reliever set for one-game stint with Triple-A Pawtucket on Saturday
ST. PETERSBURG -- Look for Andrew Bailey to be back in the Boston bullpen on Monday night, when the Red Sox open a three-game series in Chicago against the White Sox.
The closer threw a 15-pitch simulated game at Tropicana Field on Thursday. The final step before activation is a one-game Minor League stint for Triple-A Pawtucket on Saturday.
"I felt good. I threw all my pitches," Bailey said. "The next step is to pitch Saturday in Pawtucket and then be back. Everything feels good. It's a baseball thing, just getting acclimated again. Everything feels great."
The Red Sox bullpen looks much better with Bailey pitching the ninth inning, particularly when you consider Joel Hanrahan is out for the rest of the season.
"Watching him out there today, he threw the ball very well," said Red Sox manager John Farrell. "Not only in terms of power with his fastball, but action to his secondary stuff. He warmed up without any issue. He came out of it feeling well."
Was there any consideration to activating Bailey without a rehab stint?
"I mean when you see the ball come out of his hand, sure, you think about that," said Farrell. "But the fact is, he's 19 days from his last game. He's a guy that pitches with a lot of adrenaline in that role and I think the next progressive step will be in a game situation against a different uniform and all the other things that we can't produce in a sim game situation, so that's where Saturday takes him."
Bailey was sidelined with a strained right biceps. His last appearance for the Red Sox was on April 28.


text: Easy and effortless, these jeans are the perfect choice for any occasion. Our incredible vintage 100% cotton non-stretch denim makes the perfect fabric for our modern take on the boyfriend jean. Its slimmer relaxed fit strikes the perfect balance between tomboy and feminine. Vintage Levi's made in the American South circa 90s, RE/DONE in Los Angeles. For a low on the hips, oversize boyfriend fit that looks like you actually borrowed them from your boy, buy this denim in your true size. For a slimmer, loose-but-slouchy fit, size one down.Front Rise 9 1/4" Back Rise 13" Inseam 29"Model image is for style use only.

subset: commoncrawl


text:
Polls seem to suggest a close one. Get your Antony Greens on at the ABC election site, and there's blogging at Crikey's place. Of course, everyone south of Queensland has the advantage – they can bring Queenslanders the election results from the future.
QLD: Vote early, vote often
Saturday, 21 March, 2009 by Tobby
Posted in Australian politics | Tagged election, Queensland | 1 Comment
One Response
From the future or not, I don't think I want to know where things will stand.
Comments are closed.
Recent Posts
Recent Comments
- Aboriginal issues Afghanistan Alberto Gonzales Alexander Downer Andrew Bolt APEC Australian Federal Police Barack Obama blame game Brendan Nelson campaign strategy climate change debate Dennis Shanahan economic crisis economic management election emissions trading Environment federalism fiscal policy Foreign policy freebie funny George Megalogenis George W Bush Glenn Milne global warming Government Greens Greg Sheridan Guantanamo Bay health immigration income tax industrial relations interest rates Internet filtering Internets Iran Iraq Islam Janet Albrechtsen Joe Hockey John Howard John McCain Julia Gillard Kevin Andrews Kevin Rudd Labor leadership Libs Malcolm Turnbull Matt Price media Mohamed Haneef Paul Kelly Peter Costello petrol Philip Ruddock Piers Akerman political advertising political psychology polls Random Sarah Palin Senate terrorism Tim Blair Tony Abbott torture troop surge United States of America US politics WorkChoices
Latest ABC Political News
Not A Hedgehog is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 Australia License.


text:
New install. When attempting to change password, Windows client users are getting an error message from Netwrix password mgr: "Change password failed. The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you."
Altho it's an Netwix dialog box presenting the error, the text is typical Windows, so I think the text of the error is coming from Windows.
Even tho the error message seems to indicated a failed password change attempt, the password does change on the network. It's the client-side password that doesn't change. That is to say the client can now access network resources using the new password, but if you disconnect the client from the network, you will need the old password to log on to the client. That indicates to me that the client's password cache didn't learn about the password change.
We are trying to roll this product out for remote users to deal with password changes. Therefore they will need to execute password changes from outside the network via the Password Change Manager server. Since the remote users don't normally log into the network, they being remote and all, the password cache on their notebooks needs to be synched with their network password.
My gut feel is that the problem has to do with the remote notebook's password cache not being updated by the Password Manager server. So maybe there's a process not reaching out to the notebook, or the notebook isn't allowing the external process to do what it needs to do.
Turning Kaspersky A/V off didn't change behavior.
Don't see anything interesting in event logs on clients, Netwrix server, nor DCs.
Clients are Win8.1 using https to connect to a Win2k8R2 Password Mgr server. DC's are Win2k8R2.


text:
Recently the ceasefire between the Sri Lankan government and the Tamil Tiger separatist rebels (the official name being the Liberation Tigers of Tamil Eelam or LTTE) broke down and there has been a rapid escalation of violence with large numbers of casualties on both sides and, inevitably, civilians bearing the brunt of it and being forced to flee their homes.
The US government has been trying to get the warring parties to desist from fighting and get back to the negotiating table, and two senior State Department officials have gone to the region to try and move the negotiation process along.
The United States has said that it strongly supported peace talks between Sri Lanka and the Tamil Tigers as there was no military solution for the conflict in the island nation.
But the US also asserted that it would not deal with the rebels who use reprehensible and bloody tactics to kill innocent people.
"We believe that there is no military solution for this kind, and we are strong supporters of negotiations," Under Secretary of State for Political Affairs Nicholas Burns told a round table of South Asian journalists.
Meanwhile Richard Boucher, US Assistant Secretary of State for Central and South Asian Affairs, said that "hostilities must cease and both sides need to exercise maximum restraint." He went on:
"We are pleased that the government and the LTTE are committed to peace talks to go to Geneva and to begin discussions again."
"We think it is important to discuss all the issues. It is also important to begin a process that can lead to a serious negotiation, and eventually, to a political solution with legitimate interest of all the communities: of Tamils, Muslims of Sinhalese," Mr. Richard Boucher told the press.
"It can be accommodated with a unitary Sri Lanka."
Accepting that a military solution was not likely to occur shows a sense of realism, and encouraging talks and negotiations are worthy goals. The reason I highlight them is because the Tamil Tigers have been designated by the US State Department as a terrorist organization. Hence these actions seem to be in contradiction with the oft-stated US government policy of never negotiating with terrorists or with so-called state sponsors of terrorism.
I have never agreed with that policy. You should be willing to talk with anybody because that is the only way you get to understand your opponents and it may even lead to a non-violent solution.
But it looks like the US policy applies only to selected groups of terrorists. Or perhaps the US government does not talk to certain 'terrorists' not out of any lofty principle, but because it serves their own political interests.
POST SCRIPT: Privacy? We don't need no stinkin' privacy!
Here's a wonderful and short animated cartoon about the NSA wiretapping of phones.


text:
Justices Clash on Affirmative Action
WASHINGTON—The Supreme Court on Wednesday seemed likely to curb racial preferences in university admissions, after 80 minutes of intense argument revealed deep fissures among justices' views on the pursuit of diversity in higher education.
Washington Wire
The case arose when Abigail Fisher, an applicant to the University of Texas, alleged the school rejected her because she is white. But the implications stretch far beyond the Austin campus. Since the 1970s, racial and ethnic diversity has become a central creed in American higher education, reflected in dozens of briefs backing UT filed by institutions ranging from the Ivy League to the military academies.
Justice Anthony Kennedy, considered the only one of the court's five conservatives open to arguments for affirmative action, damped university administrators' hopes of retaining largely unfettered discretion over race's role in admissions. When UT's lawyer, Gregory Garre, sought to explain an admissions formula the university says is a "holistic" review of myriad individual attributes, Justice Kennedy was skeptical.
"So what you're saying is that what counts is race above all," he said. "You want underprivileged of a certain race and privileged of a certain race. So that's race."
Justice Kennedy gave no suggestion of retreating from his prior view of diversity as a compelling state interest. He has said that this, in theory, could justify some racial preferences. However, he has never voted to uphold any affirmative-action program to come before the court.
UT's position was problematic to the court's conservatives partly because the university has been able to maintain a diverse enrollment through a colorblind admissions formula that automatically accepts roughly the top 10% in class rank from each Texas high school. Because Texas has many schools that are nearly all black or all Hispanic, that plan has yielded roughly 5% black and 20% Hispanic undergraduate enrollment.
The university says, however, that the highest-ranked students at a disadvantaged school have lower SAT scores than some in the middle of the pack at a more competitive suburban high school. UT's affirmative-action program aims to open doors for minority applicants from middle-class or professional families. Such students can "help dispel stereotypical assumptions…which actually may be reinforced" by minorities admitted only because of the top-10% plan, UT said in its brief.
Justice Samuel Alito seized on that point. "I thought that the whole purpose of affirmative action was to help students who come from underprivileged backgrounds, but you make a very different argument that I don't think I've ever seen before," he said.
Argument Transcript
Suppose UT gets a minority applicant whose parents "have income that puts them in the top 1% of earners in the country," Justice Alito said. "They deserve a leg-up against, let's say, an Asian or a white applicant whose parents are absolutely average in terms of education and income?"
Mr. Garre replied that affluent blacks or Hispanics bring "different experiences" than those from disadvantaged backgrounds and that the university was justified in ensuring their perspectives could also be found on campus.
College affirmative action has hung by a thread since 1978, when a fractured court barred quotas but authorized administrators to consider race as a "plus" factor among other characteristics. In 2003, the court reaffirmed that position by a 5-4 vote, in an opinion by Justice Sandra Day O'Connor in Grutter v. Bollinger.
Justice O'Connor retired in 2006, and Justice Alito, selected by President George W. Bush to fill her seat, clearly shifted the court majority on affirmative action.
Liberal justices seemed frustrated, if not angry, that so recent a ruling was being reconsidered.
Justice Stephen Breyer asked Bert Rein, Ms. Fisher's lawyer, if he wanted the court to overrule the O'Connor opinion outright.
"Grutter said it would be good law for at least 25 years, and I know that time flies, but I think only nine of those years have passed," he said. "Why overrule a case into which so much thought and effort went and so many people across the country have depended on?"
Mr. Rein said he wasn't asking the court to overturn a precedent—a rare act—but to stop administrators from using Grutter as carte blanche for race preferences.
"So you don't want to overrule Grutter, you just want to gut it," said Justice Sonia Sotomayor.
Justice Elena Kagan, who worked on the case as solicitor general, recused herself. A decision is expected by July.
Write to Jess Bravin at firstname.lastname@example.com
Copyright ©2020 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8


text:
Equity futures are higher in overnight action. Below is a 5 minute chart of the DOW futures on the left, and 15 minute chart of S&P futures on the right. Friday's selloff did quite a bit of damage, but it did not make a new low. The key for the short term will be which direction the market moves out of the current small consolidation pattern. If it breaks to new lows below /ES 1,176, then it is bearish short term, however if it breaks higher as expected then it is equity bullish in the very short time frame:
McHugh has a wave count that requires one more move higher – that would fit the 90% odds of a Monday morning ramp. That wave, if his read is correct, may or may not go on to reach new highs. Regardless, the overall formation is bearish in the intermediate following this last wave higher.
Both the dollar and bonds are significantly higher over the weekend, despite Greece accepting $146 Billion in shameful and disgraceful indebtedness – chains created by the world's central bankers for which the people of Greece will be eternally laboring on the banker's behalf. The Euro is actually much lower and is forming a flag that looks bearish for the Euro. The direction of the dollar and bonds is not a positive for equities.
Meanwhile oil and gold continue to rise, yet other more industrial commodities, like steel, continue to look structurally weak. Gold, on the other hand, looks extremely bullish like it is going to challenge new all time highs.
I continue to think that the XLF will significantly impact market direction. Goldman is up as they attempt to regain the $150 level which is now overhead resistance. Should Goldman get beneath $140, it is quite bearish, above $150 becomes more bullish.
Citizen spending rose in March by .6%, the sixth consecutive increase and now up 2.9% year over year. Meanwhile income was reported up .3% for March. Obviously those figures are coming off the total freeze of last year, not very impressive compared to the backdrop of a nearly doubled stock market. With spending outpacing incomes again, what does that tell you about the savings rate? Down again…
NEW YORK (CNNMoney.com) -- Personal spending rose for the sixth month in a row during March, while income also increased, according to government data released Monday.
The Commerce Department said individual spending rose 0.6%, or $36 billion, last month after an upwardly revised 0.5% increase in February.
Personal income climbed 0.3%, or $32.3 billion, in April following a 0.1% rise the month before. Both figures matched estimates from economists surveyed by Briefing.com.
The report also showed that personal savings as a percentage of disposable personal income, known as the savings rate, was 2.7% in March. That's down from 3% in February.
Motor vehicle sales will be reported throughout the day, Construction Spending and the Manufacturing ISM are released at 10 Eastern.
The oil spill in the Gulf is turning out to be a very significant disaster, I don't think that people have fully grasped the significance. If they are not able to get it contained fairly soon, and if it is leaking at the higher rates being mentioned, then it very well could turn out to be very significant to the macro-economy, not to mention the environment, especially if it is not contained to the Gulf. Meanwhile BP and Transocean (RIG) are both plummeting as an army of lawyers are deployed.
Keep an eye on this as it develops as the costs are going to continue to elevate as it grows, many industries will be affected.
I find the following article to be very interesting regarding Australia imposing a "super" tax upon miners. This is going to have a huge impact on BHP and Rio Tinto along with other miners who do business Down Under:
BHP, Rio Shares Drop on Australian Mine 'Super' Tax
May 3 (Bloomberg) -- BHP Billiton Ltd. and Rio Tinto Group, led declines in mining stocks in Sydney trading on concern Australia's plans to impose the world's heaviest tax regime on resource companies will cut billions from profits.
BHP and Rio fell the most in 3 months after Australia announced the so-called super tax yesterday. The 40 percent tax on resource profits will start from 2012 and raise A$12 billion ($11 billion) in its first two years. BHP, with 51 percent of its assets in Australia, said taxes on its operations there will increase to 57 percent in 2013 from 43 percent now.
"These proposals seriously threaten Australia's competitiveness, jeopardize future investments and will adversely impact the future wealth and standard of living of all Australians," Marius Kloppers, chief executive officer of BHP, the world's largest mining company, said in an e-mailed statement.
Australia, the world's biggest iron ore and coal exporter, is now the most highly taxed mining nation, reducing its competitiveness, Citigroup Inc. said. The move may reduce BHP's earnings by 17 percent and Rio's by 21 percent in 2013, UBS AG said today in a report.
BHP traded 3 percent lower at A$39.53, its biggest decline since Feb. 5, at the 4:10 p.m. Sydney time close. Rio, the third-biggest, declined 4.3 percent to A$69.00., also its biggest fall since Feb. 5.
Credit Swaps
The cost of protecting Rio Tinto and BHP bonds against default surged to the highest in almost two months. Credit- default swaps on Rio Tinto jumped 7 basis points to 83 basis points as of 4:34 p.m. in Sydney, the highest since March 5, according to Nomura Holdings Inc. and CMA DataVision in New York. Swaps on BHP rose 4 basis points to 64 basis points, the highest since March 8, Nomura and CMA prices showed.
Australia, I'm sure, doesn't want to just give away their natural resources for free, and of course that wouldn't be appropriate. However, Australia has been much heralded lately as being in the sweet spot to feed Asia and has done relatively well compared to other nations that possess debt based money systems. Their debts are, however, very high and they need revenue to service their own never ending growth requirements which emanate from living inside of their own debt backed money box.
This is a clear example where higher taxes to service those debts will translate into lower corporate earnings. The productive capacity of those companies, and the productive capacity of those natural resources are being used to service debt… and just whose hands hold the debt? You guessed it – the very central bankers who created the debt based system with NO productive effort. If you can't follow the money trail here, then you are a banker's best buddy. It does not have to operate like that at all, each country should be producing their own sovereign, non debt-backed money.
This is what happens following high levels of debt and rising taxes are clearly a trend that is going to be impacting the future. Austerity in the form of dramatic cuts and higher taxes will hurt Greece greatly as well. They had a choice, and unlike Iceland they made the wrong one for their long term wellbeing. The pressures that are about to be forced upon the people of Greece will lead to "other" events. And we still have all the other already indebted countries to go. Curing debt with debt will not work in the long run, it will end in disaster.
I read several articles this weekend on the "miracle" that is China. More people are talking about the false statistics and unchecked growth. This weekend Marc Faber joined the ranks of those saying that it has gone too far:
China May 'Crash' in Next 9 to 12 Months, Faber Says
May 3 (Bloomberg) -- China's economy will slow and possibly "crash" in the next nine to 12 months, Marc Faber, the publisher of the Gloom, Boom & Doom report, said.
"The signals are all there, the symptoms of a major bubble are all there," Faber said in a Bloomberg Television interview from Hong Kong. "The Chinese economy is going to slow down regardless. It is more likely that we will even have a crash sometime in the next nine to 12 months."
The Shanghai Composite Index has plunged 12 percent this year, the fourth-worst performer among 92 gauges tracked by Bloomberg globally, as the government stepped up measures to cool the property market and ordered banks to set aside more deposits as reserves.
The latest increase of bank reserve ratios came yesterday after earlier moves failed to halt a record surge in real estate prices. In March, prices rose 11.7 percent across 70 cities from a year earlier, the most since data began in 2005.
The clampdown on property speculation may prompt investors to turn to the nation's stock market, Faber said. Still, shares are "fully priced" and Chinese investors may instead become "big buyers" of gold, he said.
Faber is now seeing the signs of a bubble there, duh. However, his timing has been good and he is now braving a timeframe on a crash in China within the next year. Think the U.S. will avoid the fallout should that occur? I don't.
On Friday the VIX closed back above the upper Bollinger bands. That followed the market buy signal that occurred Thursday when it closed inside of the Bollinger range:
It may close back inside that range again today, that would reconfirm the market buy signal. This conflicts with the wave count that McHugh is tracking and makes the intermediate term less certain for me. I still regard the market as extremely overextended, I see nothing but threats and continue to believe that debt, and who controls it, will continue to anchor the world's economies – it will most definitely not set them free.
Deep Purple - Smoke On The Water


text:
This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Testing for business logic
This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project
- 1 Brief Summary of Business Logic Vulnerability
- 2 Description of the Issue
- 3 Functional testing and Examples
- 4 References
Brief Summary of Business Logic Vulnerability
The most recent research represented about the concept Business Logic vulnerability by Jr.Scientist Faisal Nabi in the 24th Annual Computer Security Application Conference (ACSAC, 08)California, Dec 8-12 ,2008.
(ACSAC,08)work in progress session:
Designing a Secure Framework Method for Business Application Logic Integrity in e-Commerce Systems,Faisal Nabi, Distributed System Research Group, Department of Computer Science, Victoria University of Wellington, Wellington, New Zealand. http://www.acsac.org/2008/program/wip/
Business-level- Process Integration is based on business components integration, which takes part to process a certain job/task event, which comes into being because of business logic inside a component. When we talk about business process integration, which means integrating business component's business processing logic,this integration completely rely upon that Business component's Interface. A component interface is self descriptor which provides specification, which defines that which component offers, what service (such as,Account service provided by Account Component interface, this is called Component interface specification,which reflects component's business process functionality, which indicates a component offer a particular service)Integration of components is limited through only the interface. Therefore, business process integration, which depends on component's interface specification in business component, it refers to business function / processing logic, specification of that business component (Components are reusable units for composition. This statement captures the very fundamental concept of component-based development, that an application is made up and composed of a number of individual parts,and that these parts are specifically designed for integration in a number of different applications. It also captures the "idea that one component may be part of another component" , or part of a sub-system or system, both of which represent components in their own right), and integration of all this process, then develop overall business processing logic for a business component-based software to develop an application in the middle-tier, which connected with information system in the back-end systems of organization.
Since, this business process integration is made on the base of business functional concern; it can not be dealt with technological point of view, because problem is not based on technical or technological specific principle of Integration, which is based on related to some particular component model, but as it is stated above, issue identifies that business processing designed solution based on business components and their business processing integration. This is a point , where the focus is set to the logical structure of the "business solution", this is the stage where logical problems occurs due to lack of paying attention to the design-based testing environment for Logical structure of the business solution , are known as Business Logic Vulnerabilities (Faisal Nabi, 2008).
Testing for business logic flaws in a multi-functional dynamic web application requires thinking in unconventional ways. If an application's authentication mechanism is developed with the intention of performing steps 1,2,3 in order to authenticate, what happens if you go from step 1 straight to step 3? In this simplistic example, does the application provide access by failing open, deny access, or just error out with a 500 message? There are many examples that can be made, but the one constant lesson is "think outside of conventional wisdom". This type of vulnerability cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester. In addition, this type of vulnerability is usually one of the hardest to detect, but, at the same time, usually one of the most detrimental to the application, if exploited.
Business logic may include:
- Business rules that express business policy (such as channels, location, logistics, prices, and products); and
- Workflows based on the ordered tasks of passing documents or data from one participant (a person or a software system) to another.
Attacks on the business logic of an application are dangerous, difficult to detect, and are usually specific to the application being tested.
Description of the Issue
Business logic can have security flaws that allow a user to do something that isn't allowed by the business. For example, if there is a limit on reimbursement of $1000, could an attacker misuse the system to request more money than it is intended? Or, perhaps, users are supposed to do operations in a particular order, but an attacker could invoke them out of sequence. Or can a user make a purchase for a negative amount of money? Frequently, these business logic checks simply are not present in the application.
Automated tools find it hard to understand context, hence it's up to a person to perform these kinds of tests. The following two examples will illustrate how understanding the functionality of the application, the developer's intentions, and some creative "out-of-the-box" thinking can break the application's logic and pay huge dividends. The first example starts with a simplistic parameter manipulation, whereas the second is a real world example of a multi-step process leading to complete destruction of the application. (Note that this was a real world application penetration test, so complete destruction was not actually carried out but a proof of concept was done instead).
Business Limits and Restrictions
Consider the rules for the business function being provided by the application. Are there any limits or restrictions on people's behavior? Then, consider whether the application enforces those rules. It's generally pretty easy to identify the test and analysis cases to verify the application if you're familiar with the business. If you are a third-party tester, then you're going to have to use your common sense and ask the business if different operations should be allowed by the application. Sometimes, in very complex applications, you will not have a full understanding of every aspect of the application initially. In these situations, it is best to have the client walk you through the application, so that you may gain a better understanding of the limits and intended functionality of the application, before the actual test begins. Additionally, having a direct line to the developers (if possible) while the testing proceeds will help out greatly, if any questions arise regarding the application's functionality.
Example 1:
Setting the quantity of a product on an e-commerce site as a negative number may result in funds being credited to the attacker. The countermeasure to this problem is to implement stronger data validation, as the application permits negative numbers to be entered in the quantity field of the shopping cart.
Example 2:
Another more complex example pertains to a commercial financial application that a large institution uses for their business customers. This application provides banking ACH (Automated Clearing House) electronic funds transfer and payment services to its business customers. Initially when a business purchases this service, they are provided two administrative level accounts for their company, in which they can create users at different privilege levels, such as one user can make transfers, another (e.g., a manager) can approve transfers over a designated dollar amount, etc. When a user is created by an administrator account, a new userid is associated with this new account. The userids that are created are predictable. For example, if an admin from a fictitious customer of "Spacely Sprockets" creates two accounts consecutively, their respective userids will be 115 and 116. To make things worse, if two more accounts are created and their respective userids are 117 and 119, then it can be assumed that another company's admin has created a user account for their company with the userid of 118.
The business logic error here is that the developers assume that no one would ever see or attempt to manipulate the userid that was associated with the username when the account was created (since it was passed within a POST request). To make things worse, this parameter is predictable (a linear sequence of numbers initiating from 0 and incrementing by 1), which allows userids to be enumerated within the application.
With the understanding of how the application functions and the understanding of the developers' misguided assumptions, it is possible to break the logic of the application. Now that an account for a user of a different company has been enumerated (remember userid 118 from above), let's create another user account of our own with privileges limited to only being able to transfer funds internally and update our user preferences. When this new user account is created, it is assigned a userid of 120. If we log in with this newly created account, we can't do anything but update our own user preferences and make limited transfers internally. If we make any change to this user's profile, the userid is submitted to the application with our preference change. If we trap this request within our intercepting proxy and change the userid to 118 (remember that userid 118 was found by enumerating user accounts and that it belongs to a different company), then that user is effectively removed from the other company and added to our company. Two things will result from this. First, this will perform a denial of service for the other customer, since they can no longer access this account (since it is now associated with our company). Second, we can now run reports and see every transaction that the company's user performed (including money transfers with bank account numbers, routing numbers, balances, etc) now that this userid is associated to our company. The application logic saw a request from an authorized user (via a valid session token), but did not cross reference this valid token to see if the userid really belonged to this company. Since it didn't cross check that the userid that was submitted in the request belonged to the current authorized user's company, it associated that userid to the current company of the authorized user.
Now let's take this a step further. Suppose a new customer is given two admin accounts, with the userids starting at 113 and 114 for our current company. What would happen if we automated the attack above (i.e., sending an authenticated request with a different userid) with a fuzzer, utilizing the same request but starting at userid 0 and incrementing to 112. If this was completed, then our company would now have 113 new accounts, of which many could be admin accounts, user accounts with different privileges, etc. We could now run as many reports as we like, harvesting account numbers, routing numbers (of individuals and other companies), personal information, etc. Unfortunately, once an account has been removed from its previous, legitimate company and has been added to our company, we lose the capability of transferring money using the privileges of this account. Regardless, the damage has been done, since no other company can access the banking application using these accounts any longer, since they now belong to our company. Effectively, this is a complete DoS for every company but ours, and we can now harvest a lot of sensitive information from these accounts (e.g., previous transactions) by running reports for these users that are now within our current company.
As you can see, the vulnerability within the business logic was due to assumptions made by the developers and how the application reacted when it received unexpected data. First, developers assumed that all data (in particular, the userids) passed with the body of a POST request was valid and did not verify it on the server-side before processing it. Second, the application did not verify that the authentication/authorization session token (a cookie, in this scenario) for a user belonging to one company actually was a valid userid for that same company. As a consequence, the application logic was completely vulnerable: once the user's profile was updated using the current user's session token and another user's userid (corresponding to a different company), the application removed the user account from the victim company and moved it to the current user's company.
This example shows how understanding the functionality of the application, the intentions of the developers, and some creative thinking, can break the application's logic and pay huge dividends. Thankfully, we are ethical penetration testers and can inform our clients of this vulnerability and remediate it, before a malicious user attempts to exploit it.
Functional testing and Examples
Although uncovering logical vulnerabilities will probably always remain an art, one can attempt to go about it systematically, to a great extent. Here is one suggested approach:
- Understanding the application
- Creating raw data for designing logical tests
- Designing the logical tests
- Standard prerequisites
- Execution of logical tests
Understanding the application
Understanding the application thoroughly is a prerequisite for designing logical tests. To start with:
- Get any documentation describing the application's functionality. Examples of this include:
- Application manuals
- Requirements documents
- Functional specifications
- Use or Abuse Cases
- Explore the application manually and try to understand all the different ways in which the application can be used, the acceptable usage scenarios, and the authorization limits imposed on various users.
Creating raw data for designing logical tests
In this phase, one should ideally come up with the following data:
- All application business scenarios. For example, for an e-commerce application this might look like:
- Product ordering
- Checkout
- Browse
- Search for a product
- Workflows. This is different from business scenarios, since it involves a number of different users. Examples include:
- Order creation and approval
- Bulletin board (one user posts an article that is reviewed by a moderator and ultimately seen by all users)
- Different user roles
- Administrator
- Manager
- Staff
- Different groups or departments. Note that there could be a tree (e.g. the Sales group of the heavy engineering division) or tagged view (e.g. someone could be a member of Sales as well as Marketing) associated with this.
- Purchasing
- Marketing
- Engineering
- Access rights of various user roles and groups - The application allows various user privileges on some resource (or asset) and we need to specify the constraints of these privileges. One simple way to know these business rules/constraints is to make use of the application documentation effectively. For example, look for clauses like "If the administrator allows individual user access..", "If configured by the administrator.." and you know the restriction imposed by the application.
- Privilege Table – After learning about the various privileges on the resources along with the constraints, you are all set to create a Privilege Table. Get answers to:
- What can each user role do on which resource with what constraint(s)? This will help you in deducing who cannot do what on which resource.
- What are the policies across groups?
Consider the following privileges: "Approve expense report", "Book a conference room", "Transfer money from own account to another user's account". A privilege could be thought of as a combination of a verb (e.g., Approve, Book, Withdraw) and one or more nouns (e.g., Expense report, conference room, account). The output of this activity is a grid with the various privileges forming the leftmost column, while all user roles and groups would form the column headings of other columns. There would also be a "Comments" column that qualifies data in this grid.
Privilege Who can do this Comment Approve expense report Any supervisor may approve reports submitted by his subordinate(s) Submit expense report Any employee may do this for himself Transfer funds from one account to another An account holder may transfer funds from their own account to another account View payslip Any employee may see his own payslip
This data is a key input for designing logical tests.
Developing logical tests
Here are several guidelines to designing logical tests from the raw data gathered.
- Privilege Table - Make use of the privilege table as a reference while creating application-specific logical tests. In general, develop a test for each admin privilege to check if it could be executed illegally by a user role with less privileges or no privilege. For example:
- Privilege: Operations Manager cannot approve a customer order
- Logical Test: Operations Manager approves a customer order
- Improper handling of special user action sequences - Navigating through an application in a certain way or revisiting pages out of sync can cause logical errors which may cause the application to do something it's not meant to. For example:
- A wizard application where one fills in forms and proceeds to the next step. One cannot in any normal way (according to the developers) enter the wizard in the middle of the process. Bookmarking a middle step (say, step 4 of 7), then continuing with the other steps until completion or form submission, then revisiting the middle step that was bookmarked may "upset" the back-end logic due to a weak state model.
- Cover all business transaction paths - While designing tests, check for alternate ways to perform the same business transaction. For example, create tests for both cash and credit payment modes.
- Client-side validation - Look at all client side validations and see how they could be the basis for designing logical tests. For example, a fund transfer transaction has a validation for negative values in the amount field. This information can be used to design a logical test such as "A user transfers negative amount of money".
Standard prerequisites
Typically, some initial activities useful as setup are:
- Create test users with different permissions/privileges
- Browse all the important business scenarios/workflows in the application
Execution of logical tests
Pick each logical test and do the following:
- Analyze the HTTP/S requests underlying the acceptable usage scenario corresponding to the logical test
- Check the order of HTTP/S requests
- Understand the purpose of hidden fields, form fields, and query string parameters being passed
- Try and subvert the expected process/flow by exploiting the known vulnerabilities
- Verify that the application fails for the test
A real world example
In order to provide the reader with a better understanding of this issue and how to test it, we describe another real world case that was investigated by one of the authors in 2006. At that time, a mobile telecom operator (we'll call it FlawedPhone.com) launched a webmail+SMS service for its customers, with the following characteristics:
- New customers, when buying a SIM card, can open a free, permanent email account with the flawedphone.com domain
- The email is preserved even if the customer "transfers" the SIM card to another telecom operator
- However, as long as the SIM card is registered to FlawedPhone, each time an email is received, a SMS message is sent to the customer, including sender and subject of the email
- The SMS application checks that the target phone number is a legitimate customer from its own copy of the FlawedPhone customers list, which is automatically updated every ~8 hours.
The application had been developed following security best practices, but it suffered from a business logic flaw and FlawedPhone was soon targeted by the following fraud attack:
- The attacker bought a new FlawedPhone SIM card
- The attacker immediately requested to transfer the SIM card to another mobile carrier, which credits 0.05 € for each received SMS message
- As soon as the SIM card was "transferred" to the new provider, the malicious user started sending hundreds of emails to their FlawedPhone email account
- The malicious user had an ~8 hours window before the email+SMS application had its list updated and stopped delivering messages
- By that time, the malicious user had accumulated ~50-100 € on the card, and proceeded to sell it on eBay
The developers thought that SMS messages delivered during the 8 hours period would have introduced a negligible cost but failed to consider the likelihood of an automated attack like the one described. As we can see, the customer list synchronization time combined with the lack of limit to the number of messages that could be delivered in a given period of time, introduced a critical flaw in the system that was soon exploited by malicious users.
Designing a Secure Framework Method for Business Application Logic Integrity in e-Commerce Systems,Faisal Nabi, Distributed System Research Group, Department of Computer Science, Victoria University of Wellington, Wellington, New Zealand. http://www.acsac.org/2008/program/wip/
- Business logic - http://en.wikipedia.org/wiki/Business_logic
- Prevent application logic attacks with sound app security practices - http://searchappsecurity.techtarget.com/qna/0,289202,sid92_gci1213424,00.html?bucket=NEWS&topic=302570
While there are tools for testing and verifying that business processes are functioning correctly in valid situations these tools are incapable of detecting logical vulnerabilities. For example, tools have no means of detecting if a user is able to circumvent the business process flow through editing parameters, predicting resource names or escalating privileges to access restricted resources nor do they have any mechanism to help the human testers to suspect this state of affairs. The following are some common tool types that can be useful in identifying business logic issues.
Intercepting Proxy:
- OWASP: Webscarab
- Dafydd Stuttard: Burp proxy -
- MileSCAN: Paros Proxy -
Browser Plug-in:
- "TamperIE" for Internet Explorer -
- Adam Judson: "Tamper Data" for Firefox -


text:
But because it was so fun and such a snap to make, I gave it away, knowing I can make one for myself.
I whole-heartedly endorse this pattern. Quick, satisfying, and as I said, very fun.
Love the combo. And the vintage button.
And since we had so much fun with the Three Amigos a few weeks ago,
I couldn't resist showing this one too. 🙂
The birthday party went very well. I'm always giddy with relief when birthday parties are over and everyone seemed to have fun. And no crying is an extra bonus. I love how easy to please little kids are. Throw some cupcakes and some rubber spiders and Diego stickers at them and they are happy campers.


text:
Technology and Media
Media and entertainment companies are finding content creation, aggregation, and distribution have become the center of their businesses, ever-evolving and transforming as new technologies come into play that disrupt traditional business models.
Leverage DAZ and Oracle to Address your Key Technology Imperatives
The rapidly growing amount of content available via the Internet and the proliferation of devices offering high-quality viewing experiences have drastically shifted the way consumers view, access, and purchase content. With that said, many technology and media companies have sophisticated ERP and analytic systems in place already, but most have only scratched the surface of their potential. To thrive in today's environment, companies must put effort into both innovation and efficiency, embracing new approaches to content development, distribution, operations, and technology. With years of hands-on experience DAZ and Oracle can advise you through your challenges and get it right the first time.
- Revenue Management
- Royalty Calculation for Software and Hardware
- Multi-Channel Marketing and Distribution
- Ad Expense/Ad Revenue Tracking and Analysis
For more information about DAZ Systems Experience and Customers, visit DAZ Case Studies.


text:
For MVP: Justin Verlander and Matt Kemp (No…Ryan Braun)
If you accept the premise that Felix Hernandez really was the American League Cy Young Award Winner in 2010, then the conundrum is solved as to who is the American League MVP in 2011.
The premise of a pitcher with a won-loss record of 13-12, who led his league in only one standard category, is that the Cy Young goes not to the most valuable pitcher, but to some kind of statistically "best" one. We can argue forever about whether that's the way it should be (I don't think so) or if, even accepting the premise, Hernandez really fulfilled the requirement (I also don't think so). But the arguments are academic and the precedent is set.
Thus, whatever award can go to the "most valuable" pitcher it is not the Cy Young, and by process of elimination it necessarily must be the MVP. Before the Cy was established in 1956, this was an accepted premise that was applied for starters (Lefty Grove) as early as the first year of BBWAA voting in 1931, and for relievers (Jim Konstanty) as early as 1950. If you were a pitcher, and your team rode you to whatever success it achieved, you could be the MVP.
Seems to me that after the Hernandez victory it's a little clearer, in fact. If the Cy Young can go to a guy whose only exposure to the pennant race was watching on MLB Tonight, then the guy in the middle of the thing has to get thrown into the MVP consideration.
And that's Justin Verlander.
You can argue that Miguel Cabrera has had an excellent season, and Victor Martinez, too. Jose Valverde has shed his past unreliability to become a bullpen rock. But the Tigers are where they are because Verlander won 24 games. Period. The Tigers have one twenty-homer man (Cabrera), one 100-RBI man (Cabrera), one six-steal man (Austin Jackson, 22), one nine-hold guy (Joaquin Benoit), two .300 hitters (Cabrera and Martinez), and, until Doug Fister came along, they had one pitcher with an ERA under 4.30 (Verlander).
He's a one-man team.
All of the other American League candidates are flawed. Bautista hit home runs but is going to finish around 12th in RBI. Granderson may lead the majors in Homers and RBI but his awful secret is that over the last 30 days he's batted .215 and struck out once in every three at bats and is one of the primary reasons the Yankees should be considered decided underdogs in the ALDS. Gonzalez has had a spectacular year in Boston, but frankly, the Red Sox disaster owes to much more than the fact that their pitching staff is broken.
It's a perfect storm in the American League voting: no clear position-player winner, and a good division winner carried from start to finish by a pitcher. Verlander should be the first starting pitcher chosen MVP since Roger Clemens in 1986 – but I'm not counting on it.
To me, the National League is a lot less clear. The argument for Matt Kemp, Triple Crown Winner, is inarguable. The problem becomes if he finishes third in batting, or "a few" homers or RBI away from something not done in the National League since 1937 and in either league since 1967 (and remember, even that year Carl Yastrzemski tied for the home run crown – I like to note that Frank Robinson was the last pure winner in 1966).
My argument to this point has been that one other statistic has made Kemp the MVP even if it's just close on the Triple Crown. He has stolen 40 bases. Consider Jose Canseco's MVP season in 1988: league-leading 42 homers and 124 RBI, plus he finished fourth with 40 steals. So far this looks a lot like what Kemp may end up with. Except Canseco hit just .309, to finish ninth. Kemp seems a lock to finish third or better in the 2011 NL Batting Race.
It's a compelling argument, until you consider that Ryan Braun is leading that batting race, and is only five homers and ten RBI behind Kemp, and second to Kemp in runs scored, and will finish seventh or eighth in stolen bases – and all of it, in the crucible that is a pennant race.
If I had a vote – and they will give me one when hell freezes over – I would have to wait until Wednesday's boxscores are in. A year ago Kemp was on the verge of ruining his career, and he's done what he's done in a near vacuum (although Andre Ethier wasn't a bad foil in the batting order), and in the chaos of the nightmare season at Chavez Ravine. But, as much as I hate to say that the MVP should be decided in the last three days of the season, I'd really need Kemp to win the Triple Crown – or miss it by thismuch – to vote against the guy who put up parallel numbers in the heat of the race.
Oh? Cy Youngs? Anybody who doesn't vote for Kershaw should be banned for life from major league ballparks. He's going to win the pitching Triple Crown (K, ERA, Strikeouts) with no support. The American League is Verlander, has been for awhile.
But perhaps the most important thing the writers can do is convene a meeting this winter in which they specify eligibility and criteria for these awards so we don't have to go through this every freaking year.
22 Comments
So Kershaw gets the vote cos he did it with no support, but Bautista gets penalised because the guys batting in front of him were unable to get on base (RBI support) strange logic
I heard on the broadcast for the Detroit-Baltimore game that "poor" Jeremy Guthrie was getting "only" 4 runs a game and that's why he had so many losses.
Shoot, if Cain, Lincecum, and Bumgarner got that support, they would all be 20 game winners and the Giants would have clinched by Labor Day!
Amen! Convening a meeting, being specific and setting criteria could solve more than just baseball awards. The planet could be saved! Thanks, Keith.
If Bautista hit in the Yankees lineup, and had the exact same season, he'd have about 150 RBI. Would that make him the MVP? I imagine you'd say so. So how logically does being on a different team change that? Why does the team surrounding him matter at all?
He does lead the majors in on-base percentage and slugging, as well as just about every advanced offensive statistical category. He is, even without the "RBIs", the better hitter in baseball. Having a better year than Kemp (who should be the NL MVP, I agree), too, on a team that will play as many October games as the Dodgers will. Surrounded for half a season by a lineup that included Corey Patterson.
On Verlander, the Tigers have a 12-game lead in the Central. Meaning replacing Verlander with, say, a 15 game winner, would leave the Tigers in… first place in the Central by 3 games? I mean, if Scherzer went 0-24 rather than 14-10, the Tigers wouldn't make the playoffs, either. Does that make him the MVP? I just think your logic is deeply flawed.
I don't much care for the Cy Young or MVP because they're just opinions and meaningless.
I agree with all your picks, Keith, but maybe not for the same reasons. I don't think Verlander is a one-man team. Cabrera is one of the best hitters in the game and Martinez was hitting (maybe still is hitting) .400 with RISP. Last I checked, Valverde hadn't blown a save. The Tigers have the best catcher and a lot of hitters who are either at .300 or near it. Still, Verlander's numbers are MVP-worthy. As for the NL, Braun and Fielder are inseparable. Either make them co-MVP or look at someone else. Think of all the good pitches Braun sees because Fielder is behind him– nobody ever pitches around Braun to get to Fielder. Meanwhile, Fielder's protection is Casey McGehee having a very bad season. I've watched Kemp a lot this year (so I could listen to Vin Scully) and he is without doubt the best player in baseball. He does it all. He's indestructible. It seems like he'll barely hit the ball and it's a double or even a home run, and if it looks like it's going to be a single he'll stretch it into a double. He's a man on a mission. But I like what my other favorite Keith said yesterday on SNY (Keith Hernandez that is)– Joe Girardi should get consideration for Manager Of The Year. Though I guess Yankee fans are probably back on his case after last night.
Hey KO — great post as always. Yanks ALDS underdogs — are you surprised they made it to the playoffs? ROFL, great pick — you are the kiss of death!
I'll echo the sentiment that the Tigers are NOT a one-man team, although I think Verlander still should win the MVP. You've conveniently left out a few guys. Like, for instance, Johnny Peralta, who is also hitting .300 (.301 actually… but how'd you forget him?) and has an .825 OPS. Also, Alex Avila has come out of nowhere to become the best catcher in the majors. He's hitting .295.
So it's not like there's just one guy on offense doing all the heavy lifting. The Tigers, after all, have scored the fourth-most runs in the AL.
A very thoughtful post. Now, I'm a Dodger fan, so this could be seen as a brief for Kemp. But, first, Ethier was MIA for a significant part of the season with injuries and, even when he was there, he often hit AHEAD of Kemp in the order, meaning he wasn't behind him to offer protection. I think back to when Dusty Baker had Jeff Kent batting behind Barry Bonds and realized that Kent was suffering because people pitched around Bonds to get to him–so Dusty put a less powerful but still strong hitter behind Bonds, put Kent in front of Bonds, and watched Kent's average go up (just as Kent benefited from hitting ahead of Manny Ramirez, Kent's claims to the contrary and criticism of Vin Scully for saying so notwithstanding). So, the Ethier argument doesn't quite work.
That brings me to the next point. Braun has a supporting cast. Kemp hasn't had much of one. Without Braun, perhaps the Brewers wouldn't be winning the division, but his replacement might be a solid player. Without Kemp, the Dodgers would be finishing the season in Albuquerque.
And finally, the pennant race argument. I do not question Braun's numbers or ability, but I have a problem with that. In a tough, truly meaningful game, wouldn't it be reasonable to expect an extra effort to get out Ryan Braun? As opposed to less meaningful games in which Matt Kemp's best supporting player was, uh, Juan Rivera? Not that Kemp IS the MVP and Braun is NOT; but the argument here has some holes in it.
Now that it appears Reyes will probably win the batting crown, with Braun finishing second, what does that do, if anything, to Keith's thesis that Kemp (now that he's leading in HRs as well as RBIs) has to come close to Braun in BA to justify him winning the MVP???
the pihilles phan groups are awesome…past philly groups i thought shoulda been:1. thome's homies2. in hell's bells or bell's belles3. wade's gay parades4. rheal's gals5. kruk's nut..lone fan
forget the awards…
when are you gonna apologize to vogelsong?
finishes the year with a 2.71 era….4th best in the nl
be a man ko….APOLOGIZE
I'd like for KO to revisit his AL East picks, namely his 1, 2, 3 placement. (Red Sox, Rays and Yankees, respectively, for those keeping score.) How's it looking boy-o?
Forgive me, I was mistaken: KO had…
1. Red Sox
2. Rays (wild card)
3. Orioles
4. Yankees
5. Jays
"THE FORECAST: I don't think the top two spots are at issue. Boston wins, the Rays probably take the wild card. The question becomes whether the Yankee collapse, and the Oriole and Jay growth spurts, happen rapidly enough to unleash Steinbrennarmageddon in the Bronx: the Yankees finishing last. I suspect we will see them occupy the basement long enough for the kind of good old-fashioned accusation firestorm and managerial firing speculation that used to make 161st Street the Bronx Zoo. But I do not think both sets of birds will fly with equal success. I may have Toronto and Baltimore switched here, but I see it: 1. Boston, 2. Tampa Bay, 3. Baltimore, 4. New York, 5. Toronto (and the last three, very close indeed)."
KO irreparably burned his bridges with the Yankees. I believe his AL East predictions are based on which teams he likes most. A very biased person.
Very funny alricte just the way I like it. If I lived in swine country I would want some Hand Sanitizer.
There are a bunch of ways to support Verlander for MVP, but my God did you pick the most convoluted and wrong-headed one.
Your argument is an egregious cherry-pick and just bad in general. You're basing your argument on:
-Pitcher's wins
The following statistics that were not even accrued by Verlander:
-HR (using a nebulous 20 HR plateau)
-RBI (a 100 RBI plateau)
-ERA of the other pitchers
Yikes. What a weird and terrible argument. The stat you choose to pump up JV doesn't say much of anything about JV's actual dominance and the stats you used to denigrate JV's teammates say next to nothing about them. For the love of God, the Tigers have scored the fourth most runs in baseball! And you're using their supposed offensive ineptitude (which doesn't exist at all) to support the "Without Verlander the Tigers Are Nothing" sentiment? Just wow. For someone who considers himself a "baseball nerd", you seem to either know very little about baseball or just can't be bothered to research anything.
i would like to be a part of your projects. I love the background picture here of the transition from space to our atmosphere.
good blog
very good


text:
When washed up radio DJ Lee finds himself "between jobs" he decides to launch a paranormal investigative podcast series, inspired by the likes of 'The Black Tapes', 'The Message', and 'Limetown'. Enter 'The Terror Files'.
A Scottish PodcastAided by his long suffering sidekick, struggling musician Dougie, the pair embark on their first investigation – by heading down into a newly uncovered vault underneath Edinburgh's old town.
Lee is prepared to sprinkle a bit of fiction into his reporting to keep things lively.
But it soon becomes clear that these long forgotten tunnels harbour a secret far darker than he ever could've hoped to conjure up with his own imagination…


text:
Hacking Chinese Resources
Click one or more tags to show relevant resources. Follow @ChineseLinks on Twitter, to get notified about new resources!
15 resources found.
Chinese Learn Online (CLO)
Learn Chinese Online with CLO - Go from absolute beginner to intermediate learner with our step by step, progressive audio lessons in Mandarin Chinese Read more.
Adam_CLO – over 6 years
中文阅读天地 (University of Iowa)
This site contains a huge number of lessons, complete with texts, vocabulary, audio, exercises and much more. And it's all free. Note that if you want to get the intermediate and advanced material,... Read more.
Olle Linge – about 6 years
Duolingo: Learn Spanish, French and other languages for free
Finally, Duolingo added a En->ZH course. As Duolingo is the most popular gamification learning app, the learning experience is relatively streamlined and tested. The monetarization aspect leads to ... Read more.
stefanwienert – almost 3 years
Language Radio Free (Android app for listening practice)
Language Radio is supporting intermediate to advanced language learners with their listening practice through listening to radio stations in the desired target language. You may use our pre-install... Read more.
Olle Linge – almost 5 years
Hanping Chinese Popup
The ultimate solution for quickly looking up Chinese words on your smartphone or tablet, no matter what app (or system screens) you are using. Note: For Android 5.0 (Lollipop) and higher. Whe... Read more.
hanpingchinese – over 5 years
Melnyks (Podcast / Audio Course)
This website offers theme-based, progressive and easy online lessons. Audio course with full PDF transcripts, worksheets, mobile apps, videos and more. From what I can see, the first 100 lessons ar... Read more.
Olle Linge – over 6 years
Chinese: A Modular Approach (FSI Language Courses)
This course is designed to give a practical command of spoken Standard Chinese. Nine situational modules form the core of the course. Each core module consists of tapes, a student textbook, and a w... Read more.
Olle Linge – over 6 years
Pinyin introduction and audio charts
This is the traditional Pinyin chart with audio, with the added benefit that you can download it and use it offline. Contains separate mp3 files. Female speaker with clear pronunciation. Edit: Y... Read more.
Olle Linge – over 6 years
Learn languages online for free with Mondly - Language learning made easy, fun and free
Mondly is a mobile app very similar to Duolingo (which does not support Chinese). Pro: * more or less straight course to take, no distractions * It has several languages besides Chinese. Th... Read more.
stefan-wienert – about 3 years
Hanping Chinese SoundBox (now rolled into Hanping Dictionary) (Android App on Google Play)
UPDATE 2017: This app is now rolled into our Hanping Dictionary apps (Lite, Pro & Cantonese). Great way for beginners to practice single and double-syllable Chinese words. ★ Ideal for any stu... Read more.
hanpingchinese – almost 5 years
This is a language learning game that features among other languages Mandarin Chinese (at first only Japanese was supported). It aims to teach you about 400 words by having a virtual character walk... Read more.
Sebastian Rasmussen – about 6 years
凤凰FM - 中国第一音频平台!(app for streaming of programs, audio books etc.)
This app, which is available for free both on Android and iOS allows you to access tons of programs and audiobooks for free. Some of them aren't free, but it's clearly written which are, so you don... Read more.
Olle Linge – over 6 years
20140607 皇牌大放送 D-Day:水底的战场 诺曼底登陆70周年特辑 - YouTube
【节目简介】 《皇牌大放送》有大量的独家深度报道,凤凰专题团队获全球政治人物官方机构的许可,在此节目中推出独家专题片。 70th anniversary of D-Day and the Battle of Normandy Read more.
Zoe – over 6 years
This site collects almost a thousand textbooks used in Chinese schools, ranging from grade 1 up to senior high school. Subjects cover Chinese, mathematics, English, physics, chemistry, biology, his... Read more.
Olle Linge – over 2 years
TutorMandarin: Online Mandarin Tutor
TutorMandarin is an online Chinese tutoring software and service. Students take 1-on-1 classes with professional Mandarin tutors on PC, Android, or iOS. Full courses from Beginner to Advanced, Spok... Read more.
hanpingchinese – almost 3 years


text:
|Ministries of Canton Christian Fellowship
At CCF, we believe in Community. We believe in the internal community that we call the CCF Family and we believe in the community outside of CCF. To us, community is a sense of belonging and a sense of strong family and care for one another as well caring for the communities we live in. We support our internal community by our Family Care Ministries, which are responsible that no person gets left behind and that the needs of every member are being met through excellent Christian love and service. Also, our Fellowship Ministry and our CLI Small Group Ministries like Women in the Word and the Mighty Men Ministry are huge in strengthening our internal community. For the external community, we believe that God has placed us where we are so that we can have a great and positive impact and influence on the communities of Canton, Plymouth, Westland, Ypsilanti, Belleville, Northville, Farmington Hills, and the surrounding areas of Metro Detroit.


text:
seca 413
seca 413
Carrying case for seca baby scales.
- Convenient. Comfortable transport with adjustable shoulder strap.
- High-quality: made of robust nylon.
- Transport safety. Water and dust resistant.
With this case, baby scales seca 385, 384 and 354 can be transported comfortably and safely. The exact fit of the seca 413 carry case provides optimum protection and the large opening facilitates the packing and unpacking of the scale. An adjustable shoulder strap makes transport easier and the water-repellent nylon surface keeps everything dry.
Product information.
Technical product data and support.
Technical Data
|Measure (W x H x D):
|570 x 150 x 330 mm , 22,4 x 5,9 x 13 inch
|Net weight:
|0,9 kg , 1,9 lbs


text:
"Thus may the 4th of July, that glorious and ever memorable day, be celebrated through America, by the sons of freedom, from age to age till time shall be no more. Amen and Amen."
Virginia Gazette on July 18th, 1777
Schoolchildren in America learn the basic history of the events surrounding the Fourth of July, but the details of this monumental occasion in American history somehow fall through the cracks.
Although July 4th is celebrated as America's official split from Britain's rule and the beginning of the American Revolution, the actual series of events show that the process took far longer than a single day.
Taxation without representation! That was the battle cry of the 13 colonies in America who were forced to pay taxes to England's King George III with no representation in Parliament. As dissatisfaction grew, British troops were sent in to quell any signs of rebellion, and repeated attempts by the colonists to resolve the crisis without war proved fruitless.
The original resolution was introduced by Richard Henry Lee of Virginia on June 7, 1776, and called for the Continental Congress to declare the United States free from British rule.
On June 11, 1776, the colonies' Second Continental Congress, meeting in Philadelphia, formed a committee with the express purpose of drafting a document that would formally sever their ties with Great Britain. The committee included Thomas Jefferson, Benjamin Franklin, John Adams, Roger Sherman and Robert R. Livingston. The document was crafted by Jefferson, who was considered the strongest and most eloquent writer (nevertheless, a total of 86 changes were made to his draft!) The final version, the document that we know as the Declaration of Independence was officially adopted by the Continental Congress on July 4, although the resolution that led to the writing of the Declaration was actually approved two days earlier.
The following day, copies of the Declaration of Independence were distributed and, on July 6, The Pennsylvania Evening Post became the first newspaper to print the extraordinary document.
On July 8, 1776, the first public readings of the Declaration were held in Philadelphia's Independence Square to the ringing of bells and band music. All of this had occurred with some of the delegates to the Congress not even present; New York, for example, did not even vote on the resolution until July 9th. (Did you know that that not a single signature was appended to the Declaration on July 4th. While most of the fifty-six names were in place by early August, one signer, Thomas McKean, did not actually sign the Declaration until 1781.)
One year later, on July 4, 1777, Philadelphia marked Independence Day by adjourning Congress and celebrating with bonfires, bells and fireworks.
The custom eventually spread to other towns both large and small, where the day was marked with processions, oratory, picnics, contests, games, military displays and fireworks. Observations throughout the nation became even more common at the end of the War of 1812 with Great Britain.
On June 24, 1826, Thomas Jefferson sent a letter to Roger C. Weightman, declining an invitation to come to Washington, D.C., to help celebrate the 50th anniversary of the Declaration of Independence. It was the last letter, Jefferson, who was gravely ill, ever wrote. In it, Jefferson says of the document:
May it be to the world, what I believe it will be ... the signal of arousing men to burst the chains ... and to assume the blessings and security of self-government. That form, which we have substituted, restores the free right to the unbounded exercise of reason and freedom of opinion. All eyes are opened, or opening, to the rights of man. ... For ourselves, let the annual return of this day forever refresh our recollections of these rights, and an undiminished devotion to them.
In 1941, Congress declared July 4 a legal Federal holiday. Today, communities across the nation mark this major midsummer holiday with parades, fireworks, picnics and the playing of the "Star Spangled Banner" and marches by John Philip Sousa.
Remember today is your, Independence Day.... Make the best of it!
Best RS


text:
Bollywood superstar Salman Khan has extended his support to senior Congress leader and Mumbai North West candidate Gurudas Kamat for his various "qualities" as a politician and for his "magnanimity".
Salman has in a recorded message appealed to voters to support Kamat because "good work can be done only by a good person. What's a good person? One who takes a stand on things, which Kamat takes...then you raise your voice for it, which also Kamat does, and to forgive who may have wronged you, which is rarely seen in politics and the one who works for the people, not for himself, which he does in plenty".
Interestingly, one of Kamat's rival in the fray is Salman's good friend and actor-filmmaker Mahesh Manjarekar who is contesting on a Maharashtra Navnirman Sena ticket.
Salman said in his message that Kamat's passion is infrastructure and result-oriented development.
"I believe that a politician should be a social worker, and that social work only is politics. Kamat is basically a social worker who has chosen to do this good work through the medium of his party," Salman said.
The actor, who in the past had campaigned for Congress candidates in Mumbai, said Kamat's biggest hobby and passion is that infrastructure should be there and development should happen fast.
"Many people talk about development but very few people can get results. I know Gurudas Kamat has all these qualities," the actor said.
Apart from Manjarekar, Kamat's other rivals are Shiv Sena veteran Gajanan Kirtikar, television actress Rakhi Sawant who is contesting as Rashtriya Aam Party candidate, and Samajwadi Party nominee actor Kamal Khan.


text:
How can you prevent a future unwanted pregnancy?
About 85% of sexually active women who do not use contraceptives become pregnant within a year. A woman can become pregnant while breastfeeding, from about 10 days after childbirth, and even during her menstruation. Withdrawal of the penis prior to ejaculation and periodic abstinence does not prevent pregnancy or spread of sexually transmitted diseases. Here you can read more about several forms of contraceptives.
You can prevent an unwanted pregnancy with:
- Total Abstinence
- Use of contraceptives
If you are sexually active and do not want to get pregnant, always use contraception.
Methods of Contraception:
No method of contraception gives 100% protection.
The male latex condom is the only contraceptive method considered highly effective in reducing the risk of sexually transmitted diseases (STD's). Birth control pills, Implant and IUDs do not protect against STD infection.
For the Woman
DIAPHRAGM is a rubber disk with a flexible rim that covers the cervix and must be used together with spermicide. It is available by prescription only and must be fitted for size by a health professional. The diaphragm protects for six hours and should be left in place for at least six hours after intercourse but not for longer than a total of 24 hours.
ORAL CONTRACEPTIVES protect against pregnancy by the combined actions of the hormones estrogens and progestin. The hormones prevent ovulation. The pills have to be taken every day as directed and do not work after vomiting or diarrhea. Side effects of the pill can be nausea, headache, breast tenderness, weight gain, irregular bleeding, and depression.
DEPO-PROVERA is a hormonal contraceptive injected into a muscle on the arm or buttock every three months. The injection must be repeated every 3 months. The menstruation can become irregular and sometimes even absent.
IMPLANTS (such as Norplant or Implanon) are made up of small rubber rods, which are surgically implanted under the skin of the upper arm, where they release the contraceptive steroid levonorgestrel. Their protection lasts from 3 to 5 years. Side effects include menstrual cycle changes, weight gain, breast tenderness and loss of bone mass.
Copper-IUD is a T-shaped device inserted into the uterus by a health-care professional. The IUD can remain in place for 5- 10 years. IUD's have one of the lowest failure rates of contraceptive method. Sometimes the IUD can be expelled and a woman has to check each month after her period with her finger if she can still feel the threads of the IUD. Other side effects can include abnormal bleeding and cramps, but this usually only occurs during and immediately after insertion.
Hormonal-IUD is an IUD with a small hormonal (progestogen) sleeve. It is one of the most effective forms of birth control. Next, to the above-mentioned characteristics of an IUD, it can remain in place for 5 years but has no heavy bleeding side effects. As most women experience only lighter periods and less bleeding (some stop completely having periods) it's supposed to be a perfect therapy as well for women with heavy cycle bleedings.
FEMALE STERILIZATION is done surgically. The tubes are ligated, preventing the egg-cells from encountering the sperm cells and preventing any future pregnancies. It is a permanent form of contraception.
FEMALE CONDOM is made of soft rubber and can be used only once. As a mechanical barrier method of contraception worn by women it's inserted easily into the vagina before sex and prevents direct vaginal contact with semen, infectious genital discharges, and genital lesions It is shaped like a long tube or sheath, with one closed end and one open end, and at each end, there's a flexible ring, helping to keep the female condom in place once it's inserted. Condoms are the most effective method for reducing the risk of infection from the viruses that cause AIDS and other sexually transmitted diseases (STD's).
EMERGENCY CONTRACEPTION must be taken within 3 days of unprotected sex, depending on the type used, however, the sooner used, the more effective. It prevents an unplanned pregnancy by delaying the ovulation. Most combination birth control pills (estrogens and progesterone) can also be used. Take within 72 hours of unprotected sex one dose 100 µg ethinylestradiol (=2 to 4 birth control pills depending on the ethinylestradiol amount in each pill), and 12 hours later a second dose
MORNING-AFTER copper IUD must be inserted within 5 days of unprotected intercourse. The IUD can stay for 5 to 10 years.
For the Man
CONDOMS are usually made from latex rubber and can be used only once. Some have spermicide added to kill sperm. They act as a mechanical barrier, preventing direct vaginal contact with semen, infectious genital discharges, and genital lesions. Condoms are the most effective method for reducing the risk of infection from the viruses that cause AIDS and other sexually transmitted diseases (STD's). It is important to put a condom on properly before intercourse
MALE STERILIZATION also is known as a vasectomy, is a quick operation performed under local anesthesia with possible minor post-surgical complications, such as bleeding or infection. The ability to get an erection and an ejaculation do not disappear. The sperm cells are just a very small part (1%) of the fluid and a man will not notice any difference in ejaculation. The body will absorb the sperm cells.
Rates of Effectiveness of Different Contraceptives:
|Estimated Effectiveness
|Male Latex Condom
|Female Condom
|Diaphragm with Spermicide
|Oral Contraceptives
|Over 95%
|Injection (Depo-Provera)
|Over 99%
|Implant (Norplant, Implanon)
|Over 99%
|IUD (Intrauterine Device)
|Surgical Sterilisation
|Over 99%
|Emergency Contraceptives


text:
Planning to travel across Ukraine or abroad? Remember to buy your travel insurance!
It will take just a few steps to obtain insurance from our partner – ERV – on flyUIA.com. ERV is a network of travel insurance experts extending through Europe and beyond.
Obtain insurance after booking
Haven't got time to purchase your travel insurance yet? Purchase your insurance from ERV online via Manage My Bookings.
Find out more information about insurance for travelling to Ukraine or across Ukraine.
Find out more information about insurance for travelling outside Ukraine.
ERV contacts
Tel.: +380 44 299 78 87, fax: +380 44 299 70 79.
Working hours:
Mon-Thu: 09:00-18:00, Fri: 09:00-17:00,
Sat-Sun: closed.
Click here for detailed information.


text:
The Office of Legislative and Intergovernmental Affairs (OLIA) is the point of contact for Congress and state and local governments at the International Trade Administration. The Office regularly informs legislative and intergovernmental stakeholders on current international trade matters and export opportunities. OLIA also prepares International Trade Administration officials for Congressional hearings, district events, and constituent concerns. Sign up to receive OLIA's regular updates.
Please contact us if you need help
Contact information:
International Trade Administration
Office of Legislative and Intergovernmental Affairs
1401 Constitution Ave., NW, Mail Stop 3424
Washington, DC 20230
Phone: 202-482-3015
Fax: 202-482-0900
Email: firstname.lastname@example.com
Find what you are looking for here. Please select from services below.
Advocacy Center helps California company secure $12.5 million contract with a Macedonian government agency
View more
The International Trade Administration, U.S. Department of Commerce, manages this global trade site to provide access to ITA information on promoting trade and investment, strengthening the competitiveness of U.S. industry, and ensuring fair trade and compliance with trade laws and agreements. External links to other Internet sites should not be construed as an endorsement of the views or privacy policies contained therein. This site contains PDF documents. A PDF reader is available from Adobe Systems Incorporated.


text:
Master Garage Door & Gates
Commercial & Residential Local Garage Door & Gates Services!
Garage Door Repair, Gate Repair & Electric Gate Repair Experts!
Garage Door Repair & Gate Repair Granite Springs, NY
Our Services
Garage Door Repair
Gate Repair Services
Emergency Situation?
Our 24-Hour Emergency Garage Door & Gate Service comes with the highest quality service at the lowest possible price. Master Garage Door & Gates is licensed and insured to provide garage door and gate repair services for residents of Granite Springs, NY and the near by areas. We have built a reputation on quality service, honesty and affordable pricing.
About Master Garage Door & Gates
In fact, the features on our garage doors typically far exceed the standard garage doors that are found on new homes. We are independent and have access to all the garage door manufacturers our there. Even the ones sold at The Home Depot, Lowes, and Costco. A note about the Big Box stores. We charge less for a better product. I compare their prices and products weekly and, in almost every case, we give you more garage door for less money. Also, our time to install is going to be much faster, typically in three days or less. And our installation warranty is two years on labor and parts—about twice as long as the contractor they hired out to install your garage door. Honest, Reliable and Professional Garage Door Repair & Gate Repair Services will be provided to you by us any time any day.
All of our doors have rollers with ball bearings to provide years of quiet, smooth garage door operation. Hinges are full size and 14-gauge steel, which last longer and are less likely to bend. We only use torsion spring systems on our garage doors because they are designed to maintain a level, smooth door operation. These extras ensure that your garage door lasts for years. You owe it to yourself to at least take a look at us and let us put a great door in your home, with a great warranty, and timely service. Plus we are a local, family owned business.
Garage doors come in many styles, sizes, and colors today. We have divided them into four categories below for you to start looking. At times we take you directly to the manufacturers website where they keep up with the thier new products faster than us. Remember, we are Master Plus and Preferred vendors with our main vendors. Our prices are great and our deliveries are faster. We typically get a Truck delivery every week. We also stock a lot of the doors you may want for installation today or tomorrow.
Contact Us
Our Location:
140-01 69th Ave
Flushing, NY 11367


text:
Michael Pierce INTJ Description
Likes: 0 - Dislikes: 0 - Views: 708
Media Library
We continue to issue periodic membership surveys to gather feedback on our site. Any feedback you can provide would be much appreciated!
Copyright © 2008 - 2020 TypologyCentral. All rights reserved.
All times are GMT -5. The time now is 01:27 PM.


text:
58 Progress Parkway
Maryland Heights, MO 63043
[email protected]
The National Council of the United States Society of St. Vincent de Paul is a non-profit organization under section 501(c)(3) of the United States Internal Revenue Code. Donations to the National Council are deductible. The Council's tax identification number is 13-5562362.


text:
Helping to Monitor the New Urban Agenda
Helping to Monitor the New Urban Agenda
In October 2016, world leaders adopted the New Urban Agenda at the United Nations Conference on Housing and Sustainable Urban Development, known as Habitat III, which took place in Quito, Ecuador. It sets a new global standard for sustainable urban development, and will help in rethinking how we plan, manage and live in cities. The New Urban Agenda is a roadmap for building cities that can serve as engines of prosperity and centers of cultural and social well-being while protecting the environment. This is a historic opportunity for change.
UN-Habitat is recognized as a focal point for sustainable urbanization. Quantitative and qualitative analysis, regular assessments, along with meetings and conferences, will support follow-up and review of the New Urban Agenda. This agenda is expected to enhance the contribution of cities to sustainable national development, as well as to achieve inclusive, people-centred, resilient and sustainable urban development.The New Urban Agenda's and the 2030 Agenda for Sustainable Development's follow-up and review must have effective linkages to ensure coherence in their implementation.
Through the City Prosperity Initiative, UN-Habitat is offering support to local and national governments in establishing customized monitoring mechanisms, which will allow a better-informed decision-making on policies and regulations, city-plan and extensions, and finance management for the implementation of the New Urban Agenda. The City Prosperity Initiative provides a solid methodology for a systemic and comprehensive approach to city development. With the creation of a globally comparable baseline of urban information and data, the CPI provides a guided dialogue for evidence-based policy-making and the formulation of Actions Plans and Policy recommendations. It has the potential to be a global monitoring framework for the New Urban Agenda, creating local and national monitoring mechanisms for accountability.
The CPI fully addresses the five components of the New Urban Agenda. As an integrated initiative, the CPI provides metrics, policy dialogue, best practices and specific action plans on the key components of the New Urban Agenda. In addition, the CPI works as a platform that connects data to local and national evidence-based urban policies, and to the definition of measurable city-expansions and long-term development plans, designed according to the 3-legged approach. When implemented in a large scale, the CPI clearly connects to the formulation of National Urban Policies.


text:
Reiki - Pollokshaws
Pollokshaws is a district on the southside of the city of Glasgow, Scotland. The housing stock mostly consists of some sandstone tenement housing and modern brick tenement-style buildings. Wikipedia
Crystal Reiki Life
Paisley, Renfrewshire, Pa3 4bw
Relax with reiki healing energy Schedule your therapeutic in person or distance reiki session wherever you are to facilitate emotional and physical healing! Reiki Healing Reiki is [...]Distance: 5.07 miles.
Peaceful Haven Holistic Therapies
East Kilbride, Lanarkshire, G75 9NL
Reiki Teacher offering Level 1, Level 2 Practitioner, and also Reiki Treatments with the use of a copper pyramid for increasing energy & vibrations [...]Distance: 6.91 miles.
Kaz\'s holistic therapy
Pollokshaws, City of Glasgow
I\'m a therapist and instructor I offer reiki courses and workshops to learn how to make therapeutic products. I also do [...]Distance: 0.49 miles.
JC Therapies
Glasgow, City of Glasgow, G42 9UB
Reiki Healing – What is it? "Reiki†(pronounced ray-key) is a system of energy healing from Japan, founded by Dr Mikao Usui in this century. [...]Distance: 0.9 miles.
Flourish | Alternative and Holistic Medicine | Glasgow
Battlefield, City of Glasgow, G42 9QH
0141 632 1266
Flourish | Alternative and Holistic Medicine | Glasgow www.flourish.scot Online Booking available Hi there and thank you for visiting Flourish's Reiki Pages listing. My name is [...]Distance: 0.97 miles.
Serenity Massage & Holistic Centre
Mt Florida, City of Glasgow, G44 3RA
0141 649 1444
We have a wide variety of Massage Treatments and Energy Therapies for you to explore, which can all help improve your physical and emotional [...]Distance: 1.58 miles.
Animal Reiki Scotland
Giffnock, Renfrewshire
07599 151 199
Alison has been a holistic therapist for over 20 years and practicing therapies for animals for over 10 of those. Her mission in life [...]Distance: 1.71 miles.
Holistic Healing
Croftfoot, City of Glasgow, G44 5PR
Tracy is qualified to reiki master level having completed this training in 2005. She is also qualified in body massage, aromatherapy and indiian [...]Distance: 1.95 miles.
Tranquil Times With Reiki
Glasgow, City of Glasgow, G53 6UB
12 Glenmuir Drive
Mobile Reiki TherapistDistance: 2.1 miles.
Tranquil Times with Reiki
Priesthill, City of Glasgow, G53 6UB
What is Reiki? Reiki, like other complementary therapies focuses upon the whole individual. So often when people are given a diagnosis the focus is [...]Distance: 2.11 miles.
Michelle,s Crystal Healing
Glasgow, City of Glasgow, g50jd
The method of receiving Reiki is simple. The recipient remains clothed and lies on a couch or sits on a chair and relaxes. The [...]Distance: 2.28 miles.
Awaken Mind & Body Healing
Glasgow, City of Glasgow, G5 0SE
We use an array of different Life Changing Therapies to support and assist you in whichever way you feel best. Combining Life Coaching, Hypnotherapy, NLP, [...]Distance: 2.38 miles.
Spa in the city
Glasgow, City of Glasgow, g2 5ub
Spa and beauty Salon. We offer an extensive range of beauty and spa treatment\'s and reiki healing. We offer aromatherapy, Swedish , hot stones massage, [...]Distance: 2.93 miles.
Reiki Master/teacher
Glasgow, City of Glasgow, G1
07968 197 523
I first found Reiki very useful in my own life. After my Reiki Level 1 & 2 Attunement I worked as a Reiki [...]Distance: 2.98 miles.
Reiki Healing
Crookston, Renfrewshire
Reiki is defined a healing technique based on the principle that the therapist can channel energy into the patient by means of touch, to [...]Distance: 3.02 miles.
Woodland Herbs Clinic
Glasgow, City of Glasgow, G3 6HB
Reiki is one of the most popular treatments in our natural healthcare clinic and our team of reiki practitioners includes several of Glasgow's best; [...]Distance: 3.17 miles.
New Earth Therapies & Training
Glasgow, City of Glasgow
0141 946 7130
My name is Linda J Thomson. I am a Reiki Master/Teacher, Karuna Reiki* teacher, qualified EFT practitioner and Crystal Therapist. I established New [...]Distance: 3.17 miles.
Embrace With Reiki
Glasgow, City of Glasgow
Are you ready to achieve your full potential and grow spiritually in mind, body and soul. Then you have come to the right place. Hi [...]Distance: 3.17 miles.
Colour Energy Therapies
Glasgow, City of Glasgow
07956 524445
Thank you for visiting my page. My name is Agnes T McCluskey Fully insured and qualified Reiki Master Teacher/ Practitioner, Karuna Reiki ® Master [...]Distance: 3.17 miles.
Judith Anderson
Burnside, Lanarkshire, G73 3PG
My name is Judith Anderson and I am a Reiki level II practitioner. I can perform Reiki on both humans and also animals. Home [...]Distance: 3.67 miles.
No Events


text:
Much to like about 'Despicable Me 2', review
Whenever Hollywood cranks out a sequel, there's the danger it will suffer from a case of the terrible twos.
"Despicable Me 2," a chipper follow-up to the inventive 2010 animated hit, mostly avoids that trap. While it isn't as touching or as exuberantly funny as the original, it's a cute summer diversion for kids with just enough wink-wink slyness and cheeky cinematic asides to hold the interests of older teens and adults. On those grounds, it's worth the price of a matinee admission. If you feel like paying more, the 3-D is astonishingly good.
It also fares better over other animated follow-ups by taking us on a new adventure without seeming superfluous or rote.
Screenwriters Ken Daurio and Cinco Paul, along with returning directors Pierre Coffin and Chris Renaud, realize they have a comic gold mine in Steve Carell ("The Office") so they keep the focus on their supervillain-gone-supersoftie who's dealing with the challenges of being a good dad to three very cute girls.
The filmmakers could have taken the easy way out, turning Gru's character bad again. Instead they introduce a refreshing love interest: Lucy, a go-get-'em agent from the Anti Villain League. The zany Lucy is a most welcome addition, and since she's played by the energetic Kristen Wiig of "Bridesmaids," you'll be smitten too. As you'd expect, the Carell-Wiig matchup draws aces, with Russell Brand, as Gru's right-hand man Dr. Nefario, hitting some high notes.
Lucy's alluring ways are partly responsible for coaxing Gru to join forces with the Anti Villain League. They're out to nab an evil mastermind in possession of a serum that, when injected, can transform anyone into an indestructible monster.
If that's not silly enough, the league has narrowed the location of suspects, which include a rotund owner (Benjamin Bratt) of a Mexican restaurant, to one mall. So it's up to Gru and Lucy, with the assistance of Gru's yellow little digit-like minions (scene-stealers as usual) to ferret out the bad guy.
The "Mission: Impossible" sendup is good enough, with individual scenes -- Gru's date with a fitness fanatic is a comic highlight -- proving to be even better than the spy references. And while directors Coffin and Renaud have trouble with pacing in patches, the finale is a lot of zany fun when the dimwitted minions undergo a personality change and turn purple and fierce.
But is any of this flat-out hilarious? One or two scenes are. "Despicable Me 2" is more often amusing. And on a hot summer day in July when the kids are bored, being amusing might be just the refuge a parent needs.
* * *
Rating: PG (for rude humor and mild action)
Starring: Steve Carell, Kristen Wiig, Benjamin Bratt, Russell Brand,
Directors: Pierre Coffin and Chris Renaud
Running time: 1 hour, 38 minutes


text:
In need of some professional input. After several hours of phone calls to Sirius, Chrysler and dealer, no one can help me. Purchased new, custom built Chrysler Town and Country 2009. Salesperson demonstrated Backseat TV while we were on site. Since then, TV soft button has disappeared off radio. When retrieving ESN numbers for Sirius, the radio only displays audio and traffic/date numbers, but none for video. Sirius can't/won't assist without the ESN number for video. Chrysler claims they don't know what the problem is. Wondering if there is some way to retrieve this number or if I need to demand a new radio with the purchased features. If the salesperson had not demonstrated the feature while we were there, I would assume that the function is not included. Since it was on when we were there, I am wondering how and why the TV soft key disappeared. Does vehicle have to remain in US for function to work properly? We travel to Canada frequently and wonder if the function doesn't work in Canada?
Anyone with similar experience?


text:
This Licensed Conner Classic Costume is from the massive Assassins Creed! A fantastic costume for Halloween as well as Film & TV and even book week! This brilliant Conner Classic Costume is a perfect Assassins Creed costume!
This licensed Conner Classic Costume consists of the white hooded tunic, shoulder belt and waist sash with buckle as well as trousers with attached boot covers.
Buy this Conner Classic costume online today and get it the very next day if ordered before 2.30pm. Please see our delivery options for further details.
If you do not see the costume size you require, please contact us for the next anticipated delivery date, usually in 3-5 days. Contact us on 01245 226021 or Contact Us
There are currently no reviews for this product. Be the first to review by clicking below!


text:
Giants pass on Minor League deal with Lilly
SAN FRANCISCO -- Hours before the Giants faced the Brewers at AT&T Park, the team announced it would not be pursuing an expected Minor League deal with free-agent southpaw Ted Lilly.
Through a team spokesman, Giants vice president and assistant general manager Bobby Evans said, "Upon reviewing Ted Lilly's medical history, we're going to hold off on pursuing a Minor League contract right now."
The Giants had been linked to the 37-year-old southpaw, as he was reportedly scheduled to start for their Triple-A affiliate in Fresno on Tuesday night. Lilly was released by the Los Angeles Dodgers on Sunday after being designated for assignment July 25 and has spent parts of the past two seasons on the disabled list with neck problems.
"I think it was pretty much done, pending the physical," Bochy said. "From what I've heard, there's some concerns there."
Bochy said the plan was to look at Lilly for a few games at Fresno before determining if he was fit to join the Giants' staff.
"It was basically a free look to see where he's at," Bochy said. "You're talking about an experienced big league pitcher with a real nice career."
At the time of his release, Lilly toted an 0-2 record with a 5.09 ERA and 1.61 WHIP (walks plus hits per inning pitched) in five starts. He's spent the past three-plus seasons with the Dodgers and is currently in the 15th year of his MLB career, with a lifetime mark of 130-113 and a 4.14 ERA.
Though Ryan Vogelsong is set to return to the rotation Friday, the Giants have recently moved Guillermo Moscoso to the No. 5 starter spot while sending Barry Zito to the bullpen. Meanwhile, former reliever Chad Gaudin has proved to be arguably the Giants' most consistent pitcher all year, as he lowered his ERA to 2.56 on Monday night with a strong start.


text:
A Site To See: Lil' Bub The Perma-kitten
August 29, 2012 | Sites to Sniff | No Comments|
Meet Lil' Bub, rootinest tootinest, cutest polydactyl-dwarf-perma-kitten to hit the internet. Lil' Bub has found internet fame for her unique, one-of-a-kind characteristics. Her "perma-kitten" title means that Bub will stay kitten-sized and retain all kitten-like features even in her adult years. She has 22 toes, including opposable thumbs, and bulging, green eyes that have been spreading like wildfire over the internet.
Lil Bub maintains a blog, posting daily pictures of her everyday life, unique stories, videos, and even responses to fan questions about the life of the interweb's favorite lil' superstar. Here are some of our favorite postings:
Photo source: LilBub