text:
- For Home
- For Work
- Computers
- Networking
- Printers
- Servers
- Software
- Storage
- Services
- Analytics & data management
- Applications services
- Business process services
- Data center, workload & cloud services
- Enterprise security services
- Enterprise software services
- IT financing & asset recovery
- Mobility & workplace services
- Support services
- Technology consulting
- All enterprise services
- PC & printing services
- Solutions
- Enterprise Store login
- Public sector purchasing
- Support
- For Home
- For Work
- Computers
- Networking
- Printers
- Servers
- Software
- Storage
- Services
- Analytics & data management
- Applications services
- Business process services
- Data center, workload & cloud services
- Enterprise security services
- Enterprise software services
- IT financing & asset recovery
- Mobility & workplace services
- Support services
- Technology consulting
- All enterprise services
- PC & printing services
- Solutions
- Enterprise Store login
- Public sector purchasing
- Support
Discussion BoardsOpen MenuDiscussion Boards Open Menu
- Welcome to the Community
- 1 categories, 7 boards
- Live with HP Experts
- 1 boards
- Converged Systems
- 1 categories, 1 boards
- Networking
- 6 categories, 22 boards
- Operating Systems
- 7 categories, 77 boards
- HP ExpertOne
- 1 boards
- Partner Solutions
- 3 categories, 4 boards
BlogsOpen MenuBlogs Open MenuCommunity Knowledge BaseOpen MenuCommunity Knowledge Base Open MenuOccasional Page Load IssuesOpen MenuOccasional Page Load Issues Open MenuWe have received reports from a few members that some of our pages have not been loading completely. These issues should be resolved before Noon CET (8:00 AM US EDT) tomorrow, 14 October, 2015.EnglishOpen Menu
- Community Home
- >
- Software
- >
- Enterprise Security Blogs
- >
- HP Security Research Blog
- >
- Protect your Struts1 applications
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Receive email notifications
- Email to a Friend
- Printer Friendly Page
- Report Inappropriate Content
Protect your Struts1 applications
[UPDATE]: Please refer to and install following filter to protect from Classloader maniupulation in Struts1 applications:
Since the last post on how to mitigate the Struts 2 zero day on the wild we have received many queries from customers wondering if their legacy Struts 1 applications were also vulnerable to this same attack.
The Struts security team confirmed that classloader manipulation is also possible in Struts 1 applications even if they don't use OGNL for parameter binding. They have assigned CVE-2014-0114 to this issue.
Further discussions with Struts security team have confirmed that although classloader manipulation has been verified, remote code execution has not been confirmed yet.
At HP we don't wait for an exploited zero day before we take action to protect our customers. Therefore, while the Struts team works on a patch for this issue, we strongly recommend Struts1 developers to take the following actions to mitigate the risk.
Struts1 lacks the Struts2 Interceptor chain so we cannot benefit from the Parameter Interceptor to do the work for us. But we can easily build our own using Servlet Filters for the Struts's org.apache.struts.action.ActionServlet Servlet.
Struts ActionForm bean population relies on ServletRequest.getParameterNames() to first get a list of all parameters being sent on the query and proceed to set those parameter on the ActionForm bean properties.
The following Filter will create a ServletRequest wrapper that overwrites getParameterNames() method and checks the parameter names against a customizable regular expression. If a parameter name matches this regular expression, it will be removed from the list returned by ServletRequest.getParameterNames().
Figure 1: ParamFilter.java
package com.company.filters; import java.io.IOException; import java.util.*; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; public final class ParamFilter implements Filter { FilterConfig filterConfig = null; public void init(FilterConfig filterConfig) throws ServletException { this.filterConfig = filterConfig; } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { String regex = this.filterConfig.getInitParameter("excludeParams"
); chain.doFilter(new ParamFilteredRequest(request, regex), response); } public void destroy() { } static class ParamFilteredRequest extends HttpServletRequestWrapper { private HttpServletRequest originalRequest; private String regex; public ParamFilteredRequest(ServletRequest request, String regex) { super((HttpServletRequest)request); this.originalRequest = (HttpServletRequest) request; this.regex = regex; } public Enumeration getParameterNames() { List<String> requestParameterNames = Collections.list((Enumeration<String>) super.getParameterNames()); List finalParameterNames = new ArrayList(); for (String parameterName:requestParameterNames) { if (!parameterName.matches(regex)) { finalParameterNames.add(parameterName); System.out.println("Param : " + parameterName); } } return Collections.enumeration(finalParameterNames); } } }
Figure 2: Web.xml configuration
<filter> <filter-name>ParamFilter</filter-name> <filter-class>com.company.filters.ParamFilter</fil
ter-class> <init-param> <param-name>excludeParams</param-name> <param-value>(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|") ]|\[).*</param-value> </init-param> </filter> <filter-mapping> <filter-name>ParamFilter</filter-name> <servlet-name>YOUR ACTION SERVLET</servlet-name> </filter-mapping>
We would like to thank the Struts security team for their prompt response and their validation of the proposed mitigation filter.
Update (01/05/2014):
HP Security Research Team has confirmed remote code execution is possible on certain application servers and has notified Struts security team.
Stay Secure!
In the original Struts 2 vulnerability documentation, the regular expression also check for the following initial strings followed by a dot:
- dojo
- struts
- session
- request
- application
- servletRequest
- servletResponse
- parameters
- action
- method
Why the regexp for Struts 1 presented here does not include them? Are they relevant?
Hi Arturo,
Thanks for your comment. Those keywords are relevant if evaluated in the context of the Struts2 Value Stack via OGNL. Struts1 does not use OGNL and has no access to the anything similar to the Value Stack and so they dont suppose a specific risk.
Is it safe to assume that if I am not using ActionForm, but simple using actions alone, then I am not impacted by this vulnerability?
Hi Kishore,
Thanks for your comment. If there is no ActionForm associated with the action in the action declaration, then Struts will not start the ActionForm binding process and therefore this particular attack vector will not be possible. However we strongly recommend taking all possible mitigation actions to protect your applciations from unknown attack vectors that may be working on the wild.
Thanks for making this code available. What license applies to it if any?
Here is an improved version of the filter that compiles the pattern only once: https://gist.github.com/anonymous/0045ef4df99b31b4
Hi Patrick,
Thanks for your comment. The fix is not licensed in any way and its completely open source so that any one is free to use it or modify it.
It is provided as-is with no guarantees nor support and designed as a temporal workaround until a patch is made available.
Can you tell a sample test URL that we can use to test this logic?
Thanks for the comment pmulay,
Any action associated with an actionForm is vulnerable. URL should look like http://myserver.com/myaction.do
how do you test if the vulnerability is there and then verify the fix addressed the issue? The main problem I have is I don't know how to test it the vulnerability and thus can't verify if the issue is really addressed after incorporating this fix. Thanks for any help you can provide.
Hi Jamie,
Thanks for your comment, Im sorry I cannot explain how to verify if the issue has been fixed withouth disclosing the exploit details.
All I can say is that the filter has been tested in our labs and verified by the Struts security team.
Thanks for providing the patch!
After analysing the regular expression, did you realise that in your regular expression:
the prefix part can be simplified to:
Is this still what you intended to do?
I'm using Struts 1.3.10 with Websphere 8. I tried testing the above fix in my application by providing urls with parameters like "?class.classLoader.defaultAssertionStatus=true", or "class.classLoader.resource.dircontext.docBase=som
Thanks for the comment William,
Yes I realized that and I would suggest removing the .* from the first group since otherwise properties ending on "class" wont be accepted. I chose to stick to Struts2 proposed regex and notify them about the extra ".*"
Hi Reva,
Thanks for your comment. This filter is a temporal fix for this particular vulnerability. Struts 1 uses getParameterNames to loop through parameters that are going to be bound to ActionForm properties. So in order to mitigate this issue, it is enough to prevent dangerous property names from appearing in the return collection of getParameterNames(). Other request methods like getParameters are not intercepted by the filter and so those parameter will still be available for the servlets except that an ActionForm property mapping will be prevented.
Hi Alvaro,
Can you give an example url parameter which will be prevented by this Filter?
Hi Reva,
The one you posted is an example of a bean property that wont be bound to the actionForm, although a request.getParameters() will return it. The filter will prevent request.getParameterNames() but not request.getParameters(), effectively preventing ActionForm property binding but not other legitimate accesses to the request parameter.
I have been able to replicate the exploit when using a ActionForm directly, but not when using DynaActionForms. We are using DynaActionForms it appears to use form properties from the struts-config instead of the request.getParameterName during the ActionForm binding process. Is this correct?
Hi JFreedom,
Thanks for your comment. DynaActionForms use request.getParameterNames() in the same way that ActionForms do. But the bind process is slightly different, DynaActionForms contains a HashMap where the property name and value are stored instead of using apache commons BeanUtils to set up the beans properties.
Thanks so much for addressing this.
You responded to a comment that the regex given by Struts 2 is slightly incorrect, but I was unsure how to apply your comments. You said to remove the .* from the first group, so would this change the regex to
or something else? I was finding that in our application, with the original regex, we were able to set property names that ended in "class" just fine but were also able to deny setting those that would affect the class object directly, but I'm wondering if I'm missing something. Can you please clarify?
Hi Kristina,
Thank you for your comment. The original regex suggested by the struts team is effectively equivalent to
That regex will match and prevent setting nested properties like: somethingclass.prop
But it will allow setting a property like: simpleclass (no nesting)
The regex that you suggest:
will allow to set nested and simple properties that end in "class" but will prevent the classloader manipulation.
Hello ,
Is this ok if I use below filter mapping in given solution.
Hi Alvaro,
I understand your comment about not able to detail how to verify the vulnerability. I am wondering if we can discuss this in private. I am working on a product where we need to verify if our product is vulnerable. Not sure if you can reach me via the email address I provided in the form or if possible, I can also be reached at xxx-xxx-xxxx. Thanks in advance.
Hi ushasingh,
That should work if all your actions use the .do suffix
Hi Jamie,
Im really sorry, but I cannot give any details on the exploit. Please get in contact with the Struts security team to see if they can help you.
Hi Team,
Thank you for your solution.
But which name I need to configure in servlet-name
<servlet-name>YOUR ACTION SERVLET</servlet-name>
It depends on how do you name your Struts1 servlet. Look for a servlet definition like:
The servlet name for this particular example is "action".
Hi Nilesh,
Thank you for your comment. The original regex suggested by the struts team will match and prevent setting nested properties like: myclass.something
But it will allow setting a property like: myclass (no nesting)
The following regex will allow to set nested and simple properties that end in "class" but will prevent the classloader manipulation.
Hi Shigee,
No, this particular bug only affects Action Form bindings
I've coded this, tested it, and I can see the bit of code that lets parameters through is being used, by examining the log.
So negatively, I can see this is working, no problemo.
How can I test a positive (ie, that somehing is being trapped by the code)? I dont want to know anything about the exploit, but I need a strategy whereby I can show this code is working.
Any ideas? Am I missing something glaringly obvious here? Me missing something obvious is always the default position.
Hi Tom,
Thanks for your comment. If the filter works ok and its correctly deployed, it should be preventing access to certain parameters. The parameters that are going to be intercepted are the ones in that match the regular expression. So for example if you have a Action form with a user field of type "User", then trying to set the nested property "user.class" should be trapped by the filter and logged.
1)You *should* see the parameters trapped by your regex with the System.out:
if (!parameterName.matches(regex)) { finalParameterNames.add(parameterName); System.out.println("Param included is : " + parameterName); }
else { System.out.println("Param excluded is : "+parameterName); }
2)Shark your line if you want to see the traffic coming and going
Saludos Cordiales desde EEUU,
Can we define a security policy and secure specific classes? Will this help in solving this?
I was able to recreate the issue (Struts 1.1) with url parameters (class.ClassLoader), which resulted in modifying the classloader settings. But could not see any issue with html elements with name class.ClassLoader. Is it sufficient if I only put parameter blacklisting in the filter?
Would like to know why the ParamWrapperFilter reads the input stream and check for blacklist pattern.
Parameter blacklistt should be used to protect query parameters and request body (so it is necessary to read and protect the request input stream)
I would like to know whether struts team will release the Struts1.3 version with this vulnerability been fixed ?
Thanks in advance.
Hi Support,
Any update for the my earlier query ?
In addition, Is this vulnerability impacted If my project is using the DynaActionForm ?
Please let me know in details.
Thks and Rgds
Hi support ,
We are using DynaActionForm in my project.
I would like to check with Struts support team to confirm whether the DynaActionForm is really impacted with this vulnerability.
Please let us know in details.
FYI. I have raised the same type of question last month and the question was not published yet into the portal.
Hi Feroz,
DynaActionForms are impacted but Im sorry we cannot disclose details.
Hi Alvaro,
I have applied filter using StrutsFilter1.jar from maven repository and modifying web.xml file by adding this:
However, when I Analyze project using forify static analyzer it still flags Struts1Classloader issue.
Is that supposed to be?
Hi nvaslav48,
A bug has been filed and issue will be remove in future releases.
Also I am trying to Test the ParamWrapperFilter which was last updated on Jan 22. I am providing "][]Class][<>" as a value to parameterName, however pattern.matcher(parameterName).matches() line always returns false. Please can somebody explain me what I am doing wrong here.
Hi Alvaro,
As per your suggestion, I have posted issue in github repo. Please let me know if there is a fix for Classloader manipulation issue for Struts1.x.
Hi Sohil,
I have just replied to your comment in github: https://github.com/rgielen/struts1filter/issues/4
Also, please check for a different workaround that implies patching Struts 1 code or using an unofficial patched build: https://github.com/rgielen/struts1filter/issues/3
Workaround: use patched struts distribution instead of this filter.
Patch link: https://github.com/apache/struts1/pull/1/files
Patched struts 1.3.10 is available for example for Fedora 20 in build "struts-1.3.10-10.fc20" in form of RPM: http://koji.fedoraproject.org/koji/buildinfo?build
Follow Us on Facebook
Follow Us on Twitter
Follow Us on LinkedIn
Follow Us on Google Plus
Follow Us on Youtube
Follow Us on SlideShare
- The monthly patch review – October, 2015
- PDB Type Theft
HP Security Research OSINT (OpenSourc
e Intelligen c...
Security intelligen
ce viewpoint: Encryption as an ...
HP Security Research OSINT (OpenSourc
e Intelligen c...
- HPSR Software Security Content 2015 Update 3
HP Security Research OSINT (OpenSourc
e Intelligen c...
HP Security Research OSINT (OpenSourc
e Intelligen c...
- Security research survey: What's your OpSec situat...
HP Security Research OSINT (OpenSourc
e Intelligen c...
- SBradley on: HP Security Briefing, Episode 22: The hidden dange...
Analyzing CVE-2015-1
635 from cause to cure
- Percy Rotteveel on: Crypto Manifesto 2015
Ivan Sh
Full details on CVE-2015-0
096 and the failed MS10-...
Sandeep Sagar
HPSR, Microsoft, disclosure
, and the $125,000 bug ...
- Giorgio di Grazia on: POS malware - a look at Dexter and Decebal
Technical analysis of the SandWorm Vulnerabil
ity (...
- Ajayi Oluwaseun Emmanuel on: Hacking my smart TV - an old new thing
Update your Struts 1 ClassLoade
r manipulati on filt...
Lotie Brink
Reverse Engineerin
g NAND Flash Memory – POS device...
© 2015 Hewlett-Packard Development Company, L.P.


text:
Been to the doctor for a painful medical procedure lately? How about overexerted yourself over the weekend during a ballgame with your buddies? In either case, over the counter pain medication, or analgesics if you prefer, will do. An overwhelming number of pharmaceutical companies have some sort of chemical concoction waiting to be picked up at the local pharmacy.
Recent findings however may change the way people think about mitigating pain. Evidently the mere mental representation of a partner is enough to mitigate experienced pain (Master et al., 2009). Not surprisingly holding the hand of one's partner during a painful procedure is better than holding a strangers if both were to stand behind a curtain. Would you guess that the picture of one's partner is better than holding the partners hand while behind a curtain? Masters et al., found that indeed the mental representation or picture reduced more pain. A question left unanswered is what to do if you're single? Alternatively can a different source (i.e. grandma's picture) replace the partner's picture?
Master, S.L., Eisenberger, N.I., Taylor, S.E., Naliboff, B.D., Shirinyan, D., Lieberman, M.D. (2009). A picture's worth: Partner photographs reduce experimentally induced pain.

subset: commoncrawl


text:
1/4 oz Gold Pandas
1/4 oz Gold Pandas - The Chinese Gold Panda bullion coins are among the most popular gold coins on the market. Issued by the People's Republic of China since 1982, the Chinese Gold Pandas are .999 fine gold. Several Chinese mints produce the Chinese Gold Panda bullion coins, including Beijing, Shenzhen, Shanghai, and Shenyang.
The obverse design of the Gold Panda coin depicts the image of the Hall of Prayer for Good Harvest in the Temple of Heaven in Beijing. Unlike many gold bullion coins, the reverse design of the Chinese Gold Panda changes each year. Though varying each year, the reverse nevertheless always depicts the rare yet well-known animal inhabiting China: the panda. Loved worldwide for its distinctive coloring, natural and unstrained appearance, meek temperament, and innocence, the panda celebrated on this coin gives the Gold Panda bullion coin series an endearing touch.
To view available 1/4 oz Gold Chinese Pandas or to get gold prices, click on the image representing the gold coins of your interest:


text: The community health and awareness team donates nearly $700 to the Food Bank at a ceremony at Castleview Hospital. CHAT raised the funds at last year's health fair. The proceeds will go toward helping the needy in our area. The 2006 health fair will take place Oct. 20 at College of Eastern Utah. The event provides fasting, cholesterol and glucose panels as well as flu shots for a minimal fee. The fair will start at 7 a.m. and run through 11:30 a.m. A luncheon will follow at CEU where Dr. Etzel will be the keynote speaker. All proceeds from this year's health fair will once again be donated to the food bank.


text:
Directions to Casa Caracol
Calle Argentina 19a, Barrio de Mexicanos, San Cristobal de las Casas, Mexico
- Info
- |
- Rates
- |
- Map & Directions
- |
- Reviews
- |
- Facilities
Map & Directions
From the Zocalo: Cross the plaza in a northward direction to the plaza Cathedral and continue to head north up Calle 20 de Noviembre (the pedestrian road) towards the municipal market until you reach Real de Mexicanos (five blocks). Turn left down this road and walk four blocks until you reach Calle Argentina... You will see our sign on the right!
If you arrive into the bus station we are happy to pay for your taxi to the hostel.


text:
(based on 3 reviews)
Ratings Distribution
5 Stars
4 Stars
3 Stars
2 Stars
1 Stars
of respondents would recommend this to a friend.
Reviewed by 3 customers
Sort by
Displaying reviews 1-3
Back to top
By komfort 1952
from Ceres, CA
About Me Budget Shopper
Best Uses
Comments about Freezer Labels - Set Of 500:
nice labels
Bottom Line Yes, I would recommend this to a friend
Was this review helpful? Yes / No
- You may also flag this review
Best freezer lables ever
By Diana
from Woodside, NY
About Me Midrange Shopper
We freeze food and would like to label it. We have tried writing with markers--the ink smears and becomes unreadable. We have tried other labels and they all fall off. These do not. They are the best labels ever. They accept ink easily, show the text clearly, and the label remains legible even with handling.
(1 of 1 customers found this review helpful)
Cheaply made and took too long to arrive
By Tammy
from St. Croix, USVI
These stickers were nothing like described in ad. They are very small and flimsy. Don't know how well they stick, yet because it took us a month to get them. I usually get things sent in the mail in about 5 days, but these took much longer. The company uses Fed Ex in combination with the USPS instead of simply putting it in a package and sending straight from a post office. I do not understand that at all. They were just some freezer labels. I do not recommend these at all.
Bottom Line No, I would not recommend this to a friend


text:
A former USU Eastern men's basketball coach allegedly calling himself an "Islamist Jihadist" was arrested and released in early July in Arizona after making threatening statements to professors on the campus of an Arizona College.
Christopher Craig, who served as head coach for the Golden Eagles from 2007-2010, was taken into police custody on July 10 in Thatcher, Ariz., after he allegedly went into a classroom on the campus of Eastern Arizona College waving a Bible and asking the instructor if he was Mormon. Craig then left the classroom and went to another building on the campus and continued to make derogatory statements about Mormons and Catholics before being arrested at a local Walmart store.
Craig, 32, was booked into the Graham County Jail on a number of charges, including investigation of disorderly conduct, threatening and intimidating, and interruption of an educational facility. Craig was released on July 15 after the district attorney declined to file charges against him.
A week later, police in Steamboat Springs, Colo., received 911 calls from residents about a car driving around a parking lot with a man who had a shirt wrapped around his head, a bandana wrapped around his face and sunglasses, videotaping himself. Police talked with the man who said that he was an "Islamist Jihadist" and that "in a couple of weeks everyone will know who I am". Police did not identify the man, but said he fit the description of someone arrested in Arizona earlier in the month.
Police in Fort Collins sent out a bulletin warning local churches in the area about the self-proclaimed "Islamist Jihadist" who has made threats towards the Church of Jesus Christ of Latter-day Saints and the Catholic Church.
Craig, who has kept active in social media, has continued to make posts on his personal blog with the latest entries coming on July 30. In some of his posts, Craig wrote "Everyone's [sic] on Earth mindset needs to change immediately, again, this can be done the 'easy' way, or the 'hard' way" and "West of the Mississippi River is mine. Period. I do not do diplomacy. YVHV (sic) told Me to go see Muhammed face to veil, and so I go. You think Chris has a say?" [YHWH - the Tetragrammaton - is the Anglicized version of the Hebrew letters representing "Lord" or "God." Ed.] His twitter account, which showed conversations with friends, former players he coached, biblical verses and doomsday predictions, was recently suspended.
Craig resigned from his job at Midland College in Midland, Texas on March 21. His resignation came amid Craig citing end-of-the-world prophecies and conspiracy theories on his personal blog and twitter account. His personal blog contained 31 hand written pages dated March 20 that talked about biblical verses, the possible coming of a New World Order, a possible assassination attempt on President Barack Obama while on a visit to Israel last week and much more.
Posting on his twitter account, Craig said he traveled to Jerusalem on March 21 and that the end of the world was coming on March 22. According to sources, the FBI and Secret Service contacted Craig's family about the blog and twitter posts. Craig allegedly was arrested in Israel shortly after arriving in the country. Postings on his twitter account went silent for five days before he wrote in multiple tweets on March 26 that he "currently am scared for my family and our lives. Secret Service, FBI, has been in contact with many on my behalf....I am not a threat in any way."
Craig helped guide the Golden Eagles to the 2010 NJCAA National Tournament where the team finished in third place, their best finish in over 50 years. At Northern Colorado, he served as an assistant to head coach B.J. Hill and was a part of the team that advanced to the NCAA Tournament in his only season on the bench. During his two seasons as coach at Midland, Craig's teams went 37-18 but missed advancing to the playoffs in both seasons as his teams dealt with injuries and inconsistent play.
Craig played basketball at Arizona Western College before transferring to the University of Texas-El Paso to play under then head coach Billy Gillespie in 2002.
Police in Colorado said that Craig was last seen at Rocky Mountain National Park on July 25.


text:
PPG Industries recently marked the startup of a new electronic materials group (EMG) manufacturing cell at its Springdale, PA., industrial coatings plant. This addition positions the company in the fast-growing global electronics market for conductive inks and coatings. The commissioning of the new cell marks the transfer of business and technology from industrial coatings producer Spraylat Corp., which PPG acquired late last year.
Among the range of conductive inks and coatings the EMG cell will produce are two new technologies – graphene and nanosilver conductive inks – for specialized electronics applications in the medical, automotive and telecommunications fields. The market for such technologies is expanding rapidly and is expected to continue growing for the next decade, according to Glenn Thornley, PPG operations director, industrial coatings.
PPG Expands Springdale, PA Facility
Published June 18, 2013
Related Paint & Coatings Manufacturer News
Related Breaking News
Related Products


text:
2010 updates to model-data comparisons
As we did roughly a year ago (and as we will probably do every year around this time), we can add another data point to a set of reasonably standard model-data comparisons that have proven interesting over the years.
First, here is the update of the graph showing the annual mean anomalies from the IPCC AR4 models plotted against the surface temperature records from the HadCRUT3v, NCDC and GISTEMP products (it really doesn't matter which). Everything has been baselined to 1980-1999 (as in the 2007 IPCC report) and the envelope in grey encloses 95% of the model runs.
The El Niño event that started off 2010 definitely gave last year a boost, despite the emerging La Niña towards the end of the year. An almost-record summer melt in the Arctic was also important (and probably key in explaining the difference between GISTEMP and the others). Checking up on our predictions from last year, we forecast that 2010 would be warmer than 2009 (because of the ENSO phase last January). Consistent with that, I predict that 2011 will not be quite as warm as 2010, but it will still rank easily amongst the top ten warmest years of the historical record.
The comments on last year's post (and responses) are worth reading before commenting on this post, and there are a number of points that shouldn't need to be repeated again:
- Short term (15 years or less) trends in global temperature are not usefully predictable as a function of current forcings. This means you can't use such short periods to 'prove' that global warming has or hasn't stopped, or that we are really cooling despite this being the warmest decade in centuries.
- The AR4 model simulations are an 'ensemble of opportunity' and vary substantially among themselves with the forcings imposed, the magnitude of the internal variability and of course, the sensitivity. Thus while they do span a large range of possible situations, the average of these simulations is not 'truth'.
- The model simulations use observed forcings up until 2000 (or 2003 in a couple of cases) and use a business-as-usual scenario subsequently (A1B). The models are not tuned to temperature trends pre-2000.
- Differences between the temperature anomaly products is related to: different selections of input data, different methods for assessing urban heating effects, and (most important) different methodologies for estimating temperatures in data-poor regions like the Arctic. GISTEMP assumes that the Arctic is warming as fast as the stations around the Arctic, while HadCRUT and NCDC assume the Arctic is warming as fast as the global mean. The former assumption is more in line with the sea ice results and independent measures from buoys and the reanalysis products.
There is one upcoming development that is worth flagging. Long in development, the new Hadley Centre analysis of sea surface temperatures (HadISST3) will soon become available. This will contain additional newly-digitised data, better corrections for artifacts in the record (such as highlighted by Thompson et al. 2007), and corrections to more recent parts of the record because of better calibrations of some SST measuring devices. Once it is published, the historical HadCRUT global temperature anomalies will also be updated. GISTEMP uses HadISST for the pre-satellite era, and so long-term trends may be affected there too (though not the more recent changes shown above).
Page 1 of 2 | Next page


text:
I finished my Stripe Study Shawl!
It's sitting on Maggie's twin size bed, so you can see for yourself how big it is. I used almost two full skeins of the Beaverslide 2-ply Sport/Sock weight in the Hidden Lake (teal) colorway, and nearly one full skein of the Natural Buff. This yarn, I can't even tell you. It's the best yarn ever. You really just have to see for yourself. The fiber content is 80% fine wool and 20% fine kid mohair. It comes in 458 yd skeins for $14.50. Although the suggested needle size for this yarn is a size 2-3 needle, I used a size 8 for the Stripe Study Shawl, and the fabric is velvety soft, lofty, warm, and has beautiful drape. Do yourself a favor and order some Beaverslide for yourself. Learn more about Beaverslide Dry Goods here. They are not paying me, I just loooove the yarn.
After I finished my shawl, I decided that it was high time to knit this year's slippers. I started on Thursday night and by Friday afternoon I was wearing them! They were damp, but whatever. They were mostly dry.
I used my favorite slipper pattern, Felt Clogs (AC-33) by Bev Galeskas, from Fiber Trends. I have knit this pattern many, many times. It's one of those patterns that is written perfectly, is very clear, and if you have your wits about you then you'll be fine. Unfortunately while knitting slipper number one I did not have my wits about me. I came to the last row of the instep shaping, had 4 extra stitches and should have been at the marker (I was not). I know from experience that it wasn't the pattern's error, it was mine. It's easy to get lost in these patterns if you don't keep track of your place. I was paying more attention to the television program I was watching than to the pattern I was knitting. But instead of unknitting, I decided that four stitches was not a big deal, went on to knit the cuff, and finished the slipper, four extra stitches and all.
I knit slipper number two without incident, felted them, and now can't even tell which one has the error. Gosh, I love felting.
It's a lovely cool morning here in North Carolina. I have my new shawl on my shoulders and my new slippers on my feet. It feels so good to be knitting again.


text:
Returning Customers
If you are a registered user, please enter your ART portal username and password.
Awana Cubbies Leader Casual Uniform
Item# MV-CubbieLeaderUniform2013
- Sales Unit: each
The official leader uniform for both men and women. This blue, short-sleeve sport shirt — with a three-button front and embroidered Cubbies logo emblem — fits men and women. Also in ladies cut. Cotton blend. Allow for shrinkage during washing. Special sizes are not available.


text:
With more than 18,000 square feet of meeting space in 14 rooms and featuring two private dining areas, the Radisson Cleveland-Eastlake can accommodate your event or meeting with style and ease. The Grand Ballroom features 5,664 square feet with an adjoining 1,850 square footage. With a total of more than 7,500 square feet, the ballroom can accommodate dinners and meetings of 450+ persons or gatherings and cocktail receptions for 700. Convenient breakouts and flexible options allow you to execute your vision with ease. The executive chef and culinary team will delight your guests and attendees with upscale American cuisine featuring local produce and flavors. You can view the events menu here.
Are you ready to plan your meeting in Cleveland, OH? Please contact the hotel's sales department and meet with one of the event specialists at +1 (440) 497-1610 or email@example.com.


text:
BUFFALO, N.Y. -- Buffalo's public school system's recycling efforts are even less ambitious than those of the city.
Most schools aren't even recycling bottles and cans, and the ones that do are only recycling paper and cardboard on a regular basis.
"Most schools are not recycling," said Andy Goldstein, the city's former recycling coordinator said last month on WUFO-AM.
"There are a few schools that have space issues and don't have room for it, but it can be done."
Susan Eager, the district's director of plant operations, said there have been varying degrees of recycling success over the years. Consistency has been a problem, she said.
"If you can't have the consistency, then the program is going to fail," she said.
Read more at investigativepost.org


text:
- Musician's Friend Best Selection, Price & Service. Guaranteed.
Call our Gear Heads
at: 800-449-9128
Call our Gear Heads
at: 800-449-9128
Results 1 - 1 of 1 matches
The World Beat 18" Tunable Bodhran is easily tuned with an included wrench to create a broader tonal range. A...
Our product catalog varies by country due to manufacturer restrictions. If you change the Ship-To country, some or all of the items in your cart may not ship to the new destination.


text:
Webbing & Accessories Cord
There is no end to the many uses for webbing and accessory cord. Build bomber anchors, put together a slackline, organize your climbing rack, attach your creek boat to your truck and more with Rock/Creek's selection of BlueWater webbing and accessory cord. With so many sizes, styles and colors of tubular webbing, sewn slings, daisy chains, reflective and non-reflective accessory cord, there's no way you won't find what you're looking for.
The products in the Webbing & Accessories Cord category have an average rating of 4.9 of 5 from 14 customer reviews.


text:
Ariel Dress
Style: 28467884
Utterly romantic and feminine, the delicate eyelash lace on Quilaree's asymmetric silhouette plays softly against bare shoulders, both under the light of the moon and on breezy, petal-strewn afternoons. Side zip and hook-and-eye closure. Boning and bust cups. Nylon lace; polyester satin lining. Dry clean. Imported.
- A BHLDN exclusive
- Falls 22.5 from natural waist
- Grosgrain sash included
Contact a BHLDN Stylist for style advice, reassurance, second opinions


text:
Use Overlays to layer your content on the map
Check out the video on how to use GPS overlays on Map Maker.Overlays
You can use overlays to add your own maps and images on top of the regular map to help make mapping easier. Orient yourself while looking at the world from above to understand what additional landmarks or places may be worth improving on the map.
Step 1: Enable Overlays
- Click the gear icon at the top right corner on the viewport.
- Click Labs from the dropdown.
- Scroll down to "Overlays" and click the button next to "Enable."
- Click Save. You will now see the Overlays button at the top right of viewport.
Step 2: Add Overlays
- Click Manage Overlays on the "Overlays" button at the top right.
- Add an overlay:
- To add KML file, copy the KML URL.
- To add an image, copy the map image URL.
- Click Add.
- When you are finished managing your overlays, click OK.
If you refresh your browser tab, you will need to re-add the URLs to Overlays.
Collect data for overlays:
- Smartphone apps like My Tracks will let you turn your phone into a GPS Device.
- Turn data collected by GPS into KML using Google Earth.
- Photos taken with your smart phone often contain location information and can be used to help you map. If not, check your phone's camera settings to enable location capture.
- Then, host your content on Google:
- KML: Google Maps Engine, Google Drive, Google Fusion Tables
- Photos: G+ Photos
Note: there are size and complexity restrictions for KMLs to be displayed on Google Maps.


text:
Feb 17, 2015Winter Storm & Extreme Cold Survival TipsThere is much to be said about preparing for a winter storm or adverse weather conditions. However, there are times that the time to prepare has come and gone or there is no time to prepare. What can you do? Where do you go? What should you watch for? How do you stay warm? Plenty of questions, and fortunately, there are answers.
Feb 5, 2015Camp Chef: A Better Way
A better way? That is the Camp Chef way. See for yourself in this recent article from SHOT Daily. Click here to view the article.
Feb 3, 2015Artisan Margherita Pizza
One thing that nearly everyone has had at some point in their life is a pepperoni or cheese pizza. It is time to change things up and this recipe fits the bill nicely. With its fresh ingredients and great flavor, a margherita pizza will quickly become a favorite.
Jan 29, 2015Smoked Bacon Wrapped Meatballs
Having quality finger food is a must for just about any gathering. This recipe for smoked bacon meatballs will hit a homerun every time.
Jan 26, 2015Smoked Buffalo Wings
For any gathering, having finger food is a must. Keep your fingers busy and your mouth happy with this great tasting recipe for Smoked Buffalo Wings.
- 1/3 cup melted butter
- 1/3 cup hot pepper sauce
- 1/3 cup ketchup
- 2 tablespoons honey
- 12 wings (about 1 lb), tips removed
Jan 22, 2015Smoked Jalapeno Poppers
Having a recipe that is quick to make and doesn't take long to cook are two critical factors when an event approaches. This recipe aims to please. It is quick to make and has a relatively short cook time.


text:
Nomader Pants (Men's) (out-of-stock)
Out of Stock Product Number: 24219
The Men's Nomader Pants by Patagonia are lightweight technical climbing and trekking pants made of stretch nylon with a Deluge DWR (durable water repellent) finish and 40-UPF sun protection.
For slickrock canyons, high alpine country or vertical granite walls, these are our most versatile trekking, climbing and backpacking pants. They feature a resilient, stretchy blend of 95% nylon (60% recycled) and 5% spandex that feels lightweight against the skin, resists abrasion, and provides 40-UPF sun protection. A Deluge DWR (durable water repellent) finish sheds water. The waist has a zip fly, a low-profile snap closure, offset belt loops and stretch-elastic side panels for a personalized fit. A gusseted crotch and articulated knees allow you to move freely. Mesh-lined front pockets increase airflow; zippered security pockets on each thigh keep your topos and energy bars within reach. Inseam (size 32) is 32".
* This product does not qualify for shipping to all countries.
- Made of a versatile and durable nylon/spandex fabric, with a grid-like texture that's water-repellent and provides 40-UPF sun protection
- Belt loops, zip fly, and snap closure at waist; stretchy panels at hips for comfort
- Three zippered pockets: two large on legs, one on back; front-contoured slash pockets; two back drop-in pockets; all pockets have ventilating mesh pocketbags
- Gusseted crotch and articulated knees for ease of movement
- 32"" inseam
- 4-oz 95% nylon (60% recycled)/5% spandex with a DWR (durable water repellent) finish and 40-UPF sun protection
Gender: Men's
Weight: 362 g (12.8 oz)
Material: 4-oz 95% nylon (60% recycled)/5% spandex, with DWR (durable water repellent) finish and 40-UPF sun protection
Fit: Regular fit
Season: S14
Vendor ProductId: 55015
Review ProductId: 24219
Reviewed by 1 customer
- Attractive Design
- Comfortable
- Quality Material
- Irregular Fit
Best Uses
- Biking
- Casual Wear
Comments about Patagonia Nomader Pants (Men's):
I wear these pants when biking to school. They're very comfortable, and I love the elasticity of the material; it gives the pants a very durable and flexible feel. They are not warm at all for cold weather riding, but that's nothing a pair of thermal underwear can't fix.
The pants are well designed, and I appreciate the zippered wallet pocket, for that added security. The zippered cargo pockets are excellent too, though perhaps a bit small. All of the zippers are working smoothly and don't get caught on the fabric, at least so far.
My only complaint is that they are a bit loose in the waist on me. I got the size 34 because I'm tall and need the long inseam, but in return I got a slightly wider waist than I might have preferred. It's only a slight problem, though, and I definitely recommend these pants. I love mine. :-)
- Waist:
- Feels too big
- Inseam:
- Feels true to length
- Was this a gift?:
- No


text:
10 U.S. Code § 2304c - Task and delivery order contracts: orders
(a) Issuance of Orders.— The following actions are not required for issuance of a task or delivery order under a task or delivery order contract:
(1) A separate notice for such order under section 1708 of title 41 or section 8(e) of the Small Business Act (15 U.S.C. 637 (e)).
(b) Multiple Award Contracts.— When multiple task or delivery order contracts are awarded under section 2304a (d)(1)(B) or 2304b (e) of this title, all contractors awarded such contracts shall be provided a fair opportunity to be considered, pursuant to procedures set forth in the contracts, for each task or delivery order in excess of $2,500 that is to be issued under any of the contracts unless—
(1) the agency's need for the services or property ordered is of such unusual urgency that providing such opportunity to all such contractors would result in unacceptable delays in fulfilling that need;
(2) only one such contractor is capable of providing the services or property required at the level of quality required because the services or property ordered are unique or highly specialized;
(3) the task or delivery order should be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to a task or delivery order already issued on a competitive basis; or
(c) Statement of Work.— A task or delivery order shall include a statement of work that clearly specifies all tasks to be performed or property to be delivered under the order.
(d) Enhanced Competition for Orders in Excess of $5,000,000.—In the case of a task or delivery order in excess of $5,000,000, the requirement to provide all contractors a fair opportunity to be considered under subsection (b) is not met unless all such contractors are provided, at a minimum—
(1) a notice of the task or delivery order that includes a clear statement of the agency's requirements;
(3) disclosure of the significant factors and subfactors, including cost or price, that the agency expects to consider in evaluating such proposals, and their relative importance;
(4) in the case of an award that is to be made on a best value basis, a written statement documenting the basis for the award and the relative importance of quality and price or cost factors; and
(e) Protests.—
(1) A protest is not authorized in connection with the issuance or proposed issuance of a task or delivery order except for—
(A) a protest on the ground that the order increases the scope, period, or maximum value of the contract under which the order is issued; or
(f) Task and Delivery Order Ombudsman.— Each head of an agency who awards multiple task or delivery order contracts pursuant to section 2304a (d)(1)(B) or 2304b (e) of this title shall appoint or designate a task and delivery order ombudsman who shall be responsible for reviewing complaints from the contractors on such contracts and ensuring that all of the contractors are afforded a fair opportunity to be considered for task or delivery orders when required under subsection (b). The task and delivery order ombudsman shall be a senior agency official who is independent of the contracting officer for the contracts and may be the agency's competition advocate.
Source(Added Pub. L. 103–355, title I, § 1004(a)(1),Oct. 13, 1994, 108 Stat. 3252; amended Pub. L. 110–181, div. A, title VIII, § 843(a)(2),Jan. 28, 2008, 122 Stat. 237; Pub. L. 111–350, § 5(b)(14),Jan. 4, 2011, 124 Stat. 3843; Pub. L. 111–383, div. A, title VIII, § 825, title X, § 1075(f)(5)(A),Jan. 7, 2011, 124 Stat. 4270, 4376; Pub. L. 112–239, div. A, title VIII, § 830,Jan. 2, 2013, 126 Stat. 1842.)
2013—Subsec. (e)(3). Pub. L. 112–239struck out par. (3) which read as follows: "Paragraph (1)(B) and paragraph (2) of this subsection shall not be in effect after September 30, 2016."
2011—Subsec. (a)(1). Pub. L. 111–350substituted "section 1708 of title 41" for "section 18 of the Office of Federal Procurement Policy Act (41 U.S.C. 416)".
Subsec. (e). Pub. L. 111–383, § 1075(f)(5)(A), made technical correction to directory language of Pub. L. 110–181, § 843(a)(2)(C). See 2008 Amendment note below.
Subsec. (e)(3). Pub. L. 111–383, § 825, amended par. (3) generally. Prior to amendment, par. (3) read as follows: "This subsection shall be in effect for three years, beginning on the date that is 120 days after the date of the enactment of the National Defense Authorization Act for Fiscal Year 2008."
2008—Subsec. (d). Pub. L. 110–181, § 843(a)(2), added subsec. (d). Former subsec. (d) redesignated (e).
Subsec. (e). Pub. L. 110–181, § 843(a)(2)(C), as amended by Pub. L. 111–383, § 1075(f)(5)(A), added subsec. (e) and struck out former subsec. (e). Former text read as follows: "A protest is not authorized in connection with the issuance or proposed issuance of a task or delivery order except for a protest on the ground that the order increases the scope, period, or maximum value of the contract under which the order is issued."
Pub. L. 110–181, § 843(a)(2)(A), redesignatedsubsec. (d) as (e). Former subsec. (e) redesignated (f).
Subsecs. (f), (g). Pub. L. 110–181, § 843(a)(2)(A), redesignatedsubsecs. (e) and (f) as (f) and (g), respectively.
Effective Date of 2008 Amendment
Pub. L. 110–181, div. A, title VIII, § 843(a)(3)(B),Jan. 28, 2008, 122 Stat. 238, provided that: "The amendments made by paragraph (2) [amending this section] shall take effect on the date that is 120 days after the date of the enactment of this Act [Jan. 28, 2008], and shall apply with respect to any task or delivery order awarded on or after such date."
Effective Date
For effective date and applicability of section, see section 10001 ofPub. L. 103–355, set out as an Effective Date of 1994 Amendment note under section 2302 of this title.
Provisions Not Affected by Pub. L. 103–355
This section not to be construed as modifying or superseding, or as intended to impair or restrict, authorities or responsibilities under former 40 U.S.C. 759 orchapter 11 of Title 40, Public Buildings, Property, and Works, see section 1004(d) ofPub. L. 103–355, set out as a note under section 2304a of this title.
LII has no control over and does not endorse any external Internet site that contains links to or references LII.


text:
Big data analytics is helping solve age-old business problems. Explore big data, plan its implementation, and discover the solutions from software, technology, and tools built for the demands of big data–intensive projects.
Get our most popular planning guides and insights, delivered straight to your inbox.
What are the required capabilities? How do you make informed data decisions? Find the big data insight you need to move forward.
Use our practical tools, resources, and planning guides to streamline your big data tactics and create a roadmap to enterprise success.
The right tools to get you there. Explore the different Intel® hardware and software solutions for your big data analytics.
Intel CEO Brian Krzanich talks about the equity investment and importance of the technology collaboration between Intel and Cloudera Technology, bringing an enterprise-ready platform to the mainstream for impactful big data solutions.
Learn how Intel IT successfully migrated to Cloudera Distribution for Apache Hadoop* (CDH) software to improve performance and ease of use for key Hadoop components.
Explore big data—what it is, why you should care, and how companies can take advantage to uncover insight and big competitive impact.
Intel IT offers insights into evolving its big data capabilities, which gave organizations deeper and richer insights into business patterns and trends.
Learn how the cloud and big data tech create a competitive advantage in a cost-effective delivery model, and steps to begin an initiative.
This practical planning guide for IT managers can help you plan and implement big data analytics projects.
This big data analytics infographic shows how Apache Hadoop* can work for you and which Intel® technologies can help you deploy Hadoop and optimize your infrastructure.
Find the right Intel® server and server support products with the intelligent performance and efficiency to meet your needs.
Collaboration for complete platforms with Intel® Data Center Manager and other Intel® technologies.
Diane Bryant, Data Center Group, discusses real time analytics for business in the launch keynote.
Diane Bryant, Data Center Group, discusses real time analytics for business in the launch keynote.
Intel® Integrated I/O merges the I/O controller onto the processor for reduced latency.
For data center servers or cloud, new Intel® Xeon® processors combine flexibility with efficiency.
Ayasdi helps customers uncover the insights hidden in their complex data.


text:
Im looking for a PHP editor that is good. I only request that is support sytanx coloring (which almost every editor does now anyway), not too-many features; but the important item that I need is to automatically upload my files using FTP. I would like to use DzSoft, bu I dont think that works with PHP does it?
If anyone has some suggestions, past experiences, recommendations, etc, please let me know. Im currently using Dreamweaver MX and its a memory hog and bundled with more options than i need (not to mention the trial runs out in a week)