text:
News about Arabs, including commentary and archival articles published in The New York Times.
Algeria's Invisible Arab
Conflict is illuminated as the nameless murder victim of Camus's "The Stranger" becomes a human being in a new novel.
July 25, 2015, Saturday
MORE ON ARABS AND: Books and Literature , Arabs , Daoud, Kamel , Social Conditions and Trends , Philosophy , Middle East , Camus, Albert , Muslims and Islam , Israel , Iran , Palestinians
Tracing Hip-Hop's Phenomenal Rise
An Arab World Institute show in Paris outlines the history of hip-hop as a form of expression and its spread across Europe, Africa and the Middle East.
July 24, 2015, Friday
MORE ON ARABS AND: Rap and Hip-Hop , Music , Museums , Arabs , Paris (France)
Berbers and Arabs Clash in Algeria, Leaving at Least 18 Dead
The unrest stems from longstanding disputes between the native Berbers and Arab settlers over land and housing.
July 9, 2015, Thursday
MORE ON ARABS AND: Algeria , Arabs , Berbers (Ethnic Group) , Deaths (Fatalities)
Contain and Amplify
We need a new motto for battling extremism in the Middle East. "Fighting terrorism" hasn't worked so well.
May 27, 2015, Wednesday
MORE ON ARABS AND: Middle East , Saudi Arabia , United States International Relations , Terrorism , Libya , Yemen , Syria , Iran , Iraq , Muslims and Islam , Arabs
This Angry Arab Moment
The United States can walk and chew gum in the Middle East. And it should.
May 15, 2015, Friday
MORE ON ARABS AND: Middle East , Arabs , Saudi Arabia , Iran , International Relations
Netanyahu Apologizes; White House Is Unmoved
Despite an apology by Prime Minister Benjamin Netanyahu of Israel, the White House remained furious about comments that appeared to close the door on a two-state solution to the Palestinian conflict.
March 24, 2015, Tuesday
MORE ON ARABS AND: Israel , Netanyahu, Benjamin , Palestinians , Apologies , Obama, Barack , McDonough, Denis R , Elections , Arabs , United States International Relations
Arab Alliance in Israeli Legislature Sees Unity as Vehicle for Progress
The disparate group of lawmakers are demanding seats on major parliamentary committees and influence in decision-making in Arab schools and budgets.
March 20, 2015, Friday
MORE ON ARABS AND: Israel , Arabs , Odeh, Ayman (1975- ) , Legislatures and Parliaments
Voters in Nazareth Cheer Gains by Arab Alliance
The Arab cohort, which calls itself the Joint List, received 13 seats in Israel's next Parliament. But as the euphoria in Arab towns fades, it remains far from clear what influence it will actually have.
March 18, 2015, Wednesday
MORE ON ARABS AND: Israel , Joint List (Israel) , Arabs , Jews and Judaism , Herzog, Isaac , Discrimination , Netanyahu, Benjamin
Assia Djebar, Novelist Who Wrote About Oppression of Arab Women, Dies at 78
Ms. Djebar, frequently mentioned as a contender for the Nobel Prize in Literature, often focused on gender inequality.
February 14, 2015, Saturday
MORE ON ARABS AND: Djebar, Assia , Writing and Writers , Deaths (Obituaries) , Books and Literature , Women and Girls , Arabs , Algeria
Israel Cracks Down on Lehava, a Group Tied to Anti-Arab Acts
Ten members of Lehava, a far-right Jewish group, were arrested on suspicion of incitement and calls for acts of violence motivated by racism, a day after three were arrested in an arson case.
December 17, 2014, Wednesday
MORE ON ARABS AND: Israel , Palestinians , Arson , Mosques , Arabs , Kahane, Meir
Netanyahu Apologizes to Israeli Arabs
Prime Minister Benjamin Netanyahu apologized to Israel's Arabs for his election-day rallying call to his supporters last week, which was called racist by opponents.
What Does Benjamin Netanyahu's Victory Mean for Israel?
The New York Times invites readers to ask questions about what Prime Minister Benjamin Netanyahu's policies mean for Israel and its neighbors.
Uniting Arabs in a Race for the Knesset
In Ayman Odeh's campaign for a seat in the Knesset, he hopes to unite Arab Israeli political factions and boost voter turnout.
Hymns for Home, in Arabic
Upstairs in a small Brooklyn church, Christians of all denominations from the Middle East gather to pray in Arabic and share experiences. Many have fled conflict, violence and prejudice.
The New Arab Brooklyn
The Arab population in Bay Ridge, Brooklyn, is the latest in a series of Arab enclaves appearing in New York City.
Integrating Israeli Soccer
The Times's Jodi Rudoren looks at lingering racism in the stands of the last Israeli soccer team to field Muslim players.
Hosni Mubarak Sentenced to Life Term
David Kirkpatrick of The New York Times reports on the verdict finding Hosni Mubarak, the former Egyptian president, guilty of failing to stop the killing of demonstrators in last year's uprising.
Critics' Picks: 'Lawrence of Arabia'
A. O. Scott looks back at David Lean's epic of revolution in the Middle East.
Egypt's Appetite for Politics
The Times's Adam B. Ellick follows an activist campaigning against a referendum.
Dispute in the Negev
Bedouins, members of Israel's Arab minority who are settled in the Negev Desert in southern Israel, are fighting government plans to relocate them from their traditional homes.
Rss Feeds On Arabs
Subscribe to an RSS feed on this topic. What is RSS?
Get Alerts On Arabs
Receive My Alerts e-mails on topics covered on this page.More Alerts >>


text:
Grammy's Best New Artists — Where Are They Now (page 3)
February 7, 2012 6:24 AM
Smooth Jazz 107.5 HD2 The Oasis Read More
[lastfm link_type="artist_info"]Adele[/lastfm]
The soulful chanteuse snagged 2 Grammys in 2009, Best New Artist and Best Pop Female Vocal for "Chasing Pavements." Despite vocal troubles in 2011 cancelled her tour multiple times, Adele is slated to make her return at this year's Grammys ceremony. She's nominated for 6 awards.
2009 Nominees:
Jonas Brothers
Lady Antebellum
Jazmine Sullivan

subset: commoncrawl


text:
I miss you. I miss visiting with my friends via my blog. I've been so busy that finding time to write more than this short note is difficult. I am working which is a good thing. But the bigger news is my newest grandson. Benjamin was born last week on his due date. He is just beautiful and perfect in every way. I'd like you all to meet him:
Here are his big brother Asher and big sister Elizabeth waiting for him to come home:
And big brothers, twins, David and Daniel:
To you dear blog and blog readers, I promise to bring you more good news this week but it will be in a few days. Love to all.


text:
|Publication number
|Publication type
|Application number
|Publication date
|Sep 9, 2010
|Filing date
|May 21, 2010
|Priority date
|Jul 16, 1999
|Also published as
|Publication number
|Umesh Maheshwari, Radek Vingralek, W. Olin Sibert
|Original Assignee
|Intertrust Technologies Corporation
|Export Citation
|BiBTeX, EndNote, RefMan
|Referenced by (7), Classifications (9)
|External Links: USPTO, USPTO Assignment, Espacenet
This application claims priority from U.S. Provisional Patent Application Ser. No. 60/144,378, entitled "A Trusted Database for an Untrusted Storage System," filed Jul. 16, 1999, which is hereby incorporated by reference in its entirety.
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
The present invention relates generally to the storage of electronic data. More specifically, the present invention relates to systems and methods for securing electronic data for storage in potentially untrusted environments.
In some distributed applications, computer programs are called upon to perform sensitive operations in untrusted environments. For example, vendors of digital goods like music and software may wish to control a consumer's use of those goods. One way to do this is to run a special rights-management program on the consumer's computer system or playing device that enforces the terms of the consumer's contract with the vendor. To increase performance and fault tolerance, and to facilitate a flexible range of business relationships between vendor and consumer, such a program may avoid communicating with other systems for relatively long periods of time. As a result, the program may need to store a variety of sensitive, transaction-related data—such as account balances, purchase receipts, usage records, budgets, billing records, and the like—on the consumer's system. Although the program may occasionally send this information to a trusted computer for processing, this type of communication may be limited for performance, fault tolerance, privacy, or other reasons.
In such a system, the consumer may have both the incentive and the opportunity to alter the vendor's rights management program in order to obtain unauthorized benefits. While it may not be possible to secure the rights management program completely, since the consumer will typically have ultimate control over the underlying hardware and the operating system, a number of software and hardware platforms are emerging that reduce the risk of attack. These platforms typically include a processing environment that allows authorized programs to run with reduced risk of reverse engineering and tampering. For example, this may be achieved with a hardware package containing a processor, memory, and some tamper-detecting circuitry, and/or by various techniques for software obfuscation and tamper detection. However, these platforms typically do not provide trusted, persistent storage in bulk, as it is generally difficult to prevent read and write access to devices such as disk drives and flash memory from outside the trusted platform. Thus, if sensitive records are stored locally, attackers might try to read, modify, add, or delete those records in order to undermine effective enforcement of the terms of their contract with the vendor. Systems and methods are thus needed for providing trusted bulk storage in potentially untrusted computing environments.
Systems and methods for implementing and using a trusted storage system in an untrusted environment are disclosed. Embodiments of the present invention facilitate the storage of sensitive data in digital rights management and other systems. It should be appreciated that the present invention can be implemented in numerous ways, including as a process, an apparatus, a system, a device, a method, or a computer readable medium. Several inventive embodiments of the present invention are described below.
In one embodiment, a trusted database system is provided that leverages a trusted processing environment and a small amount of trusted storage to provide tamper-detection and secrecy to a bulk of untrusted storage. The trusted database integrates encryption and hashing with a low-level data model that secures data and meta-data uniformly. This model is powerful enough to support higher-level database functions such as transactions, backups, and indexing.
In one embodiment, the trusted database system uses log-structured storage. The implementation is simplified by embedding a hash tree in the comprehensive location map that forms an important part of log-structured systems, thus enabling objects to be validated as they are located. A checkpointing optimization defers and consolidates the propagation of hash values up the tree. Since updates are not made in place, a snapshot of the database state can be created using copy-on-write, which facilitates incremental backups. The absence of fixed object locations reduces the predictability of accesses, providing resistance to traffic monitoring.
These and other features and advantages of the present invention will be presented in more detail in the following detailed description and the accompanying figures which illustrate by way of example the principles of the invention.
The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals designate like structural elements, and in which:
A detailed description of the invention is provided below. While the invention is described in conjunction with several embodiments, it should be understood that the invention is not limited to any one embodiment. On the contrary, the scope of the invention is limited only by the appended claims and encompasses numerous alternatives, modifications, and equivalents. For example, while certain embodiments are described in the context of a system and method for implementing a trusted database in an untrusted environment, those skilled in the art will recognize that the disclosed systems and methods are readily adaptable for broader application. For example, without limitation, the present invention could be readily applied in the context of a trusted environment or a substantially trusted environment. In addition, while numerous specific details are set forth in the following description in order to provide a thorough understanding of the present invention, the present invention may be practiced according to the claims without some or all of these details. Moreover, for the purpose of clarity, certain technical material that is known in the art related to the invention has not been described in detail in order to avoid unnecessarily obscuring the present invention.
As shown in
In a digital rights management system, a vendor 202 might supply electronic content 218 to a consumer for use on the consumer's computer system 204. For example, a consumer might download an encrypted audio or video file from the vendor's Internet web site. Content 218 may be associated with certain rules that are intended to govern the consumer's use of the content. For example, the vendor of an audio track may wish to charge the consumer $0.10 each time the consumer listens to the track. To enforce such a rule, the vendor may supply the consumer with an application program 212 that is able to decrypt content 218, debit the user's account, and record other information about the transaction. When a consumer attempts to use downloaded content 218 by invoking a rendering program 210 such as an electronic jukebox, the vendor's trusted application 212 will process the consumer's request, charge the consumer's account, and decrypt and release content 218 to the rendering application 210. Trusted application 212 may also transmit records 222 relating to the transaction to a clearinghouse 206 for processing (e.g., billing the consumer's account and crediting the vendor's account) and storage. Additional information on digital rights management systems can be found in Ginter et al., "Systems and Methods for Secure Transaction Management and Electronic Rights Protection," U.S. Pat. No. 5,892,900, issued on Apr. 6, 1999 ("the '900 patent"), which is hereby incorporated by reference in its entirety.
In order to support offline operation and/or to otherwise increase efficiency, trusted application 212 might wish to store sensitive bookkeeping, usage, or other information locally. Since a typical consumer's system may not contain a sufficient amount of trusted, non-volatile storage to hold this information, it may be necessary to store this information on untrusted local storage, such as the consumer's hard disk drive 214. However, vendor 202 and/or clearinghouse operator 206 will want assurance that the data stored on local storage will not be tampered with, or, if tampering does occur, that it can be quickly detected and recovered from.
The present invention provides systems and methods for securing sensitive data in such a mariner that it can be securely stored on untrusted storage. In particular, the present invention provides systems and methods for effectively converting untrusted bulk storage 214 to trusted storage 216. Thus, trusted application 212 is able to write sensitive data to, and read sensitive data from, entrusted bulk storage 214, and vendors, clearinghouses, consumers, and others can have confidence in the integrity and secrecy of such data. In one embodiment, a trusted database management system (TDBMS) 220 is responsible for performing the data manipulation and security transformations that enable the trusted storage of sensitive data on an untrusted storage medium.
Trusted database management system 220 is preferably implemented in software executable by the microprocessor of the consumer's system 204, and may make use of a variety of system resources, as described in more detail below. In one embodiment TDBMS 220 is a stand-alone executable program with an application programming interface that is callable by trusted applications. To gain access to the data maintained by TDBMS 200, applications 212 first validate themselves to TDBMS 220. For example, application 212 might validate itself by demonstrating knowledge of a secret cryptographic key. Such validation techniques are well-known, and it will be appreciated that any suitable validation technique could be used.
In another embodiment, TDBMS 220 is implemented as an embedded component library that is linked to the trusted application 212. For example, TDBMS 220 could be linked to trusted application 212 before it is distributed to the consumer. In such an embodiment, TDBMS 220 would form an integrated part of the trusted application program.
The implementation and operation of a trusted database management system will now be described in more detail with reference to
As shown in
System 402 may also include special-purpose cryptographic circuitry for, e.g., performing hashing, encryption/decryption, and/or other functions. However, it will be appreciated that these functions may be performed by appropriate software instead.
The operation of system 402 is controlled primarily by programs contained in system memory 418 and executed by the system's processing unit 416. For example, system 402 might contain a trusted application program 420 that generates data for storage in trusted database 460, and that uses data stored in trusted database 460. In addition, system 402 includes a trusted database management system 422 for managing the data stored in trusted database 460, as described in more detail below. The image of trusted database system 422 and/or trusted application 420 can be stored in untrusted bulk storage 432 and loaded into RAM 418, validated, and executed by CPU 416 when the system user wishes to perform operations that require access to the data stored in trusted database 460.
In one embodiment, system 402 may also include a special-purpose protected processing environment 488, such as that which might be provided by an integrated circuit housed in a tamper-resistant hardware package. As shown in
It should be understood, however, that the present invention can be practiced using systems and methods that do not include or rely on a strongly-protected processing environment such as protected processing environment 488. However, if a strongly-protected processing environment is not used, trusted application program 420 and trusted database management system 422 should make use of software obfuscation and other software self-defensive techniques, since a compromise to the run-time security of these programs can be used to effectively undermine the security provided by database 460. Additional information on suitable software obfuscation and self-defensive techniques can be found in the '900 patent, and in commonly-assigned U.S. patent application Ser. No. 09/095,346, entitled "Obfuscation Techniques for Enhancing Software Security," filed Jun. 9, 1998 ("the '346 application"), and commonly-assigned U.S. Provisional Application No. 60/146,419, entitled "Software Self-Defense Systems and Methods," filed Jul. 29, 1999 ("the '419 application"), each of which is hereby incorporated by reference in its entirety.
Thus, as used herein, a "trusted processing environment" will refer generally to an environment in which the run-time state of trusted application program 420 and trusted database management program 422 are protected in some manner from observation and/or modification by unauthorized programs. The trusted processing environment can be implemented in any suitable fashion, although the less-secure the trusted processing environment, the less secure, or less effective, the trusted database will generally be. For example, as explained above, the trusted processing environment may comprise a special-purpose protected processing environment such as protected processing environment 488, and/or, with less security, may comprise an obfuscated software program running on system RAM 418 and CPU 416, as it will typically be difficult for an attacker to monitor and/or modify such a program during execution.
As shown in
For ease of explanation, a brief description of each of the infrastructure and program modules shown in
Referring to
Secret store 504 consists of a small amount (e.g., 100 bytes) of read-only, persistent storage that is preferably accessible only by a trusted application program. In one embodiment secret store 504 holds a key that the database program uses to authenticate itself and/or to decrypt private data Secret store 504 can be implemented in a variety of ways. For example, in systems that have a special-purpose protected processing environment 488, secret store information can be kept in ROM 489. Secret store information can also be embedded directly in trusted application 420 and/or trusted database management system 422 using software obfuscation techniques such as those described in the '900 patent, the '346 application, or the '419 application, each of which was previously incorporated by reference herein. Alternatively, or in addition, secret store information can be stored in modifiable, but obscure, system resources and/or services such as those described in the '900 patent and the '419 application.
Tamper-resistant store 506 provides a small amount (e.g., 100 bytes) of writeable, persistent storage that can preferably be written only by trusted programs. There are a variety of ways to implement tamper-resistant store 506. For example, tamper-resistant store 506 may be provided by a locally-attached device such as a smart card, dongle, or trusted remote server. Like secret store 504, tamper-resistant store 506 may also be provided by obscure system resources such as those described in the '900 patent and the '419 application. (Note that for ease of explanation, the combination of the secret store and the tamper-resistant store will occasionally be referred to as the "trusted store"). In addition, systems that contain a protected processing environment 488 can make use of the non-volatile RAM or flash memory (if any) contained therein. As described in more detail below, in some embodiments the tamper-resistant store can be replaced by another secure mechanism, such as a tamper-resistant counter that only counts up. The database system can sign the counter value and the database hash, thus thwarting replay attacks.
In a preferred embodiment the trusted database system also includes an archival store 512 to facilitate recovery from accidental failures of the untrusted store. The archival store may be untrusted, and need not provide efficient random access to data. In one embodiment archival store comprises magnetic tape or an ftp server.
Chunk store 510 manages application data and meta-data as a set of chunks. Chunks are pieces of data that, are stored on untrusted store 502 and read into the trusted processing environment on demand. Each chunk is identified using a unique ID. A chunk is an untyped sequence of bytes, and is the logical unit of encryption, validation, and access to untrusted store 502. In one embodiment, chunks are variable-sized sequences of bytes. In another embodiment, chunks can be fixed-size, much like virtual memory pages. There is typically a performance tradeoff in selecting the amount of data to store in a chunk. Small chunks generally result in less work upon reading and writing, but increase the size of certain meta-data and can cause relatively poor clustering
The chunk store is preferably implemented as a log-structured storage system. Log-structured file systems are well-known in the art, and details regarding such systems can be found in Rosenblum and Ousterhout, "The Design and Implementation of a Log-Structured File System," Proceedings of the ACM Symposium on Operating System Principles (1991), which is hereby incorporated by reference in its entirety. As explained in more detail below, log-structured file systems were found to have certain synergies with the provision of database security in preferred embodiments of the present invention. For example, when a chunk is updated, it is physically relocated on untrusted store 502. Chunk store 510 advantageously exploits this relocation for many purposes, including the following: combining the process of locating chunks with the process of validating them, traffic analysis protection, atomic updates in the presence of crashes, snapshots for efficient backups, and so forth. It should be appreciated, however, that file structures besides log-structured file structures could also be used.
As described in more detail below, in a preferred embodiment chunks are logically grouped into partitions, with potentially different security parameters. Snapshots of partitions can be taken, and partitions can be compared or "diff'ed," which is useful in making incremental backups. The chunk store supports atomic updates of multiple chunks in the presence of crashes, and hides database logging and recovery from higher modules.
The chunk store provides tamper resistance by maintaining a one-way hash of the database in tamper-resistant store 506. As described in more detail below, when a chunk is read from untrusted store 502, its hash is validated using the hash stored in tamper-resistant store 506. In another embodiment, the system maintains a counter in tamper-resistant store 506 and signs the hash of the database and the current value of the counter. To update and validate the database hash efficiently, the chunk store can maintain a tree of hash values over the chunks. The hash at the root of this tree represents the hash of the entire database. In one embodiment the tree of bash values is modeled after an approach suggested in Merkle, "Protocols for Public Key Cryptosystems," Proceedings of the IEEE Symposium on Security and Privacy (1980), which is hereby incorporated by reference. The chunk store also encrypts chunks before they are written to untrusted store 502, and decrypts them when they are read. The encryption key is stored in secret store 504.
Backup store 508 creates and restores a set of partition backups. A backup may be full or incremental. The backup store ensures that only consistent snapshots of the database are restored after authorization by the trusted (and possibly remote) database application.
Object store 516 manages a set of named objects. An object is a higher-level abstraction of the data stored by the chunk store 510, and is generally the unit of data that is read or written at the interface between trusted application program 212 and trusted database management system 220 in
The object store keeps a cache of dirty and frequently-used objects. Caching data at this level is beneficial because the data are decrypted, validated, and unpickled. The object store also provides concurrency control for transactional access to objects. The object store caches chunks for good performance, as relocation typically destroys inter-chunk clustering.
Collection store 518 manages a set of named collections of semantically-related objects. The indices on a collection are updated automatically. Collections and indices are themselves represented as objects. Collections may include unordered lists, keyed maps, sorted keyed maps, or other suitable data structures. In one embodiment collections are accessed via iterators. Keyed maps may also be accessed using a key lookup, and sorted keyed maps may be accessed using range queries.
Additional features and illustrative implementation details of the program modules shown in
The chunk store manages a set of partitions, each containing a set of chunks. The chunks in different partitions may be encrypted with different encryption algorithms or encryption keys. Note that a partition logical group, not necessarily a physical area on the untrusted store. The chunks comprising a partition may be stored virtually anywhere on the untrusted store. The security parameters associated with a partition are used to encrypt, and to hash, its chunks. Chunks and partitions are named with unique identifiers (IDs). A chunk ID comprises the ID of the partition containing it and an element ID that is unique within the partition.
In a preferred embodiment, the chunk store writes chunks by appending them to a log on the untrusted store. In this embodiment chunks do not have static locations outside the log. As described in more detail below, the chunk store uses a chunk map to locate and validate the chunks. When a chunk is Written, it is hashed and encrypted, and the map is updated. When a chunk is read, it is decrypted and validated against the map. The chunk map also helps copy partitions using copy-on-write techniques. The chunk map is itself stored as a set of chunks. When a chunk is written or deallocated, its previous version in the log, if any, becomes obsolete. Log cleaning reclaims the storage of obsolete versions.
Tamper-detection is provided by creating a path of hash links from the trusted store to every current chunk version. There is a hash link from one object to another if the first object contains a hash of the second. If an object is linked to another object via one or more links using a collision-resistant hash algorithm, it will be computationally difficult to change the second without changing the state of the first or breaking a hash link. The hash links are embedded in the chunk map and the log.
Similarly, secrecy is provided by creating a path of cipher links from the secret store to each current chunk version. There is a cipher link from a first object to a second object if the second object is encrypted using a key stored in the first.
In one embodiment atomicity for concurrent operations can be provided through mutual exclusion. Although it does not overlap disk accesses and computation, it is simple and acceptable when concurrency is low.
As previously indicated, in a preferred embodiment application data and indexing information are stored in untrusted storage as a set of chunks with unique IDs. A chunk map maps each chunk ID to its location on the untrusted store and to its expected hash. The chunk map is itself made up of chunks
The lowest level of tree 600—i.e., "leaves" 618 —consists of data and meta-data generated by the trusted application program, the object store, and/or the collection store. The other levels of the tree consist of chunks containing information used by the chunk store to organize, manage, and secure the leaf data As shown in
Referring once again to
Partition leader 614 may also include a variety of other information, such as allocation information 730 and partition copying information 732. Allocation information 730 may, for example, be used in allocating and deallocating chunks. For example, allocation information 730 may include information regarding the number of chunks contained in the partition (e.g., the number of map chunks 613 and data chunks 618), and/or the head of a list of previously-allocated chunks that are now deallocated—also known as the freelist.
Referring once again to
The relative order of hashing and encrypting chunks is flexible. In one embodiment chunks are hashed before encryption (and, therefore, validated after decryption). This has the security advantage that an attacker does not know the plaintext chunk over which the hash was computed, and therefore cannot launch brute-force attacks to find other chunks that have the same hash value as the first. In another embodiment, chunks are hashed after encryption (and validated before decryption). This has the performance advantage that it is possible to validate a chunk without decrypting it. In general, the system validates a chunk only when it needs to read its content from the untrusted store, so the chunk needs to be decrypted anyway and there is no performance advantage. However, it may be desirable to validate chunks even when there is no need to read them, and it is then that this performance advantage matters. For ease of explanation, the following discussion assumes the use of the first embodiment (i.e., chunks are hashed before encryption); however, it will be appreciated that the second embodiment (i.e., chunks are hashed after encryption) could be readily implemented with straightforward modifications.
When the chunk store is asked to allocate a new chunk, the chunk store returns an element ID for a new data chunk in the appropriate element map. The element ID of a map or data chunk in a partition is based on the position of the chunk in the element map. This approach obviates the need to store element IDs in the map explicitly. Further, it allows the ID of a chunk's parent to be determined, which can be used to optimize reads.
The IDs of deallocated data chunks are reused, in order to keep element maps compact and to conserve ID space. Each element map preferably contains a free-list linked through the freed descriptors; the head is stored in the partition leader.
As mentioned, allocation of IDs is not persistent until the corresponding chunk or partition is written (committed). The descriptors for chunks and partitions that are allocated but not written are marked tentative. Upon recovery from a crash, their IDs are free-listed for re-allocation.
In a preferred embodiment, the chunk map maintains a cache of descriptors indexed by chunk IDs, and a cache of leader chunks indexed by partition IDs. The cache contains decrypted, validated, and unpickled data. The cache is preferably protected by the trusted processing environment.
If the descriptor for a requested chunk ID c is in the cache, it is returned. Otherwise, the chunk map computes the ID d of the parent chunk of c, and reads d using the regular chunk store operation. Thus the lookup proceeds bottom up recursively, stopping when a descriptor is found in the cache. The lookup for a partition leader progresses similarly in the system Partition. Bottom-up traversal exploits the validated cache to avoid validating the entire path from the system leader to the requested chunk.
When committing a set of chunks; the chunk store hashes and encrypts each chunk with its partition's parameters, then writes the set of chunks to the untrusted store at the tail of the log.
When a chunk c is written on the untrusted store, its descriptor is updated to reflect its new location and hash. This changes the parent chunk d. If d were also written out, its descriptor and parent would change, and so on up to the system leader. The chunk map uses checkpoints to defer updating and writing the ancestors of chunks written in each commit.
When a chunk is written, its descriptor is merely updated in the chunk-map cache and marked dirty so that it is not evicted. When the cache becomes too large and cannot be shrunk with regular eviction, map chunks containing dirty descriptors and their ancestors up to the system leader are written out as a checkpoint. Checkpointing interacts well with hashing: it defers and consolidates the propagation of hash values up the chunk map from every commit to checkpoints.
A crash loses cached updates to the chunk map, but they are recovered by rolling forward through the chunks written since the last checkpoint. The system leader is written last during a checkpoint, and its location is stored in the trusted store. The part of the log written before the system leader will be referred to as the checkpointed log, and the part including and after the system leader will be referred to as the residual log.
Although checkpointing defers the propagation of hash values up the chunk map, each commit operation still updates the tamper-resistant store to reflect the new state of the database. If the tamper-resistant store contained the hash of the system leader and were updated only at checkpoints, the system would be unable to detect tampering of the residual log.
As shown in
As shown in
The second exemplary embodiment has several advantages over the first. For example, it can use a weaker tamper-resistant store: a secure counter that can only be incremented. Such a counter might simply comprise an ordinary counter operating in the trusted processing environment, although it will be appreciated that there are a variety of techniques for implementing such a counter. Note that the counter need not be protected against increments by an unauthorized program, since an unauthorized increment would simply create a mismatch and invoke a tamper response, and thus there is little incentive for an attacker to increment the counter. Note, however, that tamper-detection still relies on the secrecy of the key used to sign the commit chunk, and thus, even if a database system needed only to provide tamper-detection, but not secrecy, it would still need a secret store.
Another advantage is that the use of a commit count allows the system to tolerate bounded discrepancies between the expected database state and the stored database state, if desired. For example, the system might allow the count in the tamper-resistant store ci to be a little behind the count in the last commit chunk cj. This trades off security for performance. The security risk is that an attacker might delete transactions ci+1 through cj. The performance gain is that the commit operation need not wait for updating the count in the tamper-resistant store—as long as the latter is not far behind. Thus, updates to the tamper-resistant store can be done lazily in most cases, which is particularly beneficial if the tamper-resistant store has a high latency (e.g., a smartcard). The system might even allow the count in the tamper-resistant store ci to leap ahead of the count in the last commit chunk cj. This admits situations where the untrusted store is written lazily (e.g., IDE disk controllers often flush their cache lazily) and there is a chance that the tamper-resistant store might be updated before the untrusted store. Again, the security risk is a deletion of transactions cj through ci. For ease of explanation, the following discussion assumes the use of the second exemplary embodiment; however, it will be appreciated that the first exemplary embodiment, or other suitable approaches, could be used instead.
The location of the head of the residual log is stored at a fixed place for use at recovery, as in other log-structured storage systems. It need not be kept in tamper-resistant store, provided that upon recovery the system checks that the stored head of the log actually points to a system leader.
Since the location of the head of the residual log is updated infrequently—at each checkpoint—it may be stored in a separate location on untrusted store without degrading performance.
To recover from crashes, upon startup, the chunk store retrieves the head of the residual log from the fixed location where it was stored. It reads the chunk versions in the residual log, guided by next-segment chunks, until it reaches the end of the log. For each chunk version, it redoes the chunk map appropriately. For each set of chunks committed in a transaction, it computes a sequential hash and compares the hash with that stored in the corresponding commit chunk. It also checks that the counts stored in the commit chunks form a proper sequence. Finally, it raises an alarm if the count in the last commit chunk differs by more than a specified tolerance from the count found in the tamper-resistant store.
To copy a partition P to Q, the chunk store copies the state in P′s leader to Q′s leader. It also duplicates the cached dirty descriptors for chunks in P to the corresponding chunks in Q. Note that Q and P share both map and data chunks, and Q inherits all security parameters from P. Thus, partition copies are cheap in space and time.
When chunks in P are updated, the element map for P is updated, but that for Q continues to point to the chunk versions at the time of copying. The chunks of Q can also be modified independently of P. However, the common use is to create a read-only copy, or a snapshot, which can be used to read a consistent state of the source partition without blocking updates on the current state of the partition.
The chunk store diffs two partitions by traversing their element maps and comparing the descriptors of the corresponding chunks. Diffs are commonly performed between two snapshots of the same partition.
The structure of the log will now be described in more detail. The log consists of a sequence of chunks, and for purposes of discussion, the representation of a chunk in the log will be referred to as a version.
In one embodiment, chunk versions are read for at least three different functions:
To enable sequential reading, the log contains information to identify and demarcate chunks. Each chunk version comprises a header and a body. The header contains the chunk ID, the size of the chunk state, and the size of padding. The body contains the chunk state plus some padding to make it an integral multiple of the cipher block size. Note that if all chunks were encrypted using the same block size, the padding size could be computed from the size of the chunk state. In one embodiment, block sizes may vary from 1 to 256 bytes. Note also that it may not always be possible to compute the padding size from the cipher for the chunk's partition, since the chunk version might be obsolete and its partition might have been deallocated. An example of a chunk version is shown in
The header is encrypted with the system cipher Es so cleaning and recovery are able to decrypt the header without knowing the partition ID. The body is encrypted with the cipher of the chunk's partition Ep. The representation is illustrated below for clarity.
The untrusted store is divided into fixed-size segments to aid cleaning, as in the Sprite log-structured file system described in Rosenblum and Ousterhout, "The Design and Implementation of a Log-Structured File System," Proceedings of the ACM Symposium on Operating System Principles (1991), previously incorporated herein by reference. The segment size is chosen for efficient reading and writing by the cleaner, e.g., on the order of 100 Kbytes for a disk-based untrusted store. A segment is expected to contain many chunk versions. The size of a chunk version is limited by the segment size. The set of chunks written in a commit operation may span multiple segments.
The log is represented as a sequence of potentially non-adjacent segments. Since crash recovery needs to read the residual log sequentially, segments in the residual log contain a next-segment chunk at the end, which contains the location of the next segment. Next-segment chunks are instances of unnamed chunks.
Unnamed chunk versions do not have chunk IDs. They are useful in the residual log for recovery, but are obsolete in the checkpointed state. For example, a deallocation chunk is written to indicate the deallocation of a chunk or partition ID. It is used during recovery to redo the chunk map, but is obsolete in the checkpointed state. The commit chunk described above is another example of an unnamed chunk. The use of unnamed chunks avoids the complexity of allocation and deallocation of regular chunk positions to store the same information.
An unnamed chunk version has a header with an invalid chunk ID. Its body is secured with the system cipher and hasher. The hash stored in a commit chunk also covers any unnamed chunks written by the transaction (with the exception of the commit chunk itself). The hash of an unnamed chunk in the checkpointed log is not stored, since unnamed chunks do not have a place in the element map.
A log cleaner reclaims the storage of obsolete chunk versions, and compacts the storage to create empty segments for writing. It picks a segment to clean and determines whether each chunk version is current by using the chunk ID in the header to find the current location in the chunk map. It then commits the set of current chunks, which writes them to the end of the log. All of this happens atomically with respect to externally invoked operations. Cleaning may be invoked synchronously when space is low, but most of it happens asynchronously if sufficient idle periods are present.
If the cleaner is unable to generate a sufficient number of free segments through cleaning, it may also allocate additional space on the untrusted store. The cleaner dynamically manages the size of the database by increasing and shrinking its size. Based on the desired characteristics of the database, it trades off performance and space utilization.
Under certain circumstances, such as checkpointing, the cleaner may be disabled (prevented from cleaning) because cleaning would interfere with such operations. When the cleaner is disabled and the free segments at the end of the log are exhausted, the cleaner is forced to increase the size of the database to generate additional space.
The cleaner need not validate the chunks read from the segment, provided that their hashes are preserved in the chunk map when they are committed. If the hashes are recomputed as part of a regular commit, the cleaner validates the chunks first; otherwise, the cleaner might launder chunks modified by an attack.
Tampering can cause a current chunk version for a chunk ID c to appear as a dead chunk version for some other chunk ID d. This is not a threat, however, because it does not change the chunk descriptor for either c or d, and tampering will be detected when c is read.
Partition copies complicate checking whether a version is current. A version contains the ID of the partition P to which it belonged when it was written. Even if the version is obsolete in P, it may be current in some direct or indirect copy of P. Therefore, the IDs of the direct copies of each partition are stored in the partition's leader, and the cleaner recursively checks the copies to see if they are current. The process would be more complex if deallocation of a partition did not deallocate its copies.
In one embodiment the cleaner does not clean segments in the residual log, since that would reclaim unnamed chunks and destroy the sequencing of segments. If the residual log becomes too large relative to the size of the database, the cleaner can request that a checkpoint occur to free more segments for cleaning. In one implementation, the cleaner picks checkpointed segments to clean based on statistical information. These statistics, such as segment utilization are stored in a segment usage table as in the Sprite log-structured file system. The segment usage table is stored persistently like the chunk map.
Operations on partitions and chunks are designed to sup port transactional updates and incremental backups. For purposes of illustration, a summary of some exemplary chunk store operations are provided below in simplified form:
Partition operations:
Chunk operations:
In a preferred embodiment, any chunk store operation may invoke a tamper-response mechanism if it reads some data from the untrusted store that fails validation. For purposes of practicing the present invention any suitable tamper response mechanism could be used, including those described in the '900 patent and the '419 application, which were previously incorporated by reference.
The chunk store is preferably unaware of transactions. Allocate, read, and commit operations from different transactions may be interleaved; however, each operation is executed atomically with respect to the others.
Note that the write and deallocate operations listed above are actually special cases of the commit operation. In general, a number of write and deallocate operations on chunks and partitions may be grouped into a single commit operation, which is atomic with respect to crashes. Allocated but unwritten chunk and partition IDs are deallocated automatically upon a system restart. In one embodiment the allocate and commit operations are separated. An alternative would be to allocate IDs when new, unnamed chunks or partitions are committed; however, this alternative would not allow an application to store a newly allocated ID in another chunk during the same commit, which may be needed for data integrity.
The backup store creates and restores backup sets. A backup set consists of one or more partition backups. The backup store creates backup sets by streaming backups of individual partitions to the archival store and restores them by replacing partitions with the backups read from the archival store.
The backup store provides consistency of backup creation and restoration with respect to other chunk store operations. Instead of locking each partition for the entire duration of backup creation, the backup store creates a consistent snapshot of the source partitions using a single commit operation. It then copies the snapshots to archival storage in the background. If restores are relatively infrequent, it may be acceptable to stop all other activity while a restore is in progress.
As shown in
A partition backup contains a backup descriptor, a sequence of chunk versions, and a backup signature. In one embodiment the backup descriptor contains the following:
The representation of partition backups is illustrated below. Here, Hs denotes the system hasher, Hp denotes the partition hasher, Es denotes system cipher, and Ep denotes the partition cipher.
The backup signature binds the backup descriptor with the chunks in the backup and guarantees integrity of the partition backup. The unencrypted checksum allows an external application to verify that the backup was written completely and successfully.
The backup store restores a backup by reading a stream of partition backups from the archival store. In one embodiment the backup store restores one partition at a time, enforcing the following constraints:
If the above constraints are satisfied after reading the entire backup stream, the restored partitions are atomically committed to the chunk store.
The first constraint guarantees that incremental backups are restored in the same order as they were created, with no missing links inbetween. It is enforced by matching the base partition ID in the backup descriptor against the ID of the previous restored snapshot for the same partition.
The second constraint guarantees that sets of partitions are restored consistently. It is enforced by matching the number of backups with a given set ID against the set size recorded in backup descriptors.
Backup restores preferably require approval from the database application, which may deny frequent restorations or restorations of old backups.
The systems and methods of the present invention are focused primarily on integrating security with storage management in the chunk store. For purposes of explanation, an illustrative implementation of the other layers shown in
An object is the unit of typed data accessed by the database application. The object store enhances the security of the trusted database system by protecting the database from application software faults. This is achieved by providing type-safe object storage and transactional semantics. The object store supports creation, deletion, reading, and writing of objects based on object IDs. The object store allows a sequence of object operations to be executed as a transaction.
The object store isolates concurrent transactions by using two-phase locking on objects, and by breaking deadlocks using a timeout mechanism. Transactions acquire locks in either shared or exclusive mode. If a typical workload includes only a few concurrent transactions, it may be unnecessary to implement granular or operation-level locks.
In one embodiment, the object store maintains a cache of unpickled objects. The object store cache is managed using a no-steal policy and a least-recently-used cache replacement scheme. Since the trusted platform may not provide perfect protection of the trusted database's runtime environment, caching objects that contain sensitive data (such as encryption keys) may create security vulnerability. Therefore, in a preferred embodiment the object store encrypts the tail of the replacement chain or evicts certain objects even before reaching the end of the chain. (Note, too that no-steal buffering of dirty data may not scale well to transactions with many modifications, and thus can be replaced if this becomes an issue.)
The object store can store one or more pickled objects in each chunk. In one embodiment each object is stored in a different chunk, as this approach reduces the volume of data that must be encrypted, hashed, and written to the untrusted store during a transaction commit. In addition, this approach simplifies the implementation of transaction commit and abort, since no chunk can contain both committed and uncommitted objects. At the same time, storing each object in a different chunk destroys inter-object clustering and increases the size of the chunk map. In embodiments where the trusted database system is used to manage relatively small databases, which can be almost entirely cached, the lack of inter-object clustering will typically be unimportant, and storing each object in a separate chunk will generally be preferable. However, it will be appreciated that either approach could be used without departing from the principles of the present invention.
Trusted applications can take full advantage of the system architecture shown in
The collection store supports functional indices that use keys extracted from objects by deterministic function's. The use of functional indices obviates the need for a separate data definition language for the database schema. Indices can be organized as lists, hash tables, B-trees, or the like. Applications can access objects in a collection using iterators. Depending on the index organization, the iterators can implement scan, exact-match, and range queries. Indices are maintained automatically as objects are updated. Indices can also enforce uniqueness of the indexed keys.
Thus, a trusted database system has been described, as well as a variety of techniques for implementing and using it. Embodiments of the present invention facilitate the storage of sensitive data in digital rights management and other systems.
The trusted database system leverages a trusted processing environment and a small amount of trusted storage to provide tamper-detection and secrecy to a bulk of untrusted storage. The trusted database integrates encryption and hashing with a low-level data model which secures data and meta-data uniformly. This model is powerful enough to support higher-level database functions such as transactions, backups, and indexing.
A preferred embodiment uses log-structured storage, which is well-suited for building such a system. The implementation is simplified by embedding a hash tree in the comprehensive location map that forms an important part of log-structured systems, thus enabling objects to be validated as they are located. A checkpointing optimization defers and consolidates the propagation of hash values up the tree. Since updates are not made in place; a snapshot of the database state can be created using copy-on-write, which facilitates incremental backups. The absence of fixed object locations may reduce the predictability of accesses, providing resistance to traffic monitoring.
As described above, certain embodiments of the present invention offer some or all of the following:
Although the foregoing invention has been described in some detail for purposes of clarity, it will be apparent that certain changes and modifications may be practiced within the scope of the appended claims. It should be noted that there are many alternative ways of implementing both the processes and apparatuses of the present invention. Accordingly, the present embodiments are to be considered as illustrative and not restrictive, and the invention is not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.
|Citing Patent
|Filing date
|Publication date
|Sep 26, 2008
|Mar 20, 2012
|Hewlett-Packard Development Company, L.P.
|Communicating chunks between devices
|Oct 25, 2007
|Sep 16, 2014
|Hewlett-Packard Development Company, L.P.
|Data processing apparatus and method of processing data
|Jan 31, 2012
|Nov 11, 2014
|Axcient, Inc.
|Systems and methods for restoring a file
|Sep 30, 2010
|Dec 30, 2014
|Axcient, Inc.
|Systems and methods for restoring a file
|Aug 8, 2012
|Feb 10, 2015
|Axcient, Inc.
|Cloud-based virtual machines and offices
|Nov 5, 2014
|Aug 11, 2015
|Axcient, Inc.
|Systems and methods for restoring a file
|Mar 7, 2014
|Sep 12, 2014
|Robert Bosch Gmbh
|Systems and methods for maintaining integrity and secrecy in untrusted computing platforms
|U.S. Classification
|International Classification
|Cooperative Classification
|European Classification


text:
Photo by Jög Sundermann
YIELD: Makes 4 servings
IngredientsCucumber relish:
- 300 ml (10 fl oz/ 1 1/4 cup) rice vinegar
- 260 g (9 oz) honey
- 360 g (12 oz) cucumber, peeled, cored and finely chopped
- 4 tbsp finely chopped long red chiles
- 3 tbsp chopped coriander
- 60 ml (2 1/4 fl oz / 1/4 cup) coconut milk
- 1 shallot, finely chopped
- 2 garlic cloves, finely chopped
- 1 tbsp finely chopped fresh ginger
- 4 chicken breasts, skinned and boned
- 1 tbsp curry powder
- 1/4 tsp turmeric powder
- 300 g (10 1/2 oz) brown jasmine rice
- 3 tbsp soy sauce
- 1 tbsp miso paste
- 4 cardamom pods
- 1 bay leaf
- 1 cinnamon stick
For Cucumber Relish:
In a saucepan, bring vinegar and honey to a boil. Stir frequently until the honey has dissolved and continue to cook for 10-15 minutes. Remove from heat. Once cooled, add cucumber, chiles and coriander and stir well. Set aside until ready to serve.
For Thai Rice Curry with Herbed Chicken:
Heat the coconut milk in a large saucepan or casserole dish which has a lid. Add shallot, garlic and ginger, and cook over a low to medium heat for 3-5 minutes. Add chicken and turn up the heat until it is evenly browned. Add curry powder and turmeric powder and stir well to evenly coat chicken. Add rice, soy sauce and miso paste, and stir well. Pour in 250 ml (9 fl oz/1 cup) water and stir well. Add cardamom pods, bay leaf and cinnamon stick. Cover and bring to a boil. Reduce heat and simmer gently for 30-35 minutes or until the rice is cooked and tender. Remove from heat and leave for 10 minutes leaving the lid on. After 10 minutes, fluff the rice with a fork and discard cardamom pods, bay leaf and cinnamon stick. Serve rice curry warm with cucumber relish on the side.
Per serving: 403.5 calories, 27.46 g protein, 56.84 g carbohydrates, 6.92 g total fat
Nutritional analysis provided by Other
Reprinted with permission from Chiva-Soms Thai Spa Cuisine by Chef Paisarn Cheewinsiriwat and his Culinary Team, (C) 2005 (reprinted 2007). Editions Didier Millet PTE LTD for Chiva-Som International Health Resorts CO., LTD


text:
It's Election Day, Get Out And Vote!
November 4, 2008. Posted by Andrew Meyer.Add new comment | Filed under: Elections, News, Places and Spaces, Real Life Stories, WBGO Community Events
Usually, going to vote at my polling station in Glen Ridge doesn't take a whole lot of time, a matter of minutes. It's an in and out affair. This morning, it was a very different story.
From the time I walked in the door at the Linden Ave School, it took me a half hour! Everyone seemed good-natured about the wait, which I was told by poll workers had been as long as 45 mintues earlier. All I can say is it's great to see so many people getting out and taking care of their civic duty!
Looking for the latest information on the elections? You can find it on our website. Also tune in tonight beginning at 8pm as WBGO and NPR bring you wall-to-wall coverage of the results of Election 2008!
Andrew Meyer
The Return of Salsa Meets Jazz
November 3, 2008. Posted by Vincent Bochis.Add new comment | Filed under: awilda, baritone saxophonist, bleecker, bobby sanabria, camero, chris washburne, folktales, greenwich village, guest artist, impresario, Jazz Alive, jazz classics, jazz returns, larry harlow, latin jazz, le poisson rouge, Notes, ronnie cuber, section members, tin tin deo, trombonist, virtuosity
Last month, Salsa Meets Jazz returned to Greenwich Village. The show was held at Le Poisson Rouge, located at the site of the old Village Gate, at Bleecker and Thompson, where Salsa Meets Jazz originated in the 1980's.Bobby Sanabria's nineteen piece juggernaut roared through two sets. The first set included new power arrangements of Latin jazz classics "Manteca" and "Tin Tin Deo." Selections from the band's latest album Big Band Urban Folktales included trombonist Chris Washburne's composition "Pink," which Sanabria described as a song that captures the sights in the city every summer. Trumpet great John Faddis' muscular virtuosity in "Tin Tin Deo" set the bar for the ozone-piercing trumpet work of the four regular section members. The defining rhythms of legendary guest artist, conguero Candido Camero, demonstrated that he continues, at the age of 87, to be a grand master who delights in connecting with the audience. Original Village Gate impresario Art D'Lugoff, who serves as a consultant to Salsa Meets Jazz and other productions, was on hand. WBGO's Awilda Rivera was the host for the evening.
On December 1, Salsa Meets Jazz returns to Le Poisson Rouge. Latin Jazz icon Larry Harlow and his orchestra will be joined by guest artist, the renowned baritone saxophonist Ronnie Cuber.
News Rap-Up by Baba Israel: The Election
October 31, 2008. Posted by Simon Rentner.Add new comment | Filed under: Jazz Alive
Obama is in the lead
Is McCain gaining speed?
The underdog, he won't throw in the towel
While Obama gets endorsed by Colin Powell
Barack the front runner
McCain has the nod of Joe the Plumber
A man with no license who owes back taxes
McCain pushing in Pennsylvania to attract backers
Obama is in the cradle of steel
In Pittsburgh trying to close the deal
Obama turning red to blue
He's redrawing the map
Could Virginia really have his back?
Barack the redistributor says McCain
Not supporting job growth and the American Dream
11th hour distractions says Obama's team
The race in Ohio is closely contested
In this state Obama might fail
Because of the fast falling support of white males
Maxed out moms unsure of Obama because he's young
And some because they fear that he's Muslim
They see themselves in Palin
But some see her views failing
From global warming to abortion
While these moms struggle to hold on and keep housing
RNC goes clothes shopping, dropping $150,000
In an economic crisis people reaching for the life line
Obama makes his closing arguments in big budget prime time
If Obama wins and gets the inauguration
Charles Barkley says he's going on vacation
Why? The White House has a new resident
Who? The first ever black president
Or will it be the oldest president it's still a mystery
With Sarah Palin ready to make history
And where's Biden been hiding?
Close to a teleprompter because of rhetorical flourishes he's been providing
Were less then a week away
What challenges we will face on Election Day?
Late mailings leaving voters lost
Provisional ballots that often go uncounted
Untrained poll workers, what ID do you bring?
Will voters get dissed?
Phony fliers in Virginia saying democrats vote on the fifth
While ACORN comes under heat
Who will lead us, who will take the seat?
Will it be victory in Iraq?
Or will our soldiers really come back?
Will there be health care for all?
Or will tax credits be too small?
The country holds its breath, from right to left
Will it be a democratic landslide? Or dead even?
Or will the the Republicans fall from grace like Ted Stevans.
Or will we see the ghost of the Bradley Effect?
Change is on the way
Red to blue, blue to red
What's ahead?
Written and performed by Baba Israel from Open Thought Music
Produced by Simon Rentner


text:
there was an error communicating with the server.
Affiliates & service centres
Worldwide presence
The leading name in luxury wristwatches, Rolex has been the pre-eminent symbol of performance and prestige for over a century. Headquartered in Geneva, Switzerland, with 28 affiliates worldwide and relying on 4,000 watchmakers in over 100 countries, Rolex continues to expand its long history of achievement and innovation.


text:
Austin City LimitsCassandra Wilson | Friday, 8 p.m.
Celebrate Billie Holiday with acclaimed jazz singer Cassandra Wilson, as she performs "Strange Fruit," "Don't Explain, "Good Morning Heartache" and other Holiday classics from the tribute album Coming Forth by Day.
The Civil WarPart 2 of 9: A Very Bloody Affair | Thursday, 8 p.m.
Political infighting threatens to swamp Lincoln's administration, and rumors swarm about Europe's readiness to recognize the Confederacy.
Award-winning documentary filmmaker Ken Burns' landmark series portrays the terrible conflict that tore America apart and defined it as a nation. The series embraces the entire sweep of the war using archival photographs, period paintings, newsreel footage of civil war veterans, live cinematography of battle sites, interviews with eminent historian, and a chorus of voices reading from diaries, letters, speeches and newspapers of the era.
The Mind of a ChefPrune | Wednesday 7:30 p.m.
With every chipped plate and hand-written to-do list, Gabrielle's "presence" is all over Prune, her tiny, 30-seat East Village restaurant. Spend a day at this idiosyncratic establishment to see what drives a reluctant chef and her "family." View the conditions of the abandoned restaurant when she first opened it in 1999 and how she breathed new life into it with a very strong perspective and personality. Gabrielle cooks Prune classics: smoky eggplant, celery salad and sweetbreads.
Easy WillpowerWith Rena Greenburg | Monday, 7 p.m.
Whether you're trying to break an addiction to sugar and carbs, overcome bad habits or even improve your mood, Rena Greenberg's Easy Willpower plan can help you be at your absolute healthiest – mentally, physically and emotionally – so you can look and feel better for the rest of your life.
The techniques Rena uses in Easy Willpower capitalize on the popular and effective methods of mindfulness and meditation. She gives people tips for using these techniques toward a specific goal, specifically by helping them change their internal conversation from a dominant negative voice to one that is supportive, encouraging and full of self-love.
Most people acknowledge that they want the results that Rena is offering, but they have little motivation to make the changes to achieve those results. Rena makes it easy, demonstrating to viewers that when they tap into the power of their subconscious mind, their past doesn't not have to equal their future.
Rena has a degree in biopsychology and is nationally board certified in biofeedback therapy and hypnotherapy. Over the last 25 years she has worked with more than 100,000 people in 75 medical centers to help them achieve dramatic weight loss. Many of her clients have lost over 100 pounds.
Is WEIU important to you? Become a member today! Also, send us a message and let us know what WEIU means to you!
Celebrating 30 Years!July 1, 2015, through July 1, 2016
WEIU is celebrating its 30th anniversary on air for radio and television broadcast!
WEIU broadcast radio 88.9 was introduced on July 1, 1985 and WEIU-TV began broadcast operations on UHF 51 on July 1, 1986, as a non-commercial, educational television station licensed to the Board of Trustees of Eastern Illinois University in Charleston, Illinois. "Ladies and gentlemen, welcome live, to the campus of Eastern Illinois University." With that introduction, Daniel Thornburgh, then the director of University Relations, christened WEIU-TV during its live on-air dedication on July 1, 1986.
Join us in celebrating 30 remarkable years of serving the University and our surrounding communities! Thank you for supporting WEIU as your public broadcasting station!
Globe TrekkerFood Hour: The Story of Cheese | Wednesday, 9 p.m.
Rosie Lovell visits the Cheese Makers Market in Beaconsfield, England, a farm in the Cotswolds and the oldest cheese monger in London to observe British techniques. Justine Shapiro travels to northern France to unearth their secrets while Christina Chang heads to Roquefort in the south for a look at the aromatic caves where that eponymous cheese is aged. Megan McCormick takes us to Parma, Italy for a taste of Parmigiano Reggiano while Bobby Chinn tours Sicily and discovers what makes ricotta so special. Brianna Barnes visits Gruyère, Switzerland to enjoy their glorious cheese while Rosie explores Castilla La Mancha in Spain and samples Manchego. Other destinations include Athens, Lebanon and Istanbul.
Wild Photo AdventuresCoastal Landscapes | Thursday, 7:30 p.m.
South Carolina's barrier islands and marshlands are explored.
Austin City Limits2015 Hall of Fame Special | Friday, 8 p.m.
Enjoy the 2015 Austin City Limits Hall of Fame Induction Ceremony, as Loretta Lynn, Asleep at the Wheel, Guy Clark, Townes Van Zandt and Flaco Jimenez are honored by Lyle Lovett, Dwight Yoakam, Vince Gill, Gillian Welch, Jason Isbell and more.
Live From the Artists DenCage the Elephant | Friday, 9 p.m.
Cage the Elephant brought their funky, soulfully psychedelic sound to the stage at the Santa Barbara Art Foundry one Wednesday evening. The set, drawn mostly from 2013's Melophobia album, was filmed at the gallery for Live from the Artists Den. Thriving off the energy of the crowd of 400 invited guests, frontman Matt Shultz delivered an epic performance in an intimate setting, hurling himself around the small space like a man possessed, while the rest of the band equaled his intensity. The evening ended with a shirtless Shultz held aloft by the cheering crowd, a triumphant exclamation point to an unforgettable night.
Time ScannersSt. Paul's Cathedral | Wednesday, 8 p.m.
Structural engineer Steve Burrows takes his team of laser-scanning experts to St Paul's Cathedral in the heart of London. They venture inside the majestic dome to explore its groundbreaking three-part structure; determine how the cathedral's architect, Sir Christopher Wren, overcame unstable foundations and immense structural forces to support his dome; and investigate how the cathedral survived a direct hit by a German bomb during the London Blitz. The laser scans produce genuine revelations and give the team new insight into this iconic architectural masterpiece.
Jessie Meyer - Wood Dale, IL
"My organization is a music service fraternity, so of course we want to support music. That organization, Kappa Kappa Psi, holds a membership here with Hit-Mix."
WEIU membership is important to Jessie, and you can also be a proud member! Also, send us a message and let us know what WEIU means to you!
Frances Murphy - Charleston, IL
"I'm very happy to support Classic Gospel ... it is important to me."
WEIU membership is important to Frances, and you can also be a proud member! Also, send us a message and let us know what WEIU means to you!
Jeff Owens - Sales and FM Manager
When Did You Start at WEIU? September 2003
What Does WEIU Mean to You? A great place for future broadcasting students to get practical hands-on experience in a friendly and safe work environment.
Favorite Show on WEIU-TV: EIU sports - go Panthers!!!
What have you learned while working at WEIU? That no matter what adversity hits us, the staff and students at WEIU will always overcome the adversity and make things happen for the greater good.
Why should someone become a member of WEIU? Your gift to us will be used for education, training, and equipment. This keeps us vital, strong and provides a safe haven for people to listen, watch and experience all that is WEIU.
Is WEIU as important to you as it is to Jeff? Become a member today! Also, send us a message and let us know what WEIU means to you!
We love to hear from you!
Most of TV is pathetic. I think your offering is outstanding and a lovely way spend an evening. Please, oh please, keep it up.
-- Nancy, Sigel
Is WEIU as important to you as it is to Nancy? Become a member today! Also, send us a message and let us know what WEIU means to you!
Reagan Carey - CTF Illinois
Reagan Carey tells us about CTF Illinois.
Reagan would love for you to tune in to Effingham: This is Our Story on Thursday, Oct. 2, at 7 p.m. We hope you'll join us!
Sujata Dey - Growing Up in Small Town Charleston
Sujata Dey will share her memories of growing up in Charleston.
Sujata would love for you to tune in to Effingham: This is Our Story on Thursday, Oct. 2, at 7 p.m. We hope you'll join us!


text:
For optimum storage, you should try to use the most precise type
in all cases. For example, if an integer column is used for values
in the range from
1 to
MEDIUMINT UNSIGNED is
the best type. Of the types that represent all the required
values, this type uses the least amount of storage.
All basic calculations (
*, and
/) with
columns are done with precision of 65 decimal (base 10) digits.
See Section 11.1.1, "Numeric Type Overview".
If accuracy is not too important or if speed is the highest
priority, the
DOUBLE type may be
good enough. For high precision, you can always convert to a
fixed-point type stored in a
BIGINT. This enables you to do all
calculations with 64-bit integers and then convert results back to
floating-point values as necessary.
PROCEDURE ANALYSE can be used to obtain
suggestions for optimal column data types. For more information,
see Section 188.8.131.52, "Using PROCEDURE ANALYSE".
|Posted by Martin Feuchtwanger on August 29 2008 9:57pm
|[Delete] [Edit]
Instead of
"For the most efficient use of storage, try to use the MOST precise type in all cases."
I think it should be
"For the most efficient use of storage, try to use the LEAST precise type THAT WILL ACCOMMODATE ALL POSSIBLE VALUES in all cases."
(EMPHASIS made just to highlight the difference.)
|Posted by Jalil Latiff on February 11 2012 8:26pm
|[Delete] [Edit]
i think the precision he meant refers to the TYPE rather than the numbers. If you have numeric data for example, you can also store it as string, but it would be more precise to store it as the relevant numeric type, as it would be more efficient.


text:
Escape to a AAA 4-Diamond hotel just north of Dallas for $145-$159 per night. Stay Fridays-Saturdays through September to save more than 50% compared with weekday rates.
The Westin Stonebriar features an 18-hole championship golf course and three restaurants. Guestrooms offer Westin's signature Heavenly Beds and White Tea by Westin bath products. Select rooms also have balconies.
Please go to your email and confirm your subscription.


text:
TRiO Student Support ServicesEvergreen's TRiO Student Support Services program is located within Student and Academic Support Services in the Library Building. We call it TRiO/KEY!
TRiO/KEY is specifically designed for students who:
- are the first in their family to go to college (i.e. neither parent has a four-year college degree) AND/OR
- meet federal guidelines for low-income status AND/OR
- have a recently documented physical or learning disability
- AND have an academic need
Learn more about the services offered.
Stop by, email or call to make an appointment. We'll be happy to answer your questions about our program.


text:
Marketplace Activity
Community Inventory Summary
Users who own this wine
Market Pricing
Average Retail:
No Data Available
No Data Available
Avg Auction:
(of 0 listings ) $0.00 Details
(of 0 listings ) $0.00 Details
2009 Cakebread - Rubaiyat Proprietary Blend - USA - California - Napa - Napa Valley - Red
USA - California - Napa - Napa Valley
Proprietary Blend
Producer Notes
Over 30 years ago, Jack Cakebread came to photograph the Napa Valley for a book and while here, he casually mentioned his interest in one day owning a vineyard to some family friends who had a ranch in Rutherford. When he returned home that afternoon, the phone rang and it was the family friends offering to sell their property. He headed back up to the valley that same afternoon to make his best... More »
Drink DatesComm: 2011-2014 VF: 2011-2024
Community Tasting Notes average score of 93 points based upon 5 reviews


text:
A match made in tableware heaven. The warm, natural beauty of bamboo and the elegance of porcelain are brought together in this stunning nesting bowl set. It's sure to dress up any dish you serve – whether you "accidently" overcooked the chicken, or decide to improvise on your mom's pasta recipe, people will hardly notice the difference when you're serving from these beautifully designed bowls. Hand wash recommended.
Wood & Porcelain
Hand wash. Do not microwave.
More Like This Item
$11.95 / 12 count
$24.95 / 63 fl oz
$37.95 / 50 count
$12.95 / 1 liter


text:
Scarves & Neck Gaiters
Beat the wind and cold with a scarf or neck gaiter made by some of the foremost outdoor experts. Go ahead and stay outside a little longer with these neck warmers by Smartwool, Icebreaker, Patagonia, Mountain Hardwear and Smartwool.
The products in the Scarves & Neck Gaiters category have an average rating of 4.6 of 5 from 10 customer reviews.


text:
XE Currency Converter
|Emirati Dirham
|Indian Rupee
Did you know?
XE Currency Converter
The XE Currency Converter includes a currency converter, cross-rate table, and forex news to keep you up-to-date on your favorite currency pair. Visit the Currency Encyclopedia ►
XE Services
Get commercial grade currency rates for your business with the XE Currency Data API or transfer money internationally at competitive rates with XE Currency Transfers ►
XE Market Analysis
North American Edition2015-10-09 11:02 UTC
The dollar and yen dove against the euro, commodity currencies and a variety of emerging world currencies as a risk-on sentiment coursed through global markets. The pound was also among the underperformers following an unexpected 4.3% m/m contraction in UK construction output in August. EUR-USD rose 0.7% in piercing 1.1360 for the first time since Sept-18. The run was sparked by above-forecast French production numbers, data not normally a euro mover ... Read More ►
European Edition2015-10-09 06:35 UTC
Commodity currencies have rallied, along with various Asian and other emerging world currencies at the expense of the dollar, yen, euro and other majors. This theme has been fuelled by a risk-on environment after the FOMC minutes from the mid-September meeting effected a further lengthening of odds for a Fed rate hike by year end. The minutes showed that "several members" were worried that downside risk to growth and inflation have increased due to ... Read More ►
Asian Edition2015-10-09 17:46 UTC
The dollar was mixed in N.Y. trade on Friday, and the FX market had a decidedly lethargic feel to is, following a fairly volatile week. Other than import/export price data, which had little impact on markets, there was little in the way of news to move currencies. EUR-USD did manage three-week highs however, peaking at 1.1387 after opening near 1.1350. USD-JPY held the 120 handle through the session, as risk appetite stayed positive for most of the day. ... Read More ►
Send a cheap money transfer ►
Looking to send money abroad? Transferring money online is easy with XE. Our service works with your bank and it's free to sign up.
- Free online quotes
- Competitive exchange rates
- No-fee money transfer options
- Bid for your preferred rate
Get a currency data API ►
Need commercial grade rates for your business? The XE Currency Data API easily integrates with your system and has guaranteed data delivery.
- 160+ global sources
- Rates for every world currency
- Accuracy with proprietary rates
- Choose frequency of updates


text:
A beautifully subtle piece of packaging design for a BBQ rub that uses typography very effectively to make an impact.Posted in Branding → Product
This design set out to communicate luxury and sophistication by realizing a stylized word mark synonymous with a personalized invitation.Posted in Branding → Logo
Kyle Thacker's interaction and product design work.Kyle ThackerPosted in Web Design → Portfolio
A simple logo design that forms the letter G twice.Posted in Branding → Logo
A neat design for a menu that uses flat colours and shapes effectively.Posted in Interface → iPhone App
A superbly simple logo design that uses straightforward typography and a distinctive mark to make an impact.Posted in Branding → Logo
A superb example of interface element design, I love the design of the main slider and the effective use of colour.Posted in Interface → Element
A superb logo design that uses shadow really effectively and really jumps out at you.Posted in Branding → Logo
An interesting iOS app design that shuns texture for simplicity.Posted in Interface → iPhone App
A bold, colorful, no-nonsense portfolio and blog by UI designer Jonas Downey.Jonas DowneyPosted in Web Design → Blog
My new responsive portfolio.Jenny KarlssonPosted in Web Design → Portfolio
A superb design for an app icon that's distinctive and clean. I particularly like the use of textures and shape.Posted in Interface → iPhone App
This is the stunning portfolio site of Stephenio Abbott. A self taught Graphic Designer and web developer from the beautiful island of Barbados.Stephon AbbottPosted in Web Design → Portfolio
Content slider for a new client. Trying to achieve a simplistic but bold design.Christopher BrayPosted in Interface → Element
A solid app design that uses colour effectively to differentiate between different metrics.Posted in Interface → iPhone App
A logo design project for Thin Film Productions that's distinctive and uses a variety of colours well.Phan giang Hong phucPosted in Branding → Logo
A great shop theme that looks great not only on desktops but also on devices. I particularly like the simple grid layout.Posted in Web Design → Corporate
Silicon – a minimalist theme with plenty of features and ways to organize your content in a unique way for each page by simply dragging and dropping the content boxes to the page.Posted in Web Design → Corporate
Portdesign is a simple and clean but still professional template suitable for any business or portfolio, and it's created by using the latest HTML5 and CSS3 techniques. With a responsive design it is easily usable with any device (Desktop, tablet, mobile phone…), without removing any content!Mehmet özsoyPosted in Web Design → Portfolio
A solid design for a camera icon that uses little details to make an impact. I particularly like the use of lighting effects on the lenses.Posted in Interface → iPhone App


text:
Confusing closure signs on A595
Last updated at 17:24, Monday, 20 August 2012
RESIDENTS and motorists were left confused by conflicting road closure notices.
A section of the A595, Tippin's Lane, was due to close last night, from 6pm, and reopen at 8am.
But the traffic management team for BT, who are carrying out the work, placed signs on the A595 last week stating the road would be closed from 8am to 6pm.
The signs, near Elliscales roundabout near Dalton, and at both ends of the closure near Kirkby, have since been corrected to show the right closure times.
A notice on the Kirkby Ireleth Parish Council notice board, in Kirkby, shows that the closure was going to be overnight, from 6pm to 8am, all along, and reveals that the first information put up on the signs was wrong.
Cumbria County Council say the road signage is the responsibility of the contractor carrying out the work.
Ian Curwen, of Moorlands Service Station, in Kirkby, said: "We knew before the weekend that the signs were wrong as the county council had told us they were closing the road through the night.
"We had a few people saying they wouldn't be able to get through to us, because of the closure, but we've been able to put them right and it's not had any impact on things."
This evening the sign had been changed again to say the road would be closed between 8pm and 6am.
First published at 08:55, Monday, 20 August 2012
Published by http://www.nwemail.co.uk
Have your say
Not only is it incorrect, there's too much unnecessary info on that sign especially when you're speeding along at 50 mph around the bends. Who cares about an apology, especially when it's spelt wrong!
I don't suppose there's any chance the council could employ signwriters who can spell!
View all 3 comments on this article


text:
This member is banned for violating our Terms of Use. If this is your account and you would like it re-activated, please contact us with your justification.
This member has provided no bio about themself...
You are not logged in, your comment will be anonymous unless you join the community today (totally free - or sign in with your social account on the right) which we encourage all contributors to do.
2000 characters limit; HTML formatting and smileys are not supported - text only


text:
Orlando Magic v Atlanta Hawks
Ivan Johnson of the Atlanta Hawks attacks the basket against Tobias... News PhotoAtlanta,Atlanta Hawks - Basketball Team,Basketball - Sport,E'Twaun Moore,Georgia - US State,Ivan Johnson - Basketball Player,NBA,NBA Pro Basketball,Orlando Magic,Philips Arena,Sport,Tobias Harris,USA,VerticalPhotographer Kevin C. CoxCollection: Getty Images Sport 2013 Getty ImagesATLANTA, GA - MARCH 30: Ivan Johnson #44 of the Atlanta Hawks attacks the basket against Tobias Harris #12 and E'Twaun Moore #55 of the Orlando Magic at Philips Arena on March 30, 2013 in Atlanta, Georgia. NOTE TO USER: User expressly acknowledges and agrees that, by downloading and or using this photograph, User is consenting to the terms and conditions of the Getty Images License Agreement. (Photo by Kevin C. Cox/Getty Images)


text:
Weatherford BMW has a complete inventory of over 200 new BMW cars and SUVs for even the most discerning buyer to choose from at our Berkeley location. Whether you're looking for one of our famed sports sedans like the award-winning 3 Series or its new brothers, the 4 Series and 2 Series coupes or would prefer the stately presence of the 5 Series or 7 Series, we have everything you need in our New Inventory.
If you want something a little bigger, we have a full
complement of BMW SUVs as well. Weatherford BMW has plenty of BMW X1s, X3s,
X5s, and X6s to choose from in all trim levels. We will soon be getting the new
i3 and i8 hybrid cars as well. We even have a full complement of M models as
well. No matter what you want - sporty rear wheel drive or stable xDrive, we've
got something for you at Weatherford BMW.


text:
Protecting credit unions and the consumers who own them through effective regulation
The mission of the NCUA is to provide, through regulation and supervision, a safe and sound credit union system, which promotes confidence in the national system of cooperative credit.
In this section, you can find credit unions and research general and financial information. Other statistics, data, and reports include the archived Quarterly Call Reports, Financial Performance Reports, and Share Insurance Queries.
Find and research specific credit unions; locate educational resources on financial literacy, privacy, and identity protection; and read about the regulations that govern credit unions and corporate credit unions.
This section details the laws and regulations that govern NCUA-insured credit unions. Here you can access current and proposed regulations, regulatory alerts and policy statements, as well as guides, manuals and forms.
View the latest news, media and events at NCUA, including newsletters, speeches, and press releases.
Home > News, Media and Events > Pepsi Cola Federal Credit Union Closes
ALEXANDRIA, Va. (March 15, 2013) – The National Credit Union Administration (NCUA) today liquidated Pepsi Cola Federal Credit Union of Buena Park, Calif. NCUA made the decision to liquidate Pepsi Cola Federal Credit Union and discontinue operations after determining the credit union was insolvent and had no prospect for restoring viable operations.
Member deposits are federally insured by the National Credit Union Share Insurance Fund up to $250,000. NCUA's Asset Management and Assistance Center will issue correspondence to individuals holding verified share accounts in the credit union within one week.
Members with additional questions about their insurance coverage may contact NCUA's Consumer Assistance Center toll free at 800-755-1030. The Center answers calls Monday through Friday between 5 a.m. and 2 p.m. Pacific. Individuals may also visit the MyCreditUnion.gov website at any time for more information about their insurance coverage.
Pepsi Cola Federal Credit Union served 558 members and had assets of approximately $652,000, according to the credit union's most recent Call Report. Chartered in 1956, Pepsi Cola Federal Credit Union served employees of the Pepsi Cola Bottling Company for 57 years.
Pepsi Cola Federal Credit Union is the fourth federally insured credit union liquidation in 2013.
NCUA is the independent federal agency created by
the U.S. Congress to regulate, charter and supervise
federal credit unions. With the backing of the full
faith and credit of the United States, NCUA operates
and manages the National Credit Union Share
Insurance Fund, insuring the deposits of more than 101
million account holders in all federal credit
unions and the overwhelming majority of
state-chartered credit unions. At
MyCreditUnion.gov and
Pocket Cents, NCUA also educates the public on consumer protection and financial literacy issues.
John Fairbanks
Office: 703.518.6336
Mobile: 571.438.0801
Ben C. Hardaway
Office: 703.518.6333
Mobile: 703.298.5223
Kenzie Snowden
Office: 703.518.6334
"Protecting credit unions and the consumers who own them
through effective regulation"
National Credit Union Administration, 1775 Duke Street, Alexandria, VA 22314-3428
If you have questions about NCUA: Go to our Contact Us page
or call 703-518-6300


text:
I was thinking of somthing you missed or didn't know.
What about a shapeshifter?
I was thinking of somthing you missed or didn't know.
What about a shapeshifter?
That's stereotypical. Not ALL Drows are bad! That's like saying that all humans are good. Or that gnomes are as gross, yet tastey, as on WoW. (They are, though.)
lol, it should be applied to ElderScrolls,
cause they lack on Races.
Btw, very good races there i might
use it for my RPG.
correct me if I'm wrong, but do I not see a Regular Archer? i see arcane and spirit, but I can't seem to find an archer, and here's a sample just cause I'm bored...
Archers are noble, caring people, usually involved with nature.They are quick to find gold and fame. They stay behind the warriors in a fight, weakening the enemy. Many do not have defensive abilities but make up for it by being swift and agile. They usually carry a small melee weapon such as a dagger, if a monster gets too close.
feel free to edit, or not use it at all, I don't care, although it would be cool to brag to my frie..cousin that my desc. is partially (or fully) in an rpg class/job guide. (I didn't say friend cause friends don't like it when you brag about role-playing stuff...they think its not cool or something like that)
just drop by, and i saw your thread, its fantastic!
Thanks for this, dude! With this I have a lot of sparked ideas in my head.
Um, I was just wondering...
How come there aren't any mention of Dragons and what-not, such as:
Wyrms - Creatures that often resemble gigantic, thick worms or snakes. Although they are considered dragons, most have neither legs nor wings. Sharp, rugged scales tend to line their back, and they have rasor sharp teeth. They are usually found in deserts plagued with sandstorms. When an enemy approaches, they arise from their hiding place within the sand and use the harsh weather of deserts to their advantage.
Wyverns - Large dragons that have the appearance of common dragons, yet with a few distinct features. One is their sleek snake tails; the other being having two legs, but no arms. Despite this disadvantage, their talons are powerful and can easily pick almost anything of their choosing up. The combination of their tenacious talons and their thick, bombastic wings that allow them to dodge almost any weapon besides an arrow make them a deadly foe.
Those are the only ones I care enough to explain, but dragons are important fantasy creatures as well. Please consider adding a catagory on them when you have the time (unless they are either not allowed or I somehow missed any mention of them...I hope the latter is not correct, for I will feel REALLY dumb...).
Inspiration for creatures- Final Fantasy xD but desc aided by google definitions (not taken from exactly, just used as a back-up).
Nurarihyon no Mago!
-- farag0n; Tales of AmnInpa: "...I got your mask already, look! Isn't it pretty?
Balthazar: Urgh.. !! It's pink..
Inpa: Oh please, it's called being metrosexual!..."