text:
Never Let A Good Crisis Go To Waste
(This post is something of a follow-up to a previous post on browser security, but that went long enough that I decided to split the posts.)
I'll leave most of what's been said about Heartbleed to others. In particular, I enjoyed Adam Cecchetti's Heartbleed: A Beat In Time presentation. But, a few people have been poking me for comments in response to recent events. A little while ago, I called for a couple responses to Heartbleed:
- Accepting that some software has become Critical Infrastructure
- Supporting that software, with both money and talent
- Identifying that software — lets find the most important million lines of code that would be the most dangerous to have a bug, and actively monitor them
Thanks to the Linux Foundation and a host of well respected companies…this is actually happening. Whoa. That was fast. I'm not even remotely taking credit — this has been a consensus, a long time brewing. As Kennedy opined, "Victory has a thousand fathers." Right after the announcement, I was asked what I thought about this. Here's my take:
The Linux Foundation has announced their Core Infrastructure project, with early supporters including Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Qualcomm, Rackspace, and VMWare. $100K from each, for three years, to identify and support the Open Source projects we depend on.
This is fantastic.
The Internet was not our first attempt at building the Internet. Many other systems, from Minicom to AOL, came first. What we call the Internet today was just the first time a global computer telecom infrastructure really took hold, pushing data and global communications onto every desk, into every home, onto mobile phones the world over. Open Source software played, and continues to play, a tremendous role in the continuing success of the Internet, as the reason this platform worked was people could connect without hindrance from a gatekeeper.
It's hard for some people to believe, but the phone company used to own your telephone. Also, long distance calls used to be an event, because they were so very expensive.
We do live in a different world, than when the fundamental technologies of the Internet were created, and even when they were deployed. Bad actors abound, and the question is: How do we respond? What do we do, to make the Internet safe, without threatening its character? It's a baby and the bathwater scenario.
I am profoundly grateful to see the Core Infrastructure project pledging real money and real resources to Open Source projects. There are important things to note here. First, yes, Core Infrastructure is a great name that avoids the baggage of Critical Infrastructure while expressing the importance of attention. Second, we are seeing consensus that we must have the conversation about exactly what it is we depend on, if only to direct funds to appropriate projects. Third, there's an actual stable commitment of money, critical if there's to be full time engineers hired to protect this infrastructure.
The Core Infrastructure project is not the only effort going on to repair or support Open Source. The OpenBSD team has started a major fork of OpenSSL, called LibreSSL. It will take some time to see what that effort will yield, but everyone's hopeful. What's key here is that we are seeing consensus that we can and should do more, one that really does stay within the patterns that helped all these companies be the multi-billion dollar concerns they are now. The Internet grew their markets, and in many cases, created them. This isn't charity. It's just verywise business.
In summary, I'm happy. This is what I had hoped to see when I wrote about Heartbleed, and I am impressed to see industry stepping up so quickly to fill the need to identify and secure Core Infrastructure.
Making the Internet a safer place is not going to be easy. But I'm seeing a world with a Core Infrastructure Project, the Internet Bug Bounty, the Bluehat Prize (which never gets enough attention), and even real discussion around when the US Government should disclose vulnerabilities.
That's,..not the world I'm used to. If this world also has Steven Colbert cracking wise about IE vulns…OK.
(Quick,vaguely subversive thought: We always talk about transparency in things like National Security Letters and wiretaps. What about vulnerability reports that lead to fixes? Government is not monolithic. Maybe transparency can highlight groups that defend the foundations our new economies are built upon, wherever they happen to be. Doing this without creating some really perverse incentives would be…interesting.)
Of Expectations And Rewards
So some people want me to say a few more things about Heartbleed.
Meanwhile, this happened.
My immediate reaction, of course, was that there was no way IE shipped that early. Windows 95 didn't even have TCP/IP, the core protocols of the Internet, enabled by default! Colbert had no idea what he's Tolkein about.
Nope. Turns out, the Colbert Report crew did their homework. But, wait. What? In what universe has yet another browser bug become fodder for late night?
Hacking has become a spectator sport. Really can't say it's surprising — how many people play sports every day? Now how many people look at a big glowing rectangle?
We make the glowing box do some very strange things.
I mentioned earlier that one of the things that made Heartbleed so painful, is that it was a bug where we least expected one to be. That is not the situation with browsers. Despite genuinely herculean efforts, any security professional worth their salt completely expects web browser vulnerabilities to be found, and exploited, from time to time. The simple explanation is that web browsers expose a tremendous amount of attack surface to relatively anonymous attackers.
Let's get a bit beyond the simple explanation.
There's a reason we have very different codebases, but very similar bugs.
So why all the noise? Why now? In this particular case, this is the first bug after Microsoft's genuinely unprecedented campaign to announce the end of XP support. The masses were marketed to, and basically told in no uncertain terms "It's time to upgrade, the next bug is going to burn you if you're still on XP." Well, here's the next bug, and there's Microsoft keeping their word.
(Update: MS is issuing an XP patch after all. Actual attacks in the field generally do trump everything else. Really, the story of XP is tragic. Microsoft finally makes the first consumer OS that doesn't crash when you look at it funny…and then it crashes when I look at it funny. Goalposts with rockets on em…)
This is also the first bug after Heartbleed, whose response somehow metastasized into the world being told to freak out and change all their passwords.
Neither of these events have anything to do with the quality of the browser itself, but they're certainly driving the noise. Yes, IE's got some somewhat unique issues. Back in the day, when Microsoft argued that they couldn't remove IE from Windows, it was too integrated — yep, pretty much. Internet Explorer is basically Windows: The Remix feat. The Internet. Which makes sense, because at the end of the day browsers have long been the new operating systems. So of course, Microsoft would basically have lots of stuff for the browser lying about. None of that stuff was ever designed to be executed by untrusted parties, so when it ended up rigged up for remote scripting…sometimes just through the magic of COM…bad things happened.
Of course, I said somewhat unique. Firefox and its predecessors implemented various amounts of themselves not at the C++ layer, but in JavaScript itself via a language called XUL and various interesting things reachable via the Components object. Leaks into this trusted code have happened, with unpleasant side effects.
Boom. And this is pretty common. As the great poet of our modern era, The Grugq wrote recently:
WebKit is basically a collection of use-after-frees that somehow manages to render HTML (probably via a buffer overflow in WebGL)—
the grugq (@thegrugq) April 30, 2014
At this point, you may be feeling rather sad about the state of security in general. The three major browsers — IE, Firefox, and Chrome — are some of the most well funded and deeply audited ongoing development efforts in the world. If they all fail, in similar ways even, what hope do we have?
There is hope on the horizon (and through this path, we finally get back to Heartbleed). While the browsers remain imperfect, that they work at all — let alone with ever increasing performance and usability — is nothing short of miraculous. There is literally nothing else where it's conceivable that you'd just wander around, executing random chunks of code from random suppliers, and not get compromised instantaneously. (Sandboxes are things children walk into and out of with relative ease. I've always wondered why we called them that.) And there is motion towards making useful languages that are both memory safe and fast enough to do the heavy lifting browsers require — Rust being the prime example.
It's not enough to be secure. Hardest lesson anyone in security can ever learn. Some never do.
Interesting things happen as JavaScript becomes a fast language — particularly the hyper-optimizable subset of JavaScript known as asm.js. Ultimately, most virtual machines are like most sandboxes. Not the JS VM's — there's been an ongoing battle to lock those down for a decade. A VM with less to attack, that can still leverage all the optimization knowledge being absorbed into LLVM, is Interesting.
There's a crazy project to try to run all of Webkit (the engine in Chrome and Safari, more or less) inside of JavaScript, including JavaScript itself. Yo dawg.
There's hope, but it comes at some price. We don't know what solutions will actually work, and we shouldn't assume any of them will ever reach 100% security. We absolutely should not assume we knew how to do security decades ago, and just "forgot" or got lazy or whatnot. For a while it seemed like the answer was obviously Java, or C#/.NET. Useful languages for many problem sets, sure. But Microsoft once tried to rewrite chunks of Windows in .NET. It did not go well. To this day, "Longhorn" will bring chills to old-school MS'ers ("Rosebud…"), and there is genuine excitement around the .NET to C++ compiler.
There are things that looked like they worked in the past, but it was a mirage. There are things that were a mirage in the past, but technology or other factors have changed. (Anyone remember DHTML? Great idea, but it took a few generations before client side interactivity really became a thing.)
Who knows. Maybe Google will someday make a sandbox that impresses even Pinkie Pie. And perhaps I have something up my sleeve…
But expecting no bugs is like expecting no crime, nobody to die in the ER, no cars to crash, no businesses to fail. It's not just unreasonable. It's also kind of awkward to see it become a spectator sport.
(Splitting the Heartbleed commentary to a second post.)
Bloody Cert Certified
Oh, Information Disclosure vulnerabilities. Truly the Rodney Dangerfield of vulns, people never quite know what their impact is going to be. With Memory Corruption, we've basically accepted that a sufficiently skilled attacker always has enough degrees of freedom to at least unreliably achieve arbitrary code execution (and from there, by the way, to leak arbitrary information like private keys). With Information Disclosure, even the straight up finder of Heartbleed has his doubts:
Heap allocation patterns make private key exposure unlikely for #heartbleed #dontpanic.—
Neel Mehta (@neelmehta) April 08, 2014
So, can Heartbleed leak private keys in the real world or not? The best way to resolve this discussion is PoC||GTFO (Proof of Concept, or you can figure out the rest). CloudFlare threw up a challenge page to steal their key. It would appear Fedor Indutny and Illkka Mattila have successfully done just that. Now, what's kind of neat is that because this is a crypto challenge, Fedor can actually prove he pulled this off, in a way everyone else can prove but nobody else can duplicate.
I'm not sure if key theft has already occurred, but I think this fairly conclusively establishes key theft is coming. Lets do a walk through:
First, we retrieve the certificate from http://www.cloudflarechallenge.com.
$ echo "" | openssl s_client -connect www.cloudflarechallenge.com:443 -showcerts | openssl x509 > cloudflare.pem
depth=4 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify error:num=19:self signed certificate in certificate chain
verify return:0
This gives us the certificate, with lots of metadata about the RSA key. We just want the key.
$ openssl x509 -pubkey -noout -in cloudflare.pem > cloudflare_pubkey.pem
Now, we take the message posted by Fedor, and Base64 decode it:
$ wget https://gist.githubusercontent.com/indutny/a11c2568533abcf8b9a1/raw/1d35c1670cb74262ee1cc0c1ae46285a91959b3f/1.bash
–2014-04-11 18:14:48– https://gist.githubusercontent.com/indutny/a11c2568533abcf8b9a1/raw/1d35c1670cb74262ee1cc0c1ae46285a91959b3f/1.bash
Resolving gist.githubusercontent.com… 22.214.171.124
Connecting to gist.githubusercontent.com|126.96.36.199|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: unspecified [text/plain]
Saving to: `1.bash'
[ <=> ] 456 –.-K/s in 0s
2014-04-11 18:14:49 (990 KB/s) – `1.bash' saved [456]
$ cat 1.bash
> echo "Proof I have your key. email@example.com" | openssl sha1 -sign key.pem -sha1 | openssl enc -base64
$ cat 1.bash | grep -v fedor | openssl enc -d -base64 > fedor_signed_proof.bin
So, what do we have? A message, a public key, and a signature linking that specific message to that specific public key. At least, we're supposed to. Does OpenSSL agree?
$ echo "Proof I have your key. firstname.lastname@example.com" | openssl dgst -verify cloudflare_pubkey.pem -signature fedor_signed_proof.bin -sha1
Verified OK
Ah, but what if we tried this for some other RSA public key, like the one from Google?
$ echo "" | openssl s_client -connect www.google.com:443 -showcerts | openssl x509 > google.pem
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
$ openssl x509 -pubkey -noout -in google.pem > google_pubkey.pem
$ echo "Proof I have your key. firstname.lastname@example.com" | openssl dgst -verify google_pubkey.pem -signature fedor_signed_proof.bin -sha1
Verification Failure
Or what if I changed things around so it looked like it was me who cracked the code?
$ echo "Proof I have your key. email@example.com" | openssl dgst -verify cloudflare_pubkey.pem -signature fedor_signed_proof.bin -sha1
Verification Failure
Nope, it's Fedor or bust :) Note that it's a common mistake, when testing cryptographic systems, to not test the failure modes. Why was "Verified OK" important? Because "Verification Failure" happened when our expectations weren't met.
There is, of course, one mode I haven't brought up. Fedor could have used some other exploit to retrieve the key. He claims not to have, and I believe him. But that this is a failure mode is also part of the point — there have been lots of bugs that affect something that ultimately grants access to SSL private keys. The world didn't end then and it's not ending now.
I am satisfied that the burden of proof for Heartbleed leaking private keys has been met, and I'm sufficiently convinced that "noisy but turnkey solutions" for key extraction will be in the field in the coming weeks (it's only been ~3 days since Neel told everyone not to panic).
Been getting emails asking for what the appropriate response to Heartbleed is. My advice is pretty exclusively for system administrators and CISOs, and is something akin to "Patch immediately, particularly the systems exposed to the outside world, and don't just worry about HTTP. Find anything moving SSL, particularly your SSL VPNs, prioritizing on open inbound, any TCP port. Cycle your certs if you have them, you're going to lose them, you may have already, we don't know. But patch, even if there's self signed certs, this is a generic Information Leakage in all sorts of apps. If there is no patch and probably won't ever be, look at putting a TLS proxy in front of the endpoint. Pretty sure stunnel4 can do this for you."
QUICK EDIT: One final note — the bug was written at the end of 2011, so devices that are older than that and have not been patched at all remain invulnerable (at least to Heartbleed). The guidance is really to identify systems that are exposing OpenSSL 1.01 SSL servers (and eventually clients) w/ heartbeat support, on top of any protocol, and get 'em patched up.
Yes, I'm trying to get focus off of users and passwords and even certificates and onto stemming the bleeding, particularly against non-obvious endpoints. For some reason a surprising number of people think SSL is only for HTTP and browsers. No, it's 2014. A lot of protocol implementations have basically evolved to use this one environment middleboxes can't mess with.
A lot of corporate product implementations, by the way. This has nothing to do with Open Source, except to the degree that Open Source code is just basic Critical Infrastructure now.
Be Still My Breaking Heart
Abstract: Heartbleed wasn't fun. It represents us moving from "attacks could happen" to "attacks have happened", and that's not necessarily a good thing. The larger takeaway actually isn't "This wouldn't have happened if we didn't add Ping", the takeaway is "We can't even add Ping, how the heck are we going to fix everything else?". The answer is that we need to take Matthew Green's advice, start getting serious about figuring out what software has become Critical Infrastructure to the global economy, and dedicating genuine resources to supporting that code. It took three years to find Heartbleed. We have to move towards a model of No More Accidental Finds.
You know, I'd hoped I'd be able to avoid a long form writeup on Heartbleed. Such things are not meant to be. I'm going to leave many of the gory technical details to others, but there's a few angles that haven't been addressed and really need to be. So, let's talk. What to make of all this noise?
First off, there's been a subtle shift in the risk calculus around security vulnerabilities. Before, we used to say: "A flaw has been discovered. Fix it, before it's too late." In the case of Heartbleed, the presumption is that it's already too late, that all information that could be extracted, has been extracted, and that pretty much everyone needs to execute emergency remediation procedures.
It's a significant change, to assume the worst has already occurred.
It always seems like a good idea in security to emphasize prudence over accuracy, possible risk over evidence of actual attack. And frankly this policy has been run by the privacy community for some time now. Is this a positive shift? It certainly allows an answer to the question for your average consumer, "What am I supposed to do in response to this Internet ending bug?" "Well, presume all your passwords leaked and change them!"
I worry, and not merely because "You can't be too careful" has not at all been an entirely pleasant policy in the real world. We have lots of bugs in software. Shall we presume every browser flaw not only needs to be patched, but has already been exploited globally worldwide, and you should wipe your machine any time one is discovered? This OpenSSL flaw is pernicious, sure. We've had big flaws before, ones that didn't just provide read access to remote memory either. Why the freak out here?
Because we expected better, here, of all places.
There's been quite a bit of talk, about how we never should have been exposed to Heartbleed at all, because TLS heartbeats aren't all that important a feature anyway. Yes, it's 2014, and the security community is complaining about Ping again. This is of course pretty rich, given that it seems half of us just spent the last few days pinging the entire Internet to see who's still exposed to this particular flaw. We in security sort of have blinders on, in that if the feature isn't immediately and obviously useful to us, we don't see the point.
In general, you don't want to see a protocol designed by the security community. It won't do much. In return (with the notable and very appreciated exception of Dan Bernstein), the security community doesn't want to design you a protocol. It's pretty miserable work. Thanks to what I'll charitably describe as "unbound creativity" the fast and dumb and unmodifying design of the Internet has made way to a hodge podge of proxies and routers and "smart" middleboxes that do who knows what. Protocol design is miserable, nothing is elegant. Anyone who's spent a day or two trying to make P2P VoIP work on the modern Internet discovers very quickly why Skype was worth billions. It worked, no matter what.
Anyway, in an alternate universe TLS heartbeats (with full ping functionality) are a beloved security feature of the protocol as they're the key to constant time, constant bandwidth tunneling of data over TLS without horrifying application layer hacks. As is, they're tremendously useful for keeping sessions alive, a thing I'd expect hackers with even a mild amount of experience with remote shells to appreciate. The Internet is moving to long lived sessions, as all Gmail users can attest to. KeepAlives keep long lived things working. SSH has been supporting protocol layer KeepAlives forever, as can be seen:
- http://www.kehlet.cx/articles/129.html
- http://patrickmylund.com/blog/how-to-keep-alive-ssh-sessions/
- https://drupal.star.bnl.gov/STAR/comp/sofi/facility-access/ssh-stable-con
- https://pthree.org/2008/04/16/keeping-your-ssh-connection-alive/
The takeaway here is not "If only we hadn't added ping, this wouldn't have happened." The true lesson is, "If only we hadn't added anything at all, this wouldn't have happened." In other words, if we can't even securely implement Ping, how could we ever demand "important" changes? Those changes tend to be much more fiddly, much more complicated, much riskier. But if we can't even securely add this line of code:
if (1 + 2 + payload + 16 > s->s3->rrec.length)
I know Neel Mehta. I really like Neel Mehta. It shouldn't take absolute heroism, one of the smartest guys in our community, and three years for somebody to notice a flaw when there's a straight up length field in the patch. And that, I think, is a major and unspoken component of the panic around Heartbleed. The OpenSSL dev shouldn't have written this (on New Years Eve, at 1AM apparently). His coauthors and release engineers shouldn't have let it through. The distros should have noticed. Somebody should have been watching the till, at least this one particular till, and it seems nobody was.
Nobody publicly, anyway.
If we're going to fix the Internet, if we're going to really change things, we're going to need the freedom to do a lot more dramatic changes than just Ping over TLS. We have to be able to manage more; we're failing at less.
There's a lot of rigamarole around defense in depth, other languages that OpenSSL could be written in, "provable software", etc. Everyone, myself included, has some toy that would have fixed this. But you know, word from the Wall Street Journal is that there have been all of $841 in donations to the OpenSSL project to address this matter. We are building the most important technologies for the global economy on shockingly underfunded infrastructure. We are truly living through Code in the Age of Cholera.
Professor Matthew Green of Johns Hopkins University recently commented that he's been running around telling the world for some time that OpenSSL is Critical Infrastructure. He's right. He really is. The conclusion is resisted strongly, because you cannot imagine the regulatory hassles normally involved with traditionally being deemed Critical Infrastructure. A world where SSL stacks have to be audited and operated against such standards is a world that doesn't run SSL stacks at all.
And so, finally, we end up with what to learn from Heartbleed. First, we need a new model of Critical Infrastructure protection, one that dedicates real financial resources to the safety and stability of the code our global economy depends on – without attempting to regulate that code to death. And second, we need to actually identify that code.
When I said that we expected better of OpenSSL, it's not merely that there's some sense that security-driven code should be of higher quality. (OpenSSL is legendary for being considered a mess, internally.) It's that the number of systems that depend on it, and then expose that dependency to the outside world, are considerable. This is security's largest contributed dependency, but it's not necessarily the software ecosystem's largest dependency. Many, maybe even more systems depend on web servers like Apache, nginx, and IIS. We fear vulnerabilities significantly more in libz than libbz2 than libxz, because more servers will decompress untrusted gzip over bzip2 over xz. Vulnerabilities are not always in obvious places – people underestimate just how exposed things like libxml and libcurl and libjpeg are. And as HD Moore showed me some time ago, the embedded space is its own universe of pain, with 90's bugs covering entire countries.
If we accept that a software dependency becomes Critical Infrastructure at some level of economic dependency, the game becomes identifying those dependencies, and delivering direct technical and even financial support. What are the one million most important lines of code that are reachable by attackers, and least covered by defenders? (The browsers, for example, are very reachable by attackers but actually defended pretty zealously – FFMPEG public is not FFMPEG in Chrome.)
Note that not all code, even in the same project, is equally exposed. It's tempting to say it's a needle in a haystack. But I promise you this: Anybody patches Linux/net/ipv4/tcp_input.c (which handles inbound network for Linux), a hundred alerts are fired and many of them are not to individuals anyone would call friendly. One guy, one night, patched OpenSSL. Not enough defenders noticed, and it took Neel Mehta to do something.
We fix that, or this happens again. And again. And again.
No more accidental finds. The stakes are just too high.
On Brinksmanship
Reality is what refuses to go away when you stop believing in it.
The reality – the ground truth—is that Aaron Swartz is dead.
Now what.
Brinksmanship is a terrible game, that all too many systems evolve towards. The suicide of Aaron Swartz is an awful outcome, an unfair outcome, a radically out of proportion outcome. As in all negotiations to the brink, it represents a scenario in which all parties lose.
Aaron Swartz lost. He paid with his life. This is no victory for Carmen Ortiz, or Steve Heymann, or JSTOR, MIT, the United States Government, or society in general. In brinksmanship, everybody loses.
Suicide is a horrendous act and an even worse threat. But let us not pretend that a set of charges covering the majority of Aaron's productive years is not also fundamentally noxious, with ultimately a deeply similar outcome. Carmen Ortiz (and, presumably, Steve Heymann) are almost certainly telling the truth when they say – they had no intention of demanding thirty years of imprisonment from Aaron. This did not stop them from in fact, demanding thirty years of imprisonment from Aaron.
Brinksmanship. It's just negotiation. Nothing personal.
Let's return to ground truth. MIT was a mostly open network, and the content "stolen" by Aaron was itself mostly open. You can make whatever legalistic argument you like; the reality is there simply wasn't much offense taken to Aaron's actions. He wasn't stealing credit card numbers, he wasn't reading personal or professional emails, he wasn't extracting design documents or military secrets. These were academic papers he was 'liberating'.
What he was, was easy to find.
I have been saying, for some time now, that we have three problems in computer security. First, we can't authenticate. Second, we can't write secure code. Third, we can't bust the bad guys. What we've experienced here, is a failure of the third category. Computer crime exists. Somebody caused a huge amount of damage – and made a lot of money – with a Java exploit, and is going to get away with it. That's hard to accept. Some of our rage from this ground truth is sublimated by blaming Oracle. But some of it turns into pressure on prosecutors, to find somebody, anybody, who can be made an example of.
There are two arguments to be made now. Perhaps prosecution by example is immoral – people should only be punished for their own crimes. In that case, these crimes just weren't offensive enough for the resources proposed (prison isn't free for society). Or perhaps prosecution by example is how the system works, don't be naïve – well then.
Aaron Swartz's antics were absolutely annoying to somebody at MIT and somebody at JSTOR. (Apparently someone at PACER as well.) That's not good, but that's not enough. Nobody who we actually have significant consensus for prosecuting, models himself after Aaron Swartz and thinks "Man, if they go after him, they might go after me".
The hard truth is that this should have gone away, quietly, ages ago. Aaron should have received a restraining order to avoid MIT, or perhaps some sort of fine. Instead, we have a death. There will be consequences to that – should or should not doesn't exist here, it is simply a statement of fact. Reality is what refuses to go away, and this is the path by which brinksmanship is disincentivized.
My take on the situation is that we need a higher class of computer crime prosecution. We, the computer community in general, must engage at a higher level – both in terms of legislation that captures our mores (and funds actual investigations – those things ain't free!), and operational support that can provide a critical check on who is or isn't punished for their deeds. Aaron's law is an excellent start, and I support it strongly, but it excludes faux law rather than including reasoned policy. We can do more. I will do more.
The status quo is not sustainable, and has cost us a good friend. It's so out of control, so desperate to find somebody – anybody! – to take the fall for unpunished computer crime, that it's almost entirely become about the raw mechanics of being able to locate and arrest the individual instead of about their actual actions.
Aaron Swartz should be alive today. Carmen Ortiz and Steve Heymann should have been prosecuting somebody else. They certainly should not have been applying a 60x multiple between the amount of time they wanted, and the degree of threat they were issuing. The system, in all of its brinksmanship, has failed. It falls on us, all of us, to fix it.
Actionable Intelligence: The Mouse That Squeaked
[Obligatory disclosures -- I've consulted for Microsoft, and had been doing some research on Mouse events myself.]
So one of the more important aspects of security reporting is what I've been calling Actionable Intelligence. Specifically, when discussing a bug — and there are many, far more than are ever discovered let alone disclosed — we have to ask:
What can an attacker do today, that he couldn't do yesterday, for what class attacker, to what class victim?
Spider.IO, a fraud analytics company, recently disclosed that under Internet Explorer attackers can capture mouse movement events from outside an open window. What is the Actionable Intelligence here? It's moderately tempting to reply: We have a profound new source of modern art.
(Credit: Anatoly Zenkov's IOGraph tool)
I exaggerate, but not much. The simple truth is that there are simply not many situations where mouse movements are security sensitive. Keyboard events, of course, would be a different story — but mouse? As more than a few people have noted, they'd be more than happy to publish their full movement history for the past few years.
It is interesting to discuss the case of the "virtual keyboard". There has been a movement (thankfully rare) to force credential input via mouse instead of keyboard, to stymie keyloggers. This presupposes a class of attacker that has access to keyboard events, but not mouse movements or screen content. No such class actually exists; the technique was never protecting much of anything in the first place. It's just pain-in-the-butt-as-a-feature. More precisely, it's another example of Rick Wash's profoundly interesting turn of phrase, Folk Security. Put simply, there is a belief that if something is hard for a legitimate user, it's even harder for the hacker. Karmic security is (unfortunately) not a property of the universe.
(What about the attacker with an inline keylogger? Not only does he have physical access, he's not actually constrained to just emulating a keyboard. He's on the USB bus, he has many more interesting devices to spoof.)
That's not to say spider.io has not found a bug. Mouse events should only come from the web frame for which script has dominion over, in much the same way CNN should not be receiving Image Load events from a tab open to Yahoo. But the story of the last decade is that bugs are not actually rare, and that from time to time issues will be found in everything. We don't need to have an outright panic when a small leak is found. The truth is, every remote code execution vulnerability can also capture full screen mouse motion. Every universal cross site scripting attack (in which CNN can inject code into a frame owned by Yahoo) can do similar, though perhaps only against other browser windows.
I would like to live in a world where this sort of very limited overextension of the web security model warrants a strong reaction. It is in fact nice that we do live in a world where browsers effectively expose the most nuanced and well developed (if by fire) security model in all of software. Where else is even the proper scope of mouse events even a comprehensible discussion?
(Note that it's a meaningless concept to say that mouse events within the frame shouldn't be capturable. Being able to "hover" on items is a core user interface element, particularly for the highly dynamic UI's that Canvas and WebGL enable. The depth of damage one would have to inflict on the browser usability model, to 'secure' activity in what's actually the legitimate realm of a page, would be profound. When suggesting defenses, one must consider whether the changes required to make them reparable under actual assault ruins the thing being defended in the first place. We can't go off destroying villages in order to save them.)
So, in summary: Sure, there's a bug here with these mouse events. I expect it will be fixed, like tens of thousands of others. But it's not particularly significant. What can an attacker do today, that he couldn't do yesterday? Not much, to not many. Spider.io's up to interesting stuff, but not really this.
DakaRand 1.0: Revisiting Clock Drift For Entropy Generation
"The generation of random numbers is too important to be left to chance."
–Robert R. Coveyou
"One out of 200 RSA keys in the field were badly generated as a result of standard dogma. There's a chance this might fail less."
[Note: There are times I write things with CIO's in mind. This is not one of those times.]
So, I've been playing with userspace random number generation, as per Matt Blaze and D.P. Mitchell's TrueRand from 1996. (Important: Matt Blaze has essentially disowned this approach, and seems to be honestly horrified that I'm revisiting it.) The basic concept is that any system with two clocks has a hardware number generator, since clocks jitter relative to one another based on physical properties, particularly when one is operating on a slow scale (like, say, a human hitting a keyboard) while another is operating on a fast scale (like a CPU counter cycling at nanosecond speeds). Different tolerances on clocks mean more opportunities for unmodelable noise to enter the system. And since the core lie of your computer is that it's just one computer, as opposed to a small network of independent nodes running on their own time, there should be no shortage of bits to mine.
At least, that's the theory.
As announced at Defcon 20 / Black Hat, here's DakaRand 1.0. Let me be the first to say, I don't know that this works. Let me also be the first to say, I don't know that it doesn't. DakaRand is a collection of modes that tries to convert the difference between clocks into enough entropy that, whether or not it survives academic attack, would certainly force me (as an actual guy who breaks stuff) to go attack something else.
A proper post on DakaRand is reserved, I think, for when we have some idea that it actually works. Details can be seen in the slides for the aforementioned talk; what I'd like to focus on now is recommendations for trying to break this code. The short version:
1) Download DakaRand, untar, and run "sh build.sh".
2) Run dakarand -v -d out.bin -m [0-8]
3) Predict out.bin, bit for bit, in less than 2^128 work effort, on practically any platform you desire with almost any level of active manipulation you wish to insert.
The slightly longer version:
- DakaRand essentially tries to force the attacker into having no better attack than brute force, and then tries to make that work effort at least 2^128. As such, the code is split into generators that acquire bits, and then a masking sequence of SHA-256, Scrypt, and AES-256-CTR that expands those bits into however much is requested. (In the wake of Argyros and Kiayias's excellent and underreported "I Forgot Your Password: Randomness Attacks Against PHP Applications", I think it's time to deprecate all RNG's with invertable output. At the point you're asking whether an RNG should be predictable based on its history, you've already lost.) The upshot of this is that the actual target for a break is not the direct output of DakaRand, but the input to the masking sequence. Your goal is to show that you can predict this particular stream, with perfect accuracy, at less than 2^128 work effort. Unless you think you can glean interesting information from the masking sequence (in which case, you have more interesting things to attack than my RNG), you're stuck trying to design a model of the underlying clock jitter.
- There are nine generators in this initial release of DakaRand. Seriously, they can't all work.
- You control the platform. Seriously — embedded, desktop, server, VM, whatever — it's fair game. About the only constraint that I'll add is that the device has to be powerful enough to run Linux. Microcontrollers are about the only things in the world that do play the nanosecond accuracy game, so I'm much less confident against those. But, against anything ARM or larger, real time operation is simply not a thing you get for free, and even when you pay dearly for it you're still operating within tolerances far larger than DakaRand needs to mine a bit. (Systems that are basically cycle-for-cycle emulators don't count. Put Bochs and your favorite ICE away. Nice try though!)
- You seriously control the platform. I've got no problem with you remotely spiking the CPU to 100%, sending arbitrary network traffic at whatever times you like, and so on. The one constraint is that you can't already have root — so, no physical access, and no injecting yourself into my gathering process. It's something of a special case if you've got non-root local code execution. I'd be interested in such a break, but multitenancy is a lie and there's just so many interprocess leaks (like this if-it's-so-obvious-why-didn't-you-do-it example of cross-VM communication).
- Virtual machines get special rules: You're allowed to suspend/restore right up to the execution of DakaRand. That is the point of atomicity.
- The code's a bit hinky, what with globals and a horde of dependencies. If you'd like to test on a platform that you just can't get DakaRand to build on, that makes things more interesting, not less. Email me.
- All data generated is mixed into the hash, but bits are "counted" when Von Neumann debiasing works. Basically, generators return integers between 0 and 2^32-1. Every integer is mixed into the keying hash (thus, you having to predict out.bin bit for bit). However, each integer is also measured for the number of 1's it contains. An even number yields a 0; an odd number, a 1. Bits are only counted when two sequential numbers have either a 10 or a 01, and as long as there's less than 256 bits counted, the generator will continue to be called. So your attack needs to model the absolute integers returned (which isn't so bad) and the amount of generator calls it takes for a Von Neumann transition to occur and whether the transition is a 01 or a 10 (since I put that value into the hash too).
- I've got a default "gap" between generator probes of just 1000us — a millisecond. This is probably not enough for all platforms — my assumption is that, if anything has to change, that this has to become somewhat dynamic.
Have fun! Remember, "it might fail somehow somewhere" just got trumped by "it actually did fail all over the place", so how about we investigate a thing or two that we're not so sure in advance will actually work?
(Side note: Couple other projects in this space: Twuewand, from Ryan Finnie, has the chutzpah to be pure Perl. And of course, Timer Entropyd, from Folkert Van Heusden. Also, my recommendation to kernel developers is to do what I'm hearing they're up to anyway, which is to monitor all the interrupts that hit the system on a nanosecond timescale. Yep, that's probably more than enough.)


text:
Simple and classic, this leather backpack is all you need to take you from work to weekend. With a timeless silhouette and durable construction, this backpack will last you season after season. Features a full-zip exterior pocket with extended magnetic snap pouch for easy access. The main compartment is secured with a full zip closure and a leather pull tab. Fully lined interior with slightly padded adjustable straps for comfortability. Finished off with our signature Marc by Marc Jacobs logo embossed on the front for a sleek look.
11.5" x 5" x 15.25"
100% Cow Leather

subset: commoncrawl


text:
Information contained on this page is provided by an independent third-party content provider. WorldNow and this Station make no warranties or representations in connection therewith. If you have any questions or comments about this page please contact email@example.com.
SOURCE CCA Industries, Inc.
EAST RUTHERFORD, N.J., June 23, 2014 /PRNewswire/ -- CCA Industries, Inc. (NYSE MKT: "CAW") announced today that it has no comment on unusual market activity.
In view of the unusual market activity in the Company's common stock traded on the NYSE MKT exchange, the New York Stock Exchange contacted the Company in accordance with its usual practice. The Company states that its policy is not to comment on unusual market activity.
About CCA Industries, Inc.
CCA Industries Inc. manufactures and markets health and beauty aids, each under its individual brand name. The products include, principally, "Plus+White" toothpastes and teeth whiteners, "Mega-T" Green Tea diet supplements, " "Bikini Zone" medicated topical and shave gels, "Nutra Nail" nail care, " "Scar Zone" scar treatment products, "Sudden Change" anti-aging skin care products, "Solar Sense" sun protection products, and "Pain Bust RII" an analgesic product.
Statements contained in the news release that are not historical facts are forward looking statements as that term is defined in the Private Securities Litigation Reform Act of 1995. Such forward-looking statements, including statements regarding expectations with respect to future operating results, anticipated future cost savings, anticipated timing and cost of implementation of the operational changes described in this new release and the manner in which the operational changes described in this news release, and the timing of their implementation, may affect future operating results, are subject to risks and uncertainties, which would cause actual results to differ materially from estimated results. Such risks and uncertainties are detailed in the Company's filings with the Securities and Exchange Commission. No assurance can be given that the results in any forward-looking statement will be achieved, and actual results could be affected by one or more factors, which could cause them to differ materially. For these statements, we claim the protection of the safe harbor for forward-looking statements contained in the Private Securities Litigation Reform Act and otherwise under applicable law.
©2012 PR Newswire. All Rights Reserved.


text:
Introduction | Science | Tools | Partners
and Assessments
Science and knowledge are critically important to enable society to understand and respond to threats posed by...
and Policy
Significant barriers and constraints persist for adaptation efforts in developing countries. Access to relevant ...
Healthy, well-functioning ecosystems enhance natural resilience to the adverse impacts of climate change...
and Finance
The impacts of climate change are already resulting in economic losses around the world. Activities to adapt...
Access to
Adaptation Finance
UNEP supports countries in accessing available adaptation finance. As one of the Multilateral Implementing Agencies ...
EbA Mountain project in Peru starts participatory 3D modelling exercise with pilot communities
Read more
The Adaptation Knowledge Day V
Adaptation Experts
4th Asia-Pacific Climate Change Adaptation Forum
Follow UNEP


text:
Hi buddies,
This is K.Mahes, J2ME developer. I am doing a J2ME application.Here, while i am connecting to server using ContentConnection con = (ContentConnection) Connetor.open(URL,Connector.READ,true); sometimes it doesnot return anything to check exception/response.It blocks to go next statement in the code. I have tried in many ways (Using TimerTask, Threads..),but no use. This blocker is reproduced in Nokia E72 as well as in WTK 2.5.2 emulator also.
So,can you please suggest me to crack this issues ASAP. Other wise is there any other way to overcome this timedout issue.
Thanks & Regards


text:
Salvation Army appeals for unwanted toys and gifts (From Redditch Advertiser)
Get involved! Send your photos, video, news & views by texting RA NEWS to 80360 or e-mail us
Salvation Army appeals for unwanted toys and gifts
11:00am Wednesday 5th December 2012 in Local
THE Salvation Army in Redditch is asking for toys and gifts from residents that it can give to families in need this Christmas as part of its annual Toy Appeal.
Anyone with unwanted toys, gifts or non-perishable foods they are willing to donate, should take them to the Salvation Army Hall in Ipsley Street or to the Salvation Army charity shop on Evesham Road in Crabbs Cross.
This Saturday, December 8, The Salvation Army band will also be playing carols outside the Evesham Road shop from 10am, followed by a performance in the Kingfisher shopping centre next Saturday, December 15 from 10.30am.
Comments are closed on this article.


text:
Early Friday morning detectives responded to a fatal bar fight near the Serenity Apartments in Ocala. Two were fatally shot and the sheriff's office is searching for two suspects.
Witnesses say four people were involved in a bar fight that included tires being slashed, car windows broken and a gun versus knife fight that ended with two of the four fatally shot.
Detectives are looking for clues in the case. If you have any information, call Crime Stoppers of Marion County at 368-STOP or 368-7867.
Follow @myfoxorlando
35 Skyline DriveLake Mary, FL 32746
Phone: (407) 644-3535News Tips: (866) 55-FOX35


text:
Dawn Hobby is the News Director at WALB-TV.
Prior to her promotion in January 2013, the Emmy award winning journalist anchored the evening news for WALB News 10.
Dawn began her broadcast career as a producer at WALB, later becoming a reporter and anchor.
She launched the news operation for Albany station WFXL, then five years later returned to WALB.
Dawn is an award winning investigative reporter and has received numerous state, regional and national broadcast honors for her coverage of live, breaking news.
She has received top honors from the Georgia Association of Broadcasters, the Associated Press Broadcasters Assn., as well as Green Eyeshade Awards for Excellence in Journalism from the Society of Professional Journalists.
Dawn holds three of the prestigious Golden Viddy Awards, bestowed by the National Academy of Television Journalists. She was named Best Female Anchor and awarded for Best Investigative Reporting.
In November 2004, Georgia Trend magazine recognized Dawn as one of the state's most influential journalists in its "Who's Who in Georgia Media" issue.
She was again recognized by Georgia Trend in November 2005, in the magazine's "Who's Who in TV News" cover story.
In 2007, and again in 2009, the Georgia Association of Broadcasters awarded Dawn the GABBY for "Best TV On-Air Personality."
Dawn received an EMMY Award from the National Academy of Television Arts and Sciences Southeast in 2011 for her work on the "Gulf Oil Crisis" special report.
Dawn is a graduate of the 2011 Raycom Media Leadership program, and a 2012 graduate of the Poynter Leadership Academy at The Poynter Institute in St. Petersburg, FL.
In March 2014, Dawn was chosen as a Fellow in the Carole Kneeland Project New Media Leadership Program in Austin, TX.
Dawn serves on the Board of Directors for the Georgia Associated Press, and in April 2014, she was appointed to the Raycom Media News Directors Advisory Board.
Dawn has one son, and is married to Atlanta author and commercial pilot Russell Still.
facebook: www.facebook.com/dawnhobbywalb
Twitter: www.twitter.com/dawnhobby
P.O. Box 3130
All content © Copyright 2000 - 2014 Worldnow and WALB. All Rights Reserved.
For more information on this site, please read our Privacy Policy and Terms of Service.


text:
* Outsport's says hold your horses on the Brendon Ayanbadejo 'four players coming out' chatter.
* In SBNation's NFL Writer's Mock Draft, the 49ers were on the clock with the 34th overall selection. They figured they'd go with another offensive weapon.
* Eight In The Box: Sando recaps a few of the 2013 under-the-radar offseason acquisitions in the NFC West.
* The 49ers have a very good - very young - offensive line. One that's taken them to consecutive NFC West titles. Right Tackle Anthony Davis is a player that Rams defensive ends will continue face…for five more seasons.
* The Rams drafted DE Robert Quinn with their first round selection in 2011. If they were awarded a mulligan, would they do it again? Bucky Brooks wouldn't.
* Today is the last day for you to vote for the Final Four…The Greatest Play of All Time
* Even NaVorro Bowman thinks the Seahawks are the second best team in the NFC West.
St. Louis Post Dispatch
* Trumaine Johnson gets thirsty when he drives. He's not guilty though, and on April 30th he'll look to make his case in a pre-trial hearing.
* Upon Further Review: Bryan Burwell sits down with former Rams RB Steven Jackson, who makes it pretty clear why he took his talents to Sou…..Atlanta.
National Football Post - A look at Draft Tendencies for NFL teams. The SEC is a pretty good college football conference… the Rams don't particularly care to draft many of it's players.
Mark Your Calendars! ProFootballTalk's Mike Florio states that Alabama RB Eddie Lacy will not need a medical re-check, and should be running for scouts on April 11th.
RotoWorld - Two or three teams could be interested in acquiring Danario Alexander. Could the Rams be one? Pffffffffft!
High Risk/High Reward - Optimum Scouting highlights a few players in the upcoming draft that have been linked to the Rams.
Bleacher Report - Matt Miller added in Inside Linebacker to his Top 1000 list. Only one person should have to click that many times to find James Laurinaitis, so here's where Miller ranked him.
ProFootballTalk - The Seahawks aren't expected to make a run at Tim Tebow. However, watch out for the Rams.


text:
- Mobile site
- E-Newsletters
- News feed
- Find us on Twitter
Follow our reporters on Twitter
Follow The Northern Echo and ours reporters on Twitter for the latest breaking news
- Find us on Facebook
The Northern Echo
Like us on Facebook
Taking the strain in Durham City (From The Northern Echo)
For details on how to contact our editorial and commercial departments, click here
Taking the strain in Durham City
8:50am Monday 14th January 2013 in News By Gavin Havery, Reporter (Derwentside & Tyneside)
WEIGHTLIFTERS from across the region and beyond gathered in Durham City over the weekend.
The Yorkshire and North-East Classic Benchpress Championships were held at The Boathouse at the end of Green Lane on Saturday.
Almost 30 lifters, men and women, aged from age 17 to 70, who are competing to be a YNE Divisional Champion and for qualification to the British Championships, took part.
They travelled from Morpeth, Consett, Bishop Auckland, Teesside, Leeds, Sheffield and Doncaster to do battle with gravity.
Organiser Jim Dulling, chairman of Durham Powerlifters, said: "The competition has local support from North-East sculptor James Armstrong.
"James has established himself as a talented artist and specialises in the use of mechanical parts being fashioned into stimulating sculptures.
"His background of Agricultural Engineering and his welding skills are being put to good use in his production of the competition trophies."
"The competition is a showcase event and attracts a substantial following."
Comments are closed on this article.


text:
Diverse America
Meet the Couples Suing the State of Georgia for Marriage Equality
"The couple were married on Valentine's Day in 2013 in New York at City Hall, after tests showed that Pam's cancer treatment appeared to have been successful.
You may have noticed the red and pink equal signs dotting various profiles on Facebook and Twitter -- or you might have already dressed up your own profile to show your support for same-sex marriage and to "paint the town red" while the Supreme Court weighs in on the Defense of Marriage Act (DOMA). As we await the outcome of this week's deliberation, let's take a look at some of the more unique, beautiful, and creative ways people are interpreting the equality sign. Here, for example, is comic artist and internet connoisseur The Oatmeal's smoky, savory tribute to the equality sign.


text:
Select Route:
Silverplume Falls forms a wide amphitheater of 60-80 degree ice at the head of the ravine. The formation consists of a short, lower-step followed by a short ledge and finally a longer steep section that is the main section of the climb. The area is wide enough to accommodate several parties, and many variations are possible. The ice, however, is usually thick and homogeneous with all routes fairly similar. Some easy mixed climbing can be had to the edges of the climb. The ice is on the southern aspect of the mountain and has a fair amount of sun exposure. Therefore, the ice forms a soft, white, foamy consistency rather than the clear hard ice on northern aspects.
Screws, the ice is usually thick enough to take long screws.
Toprope Protection
Screws, bolts and slings. The area above the climb is a gravel sandbar of mining tailings, and there is actually very little top-rope protection available.


text:
Your car is an investment that you rely on daily. Whether you need new tires, dependable service, or new brakes you can trust, our ASE certified techs will care for your car so that it can take care of you.
You want your automotive work to be done quickly and well so you can get back to your activities. For 30 years, we have been providing the Walnut area with prompt, quality, reasonably priced service.
Auto Repair- Oil changes, A/C service, tune ups, tires mounted, flats fixed
Tires- Major brand names, hard to find tires, chrome wheels, hubcaps
Brake Service- Repair, new shoes, pads, rotors, fluid exchange or flush
Call 909-594-7803 or stop in at 20241 Valley Blvd in Walnut to schedule service or tire mounting.


text:
Almost everyone connected to the production side of the concert industry can define the moment that changed the way they looked at rock and roll. Mine occurred 10 years ago, when I was a sophomore journalism major at UNC-Chapel Hill, and Genesis performed at the brand-new Dean E. Smith Center. Despite the fact that my roommate had slept out all night in line for tickets, we ended up behind the stage. But we were happy enough to have seats on the lower level, which was something we rarely achieved for Tar Heel basketball games.
I don't remember all the songs the band played, but I do recall that the lights swung out from the rig and the colored beams reached even our lame seats. Then, during the song "Mama," when Phil Collins does that creepy HA-HA-HA laugh, all the lights blacked out except for one uplight located right beneath Collins' mike stand that produced a spooky shadowy effect when he stuck his head into the beam. My friends and I thought it was all pretty cool.
Of course, I didn't know those effects emanated from something called a Vari*Lite(R) automated luminaire, an invention that had set the concert lighting world on its collective ear when it made its debut on Genesis' 1981 Abacab tour but went completely unnoticed by me. Vari-Lite's PR manager, Tom Littrell, who served as that tour's programmer/operator, tells me that it marked the introduction of the company's Series 200(TM) system and the Artisan(R) console. The "Mama" effect was done by the tour's token VL1(TM) luminaire, which had its own little silver box controller and its own operator, Bill Boswell.
Even if I had known all that, I wouldn't have imagined I'd write about it someday. But in 1991 I volunteered to add the concert beat to my copyediting duties at Lighting Dimensions--though my knowledge of lighting was limited to correcting the trademark symbols for the equipment listed in the articles I was proofreading. Still, I thought going to lots of rock shows (with backstage passes, no less!) would be a lot of fun. To my relief, I quickly learned that most of the lighting designers I interviewed found themselves in their careers for the very same reason.
Most concert LDs are or were musicians, or just people who love music--especially live music--and for one reason or another ended up working behind the scenes where they could put their creativity to more productive use. As a result, they're overall a modest bunch, but they're more than willing to share what they know with a little prompting. That I was truly interested in reporting on and promoting their work made even my most simplistic questions forgivable. (Luckily, I was able to direct my really elementary queries like "What does PAR-64 stand for?" and "How does a dimmer work?" to our former technical editor, Karl G. Ruling, who patiently provided me with every last answer and deserves most of the credit for making my first articles intelligible.)
In the scores of interviews I've done since then with concert LDs, a common theme has been both their amazement and gratification at having their work acclaimed at all. Yet such was not the case with Rosemary Kalikow's article on Imero Fiorentino's lighting design for Neil Diamond's tour, which graced the cover of the first Lighting Dimensions in June 1977.
In that interview Fiorentino describes the process of collaborating with set designer George Honchar to create a theatrically inspired touring design that was greatly aided by Diamond's input. The only lighting equipment mentioned is the 10,000W fresnel the LD needed to create a specific effect for the song "Jonathan Livingston Seagull." The article also includes insights from Honchar about the set, providing the first indication that set designers would receive almost as much credit as LDs do in these pages, for they create the surfaces that catch the light.
Diamond's production stood out for its time, but considering that concert touring has only existed for about 25 years, its aesthetic progression has been rapid. Certainly the first British invasion bands who toured the US venues lit only with followspots were eager to add huge lighting rigs to their shows when they became available. Touring rock shows may lack the subtleties of theatre, but their very brashness and sense of urgency are responsible for most of the technological advances that are now industry standards: PAR cans, bars of six, preset focuses, stacking trusses--and, oh yes, moving lights. There is no denying that once they got their hands on any moving-light technology that became available, some LDs flashed the lights up, down, and all around, simply because they could.
That trend has since seen its day, as a fully automated lighting system can now provide more light and more nuance than a conventional system twice its size. Plus, lots of musicians, turned off by what they perceived as a disco look, have requested that moving lights stay put for their shows. And, in the economically minded 90s, where tour accountants have almost as much say as the designers do about a show's look, exploring the "less is more" path has become less an option than a directive.
In the six years that I've been covering concerts, I've seen a couple hundred live and televised concerts here in New York. I've been given the opportunity to travel to shows in other cities (Yanni in Beijing rules as this year's highlight; see page 106), and sometimes sit in on production rehearsals, which has given me unlimited respect for the crews, manufacturers, and vendors who all work to make designers' visions into beautiful realities.
I don't have a favorite show, but there is one shining moment that stands out in my mind. In May 1994, I went to see Pink Floyd's Division Bell tour (LD Marc Brickman, set designer Mark Fisher), featuring an astounding amount of choreographed moving lights, an array of liquid lighting looks, precision projections, and laser effects. All very impressive, but toward the end of the show, an internally illuminated 24' (7m) mirror ball rose up from where I stood at the stadium's center mix position to a height of 70' (21m), and washed the entire stadium crowd in the kind of trippy, spotted disco light that only a mirror ball can provide. I still smile when I think about it.
Also in 1994, I had the privilege to observe production rehearsals and the load-out for the Rolling Stones' Voodoo Lounge tour (LD Patrick Woodroffe, set designer Mark Fisher) in an airplane hangar in Toronto. (As I write this, the band and much of the same crew have returned to that same airplane hangar to put together the Bridges to Babylon tour, which kicked off September 23.) A few weeks later, the 25th anniversary of Woodstock concert (LD Allen Branton, set designer Tom McPhillips) took place August 12-14 in Saugerties, NY. The torrential rain, the ensuing mud and mud people, the crowds, and the general chaos barely made a dent in the production crew's ability to make every band look and sound great. Even when it seemed we might all be fried on the FOH tower/ lightning rod during the first wicked thunderstorm, not one sleep-deprived crew member lost his or her sense of humor or purpose.
All of this isn't to say that I'm not impressed with smaller shows; often it's there that surprisingly clever and subtle lighting effects work best. For instance, using only seven Light & Sound Design Icon(R) automated luminaires, Simon Sidi created lovely, evocative, and varied looks for Tori Amos' 1994 tour. He recently did the same for Sinead O'Connor, using only slightly more equipment and an excellent star backdrop made by David Perry Productions in England to great effect.
A lot of LDs tell me that they don't want the audience to consciously admire their work; I believe most of them actually mean it. They feel their job is simply to accentuate, not overwhelm, the music, so the lighting should have only a subliminal effect. I can no longer attend a concert without checking out the lighting (even when I'm not being paid to); my sense of wonder has been replaced by a strong admiration for all those who build and tear apart shows every day. I still think it's all pretty cool, and I look forward to reporting on what y'all come up with next.


text:
You people who changed all the stuff really SUCK.
Fishdom H2O: Hidden Odyssey™
12 Online
12 Online
12 Online
22 Online
79 Online
You people who changed all the stuff really SUCK.
how do you get rid of the one little box at the botton level 16 ?
Why do you care how many times some p;ays and completes your games?
I am so saddened that you demolished our fun.....made so many people unhappy. Who reads ur emails anyways??????? Do u know whaT THEY SAY???? who ever did this is over paid and should be fired!!! Lot of people unhappy... Me.....4......1 ....going to another site.....so long.....


text:
Look and feel your best with these healthy eating tips & workout strategies.
How Kesha Got in Warrior Shape
The secrets behind this star's unbelievable booty.
Secrets of Fit and Famous Celebs
Find out how top celebrities stay in shape with these workouts and healthy eating strategies.
How Troian Bellisario Got in Pretty Little Shape
Training for three months before she even got into the air, the star of Pretty Little Liars defies gravity with her intense aerial workout.
Allison Williams' Barre-Inspired Wedding Workout
Score the actress' toned physique with her favorite exercises, whether you're walking down the aisle this summer or not.
Steal Shakira's Rockin' Body Workout
The Voice judge and sexy pop singer's trainer shares the diet and training secrets that keep her in amazing shape.
Get Sculpted Arms Like Lupita Nyong'o's
Achieve slim and strong arms like the red carpet stunner with this quick and easy workout.
Amy Adams' Sexy and Energizing Sculpting Session
Leave your inhibitions at the door with this pole dancing-inspired workout that helps the star maintain her enviable body.
Steal Noureen DeWulf's Olympics-Inspired Workout
Score a stronger core, tighter butt, and toned arms and legs with this plan the actress took from her hubby, who's playing in Sochi.


text: A lot of folks cannot understand how we came to have an oil shortage. Well, here's a very simple answer. Nobody bothered to check the oil. We just did not know we were getting low. The reason for that is purely geographical. All our oil is in Alaska, Texas, Oklahoma, Wyoming, Montana, The Dakotas, California, and Gulf of Mexico. All our dipsticks are in Washington, DC.


text: Firefighters from around metro Atlanta gathered in Cobb County for the 3rd Annual Terry Farrell 9/11 Memorial Stair Climb.Sunday's climb was open to everyone for a $25 donation. Each participant was challenged to climb 24 flights of stairs at the Riverwood 100 building located on Riverwood Parkway.The climb is both a memorial to the firefighters lost in the September 11th attacks and a fundraiser for the Terry Farrell Firefighters Fund.The fund was named after a decorated member of Rescue 4 FDNY and Chief of the Dix Hills Volunteer Fire Department before he perished when the south tower of the World Trade Center collapsed. Farrell was among 343 firefighters who lost their lives in the attack.The fund goes to assist firefighters and their families with educational, medical and equipment needs. The Georgia Chapter states they have raised over $17,000.00 in financial aid to Georgia Firefighters and approximately $100,000 in surplus equipment to fire departments.For more information on the Georgia Chapter of Terry Farrell Firefighters Fund, events past and future as well as how to donate visit terryfundga.org.


text:
« back to Movies
The Book Thief
- Release Date: None
- Genres: Drama
- Cast: Geoffrey Rush, Emily Watson, Sophie Nélisse, Ben Schnetzer, Nico Liersch, Joachim Paul Assböck, Kirsten Block, Sandra Nedeleff, Ludger Bökelmann, Rafael Gareisen
- Directors: Brian Percival
- Official Site: http://www.thebookthief.com/
- Distributor: 20th Century Fox
- Based on the beloved international bestselling book, The Book Thief tells the story of Liesel, an extraordinary and courageous young girl sent to live with a foster family in World War II Germany. She learns to read with encouragement from her new family and Max, a Jewish refugee who they are hiding under the stairs. For Liesel and Max, the power of words and imagination become the only escape from the tumultuous events happening around them. This film is a life-affirming story of survival and of the resilience of the human spirit.
Show Times / Buy Tickets
There are no current showings for The Book Thief in this area.


text:
To Tatiz:
Here is the letter edited by me:
This letter is penned by (your name) with the intent to request information from (the name of the manager) on (the name of the hotel).
The rest of the letter can be the same.
- Home
- Members
- Testing
- Reference
- Articles
- Forums
- Resources
- For Teachers
- eBooks


text:
The sick Child, 1885−86
Oil on canvas, 120 x 118.5 cm
© Nasjonalmuseet / Munch-museet / Munch-Ellingsen-gruppen / BONO 2010.
Foto: Jacques Lathion / Nasjonalmuseet
A sickbed. The composition is simple, with the main motif placed centrally and in the foreground of the picture. Details are toned down to allow certain conspicuous elements to stand out: the girl's head against the white pillow, the bent neck of the woman and the point of contact between the two. The painting is generally regarded as Munch's breakthrough, demonstrating his turn towards a more personal and emotionally-charged form of expression. The picture is often associated with the loss of his elder sister, Sophie, who died of tuberculosis in 1877. Sick girls and dying children were, moreover, a popular subject for many of the more realistically-oriented painters of the period.
Munch himself described the picture as his farewell to realism. With its materiality and sketchy style it stands out from the more crystalclear, true-to-life realism that dominated among Munch's contemporaries. Thickly applied layers of paint occur alongside thin, trickling stripes, pastose brushstrokes with scratch marks and surface abrasions. Attention is drawn to the picture's physical surface and its means of production. It appears sketchy and unfinished, as if the artist had halted work in the midst of the creative process. Here Munch makes an earnest bid to become master of the "unfinished" artwork.
The work was first shown at the National Annual Autumn Exhibition in 1886, although on that occasion it bore the title Study. The painting's unconventional aspects prompted outrage and indignation, although it also attracted a degree of approval. The scandal ensured the painting's success and its enduring position as one of the best known and most discussed of Munch's works. In due course he painted no less than six versions of the motif. Initially the National Gallery acquired a later version, thanks to a bequest from Olaf Schou in 1909. But in 1931 this was exchanged for Munch's first version of the painting from 1885–86. Schou's picture is now in the Göteborg Museum of Art.


text:
A 'tweet' experiment in undergraduate course
Jill Scott incorporated what she calls "MicroWriting" – writing on social media sites – into one of her courses last term to engage students in complex material, encourage class interaction, and develop effective writing skills.
"What makes a good tweet is no different from what makes a good sentence. It's using all your words and characters well," says Dr. Scott, an associate professor in the Department of Languages, Literatures and Cultures. "You write convincingly to the extent that you are clear and concise. You just keep working with your 140 characters to hone, develop, trim, and tweak your utterance to give it the maximum expressive impact."
Students in Dr. Scott's course, Conflict in Culture: Literature, Law, and Human Rights, were required to tweet at least three times each week with a group of peers. They responded to questions about the readings, and they used it to prepare for discussions in class or share relevant links. In sum, the students posted about 3,000 tweets.
The level of student engagement impressed Dr. Scott. The on-going activity on Twitter meant that students were consistently in dialogue with each other, creating an online learning community to supplement in-class learning. Dr. Scott posted "Twitter essays" each week to initiate discussions online before the class met. Students worked in small groups during class as well, with lectures only taking up about half the class time.
Dr. Scott purposefully chose to employ Twitter and group work in her blended-learning style course. A social media platform like Twitter allows her students to exchange more information than they can in a traditional lecture course. And, working closely with each other in groups over a long period of time lets students appreciate how conflict and resolving conflict are part of their own worlds, not only concerns in different countries.
Dr. Scott's research in undergraduate pedagogy has received funding from the Centre for Teaching and Learning and a Proctor and Gamble Higher Education Grant.
Conflict in Culture: Literature, Law, and Human Rights Twitter account


text:
Great Cup Final Story From Kickback
Posted 31 May 2012 - 02:44 PM
Thousands of Jambos will be telling stories of the historic triumph against our city rivals for years to come. I always knew my personal story would be tempered somewhat by the fact that I had to catch a flight the next morning at 8am to get to a wedding, having changed my travel plans after the semi final victory — my withdrawal from the stag night was a no-brainer. But I had no idea that my story would become quite as dramatic as it did. I am now returned from the wedding, battered and bruised, and I am compelled to share this story with you.
This is my story. (This is my song).
I got a bus through to Glasgow at 10 o' clock with a most excellent band of brothers and sisters under the leadership of the mighty John S (whose management of his troops was exceptional and whose specially produced John Cumming T-shirts were worn by many with pride). Remembering my mishap at the World Cup Semi Final in 2010 where I left my ticket at a friend's house and realised upon arrival in Cape Town, I was exceptionally careful this time! (As it happens, on that occasion I had just enough time to CANE IT down the motorway and back to retrieve said ticket).
I had my SC final ticket in my in-tray at work and was checking it every day. When I left on the Friday evening I carefully placed the ticket between the pages of a book I was taking home along with my boarding pass for the Sunday flight. I must have checked my pocket on the bus 10 times or more to make sure the ticket was still there.
Rocking up to Hampden with scores of Hearts fans, I reached into my pocket for the ticket. At this point, I unfolded it ready for to hand over at the turnstile. This is when I realised what I had done. The horror that spread through every cell of my body was cold, hideous and extreme. I was looking at a used ticket for a Quantic gig a couple of weeks ago at the HMV Picture House.
I made my mate aware of this awful realisation. The colour drained from his face. It's hard to explain how I felt physically, a curious sense of displacement and dizziness had taken hold and it's fair to say I was close to tears. I went up to the first guys I saw wearing yellow hi-vis vests.
"Excuse me. Something really bad has happened."
My hands were shaking as I handed the ticket to one of them. He unfolded it and studied it, confused.
"What's your point?"
"That is supposed to be my ticket. I brought the wrong ticket."
Straight away, without me even asking: "There's nothing you can do. There isn't even a ticket office open today."
This came as no surprise. There was only twenty minutes to go before kick-off. My mate said, "There's got to be something we can do, you'll get in — somehow, you'll get in." His blind optimism was exactly that — blind. And he wasn't fooling himself any more than he was fooling me.
I had to try though, so I called my other mate who had organised the ticket purchase, in whose name and credit card number the booking was. It was a futile hope especially at the last minute that somehow I might be able to get a member of staff from the ticket offices that weren't even open to find the booking on a computer and magically issue a reprint. My mate on the phone was already inside and while he promised to try to make a couple of calls, it was clear this was an act of desperation with no chance of a successful outcome. I did the same and called a couple of other folk who also wouldn't be able to do a thing to help and went to their voicemails anyway. I wasn't getting into this game.
I repeated the conversation I had had with the security official several times with other security staff members and police. But it was quite simple. There was no way anyone could be admitted without a valid ticket, and there was no facility in operation whereby I could attempt to resolve this unfolding disaster. My mate meekly suggested I take his ticket on the spurious logic that I deserved it more having been a fan for longer than he. I rejected this magnanimous but ludicrous suggestion. The idea he reinforced that I would still get in was equally ludicrous. Really now the match was about to start and he would have to abandon me and make his way into the ground. Before he did, I took a picture of his ticket so as I would know where my seat was in the vain theory that God might intervene — perhaps someone might take pity on me at half time, perhaps if I had my mate film the empty seat as "evidence"....
Aye, right.
I simply couldn't believe what was happening. I had a ticket but it was still sitting on my desk in Edinburgh and even though my entitlement was valid, without that ticket in my actual and immediate possession, my seat in the stand would remain empty for this match and that was that.
At this point I could have admitted defeat. But in that situation you will try anything. So I tried getting in to the main stadium office to plead my case but the guys on the door wouldn't even let me speak to reception, even gave me the "We're going to have to ask you to move away now Sir...".
I kept trying, explaining my predicament to at least twenty officials around the stadium and the match had already started. Some had sympathy for me. Some tried consulting their area supervisor. None could help. I begged at the hospitality entrance. I begged with several actual turnstile operators. The best I was getting was being referred to senior staff who would then fob me off. Quite rightly. That's their job. Of course I wasn't getting in with my used HMV Picturehouse ticket. One supervisor guy told me the only chance I had was to buy a ticket from someone selling a spare, or maybe something might arise from a fan not being admitted by police for being too drunk. He said to hang around near the main entrance: that was where random tickets would "always" be on offer, only he was amazed that he hadn't seen a single tout on this day…
Then among the stragglers making their way in I saw one guy holding a ticket in the air. I ran up to him. He said, "Ticket swap?"
"Um, sure, but I really doubt you'll go for that, buddy."
He had a ticket to the Hibs end and was after swapping it for a Hearts one. My only glimmer of hope failed right then and there.
I have never felt so sickened and I was all out of options. But still I persevered and came upon yet another steward with whom I initiated the all-too-familiar routine. This guy sounded kind of Australian and seemed pretty sound. Quite a few of the officials had been sufficiently taken by my distress at least least to try to help. This guy was another who said he would direct me to one of senior stewards. But there was just something about this guy that meant I allowed one last ember of improbable optimism to glow unextinguished.
"Mate, all I need is one guy to hear me, to believe me, to understand what is this means and to think beyond the staple response — I know you shouldn't let me in, that stands to reason, but please be that guy who takes a chance and who rescues a fellow human being from an anguish he does not deserve..." Or words to that effect.
He took me to his boss and once again I explained what had happened.
This time, the guy asked me "Where are you sitting?"
Yes. Here was a hint, however small, that this might come good…
I couldn't even remember where my seat was exactly, I was in such a daze. I got my phone to show him and my efforts to call up the photo of my mate's ticket were nervous and fumbling. It took me forever and I had to reset the brightness of the screen and I struggled to zoom in on the details. I was losing it.
"Right," he said, and he walked up to one of the exit doors and banged on it.
Oh my God, I thought, he is actually going to have someone go and check that the seat is empty. Ten minutes into the game and I actually might make it inside...
Someone opened the door from inside. I squatted in prayer.
"Come on then."
He wasn't checking with a colleague. He was holding the door open for me to walk in.
I was speechless. I hugged him as I went in, delirious.
"I'm taking you at face value here."
"I swear on my life I'm not lying to you, I did have a ticket."
I stumbled in and up the steps. Mentally drained, if I'm being honest. I went and found my seat and my mate who couldn't believe I had managed to get in even though he said he had always believed… Barely had our celebratory reunion taken place when Darren Barr scored the opening goal for our celebrations to multiply and soar, joined as we were by 25,000 other Jambos in pure ecstasy.
You all know what happened over the next seventy-five minutes.
After the game I went in search of the steward who had come to my rescue. In my shattered state I had failed even to ask his name. It took me ages to track him down but I did manage to find him and I thanked him for what he had done, and took his email address. I promised him I would email him a picture of my real ticket. And I promised him I would auction it on ebay and donate the proceeds to a charity of his choice. Without hesitation he identified Breast Cancer Campaign.
Everyone has moments in their lives where they need a stranger to do them a turn, to lay rules and regulations to the side for the greater good. This gesture is something that I can do to reward this man for being the karmic conduit I was praying for in that desperate, horrible situation.
I am delighted to be offering up my perfectly intact Scottish Cup Final ticket for auction. Unfolded, unbroken, pristine:
Moreover, I have set up a JustGiving page in honour of my deliverer and to raise money for the cause of his choice. I hope that anyone who can relate to this story might see fit to make some kind of donation to a very worthwhile charity.
Thank you for your time, and 'mon the Hearts.
Running a Loch Ness Marathon for the Sunshine Appeal https://mydonate.bt..../alasdairsmith1
Posted 31 May 2012 - 02:59 PM
Posted 31 May 2012 - 03:03 PM
Posted 31 May 2012 - 03:04 PM
Posted 31 May 2012 - 03:06 PM
- "On 18th September 2014 between the hours of 7am and 10pm, absolute sovereign power will lie in the hands of the Scottish people." J Sillars 2014
Posted 31 May 2012 - 03:31 PM
Before you start bidding I think it's best to make sure it's not Irvine Jambo again!
very good
Running a Loch Ness Marathon for the Sunshine Appeal https://mydonate.bt..../alasdairsmith1
Posted 31 May 2012 - 06:01 PM
Edited by Squirrelhumper, 31 May 2012 - 06:04 PM.


text:
In television and print interviews, Professor David Reiss commented on today's ruling to allow the public to buy shares in the Empire State Building. The court rejected arguments by a small group of current investors that the initial public offering of stock would violate state law. "This represents a kind of watershed moment for the case," Professor Reiss said. The IPO is expected to raise $1 billion for a new company called Empire State Trust Inc.
Read the Bloomberg article.
Watch the Fox Business interview.
Read the latest issue of BLS LawNotes
"Brooklaw," the BLS Seal, and Logo are service marks of Brooklyn Law School. Contents Copyright © 1995-2013 Brooklyn Law School. All rights reserved.


text:
Deep in Polk County's Green Swamp, Ringling's Center for Elephant Conservation has something to celebrate.
Baby "Mike" was just born to his mom Angelica.
When they are born, males usually weigh in at about 350 pounds. Mike arrived early and weighed about 214 pounds.
None of that seems to be slowing him down. At just one month old now, he is exploring the world around him and mimicking whatever his mom does.
Mike will probably stay at the center for elephant conservation to father his own babies one day.
Click on the player to see Ken Suarez's full report.
4739 NW 53rd Avenue, Sutie BGainesville, FL 32653
Phone: (352) 371-0051


text:
Posts categorized "NFL"
It's Mad I tell you...by Jason Miller
It is estimated by the Fantasy Sports Trade Association that 32 million people aged twelve and above in the US and Canada played fan...Read More »
Packers/Niners, the Aftermath.by Jon Henseler
I don't know who else was catatonically watching the Fox Sports wrap up after the Packers allowed a three man rush to crush A-Rod t...Read More »
A QB by Any Other Nameby Robb Reel
After Peyton Manning's historic performance to open the NFL season Thursday night, the Columbus Dispatch was slightly less accurate ...Read More »
Thank you Tom Bradyby Jason Miller
First let me point out that I need Tom Brady to be as good as ever this year as he is on my Fantasy Football team. But even more th...Read More »
New Aaron Rodgers State Farm Commercial is Awesomeby Jon Henseler
First of all, take a gander at the headline I wrote for this puppy! Looks like Mom is going to have to make space between my bowli...Read More »
NFL History On Opening Nightby Tom King
Pro football in 1969 was not the spectacle it is today. No NFL Network. No 24-7 internet and blogosphere dissecting every minute d...Read More »
Fantasy Football best thing to ever happen to NFLby Chris Schulte
I come into the office this morning and I hear all this chatter about last night's 49-27 Denver win over Baltimore in the NFL seaso...Read More »
My Favorite Catch Phrasesby Craig Mattick
I've always marveled at some of the best announcer's catch phrases. I would say a large number of announcers try too hard to come u...Read More »


text:
Which, if any, late-inning units topped the Bullpen Mafia?
No portion of a Major League Baseball team's roster experiences more in the way of volatility than a bullpen. One year you think you have it perfect, the next, the same guys look like they don't belong in the same roles. Sometimes its injury; sometimes its just plain ineffectiveness. But year to year, the ultimate success rate of a bullpen is close to impossible to predict.


text:
Quick Links
Mona Tolbert
(713) 292-0361
Girl Scout Ambassador Speaks at Texas Women's Conference
Sixteen-year-old Oliver Foundation teen board member to address obesity in children
HOUSTON, Texas (November 9, 2010) – More than 7,000 women will descend on the streets of downtown Houston looking for networking, professional development and personal growth opportunities at this year's Texas Women's Conference taking place at the George R. Brown Convention Center November 10. Sixteen-year-old Girl Scout Ambassador, Nina Distefano, will also be attending the Texas Women's Conference, but she'll be imparting her wisdom as a guest speaker, addressing the importance of a healthy diet and providing solutions for childhood obesity.
"I'm trying to make a difference in the world and help address unhealthy eating that has lead to a high rate of obesity in our generation," said Nina. "At the conference I will be talking about the importance of breakfast and how proper nutrition helps students be better prepared in the classroom."
Currently, Nina sits on the Teen Board of the Oliver Foundation, a non-profit organization whose mission is to create effective partnerships, provide resources, and help develop sustainable family, community, and program practices that focus on a balanced, healthy lifestyle. As a Teen Board member Nina helps to energize kids and teens to be more health conscious through community and school outreach projects that encourage lifelong healthy eating and physical activity habits. She has been involved with the organization since she was in the eighth grade. Nina was asked by Debbie Woehler, executive director of the Oliver Foundation, if she and a fellow Teen Board member were interested in speaking at the conference. She happily accepted.
Nina credits her Girl Scout experience with helping her break out of her shell and acquiring a passion with a purpose.
"I was very shy and Girl Scouts forced me to active in the world around me," said Nina. "By getting the work done to achieve patches and learning about different issues being faced and causes I can fight for. I learned that I can make a difference by developing fresh ideas that could possibly solve some of these problems."
Girl Scouts of the USA is the world's preeminent organization for girls, with a membership of more than 3.5 million girls and adults. Girl Scouting builds girls of courage, confidence, and character, who make the world a better place. Chartered by GSUSA to provide Girl Scouting locally, Girl Scouts of San Jacinto Council is one of the largest Girl Scout councils in the country serving more than 72,000 girl members and 18,000 adults in 26 southeast Texas counties. For more information call 1-800-392-4340 or visit www.gssjc.org.
GSSJC | Communications Department
3110 Southwest Freeway Houston, TX 77098


text:
In Chicago midfields, Hemon discovers transcendental soccer nation
Hemon does not use the word "obsession" to describe his connection to football. But he is clearly an engaged mystic, delighting in the vision of a park player from Tibet minding goal during a thunderstorm: "The ground is giving off vapour, the mist touching their ankles, and at moments it seems that they're levitating a few inches above the ground, untouched by the flood."
In the Nov 12 interview, conducted before the two-leg World Cup qualifying playoff between Bosnia-Herzegovina and Portugal, we discuss Hemon's evolving regard for the team coached by Miroslav Blazevic. Before the 0–2 aggregate loss, Hemon sounds edgy about the fever gripping fans back home. For his friends abroad, he says, "Everything depends on the Bosnia match. That is the only good thing happening in Bosnia. There might be too much expectation for them there. If they go to the World Cup, then it will seem that we are all right, then the country is all right. It will allow for a lot of national fantasizing. Everyone is speaking about it. It's the most important thing that has happened in Bosnia since the war, by far."
But we start by talking about the soccer culture of the Sarajevo from youth and, in particular, about Hemon's memory of matches on the streets. Hemon never competed within a league structure. Soccer's everyday quality resonates within detail from the recent story collection, Love and Obstacles. Hemon conjures the "heartbreakingly green" pitch at the club he grew up supporting, FK Zeljeznicar. The stadium in the Grbavica section stood on the front line of war. According to Jonathan Wilson in Behind the Curtain: Travels in Eastern European Football, players and club officials had to clear the pitch of mines when the Sarajevo siege finally lifted.
In "The Conductor," Hemon positions the narrator in sight of boys trying to retrieve a soccer ball trapped in a Miljacka River whirlpool. He thinks of "a device I had used once upon a time on my own lost ball: a crate is strung on a rope that stretches from bank to bank, and boys on either bank hold the ends of the rope, manipulating it until the ball is caught."
In one sentence, Hemon conveys a vital anthropological snippet that speaks to transmission of culture—the ball-retrieval technique has been passed from one generation to the next—to cooperation between fellows and to the value of a totemic object, the ball, that permits social interaction.
Hemon saw many balls swirling in such Miljacka River pools. He competed on a Sarajevo playground that featured a slide near one of the goals. The following transcript picks up with this recollection.
Interview with Aleksandar Hemon, 12 November 2009
AH: If you were running toward the goal and wanted to score you had to duck and go under the slide. And all those who had not grown up in that particular neighborhood playing on the playground would get hurt. In school there were no school teams. There were no coaches, few school tournaments.
GG: Was this a good soccer education? Were there good players?
AH: There were particular kind of players—players who are very skillful with the ball, much like Brazilian players. Any Brazilian players who grew up playing on the beach and juggling the ball have this tremendous talent. The great players need to enter a system where their talent is converted into something lasting. There were some good players in the former Yugoslavia who entered the academies of larger clubs, and they were trained well.
In some ways it's like chess. You can be talented at playing chess, but at some point you hit this ceiling. You cannot outsmart yourself unless you start studying the games or practicing and playing against the great players. I suppose I never entered that next level.
GG: [Eduardo] Galeano says as a youth player he aspired to make words do what he could not do with the ball. Did you have that experience or did you have other aspirations of being a footballer?
Page 2 of 7 | Previous page | Next page