text:
Text Version
Chapter 11 Testing the Firewall Solutions in this chapter: ■ OS Configuration ■ Firewall Configuration ■ Working with Firewall Builder ■ System Administration ■ Testing the Firewall Rulebase ■ Identifying Misconfigurations ■ Identifying Vulnerabilities ■ Packet Flow from All Networks ■ Change Control ■ Validated Firewalls ˛ Summary 275 0000839635.indd 275 6/5/2008 3:51:10 PM 276 Chapter 11 • Testing the Firewall Introduction In this chapter we will introduce the concepts of auditing or testing firewalls. First we need to define a firewall. A firewall is an application, device, system, or a group of systems that controls the flow of traffic between two networks based on a set of rules, protects systems from external (internet) as well as internal threats, separates a sensitive areas of a private network from less sensitive areas, encrypts internal and external networks that transmit sensitive data (when used as a VPN endpoint), or hides internal network addresses from external networks (network address translator). A firewall picks up where the border router leaves off and makes a much more thorough pass at filtering traffic. Firewalls come in different types, including static packet filters (for example Nortel Accelar router), statefull firewalls (for example Cisco PIX), and proxy firewalls (for example Secure Computing Sidewinder). Similar to routers, a firewall uses various filtering technologies or methods to ensure security. These methods include packet filtering, statefull inspection, proxy or application gateway, and deep packet inspection. A firewall can use just one of these methods, or it can combine different methods to produce the most appropriate and robust configuration. A good way to start to test a firewall is to gather information from individuals that have some responsibility for it. These people may be members of the audit team, system administrators, network administrators, members of the policy team, and information security personnel. The idea is to gather and collate each person's perceptions of what the firewall's functionally should be and what it is configured to provide for the network and systems. Obtain any existing firewall documentation and network diagrams to verify the information gathered from the interview. Ideally, the firewall is a control designed to reflect policy. This means that policy must be in place before the firewall is configured. Sadly, this is seldom the case. After the information detailed above has been collected, the auditor can develop an understanding of the firewall architecture, and determine whether the firewall is configured to correctly segment networks and defend information. The next step is to evaluate the operating system (OS) configuration. This is the configuration of the firewall platform itself. All firewalls have an OS. Do not be fooled by vendor assertions that firewalls have an appliance. A firewall appliance typically will just have an OS that has been hardened. The appliance could in fact be running a scaled down version of Unix or, in some cases, be running a customized OS written by the firewall company, as in the case of the Cisco Adaptive Security Appliance (ASA). Firewalls and routers are all software driven; all they do is make it more difficult to see the code. Next it is important to ensure that system administration follows best practice: user management, patch updates, change control, and configuration backups. If the firewall is not patched it will eventually be compromised. Just because it is a security device, it is not automatically secure. Finally, it is necessary to validate that the firewall rulebase matches the organizational policy. Testing the firewall should be coordinated with testing the other components of the organization's defense-in-depth methodology. The organization should not rely only on a single line of defense; if it does, raise a red flag. Firewalls are not the panacea for all security ills. They mainly slow attackers and log activity. The overall result of the testing or audit of the firewall would be the identification of any security vulnerabilities, as well as an assessment of whether the firewall is fulfilling its function in relation to the security policy of the company. Assess whether the setup, configuration, and operation of the www.syngress.com 0000839635.indd 276 6/5/2008 3:51:10 PM Testing the Firewall • Chapter 11 277 firewall are secured sufficiently to protect the information or services that the firewall is intended to guard, considering the risks that were identified and the likelihood of occurrence. The Center for Internet Security provides benchmarks for several specific brands of firewalls devices. The benchmarks (available at www.cisecurity.org) greatly aid in developing an audit program for firewalls. These benchmarks are the source of our checklist frameworks. OS Configuration When auditing the firewall, the auditor must look at the platform or the OS on which the firewall is running. An auditor needs to check on whether the OS on which the firewall is installed is stripped to contain only the minimum functionalities or services that are required to provide the functions it runs. The firewall should be an isolated system dedicated to one purpose only, which is filtering traffic based on defined rules. The less complex the installation, the simpler its administration will be. Fewer features equates to less patching and fewer vulnerabilities. To verify this, commands can be used for determining what services and ports are available to the OS. Many operating systems have a number of built-in tools that may be used to determine which ports are listening. Some examples are listed here with more in the chapters associated with specific operating systems: ■ UNIX: lsof –I, netstat –a, and ps –aef ■ Windows the Service Microsoft Management Console (MMC), netstat –a and fport When first determining the open ports and services, the firewall should be turned off (disabled or running with a policy that allows all traffic). This is done to test only the operating-system-specific ports and services. It is important to do this on a secure network and not connect the firewall to the Internet at this point. Remember, the firewall is a router in this mode. In addition, the security settings and vulnerabilities of the OS that is installed should be analyzed. Every OS includes a set of security features and vulnerabilities, which varies from vendor to vendor and even between versions. For instance, the default security settings of the OS may not be modified during the installation and such settings may not meet the desired level of security that is consistent with the security policy. Some of the most common security settings that can be evaluated are the access rules, password rules, and logging rules. Other OS/version-specific settings and parameters should also be verified. Centre for Internet Security also provides benchmarks for several OS. Those benchmarks (available at www.cisecurity.org) can greatly aid in determining whether the OS is configured based on the general industry best practices. Firewall Configuration After looking at the firewall platform's OS, the next stage involves the validation of the firewall configuration. All firewalls have both a configuration and policy. These should not be confused. The configuration is the set of base settings associated with the firewall software and installation. www.syngress.com 0000839635.indd 277 6/5/2008 3:51:10 PM 278 Chapter 11 • Testing the Firewall Changes to the configuration of the firewall will change its behavior, and, hence, how it processes in accordance with the policy. Again the auditor must check on whether the firewall sits on an isolated system dedicated to one purpose only, which is filtering packets (and logging, of course). For instance, DNS, e-mail, or server load-balancing functions should not be installed on the same host or be processed by the firewall platform. The sole exception here is that load-balancing the firewall itself is a function of a high-availability firewall and is allowed. Since the fundamental purpose of the firewall is to manage the flow of information between two networks, the auditor must look at how it serves such a function by looking at the firewall's configuration. We need to verify whether the traffic that the firewall allows to pass through is consistent with the security policy. Testing the rulebase is discussed in the latter part of the chapter, but critical things to look at are that: ■ The access rules (authentication, authorization, and accounting) for the firewall are in line with the security policy and best practices ■ Access to the firewall system for management and maintenance is provided using an encrypted channel ■ Physical access to the device is restricted ■ The firewall is configured to hide internal restricted DNS information from external networks ■ The external firewall restricts incoming SNMP queries ■ The firewall is configured as fail closed ■ The firewall hides internal information from external sources ■ The firewall is configured to deny all services, unless explicitly allowed ■ Al security-related patches are applied to the firewall system ■ Configuration settings are properly backed up and accessible to authorized personnel only Figure 11.1 illustrates an example of a firewall's standard policy rules. In this example, the standard policy rules detail the default settings that will be merged with the policy before being installed. Thus, the configuration and the policy when applied together make the rules that are enforced at the firewall. www.syngress.com 0000839635.indd 278 6/5/2008 3:51:10 PM Testing the Firewall • Chapter 11 279 Figure 11.1 Standard Firewall Rules Configuration Working with Firewall Builder Firewall Builder (www.fwbuilder.org) is a general public license (GPL) software package designed to aid administrators in configuring firewalls. The current version, Firewall Builder v 2.1.18, supports the following firewall platforms: ■ FireWall Services Module (FWSM) ■ ipfilter ■ ipfw ■ iptables ■ PF www.syngress.com 0000839635.indd 279 6/5/2008 3:51:10 PM 280 Chapter 11 • Testing the Firewall ■ Cisco Private Internet Exchange (PIX) ■ and a number of other platforms such as: ■ FreeBSD ■ Cisco FWSM ■ Linksys/Sveasoft ■ GNU/Linux (kernel 2.4 and 2.6) ■ Mac OS X ■ OpenBSD ■ Solaris Following the setup of standard policy, the next decision to be made by the administrator is to define the interfaces of the firewall and, consequently, the configurations for each of the interfaces. Examples of interfaces that a firewall could usually have are the external interface (untrusted) and the internal interface (trusted). Testing the firewall would therefore involve the testing of the configurations of each of the firewall's interfaces to validate their compliance with the firewall policy of the organization. Building or Only Testing Firewall Builder has a number of configuration guides available on its Web site as shown in Figure 11.2: www.fwbuilder.org/guides/firewall_builder_howtos.html www.fwbuilder.org/guides/firewall_builder_cookbook.html Most vendors also have their own guidelines and install guides as well. On top of this, there are a large number of good configuration books for both generalized firewall knowledge and excellent system-specific ones (such as Check Point NGX R65 Security Administration released by Elsevier). www.syngress.com 0000839635.indd 280 6/5/2008 3:51:10 PM Testing the Firewall • Chapter 11 281 Figure 11.2 Firewall Builder How-To Guides The main advantage (other than low cost, even commercially) of a tool such as Firewall Builder is that it is able to manage several systems (see Figure 11.3). www.syngress.com 0000839635.indd 281 6/5/2008 3:51:10 PM 282 Chapter 11 • Testing the Firewall Figure 11.3 Firewall Builder Cookbook Firewall Builder also uses an interface that is both simple and very familiar to anyone who has worked with the commercial products. Figure 11.4 is an example of the Firewall Builder user interface. www.syngress.com 0000839635.indd 282 6/5/2008 3:51:10 PM Testing the Firewall • Chapter 11 283 Figure 11.4 Standard Firewall Rules Configuration This interface allows the auditor to quickly validate configuration against the policy. Also, this tool provides the capability to save rulesets. This feature enhances change management. By being able to go back and view previous rulesets, the auditor can see the patterns of change as they occur over time and also seek reasons for rules that have been added. The policy installer (see Figure 11.5) adds the capability to quickly view the date when the policy was last compiled and last installed (and if these are the same). www.syngress.com 0000839635.indd 283 6/5/2008 3:51:10 PM 284 Chapter 11 • Testing the Firewall Figure 11.5 Firewall Builder Policy Installer Rules Compilation and Installation Conflicting Rules From time to time it is necessary to merge rulebases. For this reason the Firewall Builder tool has a validation function (see Figure 11.6). Figure 11.6 Firewall Builder Rules Conflict Checker www.syngress.com 0000839635.indd 284 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 285 System Administration When you are auditing a firewall, the next thing to look at is how the operation of the firewall is being managed, continually tuned in, and monitored. Processes to be looked at are: ■ The process of user administration (that is, who can access the firewall device and make changes to its configuration) ■ The process of making changes to the configuration and firewall rulebase. ■ The process of updating and applying security patches to both the OS and the firewall ■ The process for monitoring new bugs or weaknesses of the firewall software ■ The process of determining whether all necessary firewall activities are being logged ■ The process of determining whether rule activity, logs, and rules violations are monitored ■ The process of determining whether continuity plans for firewalls are in place Testing the Firewall Rulebase The Firewall rulebase is the set of rules that dictate which packets are allowed or rejected (dropped) as they are encountered by the firewall. Packets can come from inside and outside sources, and the firewall's rulebase determines whether a packet is allowed to pass through, based on several criteria or rules. Most firewalls come with default settings. However, it is not surprising to know that these settings do not provide even the most basic level of security that most organizations would like to have. For example, some of Checkpoint's firewall appliances allow, by default, unrestricted and unlogged Domain name system (DNS), Internet Control Message Protocol (ICMP) and Routing Information Protocol (RIP) access both in and out of the firewall. These default settings leave the firewall open to Trojan horses, ping attacks (Ping of Death, smurfing, etc.), man-in-the-middle attacks, and others that exploit the open ports. Testing the rulebase can bring to light certain misconfigurations and vulnerabilities that can affect the firewall's performance and the security of the network that it was installed to protect. Rulebase management is certainly a problem area for many firewall administrators. It's easy for firewall rulebases to become riddled with incorrect, overlapping, and unused rules, even in the presence of a change management system. There has been a bit of academic research into this topic during the past few years, and researchers have identified a number of anomalies worthy of an administrator's attention. ■ Overlapping/shadowed rules often occur when administrators create one high-priority rule that generalizes lower priority rules. For example, the administrator might create a rule that appears high in the rulebase, allowing all SMTP traffic. An older rule, lower in the base, might specifically allow SMTP traffic to a mail server. Because of its similarity and lower priority, however, this more specific rule will never be triggered. The situation could be made worse when the lower rule is intended to block traffic to a particular server. Since the generalized rule appears first, the block would never take effect. www.syngress.com 0000839635.indd 285 6/5/2008 3:51:11 PM 286 Chapter 11 • Testing the Firewall ■ Orphaned rules occur when services or systems disappear from the network or other changes render a rule obsolete. All too often, these rules are never removed from the firewall, creating a potential security hole and adding to a firewall administrator's burden. ■ Unused rules are similar to orphaned rules, except these rules were never used in the first place. Unused rules could be the result of change requests from projects that never materialized, or the unused rules could result from administrator errors when creating rules. A number of commercial tools attempt to tackle these problems. Examples of these tools are FireMon from Secure Passage LLC and Firewall Analyzer from Algorithmic Security (AlgoSec) Inc. The true solution, however, is to keep your rulebase simple, limit it to a manageable size; and conduct regular audits. Identifying Misconfigurations Some areas to consider when assessing the firewall policy include: ■ Has the design taken planned growth into account? ■ Is the system patched and tested? (Do not assume that all patches work.) ■ Does the policy provide defense in depth; does the architecture consider all layers of the Transmission Control Protocol/Internet Protocol (TCP/IP) stack? ■ What is allowed into the network? What is allowed out? All traffic entering or leaving the network, should have a justification. Some regulations and standards, such as the PCI Data Security Standard (DSS) require this justification for all traffic, but it is good practice, even when not specified by an adopted standard. The SANS GIAC Certified Firewall Analyst (GCFW) GCFW gold paper repository and the reading room subsite are great places to find papers on firewall design and architecture (www.sans.org/ reading_room/whitepapers/firewalls/). Identifying Vulnerabilities A firewall vulnerability can be an error or a weakness in the firewall's design, implementation, or configuration that anyone with malicious intent can exploit to attack that which the firewall is believed to protect. We can classify firewall vulnerabilities as: ■ Validation error A validation error occurs when the program interacts with the environment without ensuring the correctness of environmental data. Three types of environmental data need validation: input, origin, and target. Input validation ensures that the input is as expected. This includes the number, type, and format of each input field. Origin validation ensures that the origin of data is actually what it is claimed to be, for example, checking the identity of the IP source. Target validation ensures that the information goes to the place it is supposed to. This includes ensuring that protected information does not go to an untrusted target. www.syngress.com 0000839635.indd 286 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 ■ Authorization error An authorization error (authentication error) permits a protected operation to be invoked without sufficient checking of the authority of the invoking agent. ■ Serialization/aliasing error A serialization error permits the asynchronous behavior of different system operations to be exploited to cause a security violation. Many time-ofcheck-to-time-of-use flaws fall into this category. An aliasing flaw occurs when two names for the same object can cause its contents to change unexpectedly, and, consequently, invalidate checks already applied to it. ■ Boundary checking error A boundary checking error is caused by failure to check boundaries and ensure constraints. Not checking against excessive values associated with table size, file allocation, or other resource consumption leads to boundary checking errors. Buffer overflow is a result of a boundary checking error. ■ Domain error A domain error occurs when the intended boundaries between protection environments have holes. This causes information to implicitly leak out. ■ Design error Design errors can be traced to the system design phase. For example, a weak encryption algorithm falls into this category. 287 Following are the most common effects of the vulnerabilities described above: ■ Execution of code Execution of unwanted code occurs when a vulnerability can lead to code being illegitimately executed. This includes, but is not limited to, code written by an attacker. ■ Change of target resource Change of target resource occurs when a vulnerability allows the state of a resource to be illegitimately changed by an attacker. A resource could be a host, a firewall rule table, or any entity that should be protected by the firewall. ■ Access to target resource Access to a target resource occurs when a vulnerability allows an attacker illegitimate access to some resource. Again, a resource may be any entity that is protected by the firewall. Examples of this vulnerability effect include allowing an attacker to read the firewall rule tables or to find out which services are available on a protected host. ■ Denial of service (DoS) DoS occurs when a vulnerability is exploited to disrupt a service provided to legitimate users. Services in this context may range from packet forwarding or network address translation to administration. Firewall vulnerabilities are best identified by using automated tools called vulnerability scanners. These scanners determine the firewall's vulnerabilities by comparing its configuration against known weaknesses and vulnerabilities. The following are the most common tools used in the industry: ■ Active vulnerability scanners such as Internet Security Systems (ISS) Internet Scanner, Symantec NetRecon, and Nessus (see the chapter on scanning with Nessus) ■ Host-based scanners such as Microsoft Baseline Security Analyzer (MBSA), ISS System Scanner, and Symantec Enterprise Security Manager (see the chapter on scanning with MBSA) www.syngress.com 0000839635.indd 287 6/5/2008 3:51:11 PM 288 Chapter 11 • Testing the Firewall Packet Flow from All Networks Vulnerability scanners should be complemented with other specialized tools designed to analyze the packets going through the network. Scanning the Network Apart from assessing misconfigurations and vulnerabilities of the rulebase directly, the network itself should be scanned from every possible interface, both from the inside and outside, in all directions. For these scans, several tools that perform network mapping and port reconnaissance are available for download from the Internet, such as nmap, NmapWin, hping, Superscan and nemesis. Passive vulnerability assessment tools (packet sniffers) are also available; these capture and display network traffic for analysis. Examples of these tools are Wireshark, tcpdump, and windump, to name a few. Lastly, there are active vulnerability scanners, wherein especially crafted probes via plugins are sent through the network to see how the target will respond. Examples of active vulnerability scanners are Nessus, Saint, SARA, and others. Using the aforementioned tools, you can perform some basic tests such as: ■ Using Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) to scan the firewall for all possible 65535 ports. ■ Performing a ping sweep to see if echo-requests can pass through ■ Performing a SYN scan subnet to look for open ports (use a full TCP Connect scan for proxies) ■ Performing a slow SYN scan to see if port scans are detected ■ Performing a scan with FIN packets to see if they are handled differently ■ Performing a scan with ACK packets to see if they are handled differently ■ Fragmenting ACK packets to see if they are handled differently ■ Performing a UDP scan subnet to look for open ports It is recommended that security administrators use more than a couple of tools to scan and monitor the network. This use of multiple tools will minimize false positives and false negatives, and will give a more complete picture of the network. When scanning, ensure that sniffers are configured to monitor traffic passing through the firewall. Do not trust the firewall logs alone. Using nmap The following are screenshots captured while performing some of the basic tests listed above using nmap. Note that several types of information, such as open ports and running services, are displayed as output. TCP and UDP scan the firewall for all possible 65535 ports; see Figure 11.7. Nmap –sTU –p1-65535
www.syngress.com 0000839635.indd 288 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 289 Figure 11.7 nmap Scanning for 65535 Ports Perform a ping sweep to see if echo-requests can pass through; see Figure 11.8. Nmap –PE
Figure 11.8 nmap Scanning Ping Sweep SYN scan subnet to look for open ports (use a full TCP Connect scan for proxies); see Figure 11.9. Nmap –sS
Figure 11.9 Nmap SYN Scanning for Open Ports Scan with FIN packets to see if they are handled differently; see Figure 11.10. Nmap –sF
www.syngress.com 0000839635.indd 289 6/5/2008 3:51:11 PM 290 Chapter 11 • Testing the Firewall Figure 11.10 nmap Scanning with FIN Packets Scan with ACK packets to see if they are handled differently; see Figure 11.11. Nmap –sA
Figure 11.11 nmap Scanning with ACK Packets UDP scan subnet to look for open ports; see Figure 11.12. Nmap –sU
/24 Figure 11.12 nmap UDP Scanning for Open Ports www.syngress.com 0000839635.indd 290 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 291 Using hping2 Also available is hping2, a command-line oriented TCP/IP packet assembler/analyzer. Patterned after the ping(8) Unix command, hping supports TCP, UDP, ICMP and Raw IP protocols, has a traceroute mode, the ability to send files through a covert channel, and many other features. All header fields can be modified and controlled using the command line. Some of the uses of hping are firewall testing, advanced port scanning, network testing using different protocols, type of service (ToS), fragmentation, manual path maximum transmission unit (MTU) discovery, advanced traceroute under all the supported protocols, remote OS fingerprinting, remote uptime guessing, and TCP/IP stacks auditing. Execute an hping for UDP scan of port 123; see Figure 11.13. Figure 11.13 hping Scanning of Port 123 Send an ICMP timestamp request packet (icmptype 13); see Figure 11.14. Figure 11.14 hping Sending Timestamp Request Packet Do hping SYN scan of port 1; see Figure 11.15. www.syngress.com 0000839635.indd 291 6/5/2008 3:51:11 PM 292 Chapter 11 • Testing the Firewall Figure 11.15 hping SYN Scanning of Port 1 Change Control A properly configured firewall rulebase soon becomes weak if it is not given a regular checkup. It comes to no surprise that some firewall administrators configure their firewalls just once and then never worry about it again. New vulnerabilities in both operating systems and firewall software are constantly being discovered. If the firewall operating system and software, including the rulebase, are not being updated, the firewall will not be able to withstand an attack, and would have little claim to due diligence, and reasonable and prudent precautions in any legal proceedings. However, changes to the firewall should never be done arbitrarily or on impulse. A proper change management procedure, as part of the overall security policy, is highly recommended. The following information should be included as comments whenever a rule is modified: ■ name of person modifying rule ■ date/time of rule change ■ reason for rule change ■ approval from management The best part here is that this type of check is custom designed to by baselines and placed into an automated check. Why not let the system do the work for you and send an alert when anything changes without going through the correct change process? Validated Firewalls Firewall configurations should be validated before they are put into production (a live environment). Validation means checking that the configuration would enable the firewall to perform the security functions that we expect it to do and that it complies with the security policy of the organization. You cannot validate a firewall by looking at the policy alone. The policy is an indicator, but not the true state. The only way to ensure that a firewall is behaving correctly is to test it using the thing it is set to control, packets. To validate a firewall, you need to fire packets at it. www.syngress.com 0000839635.indd 292 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 293 Validated firewalls need to be constantly monitored for health and stability. Proper change management procedures and policies around the firewall rulebase should be observed at all times. Every time a new rule is made, the firewall should be validated again as a whole, not just for the particular rule that was added or changed. Abnormal traffic patterns should be investigated immediately. If servers that normally receive a low volume of traffic are suddenly responsible for a significant portion of traffic passing through the firewall (either in total connections or bytes passed), then this might be a situation worthy of further investigation. While sudden peaks and spikes are to be expected in some situations (such as a Web server during a period of unusual interest), sudden peaks and spikes are also often signs of misconfigured systems or maybe even attacks in progress. Rule violations should be treated as incidents. Looking at traffic denied by your firewall may lead to interesting discoveries, but it is unlikely that even the smallest of organizations could watch all the logs (if they are working). This is especially true for traffic that originates from inside your network. The most common cause of this activity is a misconfigured system or a user who is not aware of traffic restrictions, but analysis of rule violations may also uncover attempts at passing malicious traffic through the device. Detecting probes originating from inside the trusted network should be performed periodically. These are extremely interesting, as they most likely represent either a compromised internal system seeking to scan Internet hosts or an internal user running a scanning tool, which are both scenarios that merit attention. Apart from those previously mentioned, firewall log files should be regularly monitored to check for significant events. These fall into three broad categories: critical system issues (such as hardware failures or performance bottlenecks), significant authorized administrative events (ruleset changes, administrator account changes), and network connection logs. ■ Host operating system log messages For the purposes of this document, we will capture this data at the minimum severity (maximum verbosity) required to record system reboots, which will record other time-critical OS issues, too. ■ Changes to network interfaces We need to test whether or not the default OS logging captures this information, or if the firewall software records it somewhere. (Is UNIX ifconfig (or the equivalent) invoked?) ■ Changes to firewall policy ■ Adds/deletes/changes of administrative accounts ■ System compromises ■ Network connection logs The information in these logs includes dropped and rejected connections, time/protocol/IP addresses /usernames for allowed connections, and amount of data transferred. There are several tools that can automate firewall log monitoring, including such features as realtime alerts and notifications, and customized reports. Configuration reviews may be mandatory for firewalls that process regulated data. In fact, the Payment Card Industry Data Security Standard (PCI-DSS) requires quarterly firewall reviews for systems involved in payment card processing. www.syngress.com 0000839635.indd 293 6/5/2008 3:51:11 PM 294 Chapter 11 • Testing the Firewall Manual Validation A manual validation of the rulebase is most effective when done as a team exercise by the security manager, firewall administrator, network architect, and everyone else who has a direct involvement in the administration and management of the organization's network security. First and foremost, the rulebase should conform to the organization's security policy, hence the recommendation that security managers and administrators be present in the rulebase review. Prior to the validation, the rulebase should be backed-up to ensure that, if anything goes wrong after implementing changes to the firewall, the previous rulebase can be installed and troubleshooting can be done from there. In validating the rulebase, unneeded rules should be eliminated. Keeping the rulebase as short and simple as possible conforms to best practices. If there is a rule that everyone is unsure of, it should be removed. The same applies to redundant rules. Some rules can also be grouped together. While on the topic of best practices, it is recommended that any changes be documented for future reference. Any exceptions to the rules should also be documented, along with an explanation for why these exceptions exist. (This could be a good place to create a baseline for future audits). Lastly, the rules should be validated for correct order. Rule order is very critical. Most firewalls (such as SunScreen EFS, Cisco IOS, and FW-1) inspect packets sequentially. When a packet is received, it is compared against the first rule, then the second, then the third, and so on. When a matching rule is found, checking is stopped; the rule is applied. If the packet goes through each rule without finding a match, then that packet is denied (or it should be. The only last rule on a firewall that should ever exist is a default drop or reject, this is not always the case). It is critical to understand that the first rule that matches is applied to the packet, not the rule that best matches. Based on this, it is recommended that the more specific rules be first, and the more general rules be last. This arrangement of rules prevents a general rule being matched before hitting a more specific rule, helping to protect the firewall from misconfiguration. Automated Rulebase Validation There are readily-available tools that perform an analysis of the rulebase by matching it against a standard or benchmark, such as the Router Audit Tool (RAT) and Nipper. (See the router and network devices chapter for separate how-to manuals for RAT and Nipper.) These tools run every rule in the rulebase against known weaknesses and vulnerabilities, and then provide a report at the end, with recommendations on how best to rectify the discovered errors. Using automated tools is much faster than manual validation and, often as an added feature, can detect whether the latest firewall patches/updates have been installed. However, automated tools do have their limitations. One limitation is that they cannot guarantee that the rulebase is in line with the security policy. In this case, manual validation has an advantage. Creating Your Checklist The most important tool that you can have is an up-to-date checklist for your system. This checklist will help define your scope and the processes that you intend to check and validate. The first step in this process involves identifying a good source of information that can be aligned www.syngress.com 0000839635.indd 294 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 295 to your organization's needs. The integration of security check lists and organizational policies with a process of internal accreditation will lead to good security practices and, hence, to effective corporate governance. The first stage is to identify the objectives associated with the systems that you seek to audit. Once you have identified the objectives, a list of regulations and standards to which the organization needs to adhere may be collated. The secret is not to audit against each standard, but rather to create a series of controls that ensure you have a secure system. By creating a secure system you can virtually guarantee that you will comply with any regulatory framework. The following sites offer a number of free checklists that are indispensable in the creation of your firewall audit framework. CIS (Center for Internet Security) CIS provides a large number of benchmarks, not only for operating systems, but also for network devices and even firewalls. (CIS is mentioned throughout this book.) CIS offers both benchmarks and tools that may be used to validate a system. The site is www.cisecurity.org. Part of the CIS checklist for checkpoint firewalls is shown in Figure 11.16. Figure 11.16 CIS Checklist for Checkpoint Firewalls www.syngress.com 0000839635.indd 295 6/5/2008 3:51:11 PM 296 Chapter 11 • Testing the Firewall SANS The SANS Institute has a wealth of information available that will aid in the creation of a checklist and many documents that detail how to run the various tools. The SANS reading room (www.sans.org/reading_room/) has a number of papers that have been made freely available: ■ GCFW Audit Gold Papers (firewall-specific) ■ GCUX UNIX Gold Papers and GCWN Windows Gold Papers (and maybe others) ■ general tools papers (www.sans.org/reading_room/whitepapers/tools/) SANS SCORE (Security Consensus Operational Readiness Evaluation) is directly associated with CIS. NSA, NIST and DISA The US government through the National Security Agency (NSA), Defense Information Systems Agency (DISA) and National Institute of Standards and Technology (NIST) has a large number of security configuration guidance papers and benchmarks. NIST runs the US National Vulnerability Database (see http://nvd.nist.gov/chklst_detail.cfm? config_id=58), which is associated with a number of network and operating system Security Checklists from DISA (http://iase.disa.mil/stigs/checklist). These are covered in more detail in each of the sections for the operating systems. (See the UNIX and Windows chapters for more information.) www.syngress.com 0000839635.indd 296 6/5/2008 3:51:11 PM Testing the Firewall • Chapter 11 297 Summary Many people and groups such as Gartner (www.gartner.com) have come out stating that firewalls are dead. The truth is that this is far from reality. It may be true that firewalls are changing, but they are an essential component of security. Though protocols such as RPC over HTTP and peer-to-peer networks eat away at the effectiveness of the firewall, allowing traffic inside the network, it is difficult to think about securing a site without a firewall. It is impossible to meet the compliance requirements of any system without one. It is better and easier to defend a small subset of network traffic and access through a limited number of choke points that to think about everything at once. This is what firewalls have traditionally done, and they still add to the security of any site. An administrator without a firewall is putting out fires. This is where the validation of a firewall is so important. It is not enough to have one; it must be effective. This means auditing and testing. www.syngress.com 0000839635.indd 297 6/5/2008 3:51:11 PM 0000839635.indd 298 6/5/2008 3:51:11 PM
File Information
Link or Click Back
portlet Settings
Here will be a configuration form
Site Map 1
Site Map 2
Site Map 3
Site Map 4
Site Map 5
Site Map 6
Site Map 7
Site Map 8
Site Map 9
Site Map 10
Site Map 11
Site Map 12
Site Map 13
Site Map 14
Site Map 15
Site Map 16
Site Map 17
Site Map 18
Site Map 19
Site Map 20
Site Map 21
Site Map 22
Site Map 23
Site Map 24
Site Map 25
Site Map 26
Site Map 27
Site Map 28
Site Map 29
Site Map 30
Site Map 31
Site Map 32
Site Map 33
Site Map 34
Site Map 35
Site Map 36
Site Map 37
Site Map 38
Site Map 39
Site Map 40
Site Map 41
Site Map 42
Site Map 43
Site Map 44
Site Map 45
Site Map 46
Site Map 47
Site Map 48
Site Map 49
Site Map 50
Site Map 51
Site Map 52
Site Map 53
Site Map 54
Site Map 55
Site Map 56
Site Map 57
Site Map 58
Site Map 59
Site Map 60
Site Map 61
Site Map 62
Site Map 63
Site Map 64
Site Map 65
Site Map 66
Site Map 67
Site Map 68
Site Map 69
Site Map 70
Site Map 71
Site Map 72
Site Map 73
Site Map 74
Site Map 75
Site Map 76
Site Map 77
Site Map 78
Site Map 79
Site Map 80
Site Map 81
Site Map 82
Site Map 83
Site Map 84
Site Map 85
Site Map 86
Site Map 87
Site Map 88
Site Map 89
Site Map 90
Site Map 91
Site Map 92
Site Map 93
Site Map 94
Site Map 95
Site Map 96
Site Map 97
Site Map 98
Site Map 99
Site Map 100
Site Map 101
Site Map 102
Site Map 103
Site Map 104
Site Map 105
Site Map 106
Site Map 107
Site Map 108
Site Map 109
Site Map 110
Site Map 111
Site Map 112
Site Map 113
Site Map 114
Site Map 115
Site Map 116
Site Map 117
Site Map 118
Site Map 119
Site Map 120
Site Map 121
Site Map 122
Site Map 123
Site Map 124
Site Map 125
Site Map 126
Site Map 127
Site Map 128
Site Map 129
Site Map 130
Site Map 131
Site Map 132
Site Map 133
Site Map 134
Site Map 135
Site Map 136
Site Map 137
Site Map 138
Site Map 139
Site Map 140
Site Map 141
Site Map 142
Site Map 143
Site Map 144
Site Map 145
Site Map 146
Site Map 147
Site Map 148
Site Map 149
Site Map 150
Site Map 151
Site Map 152
Site Map 153
Site Map 154
Site Map 155
Site Map 156
Site Map 157
Site Map 158
Site Map 159
Site Map 160
Site Map 161
Site Map 162
Site Map 163
Site Map 164
Site Map 165
Site Map 166
Site Map 167
Site Map 168
Site Map 169
Site Map 170
Site Map 171
Site Map 172
Site Map 173
Site Map 174
Site Map 175
Site Map 176
Site Map 177
Site Map 178
Site Map 179
Site Map 180
Site Map 181
Site Map 182
Site Map 183
Site Map 184
Site Map 185
Site Map 186
Site Map 187
Site Map 188
Site Map 189
Site Map 190
Site Map 191
Site Map 192
Site Map 193
Site Map 194
Site Map 195
Site Map 196
Site Map 197
Site Map 198
Site Map 199
Site Map 200
Site Map 201
Site Map 202
Site Map 203
Site Map 204
Site Map 205
Site Map 206
Site Map 207
Site Map 208
Site Map 209
Site Map 210
Site Map 211
Site Map 212
Site Map 213
Site Map 214
Site Map 215
Site Map 216
Site Map 217
Site Map 218
Site Map 219
Site Map 220
Site Map 221
Site Map 222
Site Map 223
Site Map 224
Site Map 225
Site Map 226
Site Map 227
Site Map 228
Site Map 229
Site Map 230
Site Map 231
Site Map 232
Site Map 233
Site Map 234
Site Map 235
Site Map 236
Site Map 237
Site Map 238
Site Map 239
Site Map 240
Site Map 241
Site Map 242
Site Map 243
Site Map 244
Site Map 245
Site Map 246
Site Map 247
Site Map 248
Site Map 249
Site Map 250
Site Map 251
Site Map 252
Site Map 253
Site Map 254
Site Map 255
Site Map 256
Site Map 257
Site Map 258
Site Map 259
Site Map 260
Site Map 261
Site Map 262
Site Map 263
Site Map 264
Site Map 265
Site Map 266
Site Map 267
Site Map 268
Site Map 269
Site Map 270
Site Map 271
Site Map 272
Site Map 273
Site Map 274
Site Map 275
Site Map 276
Site Map 277
Site Map 278
Site Map 279
Site Map 280
Site Map 281


text:
|Probable Pitchers
|Won, 5-3
|@ Gwinnett,
6:35 p.m.
|Hill (9-2, 1.90) vs.
Schlosser (4-4, 4.33)
|Won, 5-1
|vs. Bowie,
7:00 p.m.
|Simmons (0-0, 5.88) vs.
Pettit (4-6, 6.40)
|Lost, 5-1
|vs. Wilmington,
7:05 p.m.
|Rauh (1-1, 5.08) vs.
Manaea (2-7, 4.75)
|Won, 8-4
|vs. Lakewood,
7:05 p.m.
|Johansen (4-3, 5.04) vs.
Viza (3-11, 5.10)
|Lost, 3-2
|vs. State College,
7:05 p.m.
|Van Orden (0-1, 4.50) vs.
Baez (0-0, 1.69)
|GCL Nationals
|@ GCL Marlins,
11:00 a.m.
|TBD and TBD vs.
TBD and TBD
|DSL Nationals
|Lost, 7-5
|@ DSL Cardinals,
10:30 a.m.
|W. Pena (1-3, 3.38) vs.
Diaz (1-2, 3.24)
Syracuse 5 Gwinnett 3
• Roenicke (W, 4-4) 5IP, 6H, 3R, 2ER, BB, K, HR
• Grace (H, 2) 2IP, 1H, 0R, 0BB, K
• Souza 3-4, R, 2B, 3B, 2BB, 2SB
• Burriss 2-5, 2R, 2-2B
Yunesky "Yuleftmehanging" Maya lost another game involving the Chiefs. But this time Chiefs fans were happy to learn that he was pitching for the opposing Gwinnett Braves. Maya gave up all five runs and apparently learned that Steven "Phone" Souza is good at baseball. Souza was a homer short of the cycle. In the 1st, Souza doubled in Emmanuel "Don't Call Me Lewis" Burriss for the Chiefs first tally. In the 3rd, Souza tripled in Emmanuel "I'm not Webster either" Burriss for another Chiefs tally. In the 6th, Steve "Believe" Souza walked, stole second, and later scored on a fielding error. Josh Johnson put Gwinnett out of their misery with a two-out pinch hit two-run double to make the final score 5-3 in the frame as well. Props to Matt Grace as well who pitched two scoreless innings of relief and remains unscored upon in 13⅔ AAA innings.
Roster move: RHP Neil Holland reassigned from Harrisburg.
Harrisburg 5 Bowie 1
• Simms (W, 2-0) 6IP, 4H, R, ER, BB, 4K
• Self 2IP, 1H, 0R, 0BB, 0K
• Martinson 3-4, RBI
• Sanchez 2-3, R, BB, HR, 3RBI, CS
• Hague 2-4, R, 2B
John Simms continues impress at the AA level, winning for the second time in three starts as Harrisburg knifed Bowie, 5-1. The 22-y.o. Texan turned in six strong innings with the lone BaySox run given up on four hits and one walk. Adrian Sanchez smacked a three-run HR in the 4th to break open a 1-0 game while Jason Martinson led the hit column with a 3-for-4 night as the Senators piled up 12 hits and drew five walks.
Wilmington 5 Potomac 1
• Dickson (L, 1-7) 6IP, 8H, 3R, 3ER, BB, 4K, HR
• Turnbull 3IP, 2H, 2R, ER, 3BB, 3K
• Pleffner 2-4
• J. Miller 1-4, 2B, RBI
Wilmington broke a 1-1 tie with a single-triple-double sequence to open the 6th and cruised to a 5-1 win over Potomac in the series opener. Starter Ian Dickson turned in a quality start of three runs allowed over six innings, but four of the eight hits went for extra bases as he walked one and struck out four while taking his seventh loss. The P-Nats bats were limited to just five hits total, with Shawn Pleffner the sole batter to reach base twice. Justin Miller's RBI double in the 2nd prevented back-to-back shutouts as the P-Nats have lost seven of their last eight scheduled games to fall below .500 at 8-9 for the second half.
Roster move: LHP Jake Walsh promoted from Hagerstown.
Hagerstown 8 Lakewood 4
• Giolito 4IP, 7H, 4R, 3ER, 3BB, 6K, WP
• Cooper (W, 6-2) 3IP, 4H, 0R, BB, 3K
• Kieboom 3-4, R, 2-2B, RBI, HBP
• Ballou 2-4, R, BB, RBI
• Ward 2-5, 3RBI
Hagerstown continued its domination of Lakewood, doubling 'em up 8-4 for its 13th victory in 17 games versus the Sally League's New Jersey entrant. Lucas Giolito, named the #11 prospect in BA's midseason
SEO project prospect list, was knocked around for four runs on seven hits and three walks over four innngs. He struck out six. The win went to Andrew Cooper, who turned in three scoreless frames for his sixth "W." Hagerstown matched a season-high of 16 hits with the 3-4-5 trio of Isaac Ballou, Spencer Kieboom, and Drew Ward going 7-for-13 with two doubles (Kieboom), two runs scored, and five RBI.
Roster moves: RHP Samuel Johns reassigned from Auburn; SS David Masters activated from the 7-Day DL.
State College 3 Auburn 2
• Derosier (L, 0-2) 4⅔ IP, 8H, 3R, 3ER, 2BB, 4K, HR, WP
• Ramos 2⅓ IP, 0H, 0R, 0BB, 4K, 1-0 IR-S
• Riopedre 1-4, 2B, 2RBI
• Eusebio 1-3
The Doubleday offense remained AWOL in a 3-2 loss to State College. Auburn managed just six hits, with the lone extra-base knock accounting for both of its runs as Chris Riopedre smacked a two-out, two-run double in the bottom of the 3rd. It was an answer to the three-run homer allowed by Matt Derosier in the top of the 3rd. The almost-20-y.o. was spiked for eight hits total over four and 2/3rds while walking two and striking out four in his second loss. Tyler Mapes and David Ramos combined for four and a 1/3rd innings of scoreless relief, but the Doubledays had just two baserunners after the 3rd inning for a total of three left on base.
Roster moves: RHP Tyler Mapes reassigned from the GCL Nationals, SS Willie Medina demoted from Hagerstown.
GCL Nationals — PPD
Let's hope they have enough (healthy) pitchers into handle three doubleheaders in four days, as Monday's game against the G-Marlins was rained out to create twinbill this morning.
Roster move: OF Gilberto Ramirez promoted from the DSL Nationals.
DSL Mariners 7 DSL Nationals 5
• Acevedo 5IP, 6H, R, ER, 3BB, 4K
• Charlis (BS, 3; L, 3-1) ⅔ IP, 3H, 2R, 2ER, 0BB, 2K, HBP, 2-2 IR-S
• Vilorio 2-4, R, RBI, 2E
• Pilier 1-3, BB, E
• Pimentel 1-4, R, HR, 3RBI
The D-Nats 'pen turned a 5-1 lead into a 7-5 loss with six runs allowed in the final three innings, including four in the 9th. Starter Carlos Acevedo turned in five innings of one-run ball, scattering six hits and working around three walks with four set down on strikes. His work would go for naught as Fiyeral "El Incendiario" came on in the 9th with one out and two runners on and let them both in along with two of his own for his third blown save and first loss. Luis Vilorio went 2-for-4 with a run score and an RBI to lead the hit column while Davinson Pimentel smacked a three-run homer in the 1st to lead the D-Nats offense.
17 Responses to "Tuesday's News & Notes"
Props to Luke for getting this one out on time. I've got to be better and help out a bit more. Nice to work on the writing chops, but I barely deserve a 2SDs credit on this one. Souza, however, deserves all the credit in the world and is trying to play Jayson Werth into very expensive trade bait or Aaron Rowand albatross status.
I don't know how you trade a guy with a 21 million a year contract from here-on-out that has a full no-trade clause attached? Its up to ownership to accept the fact they over paid and allow him to recede to a bench role along with McLouth. Somehow I don't think that's going to happen at least not yet.
You're right. That Werth deal was an overpay. Not the worst overpay in recent MLB history by a long shot, but an overpay nevertheless. I hope he's the well paid mascot on a champion who helps guide them through the nailbiters in the World Series, but we're a long way from there yet.
Full moon over Aberdeen this weekend
12 July
Ex-po Jeff will give a report on any games
Taken in.
Interesting result to that question: first kid from
Draft to reach hags: Samuel Johns. Suns could
Use another rifle in the bullpen .
John Simms is 2014 Schwartz!
Cool. My man Gilberto on the rise!!
6'3″ ands wheels
$300g for kid named not Joaquin Andujar?
Must have skills
Soul drummer. I would think SS bumps
Scott Hairston next spring
Yeah – Jayson Werth's contract has a full no trade clause; he's not going anywhere. With Hairston going Souza should at least join McLouth as the R/L bench OF bats. I think that it's at least possible that the Nats let Span go and allow Souza, Taylor, Hood and Goodwin fight it out for two slots – one starting and one bench. By letting Span, ALR and Soriano go the Nats could absorb most of the pay raises coming due and possibly nose about for a true starting second baseman – although the free agent market is pretty grim.
They got Souza starting in CF in the AAA. Luke suspects the dreaded "Hellenic flu" with Goodwin. What could that indicate? Werth could be allowed to recede to a bench role rather than Souza then you'd have two outfield slots for the crew to fight over. T-Mo has to be in the mix as well.
Souza did play in the infield in Potomac. Could he return? He seems athletic enough and he has an arm?
Werth may go to a bench role, but barring an absolute collapse/injury it's not going to be in 2015 (any more than Giolito is going to pitch for the Nationals in 2014). Even with his slow June, Werth has been the third best hitter on the team behind ALR and Rendon. Hopefully Harper, Zimmerman and Ramos raise there games to move past Werth in production, but Werth is still plenty valuable. He's not the defensive OF that he was, but he's no Michael Morse out there either.
But that's a good catch on Souza moving to CF in Syracuse – I just noticed that last night and figured that it was a one off with Moore playing LF – but when I saw your comment I checked and saw that he's played 21 games in CF, as many as he had his entire career before this year. That's interesting, and if he does well may make it more likely that the team deals Span or lets him walk.
Really appreciate your insight on Souza/Werth/Taylor/Goodwin dynamic in this thread gentlemen. Your thoughts are a substantial part of the reason that this remains my number one site in the Natmosphere.
Souza is pretty athletic. And he has an arm. Not sure who would be superior Souza or Harper in CF? Both do have significant range. It seems to be given his larger body of experience Souza might be able to play second base. I suspect Souza might be a far better convert than when the Yankees converted Robinson Cano? Luke probably would be a better judge of that having seen him at third base in Potomac before the suspension.
Luke. GCL kids should be able hum baby ( as roger Craig
Always said ) to burn innings.
That Michael Barrett board has more names than
Fonzi had in his black book
Goodwin has more to prove healthy @ AAA.
Funny thing About Hairston deal is that pinyero
Is on DL for cubs. 8 arms on burg. DL
I don't see the Nats bringing Span back. The system is deep with OF prospects, and Span has not performed well enough to justify keeping around a .260 hitter with zero power. Also, according to his defensive metrics, his CF play is down this year.
The one issue the Nats have is that their lineup is already too right-handed dominant, and two of the Nats 3 every day left-handed hitters, may not back next year (ALR and Span). The Nats best OF and 1B prospects all bat right-handed (Taylor, Souza, Moore). The Nats are not going to go with everyday lineup that has all RH hitters outside of Harper. Also, to the extent that the Nats will consider Espinosa as an everyday option next year, he is even more awful as a LH hitter than he is as a RH hitter. If Span and ALR go, could see the Nats trolling for a LH 1B/OF type.
For that reason I don't see them letting ALR go and pick up his option. Now, you've got Zim and his shoulder in left field. One outfield slot opens ostensibly in CF unless Werth becomes a backup. They've got Skole but he looks to be another season or so away.
I also think they need a left-handed catcher like Jason Castro as the "back up". Its almost a given that Ramos will spend a lot of time on the DL as a result of the knee reconstruction. A catcher with a bat. What they have now just doesn't seem to cut it.
If they go out looking for second base its going to have to be left-handed bat again which probably limits their choices.

subset: commoncrawl


text:
A lot of people are still talking about the Vhong Navarro-Cedric Lee-Deniece Cornejo case this morning, March 23, 2014 two months after the mauling incident happened. This proves that the Filipino people whether they are in the Philippines or in some parts of the world are eager to know if the justice system in the country is rolling fairly.
For some netizens who are following this case since the beginning, Vhong Navarro should fight until the end if he really wants to win his battle against Cedric Lee, Deniece Cornejo and Roxanne Cabanero. But according to them, the actor-TV host is now walking on a very rocky road because his antagonists are also finding the best remedies just to get a favorable decision.
Everyone knew that Cedric Lee, Deniece Cornejo and other personalities involved in the incident have already elevated the case to the Court of Appeals. Reports said the CA has already released an order to the DOJ asking why the Temporary Restraining Order should not be issued to stop the hearings. The report was posted online just minutes after its released.
It was also posted by Mr. Tony Calvento on his official Facebook page to update his followers. And speaking of Mr. Tony Calvento, he confirmed that Vhong Navarro is now walking on a very rocky road. Several hours ago, he posted an update on Facebook. Based on his calculation, the It's Showtime host faces a very long battle because the accused will try use all the legal remedies to delay the proceedings.
Hit this link and click subscribe to get instant update.
- Tony Calvento: A rocky road for Vhong Navarro, Deniece Cornejo and Cedric Lee
- Vhong Navarro case: Deniece Cornejo follows Tony Calvento
- Vhong Navarro-Cedric Lee-Deniece case: Tony Calvento receives death threats
- Vhong Navarro case: Is Roxanne Cabanero connected with Cedric Lee and Deniece?
- Vhong Navarro update: What Roxanne Cabanero wants from Tony Calvento?


text:
The Sunday, Aug. 24 episode of "Falling Skies," 410, "Drawing Straws," is the last one before the two-part finale. The current plan may be a crazy one, as others have no problem reminding Tom every chance they get, and it's not one that can be taken lightly.
"Man should be prepared to be sufficient unto himself."
This episode of "Falling Skies" is very much about setting up what happens in the season finale, and because of that, not much really happens, especially in terms of the mission to fly the beamer to the moon, which, honestly, just sounds crazier the more times it's said. Yes, they figure out who's going to go, Hal and Ben finally have a real conversation about Maggie and Lexi gets a reality check, but the end of the episode could change everything, and instead, the aliens take a backseat in this episode as the humans work out their relationship problems. It's a solid episode, one that seems to take care of those issues that could otherwise be in the way during a finale and a mission like they have planned, but it also feels like it's set up to do just that so they don't have to worry about any of that stuff for the finale and can concentrate on the problems at hand. It's pretty much what we've come to expect from this show as a season is coming to an end.
With the Espheni emptying out ghettos, Tom knows they have only one thing left to do to attempt to win the war: fly the beamer to the moon and take down the power core. He's all ready to do it himself, but Anne argues that they have to decide things together (and she's not just talking about the group). Then, to make things worse, they realize that Cochise can't go along on the mission since the beamer is made to reject all things Volm, so with that, they need two people to go – and Matt is the one to suggest they draw straws. With everyone on board with that, Tom has no choice but to agree.
Matt has chosen the perfect time for his teenage rebellion, and you know what? All the power to him. It begins with Matt's rebellious side leading to him figuring out how to pilot the beamer, and it continues with his decision to put his name in the skull, only for Tom to tell him no because of his age – and no, he doesn't like his son throwing a history lesson back at him. "Yeah, I know, but you have to be 15 to pilot an alien spaceship, and you don't have your learner's permit yet," Tom says, and the discussion is over. That line is gold.
In the end, the draw goes exactly as expected: a Mason son is chosen, and Tom fixes it so he goes with Ben. However, as he explains to Anne, it's not only that he's not willing to let his son go without him; he also feels like he's supposed to be on the mission, like it's what he's supposed to do, like her belief in Lexi, and really, how can she argue with that? So with Anne's second day anniversary present – Epictetus, pocket science – Tom's ready to go to the moon (and return so he and Anne can have a honeymoon). "Don't be afraid to let yourself feel things," Tom advises his youngest son and leaves Matt and Weaver to take care of each other. "You don't have to be so tough all the time." Only the launch doesn't go off as planned.
Meanwhile, Weaver finds Pope taking a name out of the skull and immediately assumes that it's his own, given Pope's very vocal feelings on the subject. It's only after they've fought a bit that Pope reveals he took Tom and Weaver's names out because he needs to be on the ship. "These people, they need you, you and Mason. Nobody needs me," Pope explains. "I could disappear tomorrow, and I really doubt that anybody's going to notice. I gotta be on that ship. That beamer's on a one-way ticket. It ain't coming back. We both know that. Let me be the hero, Dan. Let me be the martyr. It's just a Hail Mary for the plan. Let me do something, something worth remembering." He has no family, no kids, no wife, nothing, even as Weaver says that she might come back. That's the best scene of the episode, hands down. As entertaining as it is to see Pope and a Mason at each other's throats, they have been pretty good this season at mixing that up with showing other sides of Pope, whether that's his relationship with Sara or this encounter with Weaver.
The Hal/Maggie/Ben love triangle continues, with Ben and Maggie both trying to talk to Hal and blame the spikes and Hal arguing that everyone has their version of spikes, a.k.a. something to blame for lack of self-control. It's Tom who offers some words of wisdom: ultimately, it's up to Maggie. It takes Hal some time – seeing Ben and Maggie kissing again when he goes to forgive his brother doesn't help – but he and Ben do have the short version of the conversation they need to as they're getting ready for the launch. That doesn't mean that Hal's not hurt by what they did, so could that be what him bleeding from his chest in Ben's dream earlier this season was foreshadowing? Hal hurt from their betrayal?
Finally, it looks like Lexi chooses the right family, and it all begins with a nightmare of Ben changing and him blaming her for it. The Monk takes her out to train, to practice using her powers to control gravity, which means destroying a tree. "I don't want to destroy it," she argues, but he tells her, "You are setting it free. …You are the bringer of peace." (Remember when Lexi used that same word – "free" – before killing Lourdes?) Her potential is unlimited, but as Lexi learns when she eavesdrops on the Monk and Scorch's conversation on the shadow plane, she's on the wrong side. Scorch is worried that they can't control Lexi for much longer, and that means one thing: time to kill her.
Well, Lexi instead turns the tables on the Monk and kills him first, then she shows up to take out the beamers before they can take out Chinatown. Talk about making an entrance! "Hello, father," she greets Tom. Welcome back, Lexi. But can she be trusted?
"Falling Skies" season 4 ends next Sunday with the two-hour finale at 9 p.m. on TNT. What did you think of episode 10, "Drawing Straws"?
Suggested Links
- 'Falling Skies': Noah Wyle on Tom's struggles, Weaver as his conscience and more
- 'Falling Skies': Scarlett Byrne on Lexi's actions, the unity necklace and more
- Drew Roy previews 'Falling Skies' season 4: Leadership, betrayal & Hal's Cochise
- 'Falling Skies' 'Till Death Do Us Part' review: Talkin' crazy
- TNT renews 'Falling Skies': Season 5 will be its last


text:
- Text Size:
- ASmall Text
- AMedium Text
- ALarge Text
Crews have retrieved the body of a Northern Kentucky man from Lake Cumberland.
WKYT-TV reported it took search crews nearly two hours on Sunday to find the body of 42-year-old George John Fiorini.
The Pulaski County coroner's office said Fiorini was diving off a cliff with friends when he went under. His body was found near Burnside.
Authorities say Fiorini had recently moved to Ludlow from Cincinnati.
The views expressed are not those of this site, this station or its affiliated companies. By posting your comments you agree to accept our terms of use.blog comments powered by Disqus


text:
Are you thinking about taking an online course or several online courses?
Consider the following four statements before you decide to take an online course:
1. I want to take this course because
A. it is very important for my degree program or my job
B. my friends are taking the course also
C. I'm interested in the subject, but I have no deadline to complete it
If you have a strong motivation to complete your course,you will do well. If not, you may want to take it at another time.
2. When course work gets tough and I don't want to study,
A. my significant other/parents/children/friends encourage me to keep going.
B. my significant other/parents/children/friends are not concerned.
C. my significant other/parents/children/friends discourage me from studying and encourage me to do other things.
If you have a support system, you will be motivated tocomplete your work. If not, others may interrupt important study time .
3. I have time to study
A. because I do not have a lot of other obligations. I am able to fit class and study time into my weekly schedule.
B. even though I have other obligations, because I manage my time well.
C. but I have many obligations which may take priority over my course and study time.
If you can manage your time well, you will find the time to be an active participant in your course . If you have too many other obligations (job(s), marriage, childcare, parent care, time with friends, other obligations and activities), you may not be able to keep up with your assignments.
4. I can login to my course
A. anytime, because I have unrestricted access to a multimedia computer and an Internet connection at home or a laptop with wireless Internet access.
B. every day, because I will be using a computer at work or in a college computer lab.
C. only at certain times, because I will be using a computer used by other members of the family (or at a public library or at the home of a friend or relative).
If you have appropriate access to a computer and Internet connection on a daily basis during your prime study time, you will enjoy using the course software. If not, you may become discouraged by logistical and technical problems.
If you have decided that your motivation, support system, available time, and technology access are acceptable, you will need to consider the following issues (and tips) to succeed as an online student.
- time management
Managing your time well is the most important factor in your success as an online student. Online courses actually take more time than classroom courses because they involve reading and writing instead of listening andspeaking. The time that you spent driving to campus. parking, and going to your classroom will now be spent reading and writing. In online courses discussion postings and email can accumulate quickly. You need to login every day to keep up with course communication.
- reading
Online courses involve a lot of reading. Information that you would normally hear in a classroom will usually be available for you to read. If you like to read, have good reading comprehension and read fast you will do very well in an online course.
- writing
Online courses involve a lot of writing. Things that you would normally say in a classroom will usually have to be written so that the instructor and other students can see them. If you like to write, have good writing skills and can type fast, you will do very well in an online class.
- self directed learning/monitoring your ownlearning
In an online course, the instructor is a facilitator, not a lecturer. You must take the responsibility for your own learning. Information will be presented in yourt extbook and through lesson content, PowerPoint presentations, video, and Websites. It is up to you create your own learning path and monitor your own progress.
- efficiency and organization
Since you will be directing your own learning, you will do much better if you are efficient and organized. Knowing the assignment due dates and test dates on the course timeline is very important. You can add private entries to your course calendar for additional reminders. Take your tests and hand in assignments early.
- anxiety and stress/test taking
Everyone has some anxiety and stress when taking classes, handing in graded assignments, and taking tests. If you are concerned about the time limits and technology involved in online testing, you may want to ask your instructor if he/she will create a practice test for the students in your class. The best way to relieve anxiety is to avoid procrastination. Taking your test early in the test availability period will eliminate the anxiety of a computer crash or power outage at the last minute!
- adequate prior knowledge
Your course will be easier if you have prior knowledge of the subject. Even so, you need to be sure that you have adequate time to read, write, complete assignments, and take tests.
- willing participation
It is very important that you post to course discussion as often as possible and send email when necessary. If you do not communicate, the instructor will think you are lost in cyberspace. Most instructors will include discussion in their grading structure.
- patience in communication
Instructors are not always available 24/7, so you may not receive immediate feedback. Sometimes you will need to wait until the instructor or another student is online to answer a question for you. You will need to plan ahead to allow for the time lag between questions and answers.
- working alone/internal motivation
An online classroom can be a very vibrant learning community if everyone contributes to online discussion. However, you will still be studying alone at home or in your office and may feel isolated at times. You will need to have internal motivation to keep on task andavoid interruptions and distractions. If you like working alone, communicating by writing, and working at your own best time of day, you will do well in an online course.
- computer skills
Although you do not have to be a pro at computers to take an online course, you will do better if you are willing to try new things on the computer. Do not be afraid to click on tabs, buttons, and links and try out tools in your course. Occasionally you may have a technical problem. If you cannot solve a technical problem yourself, email your instructor and/or contact WebStudy tech support (firstname.lastname@example.com, 24/7) or RVCC tech support (firstname.lastname@example.com, weekdays 8:30 am-5:00 pm)


text:
Feb. 24, 2012
Each day leading up to the Cougars' final regular-season home game against Washington, an interview with a senior will be posted to this website. Friday's Q&A is with Abe Lodwick, a forward from Bend, Ore.
Q: What made you decide to continue your basketball career and education at Washington State?
A: I decided to come to WSU because the guys that were on the team at the time that hosted me on my recruiting visit, Daven Harmeling and Robbie Cowgill, I had a pretty good connection with them and most of the guys on the team. I really liked the guys on the team and knew I'd be spending most of my time with them. And I just liked the family environment in Pullman.
Q: Having been in Pullman for nearly five years now, what do you like most about the town?
A: I love the family environment of Pullman, it's just a completely unique feel than any other place I've ever been as far as colleges are concerned. At different campuses you can kind of get lost in the mix, but in Pullman the pace is a little slower and people actually care about each other here.
Q: What's your biggest strength on the basketball court?
A: My leadership. That is one of the few things I can control at all times of the game, so I feel like that's something that has really gotten me through these last five years, and it continues to grow.
Q: What do you need to work on on the court?
A: I think I just need to keep working on my defense and rebounding and understand that being a little bit smaller and undersized with the guys I'm guarding, I have to work that much harder and be in the right position so just making sure I'm always in the right place in the right time. That's something I can continue to work on.
Q: How would you describe yourself?
A: I'm pretty laid back, but I'm also very competitive. I know that's a pretty strange combination, but that's something I've always really been. Not too many things get me upset, but I just really like competing with people just at anything and everything, especially at basketball of course.
Q: What's your favorite college arena you've played in?
A: Probably Madison Square Garden. We played terrible there last year, but it was still a really fun experience and with Madison Square Garden, there's so much history there, so to be able to play in the mecca of basketball is always a blessing.
Q: What does being a team captain mean to you?
A: It means a lot to me. To me it just shows the respect my teammates and coaches have for me and the hardwork I've put in in my time here. I try to do the right things on and off the court, doesn`t mean I'm perfect, I'm definitely not perfect, but it means a lot that I've been recognized as a captain these last three years.
Q: What NBA player did you emulate or look up to as a kid?
A: I've always looked up to Dirk Nowitzki, just because I really liked the way he played. He's kind of a big, awkward white guy, but he's one of the best in the game at finding angles and he's so skilled and just a pure offense player. I've always appreciated defense minded players, especially since I've been in college, guys like Ron Artest or former players like Dennis Rodman or Scottie Pippen, they really played hard and were versatile, especially defensively.
Q: What's your favorite sport other than basketball?
A: My favorite sport other than basketball is baseball. It's a lot of fun...but realistically it's intramural softball, which I'll be playing this spring and I'm very excited about.
Q: What advice can you give younger players at WSU?
A: Just to be patient, not necessarily just on the court type of stuff, but just let Pullman grown on you. It's kind of hard when you come to Washington State the first time, you feel like you're on the surface of the moon, out in the middle of nowhere. But everyone I've known has really enjoyed Pullman and WSU more and more with each year they're here, so by the time they're seniors they'll be glad that they came and that they stayed.
Q: What's next for you after you're done at Washington State?
A: That's a good question. I'm going to have a few options, hopefully, and I'll definitely think about it more seriously after the season is over. We'll see what the next chapter brings, but I'm excited for whatever it is.


text:
Dec. 13, 2012
By Gregg Bell - UW Director of Writing
SEATTLE - Plantar fasciitis. Three weeks on the bench. Then, leg cramps.
Whatever. Scott Suggs apparently doesn't need pampering - or even full health -- to excel.
The senior co-captain asked to leave then re-entered this game numerous times en route to a career-high 24 points. He scored through brutish Seattle University defenders that pressed in endless waves. Washington's four other starters also each scored in double figures as the revived Huskies ran out to a 27-point lead then beat Seattle University 87-74 in a rivalry game that really wasn't that close Thursday night at KeyArena.
The Huskies (5-4) never trailed the Redhawks (3-4). The only time the game was tied was 0-0 at tipoff.
"Great job, Scott! Way to lead us!" coach Lorenzo Romar told Suggs as he left the floor for the last time inside the final minute.
"My whole lower body was cramping up, for the most part," the fifth-year senior said. "Pat (Jenkins), our trainer, kind of stretched me out a little bit (and) gave me something, some nasty stuff. But it worked for me."
He was smiling, caught up in the glow of a painful yet relieving win.
Washington had lost three of the previous five games. But this time, Abdul Gaddy, Suggs, C.J. Wilcox, and Hikeem Stewart calmly and deftly broke Seattle U's relentless press time and again. UW bolted to a 46-19 in 17 minutes into the game.
Most encouraging: On the other end the Huskies got up in ball handlers' faces more consistently than they had in any of the season's first eight, unsatisfying games.
Romar agreed this was his team's most complete game so far.
Now, an even truer test: Can Washington string together this type of effort twice in three days, can it show consistency for the first time this season, when it hosts Jackson State (0-7) on Saturday at 4 p.m.?
"We've got to come out with the same intensity. That's got to be our standard. That kind of defensive intensity must be our day-in, day-out defense," Suggs said, looking ahead to facing a Jackson State team that lost 52-41 at Washington State Thursday.
In Seattle, Washington shot a season-best 54.4 percent from the field and had a season-high 42 rebounds to improve to 24-4 all-time in the cross-town series that began in the 1953 NCAA tournament. Some of the players from that game were on the floor at halftime and were given plaques with their big ovation from the crowd of 6,137 - three times more than Seattle U.'s previous season-high in attendance.
One of those receiving cheers was Bob Houbregs, the former Huskies All-American who scored an NCAA tournament-record 45 points as Washington beat Seattle U. in Corvallis, Ore., almost 60 years ago.
This rugged, banging game began with Romar hugging Seattle U. coach Cameron Dollar, his former top UW assistant, at midcourt. Dollar then immediately sent his Redhawks at the Huskies in non-stop, full-court presses while using mass substitutions that looked more like line changes in hockey.
Dollar was hoping his constant press would wear down an already thin Washington bench, as the Huskies were again without Andrew Andrews. The backup point guard missed his second consecutive game with a sprained ankle, though this time he was dressed in uniform.
Instead Seattle U.'s press effectively jump-started the Huskies out of the funk that had them down by 18 early in the eventual three-point loss at home to Nevada last weekend. Washington made 10 of their first 14 shots this time, all but one of them in the lane.
That one outside make was by Stewart. Offensively mothballed for two seasons, Stewart swished his first three shots for six points, two more than he had in eight games this season before Thursday. He was also the key that kept the Huskies from turning the ball over against the press each time Suggs left with the cramps.
"It started in my back and went all the way down," Suggs said of the seizing pain, though he looked relaxed afterward while casually chewing on red licorice courtside.
Stewart left the game late after an awkward landing on a stiff left leg while leaping to make a pass. Gaddy and trainer Jenkins had to prop up on each side of Stewart to get him to the bench. Romar said his sophomore guard hyper-extended his knee, but the coach thinks his sophomore guard will be OK. "I'm proud of Hikeem," Romar said after Stewart's best game as a Husky. Aziz N'Diaye, who finished with 14 points and 11 rebounds, made six of seven shots for 12 points in Washington's runaway opening half. All those points came inside after UW broke the press.
The Huskies took a 49-27 lead into halftime. Knowing Seattle U. has the personality of its dogged, relentless coach, Washington braced for the inevitable rally. The Redhawks press finally got consecutive backcourt turnovers during an 11-2 run that made it 51-38 game with 17:43 remaining.
But then Suggs hit one of his two 3-pointers on the night. Wilcox, who finished with 12 points after scoring 20 or more in the previous three games, made a long jumper.
And Desmond Simmons then made another play that epitomizes his scrappy, indispensible game. He stole a pass on the right wing then saved the turnover with a shovel pass back into the court to Gaddy - all while he fell into the Seattle U. bench. Simmons got up and sprinted to UW's offensive end, where Gaddy found him trailing down the lane with a deft touch pass.
Simmons finished the all-heart play with a scooping basket while he got fouled. His three-point play made it 62-41 Huskies with 13:39 left.
Seattle U. never got closer than the final score after that.
Simmons finished with his third double-double in nine games, scoring 13 points and snaring 12 rebounds.
"That's what I am striving for. I've been working on it, and I am pursuing the ball better than I did earlier in the season," he said.
Eleven days after becoming the first Husky to grab 18 rebounds in a game since Jon Brockman in the 2009 NCAA tournament, the hustling, 6-7 sophomore was so determined on the boards he ripped one away from his teammate N'Diaye. That was while Simmons went flying across the baseline midway through the second half.
"I was definitely anxious for it. I was definitely looking forward to it," Simmons said of this one. "Scrappy team.
"It was a test for us. A lot of people were saying we are not as physical or as scrappy a team (as UW has been in the past). It was definitely a challenge for us."
They passed this test, easily.
Now, can they put a few of these together in a row?
"I'm really curious," said Gaddy, who had 11 points, five assists and six of UW's 12 turnovers while playing all but a few seconds of the 40 minutes.
"It will show how mature we are. We've got to have the same effort every game. That something Coach has been telling us.
"And that's something mature teams do."


text:
Whats ya best car!!!???
Whats ya best car!!!???
Initial D number 1 WOOO!
nissan sky line
Its the only good car I know the name of
yup nissan skyline (the one off 2 fast 2 furious) and BMW Z4 love that car...got any pictures of these cars you mention?
A box. With wheels. Oh and you have to have the string attached too.
Ferrari Enzo owns all.
Screw your rice burners, Pontiac Chevelle.
Out of the night that covers me,
Black as the Pit from pole to pole,
I thank whatever gods may be
For my unconquerable soul.
In the fell clutch of circumstance
I have not winced nor cried aloud.
Under the bludgeonings of chance
My head is bloody, but unbowed.
Beyond this place of wrath and tears
Looms but the Horror of the shade,
And yet the menace of the years
Finds, and shall find, me unafraid.
It matters not how strait the gate,
How charged with punishments the scroll,
I am the master of my fate:
I am the captain of my soul.
|Current Desktop | Audioscrobbler | MySpace |
:xOriginally posted by Vanil4_Intel@Mar 8 2004, 10:06 PM
Screw your rice burners, Pontiac Chevelle.
oh and my car isn't rice it's completley stock except for the head unit. pics
um-i'm too young to drive, but my stepdad has a Noble M12 GTO
google it to see what it looks like.
Cars suck. :chemist:
Motorbikes are much much better. Suzukis all the way. The SV1000 is definately on my hot-list right now.
Either that or a fancy Ducatti even though the engine casing isn't too goo *mumbles on*
Nissan Skyline GTR
Subaru Impreza
Ford Focus
Ford Charger
Formerly known as Chris.
I hope you're talking about a souped up focus because my parents have a Focus LX sedan, I've floored it and it still accelerates at the same speed as a snail.Originally posted by Chris@Mar 9 2004, 07:02 AM
Ford Focus
I hope you're talking about a souped up focus because my parents have a Focus LX sedan, I've floored it and it still accelerates at the same speed as a snail. [/b][/quote]Originally posted by Todd+Mar 9 2004, 02:16 PM-->

QUOTE (Todd @ Mar 9 2004, 02:16 PM)


text:
I am fortunate enough to have a best friend who's been in my life since I was five. Our mothers went to nursing school together, we attended the same small neighborhood church and went to the same school from Kindergarten through high school graduation, and were in each other's weddings. She knows me better than anyone else on the planet and vice versa. The kind of soul mates who can abbreviate an entire explanation using a single word or name from the past. But she lives 90 minutes away. So, every six months we meet in the middle for dinner to celebrate our respective birthdays. Just the two of us...no husbands, no kids, no interruptions...just two best friends laughing about the good times, crying about the tough ones, and swapping secrets. No matter how broke we are or how busy we get, we make this night happen twice a year. When I know I've got that on my calendar, I can get through just about anything!"
Member Lifesavers
Submit a Lifesaver!
What helps you juggle work and family? What's your favorite quick stress reducer? Have you found a way to squeeze in some 'me' time into your busy schedule? Share your tips!
Showing 10-18 of 219 Lifesavers
Always keep a business card in an easy-to-find place in your purse or laptop bag; slip another one into your coat or jacket pocket. If you accidentally leave these things behind while you're out and about -- or if someone takes yours by mistake -- it'll be easier for someone to return them to you!by Lylah M. Alphonse on 7th July 2008915Vote!
A diaper emergency kit in my purse and in the glove compartment -- save your bread bags and a pack of almost-empty wipes, pack two diapers and the wipes into the bread bag and twist tie the top. You can use the bread bag to politely dispose of a smelly diaper. Voila -- Diaper 911!by relaxnsmile on 17th June 2008887Vote!
Dear all, I would like to share a little lifesaver with you. My daugther Sonia wakes up very early and usualy comes to wake me up is the morning. So I started to leave in the evening on the kitchen some sandviches and drinks. Also I learned her how to turn on the audiosystem and have bought her children CDs. So now she is not coming on 8 am, she can entertains herself when I get get some Saturdaysleep!by Annaznam on 19th March 2011854Vote!
Online shopping delivered to my office is a lifesaver. As long as I dont have to try it on, I can order handbags, facial products, or anything else online and it saves TONS of time.by oceans mom on 11th March 2011821Vote!
I see my son part-time so I prioritize, especially when he is around. He is older now, so I let him know ahead of time if he needs to make plans while I am working or at an important function. I spend quality time with him every other Sunday when I make a nice breakfast and/or dinner. He is quiet, but I make sure to engage him in conversation for at least twenty minutes to keep up with his life, and let him know how important he is to me. I de-stress with music I enjoy, seeing live bands play out, laughing with friends, dancing around the house, a hot bath once in a while, incense, candles, meditation, yoga, etc.by phoenixmama on 4th March 2011804Vote!
My teething baby always tries to bite my finger when I am applying teething gel. So instead, I put the gel on her toothbrush and let her chew away!by raisin4cookies on 7th July 2011776Vote!
Pretty much the only "me time" I get is my lunch 1/2 hour at work. Take that lunch break! You deserve it (and hey, it's legally mandated!) I turn off my "oh, I have SO much work to do" state of mind and grab my book and sit at starbucks or in the parking lot in my car and read/eat. It's really the only time I get to myself until around 10 pm (and that's if the baby goes to bed on time!)by MamaSara on 7th May 2011743Vote!
Post-its!! I keep packs of them in the van so when we are running around town or out to dinner the kids can use them. I tell them to count how many times they see a red car or stop sign ect.... at dinner i tell them to write as many things down that they see that starts with a certain letter or has a certain color in it! Even if they get bored the end up playing tic tac toe or drawing.by candi on 1st July 2011734Vote!
Plastic drink cups! I bought a package of them for less than $1, and handed each of my two youngest kids15 cups. They happily stacked them into pyramids, collapsed them into piles, "decorated" them with action figures, and had tons of fun (while I was able to get dinner on the table with no fuss). It's a cheap investment, and perfect for long waits at the doctor's office or restaurants.by Lylah M. Alphonse on 23rd June 2011735Vote!


text:
Curriculum Vitae
I am a Ph.D. Candidate in the Department of Government at Harvard University. My research focuses on comparative political economy, the politics of the welfare state, and economic development. I am interested in the effects of global development initiatives on public policy, and in particular on the provision of public social services and redistribution. My research aims to gain a deeper understanding of the politics of redistribution in the developing world and to determine how modern development initiatives alter the incentives to welfare state development. I received a B.A. in Political Science and Economics from Texas A&M University in 2011.


text:
Volume: 25 Issue: 5 (May 2002)
Entry-Level Graphics Workstation from HP
The x1100 comes with an optional DVD+RW/CD-RW combination drive. A digital video production pack age is also available, as is a factory-integrated IEE E1 394 OHCI card for digital video connectivity.
The HP x1100 supports Win dows 2000/NT and Linux operating systems. Pricing starts at $1125. (Hewlett-Packard Co.; www.hp.com) -JD
Back to Top
Printed from CGW.com
Computer Graphics World Inc. | www.cgw.com | (800) 280-6446
Copyright 2013


text:
The point guard question
- Details
- Source: RJ Blogs
(by RJ Young) Woodard came along at a time when the Sooners were anything but settled at the point. Sam Grooms helped get the 2012-13 squad through some rough times while Isaiah Cousins found himself as a scorer and Je'lon Hornbeak learned to play the position. But Grooms was not...Read more


text:
I know from the .NET perspective that an assembly with a version of 1.13 is considered a newer release than version 1.2 because each number in the version is evaluated individually. However from a numerical point of view 1.13 is < than 1.2.
The issue comes down to readability when publishing updates for customers. From .0 to .9 it's all the same but at .10 you have to differenciate. So, do you limit the number of point releases to 9 and then increment the major version when you reach .9?
Please don't assume that the end user has an understanding of typical development version numbering schemes.
Don't think of it like a decimal number. The (.) is a delimiter between the different fields. What each field means (for example):
Absolutely! That'show I see it when I look at version numbers. But it's not how your average Joe reads the text '1.13'. I guess as programmers it's easy to project our understanding on our users. That's why I'm interested in responses on experience with confusion on the numbers. It may not be a real issue, or perhaps it's just been ignored.
Update 2: Response to "provide documentation" or "explain it to users" type solutions: they don't work! :) If you have to explain a version number to the user you've already made it more complex than it needs to be. While the primary audience for a piece of technology may be developers in many companies the actual procurement and management of software is handled by secretaries and clerical staff who have no development or technology background at all. If their manager asks them "Is there a new version available from 1.9" and they see "1.11" they may not register it as a newer release.


text:
ARLINGTON, Texas (AP) -- Melvin Mora has become a dangerous
hitter with the bases loaded.
Mora drove in four runs in a pair of bases-loaded singles,
helping the Baltimore Orioles snap their season-high 12-game losing
streak with a 7-6 victory over the Texas Rangers on Sunday.
Mora improved to 8-for-15 with 18 RBI with the bases loaded
this season.
"I knew the club needed me," said Mora, second in the AL with
a .349 average. "I gave it a little extra."
Mora's two-run hits in the third and fifth helped stop the
Orioles' longest slide since dropping the final 12 games of the
2002 season.
"If we'd lost this one today, we might as well have called it a
season," Orioles starter Sidney Ponson said.
Baltimore's Brian Roberts reached base four times and scored
three runs.
"We were ready for something positive to happen," Roberts
said. "We thought we'd break the streak every day for the last 10
days. Now we can move on."
Ponson (9-13) allowed five runs and 12 hits -- 11 singles -- in
seven innings, but won for the sixth time in his last seven
decisions. He struck out six and walked none.
"I thought Ponson threw well," Orioles manager Lee Mazzilli
said. "He did what an ace is supposed to do. He got us deep in the
game so we could let the other guys take over."
B.J. Ryan allowed one run and two hits in one-third of an
inning. Jorge Julio got five outs for his 19th save in 21 chances.
Texas starter Chris Young (0-1) allowed four runs and six hits
in 4 1-3 innings in his second big league start and left in the
fifth trailing 4-2.
David Dellucci's solo homer in the seventh -- the Rangers' only
extra-base hit -- made it 6-5.
Baltimore regained its two-run lead on Roberts' RBI single in
the eighth off Brian Shouse.
Pinch-hitter Brian Jordan's RBI groundout against Julio in the
eighth got Texas within 7-6, but the Orioles' closer got Kevin
Mench to pop out with the tying run at third.
Mark Teixeira went 3-for-4 with two RBI for Texas, which lost
five of seven to Baltimore in the season series that ended Sunday.
Texas took the lead in the first on Teixeira's RBI single, but
Baltimore went in front in the third on Mora's two-run single.
"It seemed like every time we scored, they'd come back with
another run," Teixeira said. "We couldn't catch them."
Laynce Nix's RBI single in the fourth tied it for Texas at 2,
but Mora's two-run single in the fifth chased Young and put
Baltimore ahead 4-2.
Rangers second baseman Alfonso Soriano's two-out error on Jay
Gibbons' grounder in the sixth allowed Rafael Palmeiro to score
from third, making it 5-2.
Texas pulled within 5-4 in the sixth on RBI singles by Teixeira
and Soriano.
Palmeiro's run-scoring double in the seventh off Carlos Almanzar
made it 6-4. Palmeiro has 564 doubles, moving past Charlie
Gehringer for 15th on the all-time list.
The Rangers tried to draw even in the ninth when Eric Young had
a one-out pinch single. Young went to second on Julio's wild pitch,
then tried to take an extra base but was thrown out at third by
catcher Javy Lopez. Dellucci's strikeout ended the game.
"In that situation with the game on the line, I've got to make
a better judgment," Eric Young said. "The play was too close to
take a risk in that situation."
Before the losing streak, the Orioles had won 11 of their
previous 13. Mazzilli said getting a positive result was important
heading into Monday's day off.
"It's good to break the ice," Mazzilli said. "Today we
handled it well, being mad, fighting back and not giving up."
Game notes
Roberts was awarded first base in the fifth on catcher's
interference against Gerald Laird. Laird called a pitchout with a
runner on first, and as he moved out of the batter's box to make a
throw to second, his glove made contact with Roberts' bat. Laird
was charged with an error. ... Rangers infielder Herbert Perry has
a rehab assignment in Double-A Frisco this week and is expected to
be activated when rosters are expanded to 40 on Sept. 1. ... Texas
right-hander Juan Dominguez, out since June 16 with an upper back
injury, was scheduled to throw two rehab innings for Double-A
Frisco on Sunday.


text: tag:blogger.com,1999:blog-226690016900160196.post7645057174574379803..comments2016-06-22T12:15:35.911-04:00Comments on Legal History Blog: Bebchuk & Hamdani on the History of Federal Corporate LawMary L. Dudziakhttp://email@example.com:blogger.com,1999:blog-226690016900160196.post-2981876694128494992006-12-17T15:37:00.000-05:002006-12-17T15:37:00.000-05:00Consider the non-federal uniform laws adopted by m...Consider the non-federal uniform laws adopted by many states, especially those that impact commercial activities. Nationally, the legal profession had been quite astute in the 20th century in framing and pushing for the adoption of such uniform laws. Now if the commerce clause stuck to "originalism" such as that suggested by Justice Thomas rather than the New Deal approach, what protection might investors have?Shag from Brooklinehttp://firstname.lastname@example.com


text:
How can a selected Personas be set back/disabled in Firefox 3.6?
I have downloaded and installed Firefox 3.6 and selected a Personas (lightweight themes/toolbar skins). However the content of the download status bar at the buttom is no longer readable. How can the Personas be removed/disabled such that the original state after the installation is restored?


text:
Ex-Baylor pledge, three-star WR John Humphrey verbally commits to Oklahoma
- Details
- Source: Dallas Morning News
(by EJ Holland) John Humphrey thought he found the right school in Baylor back in April. But the three-star Clear Falls wide receiver started to attract more and more offers and eventually backed out of his verbal pledge in June. Humphrey made an unofficial visit to Texas in...Read more


text:
School Oh How I Miss Thee
About two years ago I started my venture towards a Bachelors Degree in Business Administration…
I have always been a big water drinker and that habit was passed onto my daughter but the boys, forget it, they have had little interest in water. AJ loves juice and/or soda. Baby K loves him some milk, all day long. I do not drink my well water, gross. Although my well water has tested completely clean and actually really good water to drink, the taste is awful and I won't drink it so I buy bottled water and a big old water jug for the fridge to fill my water bottles.
I found out that if I buy bottled water and simply fill the water bottles and leave them in the fridge that my sons have a new found love of water. My sons will beg to drink bottled water and seriously will drink it all day long. I can even refill it from my tap because they drink the tap water, the rest of us don't but the boys don't seem to care where the water comes from as long as it is in a bottle.
So that is how I get my sons to drink more water.
Are your kids big water drinkers?
My MIL recently bought me some of those Tervis tumblers- I've always got one with me filled with ice water. My son LOVES drinking *my* water out of those but refuses to drink it out of his sippy cup LOL
Cassandra McGraw´s last blog post ..Going Gluten and Casein Free
They definitely do like the containers better than a glass. I flavor it sometimes, and that helps too.
blueviolet´s last blog post ..Saturday Giveaway Parade 5-7
When the kids were younger I often did this trick. It also worked to remind myself to grab the water out the door. As they grew up we also bought them their own water bottles and let them pick them out. Having the filtered water in the fridge door became the biggest turning point for the entire family. My kids are teens now and I just have to remind them every once in a while, but instilling the water drinking habits early means no arguments now 🙂
Val – Mom Chats´s last blog post ..Great Recipes for Cinco de Mayo
I use reverse psychology on my 6 yr. old daughter that always avoids water like the plague. What I did to trick her is I would get fresh lemons and make a gorgeous glass of ice water and squeeze in the fresh lemon, being sure to make mmm yummy sounds. Then I add a fresh piece of mint and a perfect slice of lemon to the edge. I told her that these are mommy's favorite drink and it makes me so pretty and smart. That had her intrigued and wanting to be like mommy and she drinks it right up. Kinda a hassle to get her to drink it but it is worth it just to get some H20 in her. LOL
That is a great idea. My kids always love drinking out of a container straight from the cold fridge! I will have to do this more!
Shop with Me Mama (Kim)´s last blog post ..An Interview With My 3 Year Old
My kids are the exact same way.
MommaDJane´s last blog post ..Happy Mother's Day From Noah