text:
Systems and methods for securing the content integrity of and access to object data and code in a distributed system. Content protecting URLs provide a mechanism for checking code or data transmitted out-of-band. Dynamic permission grants are supported during program execution for code or users unknown prior to runtime.
1. A method comprising:
making a remote call to an object in a distributed system, the object comprising object code and object data, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL in-band;
downloading the object, the download of the object being split into: an in-band download of the object data and an out-of-band download of the object code using the code base URL; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method according to
7. The method according to
8. The method according to
9. The method according to
10. A method comprising:
making a remote call to an object in a distributed system, wherein the object is split into object code and object data, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL, wherein the code base URL is downloaded in-band;
downloading the object code, wherein the object code is downloaded out-of-band; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.
11. The method of
12. A computer-readable medium containing instructions to perform a method in a distributed system, the method comprising:
making a remote call from a client to an object in a distributed system, the object comprising object data and object code, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL in-band;
downloading the object, the download of the object being split into:
an in-band download of the object data and an out-of-band download of the object code using the code base URL; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.
The present invention relates generally to systems and methods for providing security for code and resources available in a distributed network.
Security is a fundamental issue in network communications, particularly where it involves the sharing of resources over the network. In a distributed system, resources (e.g., hardware resources such as printers, data resources such as files, and software resources such as applications) located at remote computers communicate and coordinate their actions by passing messages. Examples of such distributed systems include: the Internet; an intranet (a portion of the Internet managed by an organization); and a mobile computing network.
Security may encompass a desire to guarantee the privacy, integrity and/or availability of resources in a distributed system. Cryptography provides a basis for authentication of messages, as well as their secrecy and integrity. Cryptography is implemented through a security protocol, the protocol defining the cryptographic algorithms used, and the management of keys. Public-key cryptography makes it easy to distribute cryptographic keys, but its performance may be inadequate for the encryption of bulk data. Secret-key cryptography is more suitable for bulk encryption tasks. Hybrid protocols, such as Secure Sockets Layer (SSL), establish a secure channel by public key cryptography and then use the secure channel to exchange secret keys for use in subsequent data exchanges.
Some programming languages enable programs (executable code) to be loaded into a local process from a remote server and then executed locally; the transferred code generally being referred to as "mobile code." In such cases, the internal interfaces and objects within the local process are exposed to attack by the mobile code.
Java™ is perhaps the most widely used language of this type. The Java Virtual Machine (JVM) is designed with mobile code in view. It gives each application its own environment in which to run. Each environment has a security manager that determines which resources are available to the application. For example, the security manager might prevent an application from reading and writing files, or give it limited access to a network connection.
Java applets are a well-known and widely-used example of mobile code. A user, running a browser, selects a link to an applet whose code is stored on a web server. The code is downloaded to the browser and runs on the browser locally to provide, for example, a better interactive response—i.e., one that does not suffer from the delays and variability of bandwidth associated with network communications.
When a user runs a program (such as a browser) that downloads mobile code (e.g., a Java applet) to be run locally on its behalf, the user has no good reason to trust the code to behave in a responsible manner. In fact, there is a danger that the downloaded code will be "malicious code" that removes files or accesses private information. To protect users against untrusted code, most browsers specify that applets cannot access local files, printers, or network sockets. Some users of applications of mobile code are able to assume various levels of trust in downloaded code. In such cases, the security managers are configured to provide more access to local resources. For example, after receiving code from a designated "trusted source", the code may be allowed greater access to local resources.
In object-oriented distributed systems, there are many types of objects to which access control must be applied, and the decisions are often application specific. A "protection domain" is generally described as a domain that specifies the resources that can be accessed by processes executing within the domain and specifies the operations permitted on each resource. A protection domain in one implementation of an object-oriented system groups together a set of classes which are granted the same set of permissions. The protection domain is associated with a class loader from which the classes are loaded, a code source indicating the location from which the classes are loaded, and a (possibly empty) set of principals representing aspects of the identity of the entity (e.g., user) which is executing the code belonging to the classes. A given protection domain is mapped by a security policy to the set of permissions granted to classes belonging to that protection domain; the permissions themselves designate privileged resources or actions that can be accessed or exercised by parties granted the permissions.
The protection of Java programs that include mobile code is based upon the protection domain concept—local code and downloaded code may be provided with different protection domains in which to execute. There can be a protection domain for each downloaded source, with access rights for different sets of local resources, depending upon the level of trust that is placed in the downloaded code.
In an ideal world, communication would always be between mutually trusting processes and secure channels would always be used. There are many reasons why this ideal is not attainable. There is overhead (cost) associated with security procedures. Access to internal networks may be controlled by firewalls (firewalls produce a local communication environment in which all external communication is intercepted). But firewalls offer no protection against attacks from inside an organization. Finally, access to services on the Internet must be unrestricted, because the goal is to offer services to a wide range of users. Thus, security issues are simply inherent in the open nature of many distributed systems.
Systems and methods consistent with the present invention, described herein by various implementations, provide for content integrity of code downloaded out-of-band.
According to one implementation, a method is provided which includes downloading in-band, for a remote call in a distributed system, data of an object and a code base URL for code of the object. The method further includes downloading the code out-of-band using the code base URL to ensure content integrity of the code. The downloaded data and code may be for transfer of an object in a remote method invocation. The method may further include, prior to using the code base URL, confirming that the code base URL is a content integrity protecting URL. In using the code base URL to ensure content integrity, the method may employ a protocol identified in the URL, or a message digest included in the URL.
In another implementation, a method is provided which includes receiving in-band in a distributed system a code base URL for code of an object, and determining whether the code base URL is a content integrity protecting URL.
In another implementation, a distributed system is provided which includes a server computer, including a memory with a service program and a processor that runs the service program, and a client computer, including a memory with a client program and a processor that runs the client program. A secure channel, between the server computer and the client computer, provides content integrity for transmission of data (of an object) and a code base URL (for code of the object). A program is provided which includes a method using the code base URL to ensure content integrity while transmitting the code on another channel between the server computer and the client computer.
In another implementation, a computer-readable medium is provided containing instructions to perform a method in a distributed system. The method includes downloading in-band, from a server to a client in a distributed system, data of an object and a code base URL for code of the object, and downloading the code out-of-band to the client using the code base URL to ensure content integrity of the code.
In another implementation, a computer-readable medium containing instructions for verifying use of a content integrity protecting URL is provided, the method including testing every URL in a code base URL to confirm that every such URL provides content integrity.
In another implementation, a method is provided including transmitting on a secure channel, from a sender to a receiver in a distributed system, data of an object and a code base URL for code of the object. The code is transmitted on another channel to the receiver while using the code base URL to determine content integrity of the transmitted code.
In another implementation, an apparatus is provided which includes means for transmitting on a secure channel, from a sender to a receiver in a distributed system, data of an object and a code base URL for code of the object. The apparatus further includes means for transmitting the code on another channel to the receiver while using the code base URL to determine content integrity of the transmitted code.
Other systems and methods are described herein, by various implementations consistent with other aspects of the present invention, in which a URL is provided that includes a cryptographic checksum for use in providing content integrity for out-of-band data.
According to one implementation, a method is provided which includes transmitting a URL on a channel that provides content integrity of the URL, the URL including a location from which data should be retrieved and a cryptographic checksum of the data. The method further includes using the URL to retrieve the data and confirming the integrity of the data with the cryptographic checksum. The cryptographic checksum may comprise a message digest. The location of the data may be a non-secure HTTP server. The non-secure HTTP server may fail to provide at least one of authentication and content integrity.
In another implementation, an apparatus is provided which includes means for transmitting a URL on a channel that provides content integrity of the URL, the URL including a location from which data should be retrieved and a cryptographic checksum of the data. Also included is a means for using the URL to retrieve the data and confirming the integrity of the data with the cryptographic checksum.
In another implementation, a computer-readable medium contains instructions for performing a method, including the above described transmitting and using steps.
In another implementation, a content integrity protecting URL is provided which specifies a location from which data should be retrieved and a cryptographic checksum of the data.
Still further, systems and methods are described herein, by various implementations consistent with other aspects of the invention, which provide for dynamic granting at runtime of permissions.
According to one implementation, a method is provided including dynamic granting at runtime of a set of permissions allowed for currently executing code in a protection domain, based on a specified combination of class loader and principal(s). The method may further include permission checking of the dynamically granted set of permissions for a specified combination of protection domain and permission. The method may further include permission checking of statically granted permissions. The protection domain may identify one or more of a source of the executing code, a signer of the executing code, a subject of the executing code, and the class loader of the executing code.
In another implementation, a computer-readable medium is provided containing instructions for performing the above described method.
In another implementation, a dynamic security policy object is provided including a set of permission mappings which include dynamically granted permissions allowed for currently executing code.
In one implementation, a computer-readable medium is provided containing instructions to perform a method, the method including dynamically granting at runtime a set of permissions to class loader objects unknown prior to runtime.
In other implementations, a computer-readable medium contains instructions to perform a method, the method including dynamically granting at runtime a set of permissions to class loader objects for subjects and/or code unknown prior to runtime.
In another implementation, an apparatus is provided which includes means for dynamically granting at runtime a set of permissions allowed for currently executing code in a protection domain, based on a specified combination of class loader and principal(s). The apparatus further includes means for permission checking of the dynamically granted set of permissions for a specified combination of protection domain and permission.
Various implementations consistent with the present invention will now be described. These are by way of example only, and not limiting. In some of these examples, the World Wide Web functions as the distributed system. A background summary of certain relevant features of the Web will be provided as context for the described implementations.
the Web as an Exemplary Distributed System
The World Wide Web (www.w3.org) is an evolving system for publishing and accessing resources and services across the Internet. It is a type of distributed system that can be constructed in the form of interacting clients and servers. The term "server" refers to a running program (a process) on a network computer that accepts requests from programs running on other computers to perform a service and respond appropriately. The requesting processes are referred to as clients. A "client" invokes an operation upon the server by sending the request (a message) for the operation to be carried out. A reply message is sent from the server to the client. A complete interaction between the client and the server is called a remote invocation.
The same process may be both a client and a server, and thus the terms "client" and "server" apply only to the roles played in a single request.
An executing web browser is an example of a client. The web browser communicates with a web server to request web pages from it.
The Web is open with respect to the types of "resources" that can be published and shared on it. In its simplest form, a resource (on the Web) is a web page or some other type of content that can be stored in a file and presented to the user; examples of such resources include program files, media files, and documents in PostScript or Portable Document Format.
However, the Web has moved beyond simple data resources to encompass services, such as electronic purchasing of goods. Some web services require some service-related code to run inside the browser, at the user's computer. For example, an applet is an application that the browser automatically downloads and runs when it fetches a corresponding web page.
Accessing Resources on the Web
Three main components for accessing resources on the Web are:
For example, HTML text for specifying a web page is stored in a file that a web server can access. A web browser retrieves the contents of this file from the web server, reads the contents returned by the server, and renders it into formatted text and images laid out on a web page. It is the browser, not the server, that interprets the HTML text.
HTML commands, known as tags, are enclosed by angle brackets. For example, the URL contained in an <A HREF . . . > tag specifies a link in a web page. The following example is taken from "Distributed Systems, Concepts and Design," S. Coulouris et al., p. 10, Addison-Wesley 2001:
The purpose of a uniform resource locator (URL) is to identify the location of a resource. On the Web, a user sometimes types a URL into a browser, but more commonly the browser looks up the corresponding URL when a,user clicks on a link, or when the browser fetches a resource embedded in a web page.
A full URL has two top-level components:
HTTP URLs are the most widely used for fetching resources using the standard HTTP protocol. An HTTP URL has two main functions: to identify which web server maintains the resource, and to identify which of the resources at that server is required. In general, HTTP URLs are in the following form:
HTTP is a "request-reply" type of protocol. A client sends a request message to the server containing the URL of the required resource. The server looks up the path name (designated in the URL) of the file and, if it exists, sends back the file's contents in a reply message to the client. The server includes the content type in the reply message so that the browser will know how to process it. The string that denotes the content type is called a MIME type; they are standardized in RFC 1521. For example, if the content is of type "text/html", the browser will interpret the text as HTML and display it. If the content is of type "image/GIF," then the browser will render the contents as an image in GIF format.
Transmitting Messages on the Internet
TCP/IP is the protocol suite used by the Internet. TCP stands for Transmission Control Protocol, and IP for Internet Protocol.
IP datagrams provide the basic transmission mechanism for the Internet and other other TCP/IP networks. Above the IP datagram layer there are two transport protocols: TCP is a reliable connection-oriented protocol, and UDP is a datagram protocol that does not guarantee reliable transmission. Above the transport layer, one or more application layers are provided in which messages are sent as UDP packets or TCP streams.
For example, HTTP requests and replies are usually transported by the direct use of TCP. However, when end-to-end security is required, a Secure Sockets Layer (SSL) protocol is layered on top of TCP to produce a secure channel, and the HTTP messages are then transmitted via the secure channel.
The IP layer (bottom layer in
TCP and UDP, as transport protocols, provide process-to-process communication. This is accomplished by the use of ports. Port numbers are used for addressing messages to processes within a particular computer. Once an IP packet has been delivered to a destination host, the TCP or UDP layer software dispatches it to the desired process via a specific port at that host.
The application program interface (API) to UDP provides a message passing abstraction for inter-process communication. This enables a sending process to transmit a single message to a receiving process. The independent packets containing these messages are called datagrams. In Java and Unix APIs, the sender specifies the destination process using a socket—an indirect reference to a particular port used by the destination process at the destination computer.
The application program interface to TCP is an abstraction of a two-way stream between pairs of processes. The information communicated consists of a stream of data items with no message boundaries.
Both forms of communication, UDP and TCP, use the socket abstraction, which provides an end point for communication between processes. Interprocess communication consisting of transmitting a message between a socket in one process and a socket in another process, is illustrated in
Remote Procedure Calls and Remote Method Invocation
Distributed applications, composed of cooperating programs running in several different processes, need to be able to invoke operations in other processes, often running in different computers. To achieve this, the conventional (local) procedure call model is extended to the remote procedure call (RPC) model, which allows client programs to call procedures in server programs running in separate processes and generally on different computers (from the client). Further, where an object-based programming model is used, the procedure call model is extended to allow objects in different processes to communicate with one another by means of remote method invocation (RMI). RMI is an extension of local method invocation that allows an object living in one process to invoke the methods of an object living in another process. These RMI and RPC "middleware" layers exist, as illustrated in
An object-oriented program, for example in Java or C++, consists of a collection of interacting objects, each of which consists of a set of data and a set of methods. An object communicates with other objects by invoking their methods, generally passing arguments and receiving results. Objects are said to encapsulate the data and the code of their methods.
In the distributed object model, a remote interface specifies the methods of an object that are available for invocation by objects in other processes. These methods and remote interfaces can pass objects as arguments and as results of methods. In addition, references to remote objects may also be passed.
The request and reply messages of RPC and RMI provide fields enabling authentication information to be passed between client and server. For example, the request message may contain the credentials of the user running the client program. Access control mechanisms can be built on top of the authentication information which is provided to the server. The server program is responsible for enforcing access control by deciding whether to execute each procedure call or remote method invocation according to the authentication information. For example, if the server is a file server, it can check whether the user has sufficient rights to carry out a requested file operation. Several different authentication protocols can be supported, such as a shared key for the signing of RPC or RMI messages, or a Kerberos style of authentication. A field in the RPC or RMI header may indicate which style is being used.
Providing Object Integrity by the use of Integrity-Protecting URLs
In communication systems that provide network security, integrity of in-band data is often provided by use of a Message Authentication Code (MAC). However, when using Java™ Remote Method Invocation (RMI) or Jini™ Technology, the contents of a remote call generally consists of objects, not just data. Thus, what is transmitted is not only the data representation of objects, but also the executable code for the classes that interpret and manipulate that data. When transmitting objects, it is desirable to maintain the integrity of both the data and the code. Good data may be useless if it is manipulated by corrupted code, and good code may be useless if it is manipulating corrupted data.
Systems and methods according to one implementation of the present invention provide for content integrity of both object data and code. The data and a code base URL are transmitted in-band as part of a remote call. While the executable code is downloaded out-of-band, the code base URL, that is transmitted in-band, is used to confirm content integrity of the downloaded code. As a result, the integrity of both out-of-band code as well as in-band data are preserved.
In this implementation object integrity can be maintained by using an existing data integrity mechanism for in-band data, coupled with code base URLs that provide content integrity for out-of-band downloaded code. Because the URLs themselves are sent as part of the in-band data, the integrity of the URLs is maintained. When the URLs are then used to download the associated code, either the URL protocols that are employed or the contents of the URL are used to ensure the integrity of the downloaded code. The combined result is complete object integrity, of both data and code.
The expansion from data integrity to object integrity may apply to objects sent in either or both directions during a remote call, e.g., arguments to the remote calls sent from client to server, and any returned value or exception sent from the server to the client.
As with data integrity, it is the recipient of an object that confirms code integrity. Thus, the recipient will confirm that integrity-protected URLs are in fact being used for any code that is downloaded. Note, the recipient need not require integrity protecting URLs for code that is resolved locally.
In this implementation, where an out-of-band communication is used to download code, the integrity protecting URLs may either:
The following are three examples of integrity-protecting URLs.
A first example is referred to as a HTTPS URL, which protects integrity by utilizing a TLS/SSL cipher suite to provide server authentication and data integrity. This is an example of a URL that contains sufficient information to authenticate the origin of the content, namely, the host name, and uses sufficient means to maintain content integrity in transit (namely, a MAC).
A second example of an integrity-protecting URL is referred to as a HTTPMD URL. In this case the URL itself contains a message digest (MD) value. As the content (code) is downloaded, a digest is computed based on the received content, and compared with the URL (expected) digest value. This is an example of a URL that contains sufficient information to independently verify integrity after the content is downloaded.
A third example of an integrity-protecting URL is a FILE URL that does not reference a remote host. In other words, the host component is null, empty, "localhost", or "˜", provided either the local operating system is not configured to mount remote file systems, or the underlying remote file system protocols used provide adequate data integrity and authentication of the remote hosts. In this case, the assumption is that local file systems have sufficient integrity such that no additional verification is required.
Rather than mandating which URLs provide content integrity, a pluggable framework can be used to determine if all of the URLs in a code base provide content integrity. A set of integrity verifiers can be configured into the framework using resource settings. An integrity verifier takes a URL and returns a Boolean result, where a "true" result means the verifier confirms that use of the URL will maintain content integrity, while a "false" result means the verifier cannot confirm integrity. A URL is confirmed to maintain content integrity if at least one verifier returns true.
In step 205, the integrity-protecting URL may be, for example, any one of HTTPS, HTTPMD, or local file as previously described.
An HTTPMD URL can be used in an alternative implementation, illustrated in
The HTTPS URL scheme is used in web browsers to ensure the integrity of electronic commerce transactions. In this scheme, the integrity of the data supplied is guaranteed by the fact that the server supplying the data has been authenticated and is trusted by the client receiving the data. Once that trust relationship is in place, the underlying TLS protocol ensures that the data's contents are not tampered with.
In contrast, the HTTPMD URL scheme does not require the server to provide authentication or guarantee integrity. Once the client has received an HTTPMD URL from a trusted source, it can use the URL to download associated data and verify for itself whether that data is valid.
HTTPMD URLs may be used with a standard HTTP server. Unlike HTTPS URLs, clients are not required to know whether a particular HTTPS server is trusted. In addition, the HTTP server does not need to be configured with information that would permit it to authenticate itself. This simplification of deployment distinguishes the HTTPMD scheme from the HTTPS scheme for guaranteeing the integrity of out-of-band data. According to this implementation, HTTPMD URLs have a syntax similar to that of HTTP URLs, but include a message digest as the last parameter stored in the last segment of the path. The parameter is introduced by a semicolon (';'),and includes the name of the message digest algorithm, an equals sign ('='), the message digest represented as a hexadecimal number, and an optional comment introduced by a comma (','). In addition, a comment by itself may be specified in a relative HTTPMD URL. For example: httpmd://www.sun.com/index.html;md5=7be207c7111e459eeea1c9b3d04f1667
As indicated, the HTTPS URL scheme depends on establishing a trust relationship with the server supplying the data. It is documented in RFC 2818, HTTP over TLS, which is available at: http://www.ietf.org/rfc/rfc2818.txt. The Transport Layer Security (TLS) protocol is documented in RFC 2246 and available at http://www.ietf.org/rfc/rfc2246.txt. The SSL protocol, utilized with the HTTPS URL in the previously described implementation, will now be described in greater detail.
The SSL Protocol
The Secure Socket Layer (SSL) protocol was originally developed by Netscape Corporation. An extended version of SSL has been adopted as an Internet standard under the name Transport Layer Security (TLS) protocol, described in RFC 2246. SSL is now integrated in most web browsers and web servers, and is also used in other applications, such as secure Telnet and FTP. Commercial and public-domain implementations are available in the form of libraries and browser plugins [www.rsasecurity.com, www.openssl.org].
SSL is a hybrid encryption scheme with authentication and key exchange based on public keys. Because the ciphers are negotiated in a handshake, it does not depend upon the availability of any particular algorithms. Nor does it depend upon any secure services at the start of session establishment. The only requirement is for public-key certificates to be issued by an authority that is recognized by both parties.
The main features of SSL are (taken from Coulouris, p. 299):
SSL consists of two layers sitting above the TCP/IP layers. A SSL record protocol layer implements a secure channel, encrypting and authenticating messages transmitted through any connection-oriented protocol. A SSL handshake layer implements the SSL handshake protocol and other related protocols that establish and maintain an SSL session (that is, a secure channel) between a client and server. Both layers are usually implemented by software libraries at the application level in the client and the server.
The SSL record protocol is a session-level layer. It can be used to transport application level data transparently between a pair of processes while guaranteeing its secrecy, integrity and authenticity. The communicating partners can choose whether or not to employ encryption and authentication of messages in each direction. Each secure session is given an identifier, and each partner can store session identifiers in a cache for subsequent re-use, avoiding the overhead of establishing a new session when another secure session with the same partner is required.
The SSL handshake protocol is performed over an existing connection. It begins in the clear and it establishes an SSL session by exchanging the agreed options and parameters needed to perform encryption and authentication. The handshake sequence varies depending upon whether client and server authentication are required. The handshake protocol may also be invoked at a later time to change the specification of a secured channel. For example, communication may begin using message authentication codes only. At a later point, encryption may be added. This is achieved by performing the handshake protocol again to negotiate a new cipher specification using the existing channel.
Dynamic Security Policy
The Java 2 Platform security architecture provides mechanisms for enforcing fine-grained access control in a flexible and easily configurable manner. See http://Java.sun.com/j2se/1.4/docs/guide/security/index.html for general information on the Java 2 Platform Security Architecture. In it, permission objects are granted to trusted code and/or subjects, e.g., entities representing users or groups, to enable them access to private or security-sensitive resources and operations. At the core of this system is the security policy—a Java object responsible for tracking granted permissions, and using this information to decide which security checks should pass and which should fail. The default security policy provider bundled with the Java 2 Platform assigns permissions based on the contents of a text policy file; it supports permission grants to code loaded from specific code sources, to signed code, and to principals (derived from subjects). These determinants are all static in nature—in other words, they can (and must) be specified before the program to which they apply is run, they do not change while the program executes (unless the policy provider is "refreshed", in which case it rereads the policy file), and they do not depend on objects known only at runtime. For example, an application may be run with the default policy provider configured to grant certain permissions to all code signed by company Foo; this is straightforward since company Foo is known in advance and can be easily specified in the policy file.
These static grants may be insufficient, however, when dealing with more dynamic interactions where the recipients or conditions of grants may not be known until runtime. An application may need to grant permissions to code which it has just downloaded, but can identify only via an object instantiated from it, or to a previously unknown user contacting the application from a remote machine. What is required in this case is the ability to grant permissions, at runtime, to entities or code known only at runtime.
An implementation of a dynamic security policy, consistent with systems and methods of the present invention, is now described which supports dynamic permission grants during program execution. It allows grants to for example, Java class loader objects—i.e., grants which affect all classes loaded from designated class loader instances. It also allows grants to dynamically determined subject principals—e.g., those of the currently executing subject, or ones returned by a method call. Finally, since the grants occur at runtime, the granted permissions themselves may be determined dynamically.
Before describing this implementation, the following background information on the Java 2 security architecture is provided.
Java Security Mechanisms
Security mechanisms are an integral part of the Java programming language. A Java programming language compiler converts source code into the machine language of a hypothetical machine called the "virtual machine". The virtual machine code is stored in a class file with a class extension. Class files contain the codes for all methods of one class. The class files need to be interpreted by a program that can translate the instruction set of the virtual machine into the machine language of the target machine. See Core Java, vol. 2, chap. 9, p. 702, C. Horstmann et al., Sun Microsystems Press, 2000.
The virtual machine interpreter loads only those classes that a particular program requires, along with the system classes (e.g., from a JAR file). To provide more control over the class loading process, a customized class loader can be provided to load application classes. For example, the applet class loader knows how to load class files across a network and how to authenticate signed JAR files.
When a class loader presents the bytecodes of a newly loaded Java platform class to the virtual machine, the bytecodes are first inspected by a "verifier". The verifier checks to make sure the instructions of the bytecodes cannot perform damaging actions as a result of, e.g., maliciously altered class files.
Once a class has been loaded into the virtual machine by a class loader or by the default class loading mechanism and checked by the verifier, a third security mechanism of the Java platform comes into action: the "security manager". A security manager is a class that controls whether a specific operation is permitted, e.g., whether the current thread can read from or write to specified files. The default behavior while running Java applications is that no security manager is installed, i.e., no operations are prohibited. On the other hand, the appletviewer immediately installs a security manager (called AppletSecurity) that is quite restrictive.
The default security manager of the Java 2 platform allows both programmers and system administrators fine-grained control over individual security permissions by using a security policy to determine when permission checks should succeed or fail. These permissions are controlled with "policy files" as described below.
In the Java 2 platform, a "security policy" maps protection domains to permission sets. Each protection domain groups together a set of classes which are granted the same set of permissions. It is associated with a class loader from which the classes are loaded, a code source indicating the location from which the classes are loaded, and a (possibly empty) set of principals representing aspects of the identity of the entity (e.g., user) which is executing the code belonging to the classes.
A "permission" is any property that is checked by a security manager. The Java 2 platform supports a number of permission classes, each of which encapsulates the details of a particular permission. The default implementation of the Policy class reads permissions from a "policy file".
The Java 2 platform provides a "standard model" of how to carry out permission checks. The standard model relies on two classes:
The standard model relies on a Policy object that consults the code source and principals of a protection domain in determining the set of permissions to which it maps.
In the standard model, the permission collection is entirely dependent on the code source and principals. The protection domain is set when the SecureClassLoader loads the class. The SecureClassLoader queries the current policy for the permissions that match the code source. It then creates a ProtectionDomain object with the given code source and permissions. Finally, it passes that object to the defineClass method. By way of illustration,
When the SecurityManager needs to check a permission, it looks at the classes of all methods currently on the call stack. It then gets the protection domains of all classes and asks each protection domain if its permission collection allows the operation that is currently being checked. If all domains agree, then the check passes. Otherwise, an exception is thrown.
The standard policy reads policy files that contain instructions for mapping code sources to permissions. A "policy file" contains a sequence of grant entries. Each entry has the following form:
The code source contains a code base (which can be omitted if the entry applies to code from all sources) and the names of trusted certificate signers (which can be omitted if signatures are not required for this entry). The code base is specified as:
The "permissions" have the following structure:
One of the important uses of authentication technology is signing executable programs (Core Java, vol. 2, p. 772). If a program is downloaded, the recipient will want to know where the code comes from and that it has not been tampered with since it left its origin. If the program was written in the Java programming language, then a decision can be made about what privileges the recipient will allow the program to have. Thus, the recipient first uses authentication to verify where the code came from. Then, the recipient runs the code with a security policy that enforces the permissions that the recipient wants to grant the program, depending on its origin. The java.security package enables one to assign different levels of security, depending upon where the code originated. For example, if an applet comes from a trusted supplier and it has not been tampered with, the user of that applet can then decide to give the applet more privileges.
There are many algorithms for ensuring the integrity of data and for electronic signatures. The java.security package contains implementations of many of these algorithms. A message digest can be used to detect changes in data files, while digital signatures can prove the identity of the signer.
A message digest is a digital fingerprint of a block of data (Core Java, vol. 2, pp. 744-745). For example, the SHA1 (secure hash algorithm #1) condenses any data block, no matter how long, into a sequence of 160 bits (20 bytes). The likelihood that two of these digital fingerprints will be the same is remote.
A message digest has two properties:
The second property is again a matter of probabilities, and the likelihood is again remote.
A number of algorithms are used to compute these message digests, the two best known being SHA1, the secure hash algorithm developed by the National Institute of Standards and Technology, and MD5, an algorithm invented by Ronald Rivest of MIT. The Java programming language implements both. The java.security package has a MessageDigest class for creating objects that compute a message digest. The bytes of the message (to be sent) are fed to the MessageDigest object, the digest method is called, and a message digest is returned as an array of bytes.
If a message is altered, then the digital fingerprint (message digest) of the altered message will not match the digital fingerprint of the original. If the message and its fingerprint are delivered separately, then the recipient can check whether the message has been tampered with. However, if both the message and the fingerprint were intercepted, it is an easy matter to modify the message and recompute the fingerprint, as the message digest algorithms are publicly known and do not require any secret keys. In such case, the recipient of the forged message and the recomputed fingerprint would never know that the message has been altered. One way to detect this kind of alteration, when both the sender and receiver have access to a shared secret—a session key—is to append the session key to the message text when computing the message digest. No third party can produce a suitable message and message digest unless they have access to the session key. This scheme avoids the need for the public key cryptography used to implement digital signatures.
Another way to solve this problem is to use digital signatures that authenticate a message. When a message is authenticated, the recipient knows that:
There are two kinds of public/private key pairs: for "encryption" and for "authentication". If anyone sends you a message that was encrypted with your public encryption key, then you can decrypt it with your private encryption key, but no one else can. Conversely, if you sign a message with your private authentication key, then anyone else can verify the signature by checking with your public key. The verification passes only for messages that you have signed and it fails if anyone else uses his key to sign the message. Core Java, vol. 2, pp. 750-751.
The Java security class comes with Digital Signature Algorithms (DSA) to:
An implementation consistent with the present invention for dynamically granting permissions at runtime will now be described. It builds upon the default security policy described above and provided as part of the Java 2 platform, which only supports static (non-dynamic) permission grants (http://java.sun.com/j2se/1.4/docs/guide/security/PolicyFiles.html). The dynamic security policy implementation described herein supports granting of permissions at runtime, as opposed to one which only supports an unchanging set of permission grants specified prior to execution.
Java security policies are implemented by objects that are instances of subclasses of the java.security.Policy class
(http://java.sun.com/j2se/1.4/docs/api/java/security/Policy. html). The primary function of this class is to determine at a given point in program execution whether or not the currently executing "context" possesses (i.e., is permitted to exercise an action represented by) a particular permission. Here, "context" refers to those aspects of program state relevant in determining whether or not a permission check should pass, e.g., the current execution stack, and the currently-executing subject (user). The security policy issues these decisions by means of the following method:
The default (static) Java 2 security policy operates essentially as shown in
In contrast, an implementation of the dynamic security policy is shown in
By calling this method (step 324), application code requests that the given permission be granted to the specified combination of class loader and principal(s). A "principal" represents some facet of subject (user) identity. Note that in some cases this grant operation may fail, such as when the caller does not itself have adequate permissions to authorize the grant.
Again, when the need for a security check arises (step 321), the security infrastructure will invoke the policy object's implies( ) method (step 322). However, the implies( ) method of the dynamic policy is implemented to consider dynamic grants issued at runtime via the dynamic policy's grant method, in addition (perhaps, though not necessarily) to static permission grants specified at startup.
One example is the following sequence of events:
Thus, the dynamic policy provider grants permissions on the granularity of class loader. It also provides support for associating security sub-policies with context class loaders. If a sub-policy is registered for a given class loader, it handles permission queries and grants when the class loader is the current context class loader or the nearest parent of the context class loader for which a sub-policy has been set.
This implementation of the dynamic policy provider uses the same policy file mechanism and syntax as the default security policy implementation distributed as part of the Java 2 platform.
To associate a new sub-policy with a given class loader, overriding any previous sub-policy associated with the class loader, the following method is provided:
To return a set of permissions allowed for code from the specified code source as a newly-created permission collection (which supports heterogeneous permission types), the following method is provided:
To return a set of permissions allowed for code in the specified protection domain as a newly-created permission collection (which supports heterogeneous permission types), the following method is provided:
The following constructor creates a DynamicPolicyProvider whose starting set of permission mappings is the same as those that would result from constructing a new instance of the default (policy-file based) security policy provider with the "java.security.policy" system property set to the value of policyFile:
The parameter policyFile is a URL string specifying the location of the policy file to use, or null if the current value of the "java.security.policy" system property should be used.
The implies method of the DynamicPolicyProvider overrides the implies method in class Policy. The two parameters of the implies method include "domain" which specifies the protection domain in which to check implication, and "permission" which is the permission to test implication of. The implies method returns true if permission is implied by permissions of the given protection domain, false otherwise.
If the given protection domain is the protection domain of this class, then true is returned. Otherwise, the main policy or appropriate sub-policy is consulted.
Example of a Distributed System Implemented in Java™ Programming Language
In a distributed system implemented using the Java™ programming language, services appear programmatically as objects, with interfaces that define the operations available from the service. A "class" provides a template for the creation of "objects" having characteristics of that class. Thus, a class defines the type of an object. Methods associated with the class are generally invoked on the objects of the same class or subclass. The Java programming language is described in The Java Language Specification by James Gosling, Bill Joy and Guy Steele, Addison-Wesley, 1996, which is incorporated herein by reference.
In a Java distributed system, an object is referred to as being remote when its methods can be invoked from another address space, typically a Java virtual machine on a different computer. A remote object is described by one or more remote interfaces, which are Java interfaces that declare the methods of the remote object. Remote Method Invocation (RMI) is used to invoke a method of a remote interface on a remote object. RMI is explained in, for example, the Remote Method Invocation Specification, Sun Microsystems, Inc., 1997, available at http://www.java.sun.com/products/jdk/1.2/docs/guide/rmi/spec/rmiTOC.doc.html, which is incorporated herein by reference.
Computers 104 and 106 may be similarly configured, with computer 104 including memory 124, secondary storage device 126, and CPU 128, and computer 106 including memory 130, secondary storage device 132, and CPU 134. Memory 124 of computer 104 includes a service 136, and memory 130 of computer 106 includes a lookup service 138 that defines the services available in one part of distributed system 100. Lookup service 138 contains one proxy object for each service within that part of distributed system 100. Each "proxy" object such as 140 corresponds to a service in the distributed system and implements interfaces corresponding to methods available from a service.
For example, if service 136 were a database service, the corresponding proxy object 140 would implement database interfaces such as "find" or "sort". To invoke methods on database service 136, client 142 asks lookup service 138 for a proxy to the database service. In response, lookup service 138 returns proxy object 140 corresponding to database service 136 to the client. Lookup services are explained in greater detail in U.S. Pat. No. 6,185,611, entitled "Dynamic Lookup Service in a Distributed System," which is incorporated herein by reference.
In this way, the Jini architecture relies on downloaded code to provide services in a dynamic and flexible way. Once a client downloads a proxy object, the client invokes methods on the proxy to communicate with the remote service. However, the proxy may be implemented using code that the client does not trust. Before sharing any critical data with the service, the client should preferably establish trust in the proxy, the service, or both.
Sun, Sun Microsystems, the Sun logo, Java, and Jini trademarks are registered trademarks of Sun Microsystems, Inc. in the United States and other countries.
Alternative Implementations
The client-server embodiments described herein are not meant to be limiting of the present invention. In an alternative distributed system, all processes may perform similar roles, interacting cooperatively as "peers" to perform a distributed activity or computation, without any distinction between clients and servers. This peer architecture may provide a better interactive response for users of distributed shared objects than could generally be obtained with a server-based architecture.
Another architectural model for a distributed system is the provision of a service by multiple servers. Services may be implemented as several server processes in separate host computers, which interact as necessary to provide a service to client processes. The servers may partition a set of objects from which the service is based and distribute them between themselves, or they may maintain replicated copies of them on several hosts.
In yet another architectural model of a distributed system, a cache may be used to provide faster access to select objects, such as recently used objects. For example, web browsers maintain a cache of recently-visited web pages and other web resources in the client's local file system, using a special HTTP request to check with the original server that cached pages are up-to-date for displaying them. Web proxy servers provide an alternative form of shared cache of web resources for the client machines at a site or across several sites. The purpose of proxy servers is to increase availability and performance of the server by reducing the load on the wide area net and web servers. Proxy servers can also take on other roles in the network, for example they may be used to access remote web servers through a firewall.
Other implementations and embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. It is intended that the specification and examples be considered as exemplary only, with a true scope of the invention being indicated by the following claims.
Patent Citations
Referenced by
Legal Events
Original Image


text: For those who know the English language well, the statement in the title, "young-earth creationism is a cult," may seem obvious. One definition of a "cult" is "a system of religious beliefs and ritual" which of course young-earth creationism is. But I mean the statement in reference to that more sinister meaning of "cult," as [Read More...]

subset: commoncrawl


text: You Couldn't Pick a Better Name? 8 Earthbound And DownProfileFollowUnfollow Earthbound And Down 6/19/14 5:53pmEditDelete Invite manuallyPromoteXDismissXUndismissBlock for oppositelockHideShare to KinjaShare to PinterestGo to permalink Am I the only one that would pronounce this as "ass plunder" in a Boston accent? Ass-plundah. I'm a grown man. Promise. 8 13Reply 13Discuss


text:
For Lawyers
- Member FAQs
- Court Directory
- Legal Marketplace
- KBA Photo Gallery
- Legal History Videos
- Resources
- Professional Guidelines
- Court History
- KBA News
- 100% Membership Club
- Newly Admitted Attorneys
- Membership Renewal Dues 2015
- 2015 Law Practice Today Expo
- Law and Liberty Award
- Amicus Creative Website Offer
- Attorneys' Directory 2015
Information for
Lawyers & Public:
Knoxville Bar Association NEWS
For NEW Bar Admittees
Are you a newly admitted attorney? The KBA is here to provide you with leadership, networking, and professional development opportunities. Get involved and drive decisions about services and programs for new lawyers! Download a copy.


text:
J Fit 30" Stability Exercise Ball
Special Offer:
12 Issues of Sunset Magazine
Included with purchase ($20 value).
J Fit 30" Stability Exercise Ball
Weights & Dimensions
|Product Type: Balancer or stability ball
|Material: Plastic
|Burst Resistant: Yes
|Latex Free: Yes
|Battery Required: No
|Handles: No
|Pump Included: Yes
|DVD Included: No
|Handrail Included: No
|Wheeled: No
|Exercise Training Type: Strength; Resistance
|Bottle Included: No
|Arms Included: No
|Target Muscles: Quads; Hamstrings; Glutes; Calves; Arms; Shoulders; Core
|Country of Manufacture: China
|Assembly Required: No
|Installation Required: No
|Additional Parts Required: No
About the ManufacturerJ Fit offers a wide variety of items to help you build a proper fitness routine. A wide assortment of yoga and pilates mats, carriers and accessories are perfect for helping you jumpstart a healthy lifestyle. J Fit's line of kettlebells and dumbbells are offered in singles, pairs and complete sets to serve your home gym's needs and help strengthen your body. If your workout is too much, J Fit also offers a line of hot / cold therapy packs. Whether you are stocking your gym or health club or for your own personal use, J Fit has something for everyone.
J Fit 30" Stability Exercise Ball
OUR SKU # FIT102330" Stability Exercise Ball is also sometimes listed under the following manufacturer numbers: 20-0130


text:
Franchise Index: Previous Season / Next Season
9-7-0, NFC East Division · 2012 NFL Season Summary
SRS: Total 6.2, Offense: 4.0, Defense: 2.2, SoS: 0.9, avg is 0.0.
Scored 429 points (26.8/g), 6th of 32 in the NFL. Allowed 344 points (21.5/g), 12th.
Differential of 85 points (5.3/g), 8th. Expected W-L: 10.0-6.0.
Tom Coughlin (9-7-0)
Offensive Coordinator: Kevin Gilbride
Defensive Coordinator: Perry Fewell
Stadium: MetLife Stadium
Training Camp: SUNY Albany (Albany, New York)
Our primary support comes from users like you. Sponsor this page for $40. Your message will replace this ad.


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} {{/if}} Top Spot{{#if Plural}}s{{/if}} Left{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
You can now invite anyone to meet at your favorite Starbucks.
Limited-time feature
32 year old man | Chicago, IL, USA | Seeking women 20-35 within 20 miles
Life is more than merely staying alive. Find what makes you happy and do whatever is necessary to hold onto it. Always be honest and real
My name is Jaymeson, I'm living and working in River North, Chicago, and I'm single. I hope online dating can be effective, and I'm looking to catch the attention of any woman interested in conversation, friendship, or more. Here's my top 5 list: Food Caribbean, Central, South American, Mediterranean beaches Live Music The feeling after a perfect workout, athletic event, or game The telling of a good, unique story through a book, movie, or song My social life is important to me, but I am not uncomfortable being alone. I laugh out loud when I hear something funny, and I appreciate and try to deliver my own sense of humor regularly. I'm passionate about travel far and wide, food flavors that make me say: "oh my god, you have to try this," physical activity, writing, reading, and doing the things I love with someone I love. I like good fun, good company, and feeling a sense of support with whom I'm committed. I take relationships seriously, and I know what characteristics I am looking for in a woman. Although I am trying my best to describe myself here, I am new to online dating, and feel that there is much more that can be learned by meeting me in person. I'm up for various date suggestions, and don't mind making the plans either...coffee, drinks, lunch, dinner, museum, art gallery, sports activity, club, cooking class, bowling, beach, movie, comedy show, bike ride, event, or just meeting in a park for conversation. Please feel free to email me if you want to know more
Book club , Camping , Coffee and conversation , Business networking , Cooking , Dining out , Gardening/Landscaping , Movies/Videos , Museums and art , Music and concerts , Exploring new areas , Nightclubs/Dancing , Performing arts , Playing cards , Playing sports , Shopping/Antiques , Travel/Sightseeing , Volunteering , Wine tasting
Billiards / Pool, Bowling, Cycling, Hockey, Inline skating, Other types of exercise, Running, Skiing, Swimming, Walking / Hiking, Weights / Machines
I exercise 5 or more times per week.
I like Birds, Cats, Dogs, Exotic Pets, Fish
I love most animals, and used to have various pets. Most pets, animals are favorable to me
Middle of the Road
Brazil, South and Central America in general. Europe, especially Italy, Greece and Spain. Arizona, Montana, New Orleans, New York, Chicago. I will definitely explore asia, and Africa in the next few years
Southern Illinois University Carbondale, Carbondale, IL
I love re-watching and re-reading some of the best movies and books, I'm a sushi and latin food junkie, and a french and asian food semi-junkie. I like most music except contemporary rap music, some country, and Christian music. Most things physical
Movies, Books, Music. Eating a wide variety of the best foods in Chicago. Travel. Like to go to the beach, write, exercise, organize, some fashion shopping, play games, and spend time doing the things I love with someone I love.
I recently read a book called the Mayflower about the true events surrounding the Mayflower landing and the first thanksgiving. Currently reading two books, The Conquest of New Spain, and A Brief History of Time
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What he is looking for
|6'2" (187cms)
|5'2" (157cms) to 6'3" (190cms)
|Body type:
|Athletic and toned
|Slender, Curvy, Athletic and toned, Full-figured
|No preference
|Dark blonde
|Auburn / Red, Black, Light brown, Dark brown, Blonde, Dark blonde
|No Way
|No Way
|Social Drinker
|No preference
|Other profession
|No preference
I own a personal training company, FormFunction Personal Training, Chicago
|$100,001 to $150,000
|No preference
|No preference
|Have kids:
|No preference
|Wants kids:
|White / Caucasian
|Asian, Black / African descent, East Indian, Latino / Hispanic, Native American, Pacific Islander, White / Caucasian
|Spiritual but not religious
|No preference
|English, Portuguese, Spanish
|Bachelors degree
|No preference


text:
Per Yahoo: http://sports.yahoo.com/mlb/news?slu...v=ap&type=lgns
Several hours after the Mets win in Anaheim, the team announced that Willie Randolph had been fired as manager, and several of his coaches were being let go as well. Jerry Manuel takes over, but only gets the "interim manager" title, and the rest of the coaching staff will be repopulated from the Mets' Triple-A team.
I'll leave the "Hey, let's see if we can't trade them the rights to Dusty" jokes to others. I'll just comment that this struck me as hilarious because it was just 3 hours ago that I watched "Baseball Tonight" and they had a roundtable about how they all agree that the danger had passed in Queens, and that it was clear that Randolph or his staff are doing a fine job, and how Mets management needs to call a team meeting to tell everybody that nobody's getting fired, not the manager, not the first base coach, nobody, so that the team could just get on with its business with no further distractions.


text:
Originally published on Fri November 15, 2013 12:58 pm
Actor Justin Long told us he admires the work of Woody Allen, but we wanted to see just how much he knows about the man born Allen Stewart Konigsberg. In this Ask Me Another Challenge, host Ophira Eisenberg quizzes Long on all things Woody, from the films he's directed to the instrument he plays. (Hint: It's a woodwind.)
This is the official web site of the WSHU Public Radio Group. Some links from these pages are not maintained by WSHU and are subject to change without notice. This Web site and its contents are © 2013 by WSHU, Fairfield, CT, and the respective copyright holders.


text:
More About CRAZYGRACY
Visit My SparkPage Send Me SparkMail
Recipes I've Shared:
Vegetable Bean & Tomato Soup
Low Calorie, Low Sodium, Crock Pot Favorite
Mixed Mushroom Soup
Low sodium - high nutrition
Crock Pot Sauerkraut
Easy and quick. Great on hotdogs & for cookouts.
Easy to prepare; Thick, chunky & spicey. Can be done in crock pot. freeze individual servings
Recipes I've Rated:
- Skinny Sour Cream & Chicken Enchiladas
- Italian Vegetable Bake
- Coach Nicole's Fresh & Skinny Guacamole
- Roasted Turkey
- Baked Egg Cups
- 100 Calorie (normal sized) Blueberry Muffins
- Spicy Baked Sweet Potato Fries
- Sweet Balsamic Black Bean Salad
- Yosemite Chicken Stew & Dumplings
- Jumpin' Jambalaya
- Beef Stroganoff
- 3 Cabbage Slaw
- Spicy Shrimp and Tomatoes
- Vegan "Egg" Salad
- Sweet Potato & Ginger Soup
- Bean and Macaroni Soup
- Spiced Pumpkin Soup
- Tofu and Veggie Stir-Fry
- Vegetable Couscous
- Thai Noodle Salad
- Turkey Bacon Breakfast Burritos
- Sweet Potato & Apple Kugel
- Cabbage and Potato Sauté
- Gazpacho Smoothie


text:
I actually got the idea to use Priceline from the DL Hotels forum, and it seemed to be a good way of saving $.
Anyhow, I was looking at some of the rates that hotels were going for on Priceline in the "Resort" category. It seems quite typical for a resort hotel to go from $60 to $100. This is usually is about 1/3rd to 1/2 the "list" prices online and quite a saving.
To see the whole Priceline coverage and the hotels Priceline offers go to:
Florida - Orlando/Walt Disney World - USA Hotels - BiddingForTravel.com - Message Board
These are the Resort hotels close to Disney:
Location: Disney Maingate - Celebration
Gaylord Palms Resort
Omni Orlando Resort
Location: Lake Buena Vista - Downtown Disney
Hilton Bonnet Creek
Hilton in the Walt Disney World Village
Hyatt Regency Grand Cypress
Marriott Orlando World Center
Walt Disney World Dolphin
Walt Disney World Swan
Possible: Waldorf Astoria Orlando
In other news, I just put my deposit down on the Wilderness Lodge for my trip next July 2011. Of course, this is fully refundable and with these cheaper options on the table it is quite tempting to abandon it. However, I would like to give Disney property a shot at least once.


text:
mikerose's name card
Real name
Mike Rose
Yuma, AZ, United States
Mike Rose
Yuma, AZ, United States
mikerose's most popular stock photos
mikerose's blog
This user does not have a blog yet.
mikerose's intro
I'm a graphic designer and fine artist who also tries to be a photographer from time to time. Hope you enjoy looking at my photos. I haven't placed any restrictions on my photos, but if you use any of them in your work please let me know how you used them (if it's not too much trouble)?I'm just curious. I have larger versions of some of these photos, let me know if you want one.
mikerose's equipment
Nikon coolpix 5400, Ihagee Exa, Bolsey 35mm
StatsNumber of photos rank
|Not in the TOP 1000.
Download rank
|Not in the TOP 1000.


text:
eBook Category: Romance
eBook Description: When Rafferty Evans goes out in the pouring November rain to help a lost tourist find his way off his land, the rancher doesn't expect to return with an expectant mom. Jacey Lambert isn't just pregnant--she's about to give birth. Five hungry cowboys looking for a home-cooked meal isn't what Jacey imagined when she set out for the Texas Hill Country. Neither is having her baby delivered by Rafferty, a handsome widower who offered her shelter from the storm. With an alluring cook in the kitchen and an irresistible infant in the bunkhouse, it's beginning to feel more like Christmas at the ranch. But mother and daughter have to move on eventually, and when--if--they do, Rafferty knows his fragile heart will break all over again. Unless Rafferty can convince Jacey there's only one thing her new family is lacking--him!
eBook Publisher: Harlequin/American Romance
Fictionwise Release Date: December 2008
15 Reader Ratings:


text:
Artist: TrakkSounds
Featuring: Cory Mo | Killer Mike | Rittz | Pill
Song: Atlanta Smokers Only
What do you get when you combine a slew of Atlanta's most noted veteran and up-and-coming emcees, an absurd amount of Mary Jane, and a splash of barbecue? No, not the BET Hip Hop Awards. Rather,... More
Posted 2 years ago
Song: Aint Stettin Yall
On top of its strip clubs, hot wings, and Southern hospitality Atlanta has become seemingly well-known for the way in which its residents speak. Take for instance the title of Atlanta native... More
Posted 2 years ago
Featuring: B. Stille (of Nappy Roots)
Song: All My Life
Pill and B. Stille may be from different generations of Southern hip-hop, but their approaches to life and music could hardly be better matched. Don't believe me? Just take a listen to All My... More
Posted 3 years ago
Editor's Pick
Artist: J The S
Song: Simple Man
As anyone who plays the guitar, or even plays Guitar Hero, already knows, Lynard Skynard's Simple Man is simply one of the better rock songs ever written. While the original's roots lay in... More
Posted 3 years ago
Song: It's All On Me
After a tough breakup it usually takes a while to bounce back, although some folks bounce back quicker than others. After a few weeks of speculation, Pill revealed that his separation from Rick... More
Posted 3 years ago
Featuring: I-20 | Killa Kyleon
Song: King Hustler
If you experience a little déjà vu upon listening to the latest leak off Trakksounds and ThaFixx' new compilation album, it's likely because you have heard it before. Featured back in... More
Posted 3 years ago
Artist: Cory Mo
Song: Blow Yo Mind
From Michael Jackson to Vicente Fernandez, I was exposed to several different types of music throughout life. Honestly, I can't recall what the first rap album I ever heard was, but I'd guess... More
Posted 3 years ago
When Soul Food came out back in 1997, everybody connected with the character of "Big Mama" and felt her persona in their own loved ones. In 2011, Pill pays homage to his own "mama" and feeds... More
Posted 3 years ago
Artist: Donny Goines
Song: Champions Anthem
Rap anthems are typically geared towards those struggling to succeed against long odds, whether their mission is to hustle their way out of the streets, succeed in an overcrowded music game, or simply... More
Posted 3 years ago
Artist: Jon Connor
Press play. Rotate your thumb clockwise to turn up the volume on your iPod. Nod your head. These are the actions I completed when this track landed in my email. After releasing his debut album... More
Posted 3 years ago
Just how hard does the bass beat out Pill's trunk when he's out on his hustle? Well, imagine he's affixed a basketball hoop to the trunk, and Scottie Pippen and Tim Duncan are taking... More
Posted 3 years ago
Artist: A-Trak
Featuring: Donnis | Pill | Danny Brown | CyHi The Prynce
Song: Ray Ban Vision (Remix)
Mainstream hip-hop has backed the "If it ain't broke, throw some more artists on there for a remix" adage for quite some time now, and from the look of the listener consensus on the original Ray... More
Posted 4 years ago
Song: On Da Korner
Much like Common once classically took us to The Corner in his native Chicago, fast-rising rapper Pill is now set to take us on a journey to see what life is like On Da Korner of his ATL hometown.... More
Posted 5 years ago
Artist: Freddie Gibbs
Song: Do Wrong
If God wanted us to do right, why'd he make it so easy to do wrong? Here with a rap meditation about that very paradox is Indiana's great hip-hop hope, Freddie Gibbs, and his new track Do Wrong.... More
Posted 5 years ago
Artist: Yelawolf
Featuring: CyHi The Prynce | Pill
Song: I Wish (Remix)
Album: Trunk Muzik
YelaWolf has come a long way since he made his debut on the Booth with his defiant breakthrough single I Wish, so far in fact that he's now releasing an I Wish (Remix). While the remix loses its... More
Posted 5 years ago
Song: Hear Somebody Comin
Many artists use their origins as an inspiration for their music, whether it's their state, city, or neighborhood. Pill, who hails from the "Pink City" block in Atlanta, has found exactly such... More
Posted 5 years ago
Artist: Freddie Gibbs
Song: Womb 2 The Tomb
It's been nearly two years since we last heard from Freddie Gibbs, but those who thought the Gary, Indiana rapper was gone for good can think again—as he explains on his latest feature,... More
Posted 5 years ago
Sample Text - Sample Link


text:
Additional Categories:
Mfg.: Globe Food Equipment Co.
Model: Globe GCB15G-CR
This item is shipped brand new directly from the supplier. Please not the image above is for reference only.
Item: Globe 15" Cast Iron Radiant Charbroiler Natural Gas
Model: GCB15G-CR
Description:This unit is great for cooking a variety of meats including: bacon, sausages, and franks. Ideal for steak restaurants, fast food diners, and other convenience stores.
This item comes with a field conversion kit to change unit from natural gas to liquid propane
There are currently no reviews for this item. Be the first to write one.


text:
Results 1 to 7 of 7
Thread: faun, demons and pixies
May 19th, 2008 #1
faun, demons and pixies
It's been a month since last time a posted on this forum. I had a bit of time to play and I've made my first males character (with some muscles).
here is what I've done so far:
followed by a faun:
and I've tryed to make a realistic hand:
I have more photos of the differents stage of the sculptures on my blog:
All comments and advices are more than welcome.
- Similar Threads
- Art: Demons thread(demons collection series)
- Art: Heretic Pixies Production Artwork
- SketchBook: Heretic Pixies sketchbook pages
- Art: faun, demons and pixies
- Satchiin and the Water Pixies [NIPPLES HERE]
Last edited by fab03guyane; May 19th, 2008 at 05:01 AM. Reason: bad linksMy new born sculpture website:Over the Clouds
And my new blog:Blog.Overtheclouds.com
Hide this ad by registering as a memberMay 19th, 2008 #2
You are becoming experienced very fast!
I see you have come to master the painting process as well - congrat!
Any details on the painting? Any WIP shots?
Nice muscles on the faun.
May 19th, 2008 #3
Absolutely amazing!! o.O
Do you use Super Sculpey? Do you have any tips for a beginner like me?
May 19th, 2008 #4
Very superb stuff, I am surprised, I didn't expect to see such a great quality hand!
Great figures, all three of them, the only bad thing I can say is that on the faun's musical instrument the line that goes across it is obnoxiously not straight. I just have no idea why the line is so unprofessional as compared to the rest of the figure, which is made with very clean and precise aesthetic.
May 20th, 2008 #5
Wow, these are great. That hand especially. How do you render that skin tone so evenly? Airbrush?
May 20th, 2008 #6
I don't use airbrush, it's only super sculpey, a mix of light blue and sculpey for the veins, and once the sculpture is baked, I use a mix of diluated brown and red acrylic for the wrinkles, some diluated red for the fingers and then I use a toothbrush to had some random spekle.
My new born sculpture website:Over the Clouds
And my new blog:Blog.Overtheclouds.com
May 22nd, 2008 #7
I like your anatomy a lot, it is very expressive. The proportions are good. The hands are amazing throughout! The core of your figures is very good, but there are a few small errors in the arm. The biceps originates under the deltoid and pectoralis - essentially in the armpit. Also, the the insertion of the biceps is lower on the forearm, I think that is why the left biceps of the faun looks strange. On the first male with the grapes, it is hard to see from the angles, but the scapula will rotate upward as well as around, so the deltoid on the left arm would be closer to the ear and rise much further above the clavicle in the front view. Also, the triceps in some views are too bulbous.


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} {{/if}} Top Spot{{#if Plural}}s{{/if}} Left{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
You can now invite anyone to meet at your favorite Starbucks.
Limited-time feature
26 year old woman | San Antonio, TX, USA | Seeking men 25-30 within 20 miles
What do you say on these things?
I'm a Texan girl who just moved from the DC metro area. I've lived in 4 states and 5 cities in the the last 7 years. I might stay here or I may move again; it just depends on what life brings me. For now, I'm happy to be back in Texas, hanging with childhood friends, and living by myself. I love to laugh and make people laugh. If you don't have a good sense of humor, please stop reading and move along to the next page. I often laugh until I cry. That's what laugh is about, right? What makes me different is that I am always looking to expand my mind and learn something new. Education is important to me, not always in the school format, but continuous mental growth and stimulation in some capacity. I tend to learn the most when I travel and experience new cultures, which I do quite often. I'm looking to have fun and meet a friend first. I'm looking for someone who is funny, kind, and ambitious. Let's just see where this goes.
Camping , Cooking , Dining out , Movies/Videos , Music and concerts , Travel/Sightseeing , Volunteering
Aerobics, Dancing, VolleyBall, Walking / Hiking
I exercise 3-4 times per week.
Don't display my sign
I have Cats
I like Dogs
I have a cat, Spencer. He's awesome, but I would love to have a dog, too. I'm not a cat lady; one cat doesn't make me a cat lady, does it? lol
Middle of the Road
The Johns Hopkins University, Baltimore, MD
I'm a Zumba instructor. So, I love to dance and pretend like I can understand the Spanish in the songs I dance to. I also like a good athletic challenge. I like to pretend I'm good at every sport, which I'm not, but I fake it til I make it.
"Fear of Flying" by Erica Long. It was an interesting read, but not one of my favorites. I also just started "Uganda be Kidding Me" by Chelsea Handler. I need a good laugh before the the summer semester begins.
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What she is looking for
|5'4" (162cms)
|5'6" (167cms) to 6'3" (190cms)
|Body type:
|About average
|Slender, About average, Athletic and toned
|No preference
|Light brown
|Black, Light brown, Dark brown
|No Way
|No Way
|Social Drinker
|Social Drinker
|Other profession
|No preference
Public Relations
|$50,001 to $75,000
|No preference
|Never Married
|Never Married
|Have kids:
|Wants kids:
|Black / African descent
|Asian, Black / African descent, Latino / Hispanic, Pacific Islander
Don't let the pictures fool you, both my parents are black. :)
|Christian / Other
|Christian / Other
|Graduate degree
|Bachelors degree, Graduate degree


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} {{/if}} Top Spot{{#if Plural}}s{{/if}} Left{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
You can now invite anyone to meet at your favorite Starbucks.
Limited-time feature
36 year old man | Jonesboro, GA, USA | Seeking women 22-23 within 50 miles
I'm tired of been single, and I'm here to find the right and a God fearing woman to start a family with.
I'm Just a man. A man who has made mistakes, a man who is willing to grow and learn from those mistakes. A man that's free and believes that everyone deserves an opportunity; give you the rope and let one hang themselves. One who does not judge, doesn't brag or boast on the things attained, one that loves everyone. Who am I to judge? One that will always listen with an attentive ear and an open heart and mind. One who seeks good people of substance to get to know and see where it goes. A man that will be a man until the end of time. Just hit me up to know more about me. Who knows, I may be your next friend or even more.
Cooking , Music and concerts , Religion/Spiritual , Watching sports
Soccer, Walking / Hiking
I exercise 1-2 times per week.
I like Dogs
Think I Prefer Dogs......!
Either at home or trying out a new restaurant. I like going out but the club scene is not my thing any more . I'd rather go to a movie or to a nice restaurant and have just as much fun.
My favorite music is Gospel, Hip hop, R&B, & Blues. and my favorite food is anything that taste good. I love to read in my spare time and although I really don't have that much spare time to read I still enjoy it tremendously. Feel good music is..
Meeting new people, starting a conversation with anyone and cooking. I love to cook, I can cook anything from fried chicken to anything. I started cooking when I was 10 years old and every since then I have had a passion for it.
Mathew chapter 7vs7
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What he is looking for
|5'10" (177cms)
|5'5" (165cms) to 5'11" (180cms)
|Body type:
|About average
|Slender, About average, Athletic and toned
|No preference
|No Way
|No Way, Yes, but trying to quit
|Never, Moderately
|Technical / Science / Computers / Engineering
|No preference
Computers engineering.....
|Less Than $25,000
|No preference
|Never Married
|Never Married, Currently Separated, Divorced
|Have kids:
|Yes, and they sometimes live at home, No, Yes, and they live away from home, Yes, and they live at home
|Wants kids:
|Definitely, Someday
|Black / African descent
|Black / African descent
I'm originally from West Africa. but I basically live here in GA. and I like it here
|Christian / Other
|Christian / Other
I'm such a GOD hearted person and a religious person. I've learn how to let God have the total control over my life!
|High school
|Some college, Associates degree, Bachelors degree, Graduate degree, PhD / Post Doctoral
I'm willing to further more soon. I'm in the process...


text:
First Known Use: 1560
noun je·hu \ˈjē-(ˌ)hyü, -(ˌ)hü\
Definition of JEHU
capitalized : a king of Israel in the ninth century b.c. who according to the account in II Kings had Jezebel killed in accordance with Elijah's prophecy
: a driver of a coach or cab
Ask The Editor Videos
Origin of JEHU
Hebrew Yēhū
Other Bible Terms
Learn More About JEHU
Next Word in the Dictionary: jeisticcorPrevious Word in the Dictionary: JehovisticAll Words Near: jehu
Seen & Heard
What made you want to look up jehu? Please tell us where you read or heard it (including the quote, if possible).


text:
Heat oil, fry onion for 10 minutes
Add ginger, garlic and chili, fry for a couple of minutes
Add ground coriander, ground cumin, turmeric and Garam masala, fry for a couple of minutes, until they smell nice. Season with salt and pepper
Add water and tomatoes, simmer for 10 minutes
Add chicken and combine. Put a lid on the pan and cook for 30-40 minutes, stir occasionally
Add yogurt, lemon and coriander, combine well
Remove from the heat and serve
Serve with white rice and Naan.


text:
Winter!: Prepare for holiday gaming!
It provides over the top chaotic action and lets you do everything from attatching a stupid guy to a plane and flying off to jumping from a vehicle to another. Conclusion: This game is ADDICTING!
Game Traits applied to Just Cause 2 (PS3) by luislopez
Member actions:


text:
Order Toll Free 888-748-5252
Mon. - Fri. 9am - 5pm EST
desktop site |
mobile site |
my account
cart (0) $0.00
Spike's Tactical's mission is simple, they strive to build the highest quality products and offer them at the best possible prices. It doesn't matter if you are simply a gun enthusiast, a competitive 3 gun shooter or a military or law enforcement professional, their rifles and accessories will serve you well and won't let you down when it counts, and they guarantee it.
BCM(Bravo Company Manufacturing) was founded in 2005 by a veteran United States Marine in Hartland, Wisconsin, where the company maintains its HQ today.
BCM builds weapon systems that are manufactured, reinforced and tested to meet the unforgiving needs of law enforcement, military, security and peace keeping professionals in some of the most high stress environments and situations in the world.
Swiss Model 1889 7.5x53.5 (GP90 Black Powder) caliber Schmidt-Rubin Rifles. Antique rifles; Rarely made available in the US. These rifles were only made for a few years through the mid-1890s and are chambered for the obsolete 7.5x53.5 Black Powder cartridge.
Nice rifles and fewer than 50 for sale. (Please allow for the bakelite bolt handle knobs to be chipped or cracked.) A must to complete a Swiss rifle collection!
Feature a 12rd Box Magazine complete with original mag cut off lever. Specs: 51.3" overall, 30.7" Barrel, 10.7 lbs weight.Feature a 12rd Box Magazine complete with original mag cut off lever. Specs: 51.3" overall, 30.7" Barrel, 10.7 lbs weight.
From the onset of every project, Magpul uses a list of mission-driven requirements to dictate design, material construction, and manufacturing methods that will be most efficient without sacrificing quality or performance. The goal of the design itself is to be both simple and intuitive. By incorporating ergonomic considerations, a proper user interface, and subtle visual and tactile features, the product itself should actually instruct the user about its operation and function
Police Trade-in Smith & Wesson M&P 40 .40SW caliber Pistols. The Pistols are in clean condition as the pictures show, please allow for minor metal finish wear. Includes one 15rd magazine, Night Sites and carry case. While supplies last.
(Does not have extra palm swells)
(May have law enforcement department markings)
Find Us On
Order Toll Free
You are here:
All Products > AIM 16" CHF Midlength MOE .223/5.56 Lightweight URG
New AIM complete .223/5.56 caliber upper receiver groups featuring 16" Cold Hammer Forged Chrome Lined Light Weight Daniel Defense barrels. Built using some of the finest components available (full specs below) and a forged F-Marked A2 front sight base with Mid Length gas system. Includes complete MPI Bolt Carrier Group, Charging Handle and Magpul MOE Handguards.
More info below.
New Serbian Prvi Partizan PPU brand 6.5x55 Swede ammunition. Features a 139grn lead core semi-copper jacketed soft point bullet, brass case, and non-corrosive boxer primer. Packaged 20rds to a box, and 500rds (25 boxes) to a case.
Winchester Ammunition Super-X Buckshot, 12 Ga. 2 3/4" 9 Pellets #00 Buck. Winchester Super-X buckshot leads the industry in setting the high performance standards for buckshot performance. Made with the same skill, care and quality as when first introduced in 1922. Today Super-X is made using precise manufacturing processes and the highest quality components to provide consistent, dependable performance that generations of shooters continue to rely upon.
Winchester PDX1 Defender .410 Gauge 3" (S413PDX1) Shotgun Ammunition. Winchester PDX1 Defender .410 Gauge 2.5" (S410PDX1) Shotgun Ammunition. Engineered to maximize terminal ballistics as defined by FBI test protocol, Winchesters PDX1 Defender ammunition provides maximum stopping power for the ultimate in personal defense. The proven performance you rely on when the stakes are high.
Winchester PDX1 Defender .410 Gauge 2.5" (S410PDX1) Shotgun Ammunition. Engineered to maximize terminal ballistics as defined by FBI test protocol, Winchesters PDX1 Defender ammunition provides maximum stopping power for the ultimate in personal defense. The proven performance you rely on when the stakes are high.
©2015 AIM, all rights reserved.
'firstname.lastname@example.com' An
IMX Solutions Inc.
EOS360 Extend


text:
You won't be able to dismiss this by usual means (escape or click button), but you can close it programatically based on user choices or actions.
"These gift tags in the choice design are so beautiful..I selected them in the scalloped shape and the picture frame shape with the matching ribbons to tie onto the wedding favors at the place settings....Just perfect. I also bought these to tie onto the bridal shower gift bags at each place settings at the shower. Perfect."
"The design is nice but I would have liked the flexibility to change the size of the "statement" to include more wording at the bottom; like full first names instead of initials."
"These were an add on for me. I did a navy blue background and white text. They are simple and very cute. They are a little larger than I had anticipated but maybe that is just because I didn't read the description thoroughly."
"I had these printed for the handmade soy candles we are giving away at my cousin's bridal shower. I was able to edit the text and pick the color I wanted. Worked out really well!"
"I purchased these to use as a seal for our Stylish Starfish wedding invites with the pocket fold. Customer service was great and removed the "Our Wedding" line so it just has our names and wedding date centered on the square. These are going to be perfect to seal the invites instead of using a wax or other type of seal!"


text:
Tips to help a 2 yr olds cough
B born 7/11/10 K born 12/12/11
I agree, try vicks on the feet, with socks, and I also put it on the chest. Typically I sit in the bathroom with the shower running with DS when he is sick for 10 minutes or so, and then put him to bed with the vaporizer running. Hope your LO feels better soon!
Only on bhb can you get labelled a sanctimommy for flushing when you take a shit. ~ JKMaddie'sMom
I was at a Pediatrics conference a few months ago and a Peditrician from Harvard came and told us all about this study he did comparing honey to cough medicines in kids. It turns out, giving them honey works as good if not better at suppresing coughs in children under 10. Even better, you can give them honey as often as you want and you can't overdose it because it is only honey. I haven't personally tried it on my kids yet (haven't needed to) but I have suggested it to lots of patients and have gotten mostly positive feedback. It is 1 teaspoon of honey as needed for cough.
Disclaimer: It is not safe to give honey to infants under 12 months of age because of the risk of botulism.
Salem (5.12) * Truman (5.10) * Aspen (4.09) * Briana (3.07)
B born 7/11/10 K born 12/12/11
Rainbow boy due 08.26.15
When ds got sick at that age, I usually made a cup of warm hot decaf green tea and put honey in it. He loved it, the honey helped his cough and sweetened it a little bit.
dd 2.8.04
ds 1.11.09
Please ignore any typos, I am attempting to type on my phone, not just an idiot!
Chestal Honey by Boiron. I swear by it for my kids. Hope he's better soon!