text:
Before you start
This tutorial is recommended to Web application developers, Web application testers, quality assurance teams, information security professionals and anyone else wishing to ensure their Web applications are free from all known Web security vulnerabilities. This tutorial will show how to achieve this goal using IBM Rational AppScan.
About this series
This two-part series aims to broaden your Web application development skills through the use of Rational Application Developer, Data Studio and Rational AppScan.
- Part 1 uses the IDE capabilities of Rational Application Developer and the pureQuery features of Data Studio to efficiently create a Java-based wealth management Web application.
- In Part 2 you are going to take advantage of the many Rational AppScan features available to harden, or make secure, the Java application by discovering vulnerabilities and fixing them so that you can be confident about deploying your Web application.
About this tutorial
This tutorial will show you how to install, configure and use Rational AppScan to scan the Wealth Java Web application created in Part 1 (see Resources). You will use Rational AppScan scans to ensure your Web application is free from Web security vulnerabilities. Along the way you will learn how to achieve the most out of Rational AppScan, including:
- Deployment strategy
- Customizing a scan template
- Performing a scan
- Interpreting and learning from scan results
- Producing scan reports
- Using Rational AppScan extensions
This tutorial starts with an overview of Web application security. The overview explains the importance of using Rational AppScan, to ensure the elimination of Web security vulnerabilities within the application development process of a public facing Web application. There is also an overview of Rational AppScan deployment and licensing considerations to help you get the most out of using Rational AppScan.
System requirements
To complete the steps in this tutorial you need:
- A copy of IBM Rational AppScan Standard Edition. A full or temporary Rational AppScan license. The downloaded trial version of Rational AppScan only allows the scan of a default Web site. It may be possible to obtain a temporary short term Rational AppScan license from your IBM Rational Sales contact.
- A Laptop with network connectivity to the Tutorial 1 workstation/server.
Rational AppScan and Web application security overview
In this section we'll take a look at the state of Web application security on the Internet in general, and the role that Rational AppScan plays in making Web applications more secure.
Web application security overview
With the explosion of Web applications and Web 2.0 content on the Internet, the demand for increased Web application functionality has resulted in ever larger and more complex Web applications, particularly within e-commerce Web sites and social networking type Web sites. In parallel to this trend, there has been another more sinister raising trend, the exploitation of code vulnerabilities within Web applications by hackers and criminals. This has lead to a very real and dedicated attack vector discipline, Web Application Hacking.
The evidence shows an increasing number of attacks and actual data breaches occurring at the Web application layer, as opposed to the traditional attacks at the network layer. The network infrastructure of any public facing Web solution is still as important as ever, but we have now reached a stage where network level infrastructure can be made relatively bullet proof. Therefore hackers are now focusing their efforts on more affluent areas of security weakness, which they are finding within the Web application code. Hackers are specifically targeting the high value data behind and controlled by the Web application, data which often has significant real value.
Consider the perimeter firewall, which provides protection against network layer attacks practically straight out of the box, yet a network firewall offers almost no protection against Web application level vulnerabilities. For example, the firewall may only allow https network traffic to a Web server, but the firewall does not inspect nor care about the actual HTML Web application content passing through to the Web server, which is what can be exploited. The stakes are high, as even the slightest weakness within Web application code, such as within a simple field input validation, can cause business critical vulnerabilities, leading to financial losses and severe damage to customer trust in the business brand.
Typical results of hackers exploiting Web application code vulnerabilities can allow an attacker to completely bypass the Web login system, steal user Web sessions, cause a complete Web application outage, and directly interrogate, access, and manipulate the data on the backend database.
There is a real risk of Web application vulnerabilities being exploited, especially if the application data has high value associated with it, such as payment card information, even sensitive personal data has sellable value. There is also an increase in the number of legal, regulatory and industry standards imposing large fines as a result of a data breach. Keep in mind that once a Web application is made available on the Internet, anyone in the world is able to access the application, including those pesky hackers. These hackers will have an unlimited amount of time to find and exploit any vulnerability or weakness within the Web application code. Given how the Web application created for this tutorial series has a financial theme and sensitive information worth protecting, namely a personal real estate portfolio, the importance of releasing the Wealth Web Application without vulnerabilities is clear.
Given this background and the ever increasing importance business is placing on data security, developing Web applications clean of security vulnerabilities is very much a key requirement and should be a fundamental objective of any public Web application. In this tutorial you'll use IBM's Rational AppScan to ensure the Wealth Java Web application created in Part 1 of this series, is free from all known Web application vulnerabilities, ensuring the Web application is secure enough to be placed on the Internet.
Rational AppScan overview
IBM's Rational AppScan is the market leading security suite for Web application vulnerability testing. Using Rational AppScan can help you ensure that any developed Web application is secure enough to be placed on the Internet. Rational AppScan is a powerful and customizable scanning tool, and can not only be used within the development and testing process, but is often used by security auditors and compliance officers for penetration testing, and even quality assurance teams and business management.
Rational AppScan's primary function is to scan and test for Web application vulnerabilities, and it is able to carry out thousands of vulnerability security tests such as SQL Injection, Cross-Site Scripting (XSS) and Buffer Overflow. The security tests within Rational AppScan are also regularly updated; new tests and test updates are added into the Rational AppScan test portfolio as new Web application vulnerabilities are discovered.
Rational AppScan reports and licensing
Rational AppScan has comprehensive reporting functionality built in, allowing scan results to be reproduced into a formatted report structure within an Adobe PDF file. These reports are all fully customizable within Rational AppScan. See Downloads to view all of the reports that were generated throughout the process followed in this tutorial. Rational AppScan comes with a multitude of default defined report formats that fit the vast majority of international legal standards, and industry specific regulatory requirements. These include Payment Card Industry Data Security Standard (PCI DSS), SOX, HIPPA, the OWASP Top Ten, WASC Threat Classification, ISO 17799/27001 and the SANS Top Ten to name a few.
Before purchasing Rational AppScan, it is worth taking some time to consider how you intend to deploy and use Rational AppScan within your environment. As part of this should have a good understanding of the Rational AppScan licensing system, and the two typical methods of Rational AppScan deployment. The Rational AppScan license works on a "per installed machine" basis as opposed to a "per user basis"; therefore, AppScan is installed and fixed to specific system but this system (and AppScan) can be used by many users. The application license ties the Rational AppScan application to the host system's MAC address (network hardware) and the hard disk serial number. So before deploying Rational AppScan take some time to consider and decide the best installation strategy.
The first typical option is to install Rational AppScan on a central "Test" server, which allows good management and control of the Application usage. This type of strategy is recommended if you intend to use Rational AppScan within a single testing environment.
Before finalizing your deployment strategy, you must consider whether the intended usage of Rational AppScan is within the spirit of the license agreement. For instance, buying a single license of Rational AppScan for testing Web application development within a specific site would be deemed acceptable usage.
Note: The Rational AppScan licensing system is changed to match the standard IBM Rational licensing structure by the end of 2008.
In this tutorial you will install and use Rational AppScan on a laptop that has network connectivity to the system hosting the Wealth Java Web Application created in Part 1. However, Rational AppScan can be installed on the same system you used in Part 1, and run scans locally on that system.
Install Rational AppScan
In this section you'll install Rational AppScan application on a laptop. Rational AppScan can be installed and operated from just about any modern Microsoft® Windows® based platform that has Java Runtime installed.
Installation steps
Installing the Rational AppScan application on a laptop is a relatively straightforward process.
- Double-click the installation file to launch the InstallShield
wizard, as shown in Figure 1.
Figure 1. Launching the InstallShield wizard
If the installation detects Microsoft .NET Framework 2.0 or higher is not installed, which is a requirement, the installation process will install Microsoft .NET Framework 3.0 prior to moving on with the installation process.
- Read and click I accept the terms in the license agreement and click
Figure 2. The licensing agreement
- Accept the default installation folder.
Figure 3. Choosing an installation folder
The Rational AppScan application is now installed. However, before using Rational AppScan and running scans, you need to do a bit of house keeping.
Rational AppScan Software update overview
When Rational AppScan launches, it automatically interrogates the IBM Servers to check whether Rational AppScan is up-to-date. Should an update be available, which is usually the case when running Rational AppScan for the first time, Rational AppScan proceeds to automatically download and apply it.
Rational AppScan updates are similar to those found in Anti-Virus products, in that new Web application vulnerabilities are regularly discovered. Therefore the Rational AppScan support team introduces new tests and changes to the existing library of tests within Rational AppScan, by the way of software updates. This process ensures Rational AppScan is able to test Web applications against the very latest security vulnerabilities.
For the update process to work, your Rational AppScan workstation or server must have Internet connectivity. This update process is essential for post installation and can be done on a periodic basis thereafter. Updates can also be downloaded manually from the customer support portal for developers working in locked down environments where outside connectivity is not allowed.
Rational AppScan update
Now it's time to update Rational AppScan.
- Launch Rational AppScan to see Figure
Figure 4. Rational AppScan connects to IBM Servers to check if updates are required
- Click Install to begin the automatic download and install process (see
Figure 5).
Figure 5. Updates are automatically installed
- Once the install process is completed, click View Update Log from Figure 5, which show the actual update details. Now that the update has completed, it is time to license Rational AppScan.
Rational AppScan licensing overview
Let's walk through the steps to license Rational AppScan.
- Re-launch Rational AppScan and click on the Security Issues tab in
the left pane. As part of your purchase of AppScan (or trial request), you
are provided with an email containing a License Serial Key (LSK) and
instructions where to download the AppScan license file. Click Help >
License (see Figure 6).
Figure 6. Select the License options
- On the License options window shown in Figure 7, click Obtain License
Figure 7. Click Obtain License Online
- The AppScan licensing Web site opens,
(see Figure 8). Complete the form, filling in all the red fields.
Figure 8. AppScan licensing Web site form
- For the next part of the licensing form, you need to know the MAC address and hard disk volume serial number of the system where AppScan is installed. The online generated license file locks the AppScan application installation and usage to a specific system.
- To find these details, at a DOS prompt (run
cmdin Windows), type
ipconfig/all, which displays the MAC address of your network card. Then execute
vol, which displays your hard disk drive volume serial number. Fill in the system details in the bottom portion of the AppScan licensing Web site form shown in Figure 9.
Figure 9. System details portion of the AppScan licensing Web site form
- And finally, agree to the License Agreement by clicking Continue at
the bottom of the screen (see Figure 10).
Figure 10. Agree to the License Agreement
- Once you have your license file, import it into AppScan. Return to Figure 6 and again select the License option from the Help drop-down menu to launch the License options screen from Figure 7. This time click on Load License File.
- Navigate to the downloaded license file in the AppScan License directory and
click Open (see Figure 11).
Figure 11. The downloaded license file in the AppScan License directory
Congratulations! Rational Appscan is now ready to use.
Rational AppScan in action
Now that you have installed Rational AppScan, it's time to get your application ready for testing, and then run a scan on the Wealth application.
Prepare the Web application for testing
In this tutorial you have installed Rational AppScan onto a different system to
the workstation where you installed Rational Application Developer, Data
Studio, and then developed the Wealth Java Web Application in Part 1 (see
Resources). If you are short on
hardware, Rational AppScan can be installed on the same system as Rational Application Developer and you
are able to scan the Wealth Web application locally by entering
http://localhost:9080/wealth/ as the scan URL.
We need to ensure your Wealth Java application is online and operating correctly on your Rational Application Developer platform. Within Rational Application Developer, go to Open Web Perspective > Web, then select the Servers tab (see Figure 12), and see if the Web server has started. If not, right-click and select Start. Depending on the power of your hardware, it may take a moment or two before WebSphere and your Wealth Web application is up.
Figure 12. Launch WebSphere within Rational Application Developer
Next you need to test that you can access your Wealth Web Application from your
Rational AppScan Laptop. First ensure the laptop in on the same network by
opening up your Web browser and typing in
http://<ip address of RAD>:9080/Wealth/login.jsp.
In your case the Rational Application Developer workstation has an IP address of 192.168.0.4, so your URL is http://192.168.0.4:9080/Wealth/login.jsp.
Once opened, test the Wealth Web application is working properly, by logging in and clicking a few links to ensure everything is responding as it should.
Now you know the Wealth Web application is working and can be seen by the Rational AppScan device, so you are ready to conduct your first scan.
Before you scan, however, it's worth understanding Rational AppScan scan templates.
Scan templates overview
Rational AppScan is a powerful vulnerability scanning tool and is capable of running of thousands of vulnerability tests against a multitude of vulnerability areas. Some of these test areas, such as testing the Web server and Web services, aren't relevant to ensuring your application code is clear of vulnerabilities. Therefore you need to tailor your vulnerability scan, and cut out the areas you aren't interested in scanning.
Rational AppScan uses scan templates, which are saved scan configurations used to perform specific types of vulnerability scans. Scan templates allow us to apply and save specific customization to your intended scans. Rational AppScan comes with several predefined scan templates, all of which can be used on the fly. However, there are many advantages in customizing your own specific scan template, such as ensuring the exact same scan is used in rescans and sharing of the scan template with other developers and teams.
Scan the application
Use and save your own customized scan template, in case there are problems to be fixed within code and a rescan is required.
- From the Rational AppScan Welcome Window, select Create New Scan or
from within Rational AppScan, Click the File drop down menu and select
New (see Figure 13).
Figure 13. Rational AppScan Welcome Window
- Next ensure the Launch Scan Configuration wizard is checked and click
Default from the Predefined Templates (see Figure 14).
Figure 14. Launch Scan Configuration wizard is checked
- We are then asked the type of scan you want to perform, a Web Application
Scan or Web Service Scan. A Web Service Scan covers
infrastructure, such as the configuration of the Web server. This type of scan
isn't relevant within your development process, so select Web Application
Scan, which will scan specifically for vulnerabilities within the Web
application (see Figure 15).
Figure 15. Selecting Web Application Scan
- You are presented with a screen asking for the scan Starting URL (see
Figure 16)
Figure 16. Screen asking for the scan Starting URL
- At this point you have option of selecting Full Scan Configuration,
which allows detailed customization of the scan, but in this tutorial you'll
stick to the Scan Configuration wizard, as your Web application is fairly small
and uncomplicated. Enter the URL of your Web application,
Do not enter login.jsp or welcome.jsp, just the URL root, as Rational AppScan will discover and analyse all aspects of the Web application from that point.
The case-sensitive path is particularly important to enable if your Web server is operating on case-sensitive operating system platform such as Linux or Unix.
If you need to configure proxy settings to access the target Web application server, there is an option at the bottom of this screen to do that. Instead of using IP addresses, your target Web application could be a full Internet address or internal domain name. If there appears to be proxy issues, you should go into this screen and modify the settings. Please note AppScan does not support proxy exceptions. If localhost is set as an exception in Internet Explorer, you should set it to Don't Use Proxy in AppScan.
- Click Next to reach the Login management screen (see Figure 17).
Figure 17. Login management
Login management
Login management is a key part of the scan. You want Rational AppScan to test everything a user can do and see; therefore Rational AppScan needs to be able to authenticate (login) into your Wealth Web application as a regular user. You have several options open to you, one is to be prompted, which means every time Rational AppScan finds a login page, it will stop the scan and display that page on your screen. You then login as if you were a user, Rational AppScan records those login details and then uses them to log into the Web application and continue on with the testing.
To make your scan operate slicker and avoid any scan halts, go for the automatic options. Provide Rational AppScan with the login details before the start of the scan and have them saved within your scan template for future scans.
- Select the Automatic radio button in Figure 17, and then enter a
username of
tylerand a password of
tyler(or whatever username and password you used as part of the development of the Wealth Java App in Part 1.
- You have the option of configuring "In-Session" detections, should Rational AppScan have issues managing user Web sessions and finding the logout page etc. For this tutorial, this won't be an issue.
- Click Next.
- A Rational AppScan "Policy" refers to specific groups of Rational AppScan
You need to just run Web application tests within your scan, so you need to narrow the number of tests performed to just Web application tests. Select the Application-Only Policy and click Next (see Figure 18).
Figure 18. Selecting the Test Policy
- Finally, Rational AppScan is asking if you are ready to start the scan; you
are, so click the Start a full automatic scan radio button and then
click Next (see Figure 19).
Figure 19. Gentleman Start your Engines!
- Your Scan needs to be saved, so select Yes (see Figure 20).
Figure 20. One last thing before starting the scan
- Enter a name of
WealthScan(see Figure 21) and click Save.
Figure 21. Enter scan name
The scan starts.
Scan performance
The time it takes for the scan to complete depends on the complexity and size of the target Web application, bandwidth, processing speed, and the number of tests directed within the scan. Your application is relativity small so your scan should only take a few minutes to complete.
As the scan is performed, first Rational AppScan determines to the scope of the Web application, and lists Web application files and URLs to be scanned. Next Rational AppScan engages each part of the Web application with an array of Web application vulnerabilities scans, as selecting within the policy.
As the Scan is running, select View > Scan Log. You can see the specific details of the scan. In Figure 22, you can see the automatic user logons working (highlighted in blue), various scan details and analysis being performed, and tests fail messages returned highlighted in red.
Figure 22. Keeping a closer eye on what's going on
In the bottom-right area of Rational AppScan you find the Issue Severity Gauge, which updates in real time with scan. Under this is the number of discovered and visited URLs within the Web app and the outstanding and completed tests. Figure 23 shows the stats at the end of your first scan.
Figure 23. Issue Severity Gauge
Scan completion
The results are in, and it's not good news for your Wealth Java Web application. Rational AppScan has returned a total of 18 issues, which Rational AppScan has severity classified. So you have 8 that are High Risk Vulnerabilities discovered, 3 Medium Risk, 2 Low Risk and 3 Information related issues, which all require investigation and resolving.
Fear not, Rational AppScan is far from finished in helping secure your application. If you have ever experienced a third-party Web application penetration test, quite often the subsequent report just tells you there is a problem without explaining what the vulnerability clearly is, how to fix it, or any details on the actual test they used to discover it. Well, Rational AppScan does all these things for you.
Rational AppScan shows each of the issues it has discovered by the ".jsp" file where it was found, then type of issue by severity as in Figure 24.
Figure 24. Scan results
It's time to understand what these detected issues are, but don't worry, this is where Rational AppScan really comes into its own.
Click on the first issue, which happens to be a Cross-Site Script (XSS) vulnerability. Details are populated on the bottom-right window pane (see Figure 25). It's a good idea at this point to expand this window pane size.
Figure 25. Understanding a discovered security issue
Within the Advisory section, Rational AppScan explains in full detail the type of security vulnerability it has found. In this case it is an XSS vulnerability. At the top is a brief overview of vulnerability and its severity, followed by a detailed text description in the bottom left of the window. On the right side there is a video explanation of the issue, which is a fantastic learning aid.
Back to the left side of the Advisory. If you need further information, there is a link to a specific page on the WASC (Web Application Security Consortium) site, providing even further information and advice (see Resources for a link). WASC is an organization devoted to Web application security.
If you don't know what an XSS vulnerability is, go ahead and read what Rational AppScan has to say and watch the video.
Fixing the vulnerabilities
Now that you've scanned your application and discovered the vulnerabilities, it's time to fix the problems using Rational AppScan.
Fix recommendation
So now you are well versed in understanding what an XSS issue is and why it is a problem that must be eliminated. It's time to learn how to fix it. Click the Fix Recommendation tab shown in Figure 26.
Figure 26. The fix
Rational AppScan explains in a developer friendly way how to fix the issue within the Web app.
Rational AppScan even provides example lines of Java code that can prevent the problem (see Figure 27). Rational AppScan really makes it almost child's play to fix the discovered issue, even for most "green" of developers.
Figure 27. Fix code courtesy of Rational AppScan
The "Request/Response" provides information about the actual test that Rational AppScan carried out against your Web application. Rational AppScan works by first sending a normal request, and it then sends the same request again, but it is modified with the vulnerability test. If you look at Figure 28, which shows the "Test" open, the text highlighted in red is the actual test (known as a variant) which Rational AppScan fired at your Web application. This allows you to see the specific detail of the test. Note how the code window shows the test and the red shows what was modified, allowing you to select the AB highlighter button to zoom to the part of the response where the signature was found that verified the result. You can use this information to replay the attack manually or craft your own specific tests of the same type and then save it within Rational AppScan. You can even show results of the test within a Web browser.
Figure 28. Request/Response
A variant is the slight change of the original test request that Rational AppScan sent to your Web application server.
If you doubt the validity of the test results flagged up by Rational AppScan, you are able to report a false position to the IBM Rational AppScan support team. This process involves Rational AppScan e-mailing the details of the test to IBM for analysis, but don't worry these details are sent encrypted by default.
Fix specific issues
Rational AppScan tell you there is a Cross-Site Scripting (XSS) vulnerability within http://192.168.0.4:9080/wealth/realestate.jsp, which means that the address field entry can be used to inject scripts (<scripts>) and therefore allow a cross-site script attack to take place. This type of attack can lead to an attacker stealing or manipulating an authenticated user's Web session.
As you look at your overall Rational AppScan results, it is clear it has similar XSS problems within city, create, state, value, zip, as these have all been flagged as being vulnerable to "Stored Cross-Site-Scripting".
Check the Fix Recommendation tab. Rational AppScan tells how to fix these issues by filtering out non valid characters, such as "&" ";" "<" "@", and even provides some Java code to do the job.
So you need to add field input validation checks within your Java code, and you'll use the code in Listing 1 to do that, which states to only accept alpha numeric characters.
Listing 1. Field input validation checks
if(request.getMethod().equals("POST")){ Pattern input = Pattern.compile("[a-zA-Z0-9]*"); Matcher m = input.matcher(userid); boolean match = m.matches();
Looking at your second vulnerability on the list, Rational AppScan is telling you http://192.168.0.4:9080/wealth/ and http://192.168.0.4:9080/wealth/login.jsp are vulnerable to Session Fixation. Rational AppScan tells you that a user's Web session could be stolen or manipulated because your Web application is allowing session IDs to be created by your user's Web browser. Rational AppScan explains the fix: You need to ensure your Web Application does not accept sessions created by the user's browsers. Therefore you need to invalidate the users current session and generate a new random session ID after the user has been authenticated. To do this you need to add the code in Listing 2 to login.jsp, which invalidates the existing Web session and allows your Web application to create a new one.
Listing 2. Invalidating the existing Web session
session.invalidate(); session = request.getSession(true); session.setAttribute("userid", userid);
And on the logout.jsp, you need to kill the session:
session.setAttribute("userid", null);.
The third issue on your list is another classic Web application security flaw: SQL Injection. SQL Injection allows an attacker to manipulate the backend database by allowing SQL commands to be executed within your Web application entry fields. Rational AppScan tell you the zip field is affected. Again, as with XSS, Rational AppScan explains field validation in a way to fix this vulnerability.
That fixes the high level issues. Next you see there are several medium level issues referring to Database Error Pattern Found.
Database Error Pattern means a test returned back a database error. A likely cause for this error is lack of user input sanitization, which can mean your application could be vulnerable to SQL Injection or XSS. Check the recommendation. You need to ensure you fully sanitize user input in your code, which should prevent this database error and possible vulnerability in the next scan.
Next there are two low level issues on your list, which are both Session Identifier Not Updated. Rational AppScan is telling you it is possible to steal or manipulate user sessions or cookies. Again, like with the Session Fixation issue, you need your Web application to create the user's session ID.
Looking at the bottom of your list of issues, you see three information level issues, which mean these issues aren't actual Web application vulnerabilities as such, but could be a possible issue and threat, in that readable comments have been found by Rational AppScan within the .jsp files. Rational AppScan is warning you that these comments might contain sensitive information you might not want the public or a hacker to read. The classic I have come across in real life when testing Web applications in the field, is developers leaving back door administrator usernames and passwords in comments field, to help assist testers. So you need to check out these comments or better still remove all comments from your code. Remember your code is public facing, so security best practices is to remove comments from the code, thus eliminating the possibility of disclosing any information about the Web application to a hacker.
By clicking the Remediation tasks on the left side, you are able to filter on just the list of required fixes (see Figure 29).
Figure 29. Remediation tasks
Finally it is worth checking Application Data, which tells you everything that Rational AppScan has picked up about your Web application, so you will see the directory tree layout and all the WebPages Rational AppScan discovered along the way. It should always double-check to ensure Rational AppScan has correctly discovered all of the Web Application files.
Before you make the changes to your code, look at the Rational AppScan reports briefly, as the natural process is to produce a security report, which is then supplied to the developer(s), who is tasked to make the fixes.
Rational AppScan security report
You have a list of issues that you need your developer to fix. You need to provide them with your Rational AppScan results and recommended fixes in a nice report format.
- With your scan still open in Rational AppScan, select Tools >
Report (see Figure 30).
Figure 30. Start the reports wizard
- Within reporting you find plenty of preloaded Rational AppScan reports
filtered under several topic headings. Because you want to produce an internal
report to help developers resolve the issues, stick with the
default report. Type
Security Report.
- Select Developer from the choice of templates.
- Complete the report options as in Figure 31. Note the Web application
was coded in Java not .NET or PHP, so deselect those two from the report, as
you don't need to know how to fix the issues in those languages.
Figure 31. Create a report
- Click Layout (see Figure 32), that allows you to customize the
look of the report should you want to add a company logo and anything specific
in the report page tiles. One tip for the real world is to add Company
Confidential within the page footer. You really should be regarding
these reports as highly sensitive information within your organization.
Figure 32. Reporting with bells and whistles
- Select Save and name your report (see Figure 33)
Figure 33. Saving and naming your report
Your report is saved as a PDF file.
So your report is now ready to be provided to the developer, which in the case of this tutorial is you! So you need to run through the report findings and correct your Java Web application code.
Fix the Java code
By now you should have a good understanding of what needs fixing and how, so it's time to fix the security vulnerabilities within the code.
Open Rational Application Developer and make the following changes highlighted in bold (see Listing 3), or you can just cut and paste the entire section to save time.
Listing 3. Updated login.jsp with initial new Session on Web Server and Validation Checks
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <jsp:useBean id="users" class="com.ibm.ds.users.UsersDataImpl" scope="page" /> <%@page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <%@page import="com.ibm.ds.users.Users" %> <%@page import="pureQuery.example.*" %> <%@page import="com.ibm.pdq.runtime.*" %> <%@page import="java.util.regex.*" %> <html> <head> <title>login</title> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="GENERATOR" content="Rational Application Developer"> </head> <body> <h1>Login</h1> <% String userid = request.getParameter("userid"); String password = request.getParameter("password"); session.invalidate(); session = request.getSession(true); session.setAttribute("userid", userid); if(request.getMethod().equals("POST")){ boolean matchu = false; boolean matchp = false; if(userid != null && !userid.equals("") &&password != null && !password.equals("")){ Pattern input = Pattern.compile("[a-zA-Z0-9]*"); Matcher m = input.matcher(userid); matchu = m.matches(); input = Pattern.compile("[a-zA-Z0-9]*"); m = input.matcher(password); matchp = m.matches(); } if(matchu && matchp && (userid != null && !userid.equals("")) && (password != null && !password.equals("")) && userid.length() <= 50 && password.length() <= 50 && request.getParameter("login") != null &&request.getParameter("login").equals("Login")){ Data d = SampleUtil.getData("jdbc:db2://localhost:50000/WEALTH", "<enter_username_here>", "<enter_password_here>"); users.setData(d); Users u = users.getUsers(userid); if(u != null && u.getPassword().equals(password)){ session.setAttribute("userid", userid); response.sendRedirect("welcome.jsp"); } else{ out.println("Error logging in.<br/><br/>"); } } else out.println("Error logging in.<br/><br/>"); } %> <form method="post"> userid: <input name="userid"/><br/> Password: <input name="password" type="password"/><br/> <input type="submit" name="login" value="Login"/> </form> </body> </html>
Note that the HTML comments were converted into JSP comments. Here you also
implement the previously discussed changes, including input validation, where if
the username or password are not alphanumeric, they are rejected and never make
it to SQL or Java String comparisons. Note you're also making sure a
POST request was issued, and that the Login button
named "login" is correctly valued as "login" in the
POST request.
The fix in Listing 4 ensures that any user is logged out of your Wealth application when they should be.
Listing 4. Updated logout.jsp. Tear down the session
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <%@page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <html> <head> <title>logout</title> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="GENERATOR" content="Rational Application Developer"> </head> <body> <% String userid = (String)session.getAttribute("userid"); if(userid != null){ session.setAttribute("userid", null); session.invalidate(); response.sendRedirect("login.jsp"); } %> </body> </html>
Other than changing the comment from HTML to JSP, the session is properly teared down so that a user really is logged out completely.
In Listing 5 you make changes to the code to prevent SQL injection attacks from occurring in your application.
Listing 5. Updated realestate.jsp
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <jsp:useBean id="realestate" class="com.ibm.ds.realestate.RealestateDataImpl" scope="page" /> <%@page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <%@page import="java.util.Iterator" %> <%@page import="com.ibm.ds.realestate.Realestate" %> <%@page import="pureQuery.example.*" %> <%@page import="com.ibm.pdq.runtime.*" %> <%@page import="java.math.BigDecimal" %> <%@page import="java.util.regex.*" %> <html> <head> <title>realestate</title> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="GENERATOR" content="Rational Application Developer"> </head> <body> <h1>Your realestate holdings</h1> <table border="1"><tr><th>Address</th><th>City</th> <th>Zip</th><th>State</th><th>Value</th></tr> <% String userid = (String)session.getAttribute("userid"); if(userid == null){ response.sendRedirect("login.jsp"); } Data d = SampleUtil.getData("jdbc:db2://localhost:50000/WEALTH", "<enter_username_here>", "<enter_password_here>"); realestate.setData(d); Iterator i = realestate.getRealestates(userid); Realestate curr = null; double total = 0; while(i.hasNext()){ curr = (Realestate) i.next(); out.println("<tr><td>"+curr.getAddress()+"</td><td>" +curr.getCity()+ "</td><td>"+curr.getZip()+"</td><td>" +curr.getState()+ "</td><td>$"+curr.getPropertyValue() +"</td></tr>"); total += curr.getPropertyValue().doubleValue(); } if(total > 0) total = Math.round(total*100.0)/100.0; %> </table> <h3>Total value: $<% out.print(total); %></h3> <br><h4>Enter new real estate:</h4> <% if(request.getMethod().equals("POST") && request.getParameter("create" ) != null){ String address = request.getParameter("address"); String city = request.getParameter("city"); String state = request.getParameter("state"); String zip = request.getParameter("zip"); String value = request.getParameter("value"); if(!address.equals("") && !city.equals("") && !zip.equals("") && !state.equals("") && !value.equals("")){ Pattern input = Pattern.compile("[a-zA-Z0-9\\p{Blank}]*"); Matcher m = input.matcher(address); boolean matcha = m.matches(); input = Pattern.compile("[a-zA-Z\\p{Blank}]*"); m = input.matcher(city); boolean matchc = m.matches(); input = Pattern.compile("[a-zA-Z][a-zA-Z]"); m = input.matcher(state); boolean matchs = m.matches(); input = Pattern.compile("[0-9][0-9][0-9][0-9][0-9]"); m = input.matcher(zip); boolean matchz = m.matches(); if(matcha && matchc && matchs && matchz){ try{ realestate.createRealestate(new BigDecimal(value), address, city, zip, state, userid); response.sendRedirect("realestate.jsp"); }catch(Exception e){ out.println("Error adding new real estate. <br/><br/>"); } } else out.println("Error adding new real estate.<br/><br/>"); } else out.println("Error adding new real estate.<br/><br/>"); } %> <form method="post"> Address: <input name="address"/><br/> City: <input name="city"/><br/> Zip: <input name="zip"/><br/> State: <input name="state"/><br/> Value: $<input name="value"/><br/> <input type="submit" name="create" value="Create"/> </form> <a href="welcome.jsp">back</a> </body> </html>
Here the four string and integer input fields need input validation placed on
them to avoid SQL injection attacks pointed out by Rational AppScan. The
BigDecimal class does internal input validation, and
so you don't really need to perform input validation on the value parameter,
though you might find it useful to display useful errors to users. If everything
passes input validation, then the new real estate record is added to the
database. Again the HTML comments were converted to JSP comments so that they
don't appear in the HTML at all.
Listing 6. Updated securities.jsp
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <jsp:useBean id="securities" class="com.ibm.ds.securities.SecuritiesDataImpl" scope="page" /> <%@page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <%@page import="java.util.Iterator" %> <%@page import="com.ibm.ds.securities.Securities" %> <%@page import="pureQuery.example.*" %> <%@page import="com.ibm.pdq.runtime.*" %> <%@page import="java.net.*" %> <%@page import="java.io.*" %> <html> <head> <title>securities</title> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="GENERATOR" content="Rational Application Developer"> </head> <body> <h1>Your stock and options holdings</h1> <table border="1"><tr><th>Sybmol</th><th>Description</th> <th>Quantity*</th><th>Type</th><th>Current price** </th><th>Total value</th><th>Quote date</th></tr> <% String userid = (String)session.getAttribute("userid"); if(userid == null){ response.sendRedirect("login.jsp"); } Data d = SampleUtil.getData("jdbc:db2://localhost:50000/WEALTH", <enter_username_here>", "<enter_password_here>"); securities.setData(d); Iterator i = securities.getSecuritiess(userid); Securities curr = null; double total = 0; while(i.hasNext()){ curr = (Securities) i.next(); String str = "http://finance.yahoo.com/d/quotes.csv?s="+curr.getSymbol() +"&f=nd1l1"; URL url = new URL(str); URLConnection conn = url.openConnection(); DataInputStream in = new DataInputStream ( conn.getInputStream ( ) ) ; BufferedReader br = new BufferedReader(new InputStreamReader(in)); String line = null; if(br.ready()) line = br.readLine(); String company = line.substring(line.indexOf('"')+1, line.indexOf('"', line.indexOf('"')+1)); String date = line.substring(line.indexOf("\",\"")+3, line.indexOf("\",", line.indexOf("\",\"")+4)); String price = line.substring(line.indexOf("\",", line.indexOf("\",\"")+4)+2); int multQuantity = curr.getQuantity(); if(curr.getSecuritytype().equals("option")) multQuantity = curr.getQuantity()*100; float totalValue = Float.parseFloat(price)*multQuantity; totalValue = (float)(Math.round(totalValue*100.0)/100.0); out.println("<tr><td>"+curr.getSymbol()+"</td><td>" +company+ "</td><td>"+curr.getQuantity()+"</td><td>"+ curr.getSecuritytype()+"</td><td>$"+price+ "</td><td>$"+totalValue+"</td><td>" +date+"</td></tr>"); total += totalValue; } if(total > 0) total = Math.round(total*100.0)/100.0; %> </table> <h3>Total value: $<% out.print(total); %></h3> * # of contracts for options<br/>** Delayed quotes, as retrieved from Yahoo! Finance™ <br/><br/><a href="welcome.jsp">back</a> </body> </html>
The only error this class had was the comments in the HTML. Note the change here from the HTML comment to a JSP comment.
Finally, invalidate the session (see Listing 7).
Listing 7. Updated welcome.jsp
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <%@page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <html> <head> <title>welcome</title> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="GENERATOR" content="Rational Application Developer"> </head> <body> <% String userid = (String)session.getAttribute("userid"); session.invalidate(); session = request.getSession(true); session.setAttribute("userid", userid); if(userid == null){ response.sendRedirect("login.jsp"); } %> <h1>Welcome <% out.print(userid); %>!</h1> See your <a href="securities.jsp">securities</a><br/> See your <a href="realestate.jsp">real estate</a><br/><br/> <a href="logout.jsp">logout</a> </body> </html>
Lastly, modify the HTML comment in welcome.jsp to JSP comments, and invalidate the session as discussed previously.
After updating the jsp's within Rational Application Developer, test everything is working with the Wealth Web application.
The second scan
Now that you have updated your Java code and tested that the Wealth Web Application is working, it is time to run Rational AppScan again and see how many vulnerabilities you have fixed.
Before running the another Scan, check your database tables data, since the previous Rational AppScan Scan might have populated tables with new rows of test data, including XSS, which can cause testing errors. In this case notice Rational AppScan added 50 or so entries in your securities table.
Once your tables have been checked and your Wealth Web App has been checked, you're all set for another scan.
Within Rational AppScan, click New or File > New (see Figure 34).
Figure 34. Select your previously created Scan Template, WealthScan
Next the Wizard starts again with the previous scan template information and settings populated. You want to repeat the exact same scan so accept these settings and press Next 3 times, select Application-Only and then click Finish.
Next you are prompted to save your second scan. Name it
WeathScan2, after which
the scan will commence.
Once the Scan has completed, you should notice the previous detected Security vulnerabilities have all been resolved and a clear report is displayed.
You have successfully cleaned the Wealth Web Application of all know security vulnerabilities!
Rational Appscan report choices and extensions
In this last section you'll see some of the various reports you can create and extensions you can use with Rational AppScan.
Rational AppScan reports
Now that your Web Application is free from security vulnerabilities, you can create some professional Quality Assurance reports. Such reports can be provided as part of release control process, proving your Web application has been successfully security tested, and is fit to be placed on the Internet (see Downloads to view the reports generated from your scans).
So with your last scan still open in Rational AppScan, select Tools > Report.
Now select an appropriate report template. Figure 35 shows an example of a standard report.
Figure 35. Industry standard reports
Figure 36 shows a list of the various regulatory compliance reports that can be selected.
Figure 36. Regulatory compliance reports
Delta analysis reports
When testing large Web applications, it can take several scans by Rational AppScan before all the security bugs are ironed out. On occasion you will notice as you fix one security issue, several further security issues appear. Therefore, it can be useful to produce delta analysis reports to show your progress.
Delta Analysis compares a past scan with a current scan; they are straight forward to create. Within your existing scan you want to compare, select Tools > Report > Delta Analysis Report, and then navigate to a second saved scan you want to compare in your report (see Figure 37).
Figure 37. Delta analysis reports
Rational AppScan empowers you to create your own specific report templates (see Figure 38), which is a simple and easy to learn process.
Figure 38. Creating your own report
Rational AppScan extensions
Another useful and fully customisable feature within Rational AppScan is the use of Rational AppScan Extensions. Extensions are add-ons which add additional functionality and capabilities to Rational AppScan (see Figure 39). They can add anything from exploitation tools, to e-mail notification and to my personal favorite extension that exports the scan results straight into a PowerPoint Presentation.
Figure 39. Select the Extension Manager in Rational AppScan
Rational AppScan extensions are easy to write and integrate in Rational AppScan. IBM holds several freely downloadable extensions (see Figure 40) ready for integration at http://axf.watchfire.com/.
Figure 40. Select Install
One of the most useful extensions available to download from IBM is the Email Notification Extension. To demonstrate how easy they are to integrate and how they work, here's a mini extension tutorial.
- First browse to http://axf.watchfire.com/ and download Mail-E-Vent Extension.
The extension is downloaded as a zip file, but do not unzip this file, as the .zip format is correct for importing into Rational AppScan (see Figure 41).
Figure 41. Navigate to your downloaded Mail-E-Vent Zip file
- The Mail Extension is installed.
- Close the Rational AppScan application and then reopen it (see Figure 42).
Figure 42. Return to the Extension Manager and open the new "Mail-E-Vent" Setup
- Select Save and Test Settings, and check your in box for the test e-mail
(see Figure 43). And that's all there is to it!
Figure 43. Successful test email
Now Rational AppScan will automatically send an e-mail notification (and a report where applicable), when a Scan ends, when Rational AppScan loses connectivity to the Web application, and when the scan pauses requesting a login prompt to be completed. This particular extension can be extremely useful when scanning larger and more complex Web applications, which can take a while. So you are able to go off and get on with something else, safe in the knowledge you'll receive an e-mail should Rational AppScan "need" you, which you have to say is pretty cool.
Finally you can easily create an extension yourself. IBM provides the source code for all the extensions featured on their Web site, so you can see how simple they are to produce. In no time at all you are able to integrate Rational AppScan into your business systems and produce extra features to meet any specific requirements you have.
You have ensured your Wealth Java Web Application created in Part 1 of this series is free from all known security vulnerabilities. The final revision of the Wealth Web Application can be uploaded to an Internet Web server, without you having to be concerned about it being hacked at the Web application level. Along the way in this tutorial you learned the importance of Web application security, taking time to work out a Rational AppScan deployment strategy, customizing a scan template, how to perform a scan, interpreting the results, fixing the vulnerabilities within the Web application code, and producing security reports.
|Generated reports
- Create secure Java applications productively, Part 1: Use Rational Application Developer and Data studio: Don't miss Part 1, which shows how Data Studio with pureQuery can increase the efficiency of your database-driven Web development. You will be developing a Java Web application with Rational Application Developer, and then with Java Server Pages (JSP) you will deploy the application on WebSphere Application Server.
- Web Application Security Consortium (WASC): Check out an international group of experts, industry practitioners, and organizational representatives who produce open source and widely agreed upon best-practice security standards for the World Wide Web.
- Open Web Application Security Project (OWASP): Learn about a worldwide free and open community focused on improving the security of application software.
- IBM Rational AppScan: Learn about IBM's leading suite of automated Web application security solutions.
- Learn about the features in IBM WebSphere 6.1 from this article.
- Find out what's new in IBM Rational Application Developer 7.0.
- Get an overview of Rational Application Developer V7 in the tutorial, Hello World: Learn how to create Java, Web service, and database applications with Rational Application Developer V7 (Jane Fung, developerWorks, January 2007).
- To learn about pureQuery, which gives database application developers an easy, GUI-based means to significantly increase productivity in both the design and implementation phases, read Understanding pureQuery, part 1: pureQuery: IBM's new paradigm for writing Java database applications (Azadeh Ahadian, developerWorks, December 2007) and Understanding pureQuery, part 2: Assist class modelers with data modeling (Azadeh Ahadian, developerWorks, January 2008).
- Read this tutorial if you want a refresher on JavaServer Pages.
- Visit the developerWorks resource page for DB2 for Linux, UNIX, and Windows to read articles and tutorials and connect to other resources to expand your DB2 skills.
- developerWorks technical events and webcasts: Stay current with developerWorks technical events and webcasts.
- Podcasts: Tune in and catch up with IBM technical experts.
Get products and technologies
- Download Rational Appscan Standard Edition.
- Visit https://licensing.watchfire.com and enter your details and then download the generated "license file."
- Download Rational Application Developer.
- Download Data Studio.
Dig deeper into Rational software on developerWorks
- Overview
- Free online course: Getting started with IBM Bluemix
- IBM Bluemix Garage Method
- Technical library (tutorials and more)
- Forums
- Communities
developerWorks Premium
Exclusive tools to build your next great app. Learn more.
dW Answers
Ask a technical question
Explore more technical topics
Tutorials & training to grow your development skills


text:
Lil' Kim has been given a horrid haircut butchering her long locks, according to a prisoner who was released from the Philadelphia detention center just as the rapper was admitted to begin her 366-day sentence for perjury.
"She looked like a wreck," Shaki Muhammad, 40, who had just served three months, tells the New York Post. "She didn't look anything like she did on the outside."
Muhammad also told the paper that prisoners besieged the 4'11", 30-year-old Kim (real name: Kimberly Jones) with highly personal questions about her sex life and plastic surgery.
Kim's prison stint is because of her conviction for lying to a grand jury during its probe into a 2001 shooting outside a Manhattan radio station.
Her first 24 hours in confinement were spent in solitary before she was released among the other inmates, the Post reports. This week she is due to be assigned both a cellmate and a job. "She became very friendly," said Muhammad, adding: "I know if she was on the street, she wouldn't give us the time of day."
Meanwhile, Monday's New York Times reviews Kim's fourth and latest CD, The Naked Truth, which it calls "a surprisingly dull album, with too many stale conceits." Even so, the paper did enjoy the "entertaining shots at so-called snitches," and "it's fun to hear her pretend that she hates being talked about."
Among the lines quoted: "Star Jones don't like me, she cheap and I like the best/ Damn, it must feel good to Pay-less."
Lil' Kim Cut Down to Size in Prison

subset: commoncrawl


text:
The great translucent Moon bowls look like double-faced lunar caps inside and out. A sort of lenticular reincarnation of the Dune trays. But if the trays "bear," these bowls "contain." And what do they contain? Such a great variety of things: flowers, objects, decorative compositions... But first and foremost they have that same magic light as DUNE, shimmering iridescently under your gaze. A lunar show of luminous refractions, a table center or ornament which will always be the dynamic vortex of a room.
|Transparent or batch-dyed PMMA.
Meeting the Regulation 2002/72/CE related to plastic material coming into contact with food.
|Overall: 17.7" Dia x 6.5" H
|Catalog ID
Ships via 2Modern Standard Delivery.
Have a question about this product? Need help finding something? Our expert Customer Service team is here to help. Give us a call at (888) 222-4410 or fill out the form below.


text:
Supports Outlook, Gmail, Office 365, OWA, Mac, and mobile devices.
Paid -
Details below
App by Riva CRM Integration
Riva syncs Salesforce directly to Exchange, Google Apps and Gmail, Office 365, IBM Notes, and GroupWise. Sync contacts, calendar events, tasks, email, opportunities, custom objects and more. No plug-ins to manage. Supports PC, Mac, and mobile devices.
Email & Calendar Sync
Find a Developer
Browse Jobs
Post a Job
List on the AppExchange
Learn About the AppExchange
Follow us on Facebook
Follow us on Twitter
Follow us on LinkedIn
Subscribe to our RSS feed
1-800-NO-SOFTWAREPrivacy StatementSecurity StatementTerms of Use日本語
2000-2016, salesforce.com, inc.


text:
PHP email's sender
This project received 32 bids from talented freelancers with an average bid price of $370 USD.Get free quotes for a project like this
Project BudgetN/A
Total Bids32
Project Description
I want an PHP email's sender. Only a very good sender that send the message in inbox folder in any email account.
Looking to make some money?
- Set your budget and the timeframe
- Outline your proposal
- Get paid for your work
Hire Freelancers who also bid on this project
Looking for work?
Work on projects like this and make money from home!Sign Up Now
- Forbes
- The New York Times
- Time
- Wall Street Journal
- Times Online


text:
A ribbon cutting celebrated the first day of classes for 14 students enrolled in North Carolina Wesleyan College's Aspire program, which opened January 13 for the first time on the College of the Albemarle's Dare County Campus in Manteo.
Aspire is an adult student program that provides class sessions one night a week for 5 or 8 weeks and leads to four-year bachelor's degrees in Business Administration, Organizational Administration, Marketing, and Accounting. The program is fully accredited and offers financial aid and advising.
The Outer Banks Chamber of Commerce President and CEO Karen Brown, and Dare County Commissioner Chair Warren Judge welcomed officials and guests to the event. Attending were Chamber Board Member Tim Kelly of Staples; Chamber Ambassadors Glenn Sawyer, AFLAC; Penny Bentley and Phyllis Neal, OBX Bank; and Tyler Booth, BB&T. Also attending were Dan Jones, Landon Price, Bill Rea, Nancy Chappell, Anne Morrisette, and Shelley Watson. Charter Business was recognized as a Chamber sponsor of the ribbon cutting program.
Pictured: front row, left to right: Bill Rea, Dan Jones, Dr. Evan Duff, Tracy Grant, Shelley Watson, Tyler Booth, Karen Brown and Landon Price. Second row/back row: Commissioner Warren Judge, Nancy Chappell, Anne Morrisette, Glenn Sawyer, Penny Bentley, Phyllis Neal, Sheri May, Tim Kelly, and more.
Tracy Grant is regional coordinator of the Aspire program at College of the Albemarle's Dare County Campus. She can be reached at 252-473-2264 ext. 224 and firstname.lastname@example.com.


text:
Cleveland New York Golf Courses
|North Shore Golf Course
Additional Golf Course Reviews:
|En-Joie Golf Club -- "A" game a must
|Review by: J.W. Kalka
|You better bring your "A" game when you play this PGA course. The long,narrow tree lined fairways put a premium on straight shots. Anything hooked or sliced will get you in heavy ruff,the tree line or another fairway.If you are not a long ball hitter you will not score well here as many of the holes are long. The only problem with this course has been the constant flooding that has occurred the last couple of years from the tail ends of hurricanes that cause the nearby Susquehanna river to overflow it's banks and cover most of the course. Still, if you like a challange, it's a good course to try.
|From Binghamton, NY USA


text:
Maks. liczba gości3
Rozmiar16 m²
Piętro2(z windą)
- Internet
- Klimatyzacja
- Dostępny parking
- Śniadanie
- Ręczniki
- Zwierzęta dozwolone
- Winda w budynku
|Wenzigova, 120 00 Prague, Czechy
|Rodzaj nieruchomości
|Prywatny pokój
|Kod referencyjny
|Wskaźnik odpowiedzi
|Czas reakcji
|Kilka godzin
|Zaktualizowano kalendarz
|6 dni temu
FREE Wi-Fi
Check in time is from 14:00
Check out prior 12:00
Breakfasts from 7:00 till 10:30
Royal Court Hotel is a brand new, modern and comfortable hotel, which is located in a fully restored and renovated XIX century building of the former Royal Court. It is located in the central part near the medieval sights and the quay of the river Vltava with some of the most beautiful bridges in Europe stretching across it.
Our friendly English-speaking personnel will surround you with care and attention and will make sure you have the warmest memories of your visit to Prague.
We are pleased to offer you a classic cozy double room, which is equipped with all the necessary things for your comfortable stay. You can choose rooms with either a double bed or two large beds. The rooms are equipped with:
Shower cabin, hairdryer, towels
Shower gel/shampoo
Aroma soap for hands
Air condition
Tea set
Welcome coffee and tea
Extra services (paid):
Extra cleaning
Airport transfer
Public transport tickets
Parking for middle-sized cars costs 15-25 euro/day (at the building near apartments). The price depends on the size of your car.If you have some more questions, feel free to ask me about!
|Cena za >2 gości
|45 zł opłata dodatkowa od gościa/nocy
|Zameldowanie po
|Zameldowanie przed
|Do ustalenia
|Wymeldowanie przed
|Zasady Anulowania Rezerwacji
The apartment was big, very clean and beautifully decorated. It even had to bathrooms!
The receptionist was very nice and helpful. Our car was to big to fit in their parking, so they found another one for us in a near hotel.
The breakfast was a bit expensive, but they also recommended us other places to go. However, we decided to have breakfast there because it was faster.
The street was quite noisy but with the windows closed it was not a problem to sleep.
It is a long walk to the center, but it is not far from the Wenceslao Square and it is very well connected with tram.
It was a great stay!
Our stay in the Royal Court Apartments was lovely. The apartment was exactly as in the photo. We got an upgrade to a larger place, which was more into the city center. The staff was very friendly and we got a bottle of champagne because of the switch in apartments, which was extremely nice.
Elizabeth was very nice to be in contact with. She gave me a lot of information about the public traffic and how we could get to the apartment. The apartment itself was really specious and clean. The bed was very comfortable and the living room was really nice and cosy to stay in. The only bad thing was that you had to wait for about 5 minutes before the water of the shower was warm. But for the rest, the apartment was just perfect! It was really clean and in good condition and a cleaning lady came by almost every day. We felt really home and we would definately like to visit this place again.
Elizabeth we loved your appartment! It was really neat and clean and we had a very pleasant stay there. If we ever come back to Prague, we would book it again.
Thank you!
Hey Dear Elizabeth,
I would like to thank you for your helpful consults. The location of your building was really perfect and that was a clean apartment but unfortunately there were some disappointing points about the apartment that surprised me and my family. In fact, that was not what I saw in the photos and what I reserved. Your colleague gave us a grunt!!! The radiators were off and my parents in law were really suffering. The refrigerator was really inoperative, all our shops were frozen completely, the fruits, the drinks,… and I'm not sure that the next time I reserved an apartment by Wimdu or not? Because the information published on the site is not at all in accord with reality.
I wish u all the bests,
It was very nice time in Prague. I was so nice suprised about great contact before coming, very good conditions and breakfasts in hotel and very helpful and pleasant staff. I can recommend this hotel for everybody. Thank You very much.
El Apartamento era muy bonito y muy amplio. El personal de recepción era muy amable, estaban siempre dispuestos a responder todas las preguntas que les hacíamos.
Esta situado en una zona muy tranquila de Praga.
No se necesita transporte urbano para llegar a las zonas turísticas desde el apartamento.
En 10 min. Caminando estabas en la plaza de Wenceslao.
Sin duda volveré a consultar apartamentos en Windu para mis próximos viajes.
Es una opción mejor que el Hotel.
Muchas Gracias por todo en especial a Kira, fue muy amable conmigo.
Es war ein wunderschönes Apartment! Die Rezeptionistin hat jede einzelne Frage beantwortet und konnte uns immer helfen. Außerdem haben wir gleich bei unserer Anreise Tips bekommen, was wir unbedingt sehen müssen und auch welche Events man in Prag besuchen kann. Das Apartment an sich war sehr schön eingerichtet und auch sehr ordentlich.
Zur Innenstadt braucht man auch nicht lang. Die meisten Orte sind zu Fuß erreichbar. Wir haben uns lediglich für die Burg ein Metro- und Tramticket gekauft, sonst sind wir überall zu Fuß hingegangen.
Estupendo apartamento bien ubicado y limpio, las recepcionistas mas simpáticas de toda Praga. Gracias por todo.
- Gwarancja jakości zakwaterowania
- Każdy gospodarz jest weryfikowany telefonicznie
- Bezpieczna płatność za pomocą szyfrowania SSL


text:
BBB Accredited Business since
Dale Green Company
Phone: (952) 894-5812 Fax: (952) 894-5813 1308 Highway 13 W Ste 3, Burnsville, MN 55337 View Additional Email Addresses http://www.dalegreencompany.com
BBB Business Reviews may not be reproduced for sales or promotional purposes.
Sell wholesale/retail top soil and custom soil mixtures
Request a Quote
View Business Review Inquiries
Dale Green Company has had their Business Review viewed 4 time(s) over the last 40 days. Click to view where these inquiries originated.
BBB Accreditation
A BBB Accredited Business since
BBB has determined that Dale Green Company meets BBB accreditation standards, which include a commitment to make a good faith effort to resolve any consumer complaints. BBB Accredited Businesses pay a fee for accreditation review/monitoring and for support of BBB services to the public.
BBB accreditation does not mean that the business' products or services have been evaluated or endorsed by BBB, or that BBB has made a determination as to the business' product quality or competency in performing services.
Reason for Rating
BBB rating is based on 13 factors. Get the details about the factors considered.
Factors that affect the rating for Dale Green Company include:
- Length of time business has been operating
- No complaints filed with BBB
Customer Complaints Summary
|Complaint Type
|Total Closed Complaints
|Advertising/Sales Issues
|Billing/Collection Issues
|Delivery Issues
|Guarantee/Warranty Issues
|Problems with Product/Service
|Total Closed Complaints
Definitions | BBB Complaint Process | File a Complaint against Dale Green Company
Customer Reviews Summary Read customer reviews
|Customer Experience
|Total Customer Reviews
|Positive Experience
|Neutral Experience
|Negative Experience
|Total Customer Reviews
Read Customer Reviews | Submit a Customer Review | See Trends in Customer Reviews on Dale Green Company
Additional Information
Licensing, Bonding or Registration
This business is in an industry that may require professional licensing, bonding or registration. BBB encourages you to check with the appropriate agency to be certain any requirements are currently being met.
These agencies may include:
Minnesota Secretary of State
180 State Office Bldg, 100 Rev. Dr. Martin Luther King Jr. Blvd., Saint Paul MN 55155
Phone Number: (651) 296-2803
Type of Entity
Business ManagementLaurence Butler, President
Contact Information
Business Category
Topsoil Landscaping Equipment & Supplies Lawn Maintenance
Products & Services
Dale Green Company offers the following product(s): Top Soil
Method(s) of Paymentcash, check, credit card
Products & Services
According to the information provided by Dale Green Company, this company offers dirt and nursery supplies.


text:
'84 Honda (GONE)
Started by
4 posts in this topic
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new account
Sign in
Already have an account? Sign in here.
Sign In Now
Popular Now
- 63 replies
- 2,383 views
By Big Dave2, in Outdoor Discussion, Clean-ups, and Agendas - Keep it Civil
- 1,145 replies
- 23,424 views
Peppers are back in the cold smoke. Breaking out the gas smoker later for jerky, not having a dehydrator think I'll put the peppers in the smoker and dry them out that way at around 130 or 140 degrees after the jerky is done. Not sure if it'll work but WTH.
7 hours ago, Big Dave2 said:
What do you care? I thought he was irrelevant anyway?
As the Chronicle reports, Pelosi spoke out Tuesday, essentially begging people to stop talking about third-party candidates and messing up the polling, saying that a narrow victory in the general election "would deprive Hillary Clinton of a big mandate that I think she should have going into the White House and that would be helpful as to how we go forward."
This is just how Del, D2E, Hillary, Donald, and Nancy Pelosi feel about 3rd party candidates. Nothing personal.PurpleFloyd likes this
Perhaps you are associating peanut butter with sweet things, like cookies or peanut butter cups. But peanuts aren't sweet and can work in savory things as well. Asian food seems to do that with peanuts a lot, just as an example. African food also.
1 hour ago, blue_healer_guy said:
leech, it does sound like an odd concocktion. but you gotta try it. 225 for 2 hrs, helps if u use thin bacon.
Man, I can see cream cheese but peanut butter? I may have to give it a go sometime, maybe the bacon will off set the oddness?Edited by leech~~


text:
The first cup of coffee may have been brewed in Ethiopia, Sudan or Kenya many years ago. The story has been told that perhaps in the 9th century a goat herder named Kalid noticed that his goats seemed more energetic after they ate beans or berries from a certain bush. Eventually the beans were roasted then ground and mixed with hot water and consumed by humans. The first writings about coffee appeared in 1671. Coffee was first exported from Ethiopia to Yemen and one of the fist coffee houses appeared in Constantinople in 1554.
Coffee is second only to oil as the one of the most legally traded commodities in the world. Because "it makes us think" coffee houses were places where ideas could be exchanged. Some believe that both the French Revolution and the American Revolution were both planned in coffee houses. Mark Pendergrast has written in his book "UNCOMMON GROUNDS: The History of Coffee and How It Transformed Our World" that after the Boston Tea Party in 1773 it was unpatriotic to drink tea if you sided with the colonists.
Unfortunately coffee has received some "bad press" over these many years of its existence. Most of the negative concerns about coffee probably are related to its caffeine content. However Doctor Rob Van Dam of the Harvard School of Public Health has stated that coffee is not just a "vehicle for caffeine" but is a "very complex beverage" and has many healthy and helpful qualities. For example coffee helps fight depression and coffee drinkers are less likely to commit suicide than abstainers.
Coffee may be good for your liver, and those who drink moderate amounts of alcohol are 20 percent less likely to develop cirrhosis of the liver as compared to non-coffee drinkers.
Coffee may help prevent Alzheimer's disease and also Parkinson's disease. There is a reduced risk of Type II diabetes reported as high as 25 percent in those who drink three to four cups daily.
In a National Cancer Institute study of 400,000 volunteers age 50 to 70 years of age who drank two to three cups of coffee daily, it was noted that men were 10 percent less likely to die and that 13 percent of women were less to die during this decades long study as compared to non coffee drinkers. Others have noted that in coffee drinkers there is a reduced risk of basal cell cancer, prostate cancer and a reduction in recurrent breast cancer.
One Canadian study shows that in healthy adults it is safe to consume about 400 milligrams or three 8-ounce cups of coffee daily.
Other studies state that men metabolize coffee faster than females and that coffee contains antioxidants that help protect against unhealthy free radicals that may cause tissue damage.
Because coffee has been shown to boost cognition it may seem to "make you smarter"
Voltaire, the prolific French writer, was reported to drink more than 50 cups of coffee a day. The famous composer Bach wrote "Kaffee Kantata: as a tribute to his favorite beverage.
In 1832 President Andrew Jackson signed an executive order that substituted coffee and sugar for the allowance of rum, whiskey and brandy. Since then coffee has been a "storied staple of American military culture." So, have a "cup of Joe" and toast Kalid for being so observant.
David Keisler is a gastroenterologist and internist in Aiken.


text:
Texas High Plains cash grain markets closed steady to several cents lower on grain sorghum and corn, wheat and soybeans were 4-5 cents lower. Prices paid or bid to the farmer, fob elevator as of 4 p.m. Grain sorghum quoted per hundredweight; wheat, corn and soybeans per bushel.
Area north of the Canadian River:
Grain sorghum: $2.68-2.95 mostly 2.68-2.82
Wheat: $2.29-2.37
Corn: $1.76-1.80
Triangle area from Plainview to Canyon to Farwell:
Grain sorghum: $2.77-3.02
Wheat: $2.29-2.41
Soybeans: $3.51-3.87
Corn: $1.80-2.00 mostly 1.90-2.00
Area south of a line from Plainview to Muleshoe:
Grain sorghum: $2.50-2.60
Wheat: $2.35-2.40
Soybeans: $3.55-3.85
Corn: $1.76-1.88
Elevators in the Texas South Plains were reporting offers and bids for:
No. 2 grain sorghum: $3.14-3.21 per cwt.
No. 2 yellow corn: $3.63-3.71 per cwt.
Texas Gulf export bids:
No. 1 HRW wheat: $2.85 1/4 -2.92 1/4 per bu.
No. 2 grain sorghum: $3.37-3.48 per cwt.
No. 2 yellow corn: bids insufficient to quote
No. 1 soybeans: 4.56 1/2-4.61 1/2 per bu.
© 2016. All Rights Reserved. | Contact Us


text:
Cartoony Evolution Of Famous Vampires
Artist Jeff Victor's chart has a couple of famous vampires lined up in chronological order, just in time for Halloween.
Artist Jeff Victor's chart has a couple of famous vampires lined up in chronological order, just in time for Halloween.
Buried underneath the VMAs, something else important also took place on TV last night. True Blood, HBO's long-running series about sexy vampires and the people who love them, wound to a close.
True Blood is a raunchy show about vampires and other supernatural beings. Its cast in turn contains many actors who were relatively unknown when the show first started in 2008, and are now regularly hailed as pinnacles of physical perfection.
Last week, we showed you one side of the PS3/Vita title Akiba's Trip 2: its faithful reconstruction of otaku mecca Akihabara. Today we're going to look at the other side of the game. So watch us as we strip vampires, expose them to lethal amounts of sunlight, and then loot their corpses.
While an Unreal Engine 3-powered vampire hunting period piece set in an alternate 19th century Paris may sound pretty compelling, the coolest thing about Square Enix's Bloodmasque is facial mapping technology console developers gave up on years ago.
Surprisingly, blood suckers aren't as common in video games as you might expect. They might appear as a generic type of enemy, and of course there are a few of them in the Castlevania series. We collected some of these vampires, paying attention to leave out those who like to carry people on their backs.
The author of The Zombie Combat Manual Roger Ma is back with a new guidebook: The Vampire Combat Manual, which dispenses advice on how to battle vampires. In the excerpt below, Ma tackles misconceptions about the imagery beings—just in time for Halloween:
Rigor mortis has set in. They are unable to walk. But with their arms outstretched, they hop as they search the night for prey to bite. That's how they absorb the essence of their victims. They're called "jiangshi" and are China's vampire zombies.
After EA added vampires to the mix in 2010's Late Night expansion, The Sims 3's fans have been clamoring for a way to faithfully recreate scenes from the Twilight Saga without having to resort to user-created mods. The Sims 3 Supernatural heeds their moody metaphysical call.
In a cutscene for the upcoming downloadable standalone Cole MacGrath adventure, inFamous 2: Festival of Blood, we learn why bloodsuckers from fake New Orleans would go to all the trouble of kidnapping a guy with superpowers.
Scientists have found a type of bacteria that kills off the mosquito that carries malaria. That's good news. The way the bacteria works means it could also be used to make sure there is never a plague of vampires. That's even more good news.
How did a game called Blood Bowl take this long to introduce an all-vampire team, and why aren't they turning to dust during day games?
The Vampires introduced in The Sims 3: Late Night don't want to fall in love with one-dimensional teenage girls. They just want to suck their blood.
The Sims 3 expands this fall with The Sims 3 Late Night Expansion pack, plunging your Sim into the active downtown nightlife, or letting them explore their darkest fantasies as a Sim vampire.
Join us this Wednesday on Kotaku Talk Radio to discuss the week's video gaming news and chat with Marcus Segal, the chief operating officer for Zynga.
Konami takes the Scene It? franchise in a decidedly darkly romantic direction with Scene It? Twilight for the Nintendo Wii, based on the ridiculously popular "vampire" movie.
Ghosts push aside alien abductions, werewolf infections and nightclubbing vampires to become the sole element of the occult in The Sims 3.


text:
Wikipedia:Wikipedia Signpost/2010-09-27/Arbitration report
EEML amendment requests & more
The Arbitration Committee opened no new cases, leaving one open.
Open case
Climate change (Week 16)
This case resulted from the merging of several Arbitration requests on the same topic into a single case, and the failure of a related request for comment to make headway. Innovations have been introduced for this case, including special rules of conduct that were put in place at the start. However, the handling of the case has been criticized by some participants; for example, although the evidence and workshop pages were closed for about five weeks, during this time, no proposals were posted on the proposed decision page and participants were prevented from further discussing their case on the case pages (see earlier Signpost coverage).
The proposed decision, drafted by Newyorkbrad, Risker, and Rlevse, sparked a large quantity of unstructured discussion, much of it comprising concerns about the proposed decision (see earlier Signpost coverage). A number of users, including participants and arbitrator Carcharoth, made the discussion more structured, but the quantity of discussion has continued to increase significantly. Rlevse had said that arbitrators were trying to complete the proposed decision before September 6, but it was later made clear that he will no longer be voting on this decision. This week, arbitrators made further additions to the proposed decision.
Closed cases
Eastern European mailing list
- Radeksz (Week 3)
Earlier this week, arbitrators provided their first responses to the request to reimpose an Eastern European topic ban on Radeksz. As reported earlier, the proposed topic ban was originally imposed at the conclusion of the case, but was lifted three months ago by the Committee. Arbitrator SirFozzie warned that most "drastic action" may result if there is no improvement in the topic area, and echoed this in response to the Piotrus request (see below). Arbitrator KnightLago stated that there was a "growing tiredness within the Arbitration Committee for all things EEML related" which "confused" an editor a bit. Other arbitrators asked participants to read and consider both arbitrator's comments.
- Piotrus (Week 1)
Earlier this week, Piotrus filed a request for his Eastern Europe topic ban to be lifted. This amendment request is identical to the request which was filed in July (see earlier Signpost coverage) – in that request, this statement (by former arbitrator Charles Matthews), and this statement, persuaded the majority of the Committee to oppose modifying the restrictions. However, arbitrator Newyorkbrad is again considering a motion to partially lift the effect of the restriction.
Transcendental Meditation movement (Week 3)
At the time of writing, no further progress has been made on this clarification request since last week's Signpost coverage concerning discretionary sanctions. In response to arbitrator Newyorkbrad's question of whether anything further is being requested, the filer confirmed that arbitrators have not responded to, or not answered multiple questions that the filer asked.
Race and intelligence (Week 3)
At the time of writing, no further progress has been made on this amendment request - to impose a topic ban on Ferahgo the Assassin from race and intelligence related articles. Although an arbitrator stated that he would support a topic ban, no arbitrator has cast formal on-wiki votes for the proposal yet.
The Community has been invited to comment on the Wikipedia:Audit Subcommittee (AUSC); in particular, the preferred methods of selecting community representatives, and the duration of time they would serve. "The result of the discussion will inform the Arbitration Committee on how best to proceed before progressing to another election cycle." AUSC is a subcommittee of the Arbitration Committee which should review and act upon concerns received by the community about CheckUser and Oversight activities. Currently, AUSC consist of three community representatives elected by the community, who serve one-year terms, and three arbitrators who rotate every six months or so. A summary of AUSC's activity has also been posted for comment.
- News and notes
- In the news
- WikiProject report
- Features and admins
- Arbitration report
- Technology report
Regarding the description of the motion about my person, I am puzzled that it is focusing on two critical comments regarding a failed motion from three months ago. As of this moment, regarding the current motion, at least six editors have expressed their support for it (the failed request had seven supportive comments). Further, while it is true that a similar motion failed three months ago, the reading of arbitrator comments suggests to me that the major concern about the request back then was that it was premature, and they themselves suggested it should be revisited "Possibly another month or two" (at mid-length of the remedy). Finally, I wonder why there are no references to a series of successful motions by me narrowing this particular topic ban or by others in the EE area? By focusing on the criticism and failed motion only, I do not believe this report if neutral. --Piotr Konieczny aka Prokonsul Piotrus| talk 17:17, 27 September 2010 (UTC)
- This restriction on you is about you, not others. The circumstances surrounding your restriction are starkly different to those surrounding others so mentioning their motions would not be appropriate. Steve Smith stated:
[w]hile I think I've been among the most sympathetic arbitrators to the early lifting of EEML amendments...I'm not comfortable doing so here. We're dealing with a long history of problematic behaviour in this case, and also the behaviour of someone who, as a then-administrator, should have known better. [emphasis added]
- These cirumstances are not found in the other motions, so to be fair, the only request mentioned is the former (and fully identical) "request to amend EEML Remedy 3 to end the topic ban that applies to Piotrus and allow him to edit articles related to Eastern Europe." In that, Steve Smith also explictly stated that he was persuaded by the 2 statements linked, and two other arbs explicitly concurred with Steve's analysis, while another arb left his earlier oppose that he was "concerned about some things." No arbs referred to any other supportive/critical comments which were made. In such circumstances, it is appropriate to mention/link to those community statements which arbs have acknowledged as persuasive in a particular case. Newyorkbrad, who was the only arb who proposed supporting your cause, was mentioned as again making a proposal in that direction - despite the fact that some would argue that it is not required of this report, this was mentioned purely in the interest of neutrality and awareness. Accordingly, I stand by what is written. Ncmvocalist (talk) 20:48, 27 September 2010 (UTC)
The Climate Change arbitration has made further changes this week, which I think could have been mentioned. In particular the focus of findings has been on "Battlefield conduct", and the focus of remedies introduced in recent days has been on the highly comprehensive "Remedy 3" topic ban. This would ban the named individual from editing any page, including article, talk and project page within the topic area, subject only to direct appeal to the Committee. As well as being proposed for all editors previously considered for a topic ban, it has been proposed for Minor4th, ATren, Hipocrite, Cla68, Scjessey, GregJackP, A Quest for Knowledge, KimDabelsteinPetersen, and Verbal, all of whom are new to the remedies list. Remedies have also been proposed to manage the proliferation of evidence pages in userspace related to the case. The arbitration case is said to be "winding down". --TS 22:35, 27 September 2010 (UTC)
- My understanding is that drafting is still incomplete; once it gets near to completion, readers tend to want to know more about what the decision is moving towards. I think a few more votes are needed in the remedies section before we're at that point so it should be next week (also compare this coverage of R+I PD to its previous/next issue). Ncmvocalist (talk) 02:16, 28 September 2010 (UTC)
- Sorry, it just occurred to me that my comment might be taken as a slight on your own coverage. Your point that the proposed decision is still not mature is well taken. My approach was different, in that I sought to describe the trend over the past week. This has been significant at least for those 9 editors now newly facing a possible indefinite comprehensive topic ban under proposed Remedy 3.
- Deferring discussion of the proposed remedies until the drafting is complete would certainly avoid redundancy in subsequent reports, at the expense of timeliness in reporting. Most cases are much shorter than this one and the drafting phase is not long and drawn out, so I would guess that reporting on ongoing drafting isn't normally a consideration, but at this stage I wouldn't bet too much money on the climate change case finishing before Columbus Day.
- Thanks for your reporting on this, which is very useful to me because of my voluntary non-involvement in the evidence and workshop phases. --TS 10:27, 28 September 2010 (UTC)
- These are useful considerations which I'll be thinking about; I appreciate the feedback. :) Ncmvocalist (talk) 04:01, 29 September 2010 (UTC)
- Thanks for your reporting on this, which is very useful to me because of my voluntary non-involvement in the evidence and workshop phases. --TS 10:27, 28 September 2010 (UTC)


text:
Phaedra Parks on Apollo Nida: I Never Cheated! Only Tried to Help Embattled Husband!
Phaedra Parks sat down with Ellen this week and broke her silence on Apollo Nida, saying that she did all she could for her soon to be former husband.
The Real Housewives of Atlanta star discussed Nida's prison sentence and the impending divorce that she just went public with after months of speculation.


text:
Last season's record: 11 – 2 overall / Big Ten 7 – 1 (T – 1)
Returning starters/letter winners: 15/49
Key losses:
Greg Jones – MLB – Jones was the heart of the Spartans defense the past three seasons and his production will be missed.
Eric Gordon – OLB - While Jones was the heart of the defense, it was Gordon who was the soul. While Gordon may not have gotten the press of his teammate, he will be just as missed when the whistle blows.
Aaron Bates – P – It is not often when a punter is listed as a key loss. However, Bates was more than just a guy expected to kick the ball as he also played the key part in two major special team plays (Little Giants – Mouse Trap) that helped the Spartans to two key victories in 2010.
Key returnees:
Kirk Cousins – QB – The senior signal caller is the team's leader on and off the field and is expected to have his biggest season as a Spartan this fall.
Edwin Baker – RB – The workhorse running back expects to have an even bigger season than his 1,201 yards rushing in 2010.
Jerel Worthy – DT – One of the top defenders in the Big Ten is getting early talk as one of the top picks in next spring's NFL Draft. If Worthy can stay healthy the Spartans are solid in the middle of their line.
Best games: Sept. 17 @ Notre Dame Stadium vs. Notre Dame - Oct. 29 @ Memorial Stadium vs. Nebraska
Projected finish: 10-2
Outlook: The defending Big Ten Champions may be better than they were in 2010. However, their record may not show it as they have a tough road test against Notre Dame early to go with road games at Ohio State, Nebraska and Iowa. The offense has key weapons but will need solid offensive line play to be successful while the defense must replace three key players in Jones, Gordon and Chris L. Rucker.


text:
Miami Beach's Biker Vigilante Is Filming Your Terrible Driving
It's late on Super Bowl Sunday when a sedan barrels through the bike lane on 16th Street at Alton Road, right at cyclist Ken Bereski. Bereski slams on his handbrakes and swerves. The car squeals to a halt inches from his tire. "Learn to drive!" Bereski hollers. "You got a problem?" a rotund man behind the wheel demands. The driver opens his door, but he's so fat he can't pull himself out to fight. Bereski bikes away laughing, but shaken at the close call.
Like all of Bereski's encounters with Miami's terrible drivers, the near-fistfight was caught on camera. Bereski, who bikes thousands of miles a year as a computer consultant, got so tired of getting run off the road that he outfitted his red Raleigh with digital cameras on the front and back, bought a domain name -- livetobikeanotherday.com -- and plans to shame the worst of the worst motorists online once he makes the site live.
"If you're not going to apologize and listen to what I'm saying about bike safety, I'm going to put your face online," Bereski says.
A sharp-featured 30-year-old with ice-blue eyes, Bereski moved to Miami after finishing college in Boston in 2006. He had always biked around Beantown, so when he started an Apple consulting company in South Florida, he figured he'd do the same.
Upcoming Events
Miami Heat Red, White & Pink Game
TicketsMon., Oct. 10, 7:30pm
Miami Heat vs. Brooklyn Nets
TicketsTue., Oct. 11, 7:30pm
Florida Panthers v New Jersey Devils
TicketsThu., Oct. 13, 7:30pm
Florida Panthers v Detroit Red Wings
TicketsSat., Oct. 15, 7:00pm
What he didn't take into account were the Magic City's legendarily awful drivers and the area's lack of infrastructure for bikers. That combination is so bad that Bicycling Magazine in 2008 ranked Miami the third worst city in the nation for cyclists.
Bereski saw that firsthand. As he biked from South Miami to Aventura, he saw road rage and swerving texters, and watched cops, buses, and city vehicles alike run him off the street.
The final straw came two years ago when a cabbie hit him (also at 16th Street and Alton) and then had several other drivers lie to police. "I decided, 'Why not catch everything on camera so no one can lie about it?'" he says.
So Bereski dropped a couple hundred bucks on two small, cigar-shaped digital cameras and then jerry-rigged mounts for them below his handlebars and above his back tire.
Since then, he has collected hours of unedited video. He says he worried at first about putting the near-crashes online -- but then he points to a small gold sticker under his handlebars: This bike protected by closed-circuit cameras.
"Don't say you weren't warned," he says, smiling.
Check out the video of Bereski's Super Bowl Sunday fight:
Follow Miami New Times on Facebook and Twitter @MiamiNewTimes.
Get the This Week's Top Stories Newsletter
Every week we collect the latest news, music and arts stories — along with film and food reviews and the best things to do this week — so that you'll never miss Miami New Times' biggest stories.
In Case You Missed It
Upcoming Events
Popular Stories
Sponsor Content


text:
I get to work this morning.. (late..haha) its 5am... I got out of the car and started dry heaving and gagging immediately. It stinks SO bad out here right now. The paper mill is what's making the stink but...omg its so nasty. I can smell it inside too and it just makes me wanna hurl. Just....thought Id share.
haha, strong smells when you are feeling icky is really not a good combo. I'm not having that problem this time but I have had it bad with every other pregnancy and I know how terrible it is. I can't imagine having to deal with stink in the air all day too. But I do think it's a very good sign.
Lol...thanks for sharing!
I agree with Lynn, it IS a good sign. I had strong aversions to smells too. I still do, a bit, I think! lol
Haha, that's no fun, but it is a good sign. I had to move away from this lady at the grocery store yesterday because of her perfume. It wasn't bad, it was just soooo strong smelling to me.
Anyone use Preggo Pops? I think that's what they're called. I can't actually use the "pops" because my gag reflex is amazing now, but I do suck on the hard candy. ...I don't think it matters what it is, it seems if there's something in my mouth, I don't feel the need to throw up.
Get outta the gutter guys...:bigwink:
So I've been using those all day, it's just regular candy.. it SAYS it has ginger in it to help calm your stomach, but it tasted like sour candy to me, no ginger evident. ANYWAY, I get home and DH had bought me TWO things at TacoBell last night, and the other one was in the fridge waiting on me today. I heated it up..it's a new Cantina Bowl. OMG it is ...so...good. And so freakin hurting my stomach already. I sure did down like the half the thing in ..about 5 minutes. I didn't finish it.. but I'm gonna go to bed now before my stomach REALLY starts hurting. Maybe I can sleep it off....lol
And a nap sounds good all the time.


text:
- Text Size:
- ASmall Text
- AMedium Text
- ALarge Text
The minimum wage in unincorporated areas of Santa Fe County is going up.
An ordinance approved unanimously by the county commissioners sets the minimum wage in the county at $10.66 an hour, up from $7.50.
Meanwhile, the minimum wage for tipped employees will increase to $6.40 an hour from $2.13 currently.
The increases take effect in early May.


text:
Leave a Comment
Name *
Email *
Edmond Road Food Pantry
Young Living Essential Oils
Back To School Shopping Guide
Consumer Queen Holiday Gift Guide
Like us on Facebook
I'm A Part Of
Follow Us On Pinterest
Our Supporters
Contact The Queen!
Copyright © Consumer Queen All Rights Reserved. Disclaimer|Disclosure Policy|Privacy Policy|Contact Me|CQ MediaSite Design by Mitra4Design


text:
AUSTIN — Officials have decided against a full investigation despite a preliminary inquiry finding that the friends and family of state lawmakers are getting special admissions consideration from the University of Texas at Austin.
Applicants for admission as a freshman were nearly four times as likely to be admitted as the general population if they had a legislator appeal directly to University President Bill Powers, an investigation by the chancellor's office has found.
Fully a quarter of the politically connected applicants to UT's School of Law were admitted despite grade point averages and Law School Admission Test — LSAT — scores "well below" and "far below" the usual standards. These students produced four of 10 of the worst LSAT scores among all students admitted since 2009, the report found.


text:
FREE T-shirt from ELECTORAL COLLEGE Sportswear!Ā
Happy New Year!Ā Here's an easy way to stretch your 2016 shopping dollars!
ELECTORAL COLLEGE--"America's Original Party School"--Is offering one FREE school logo T-shirt for every two items you purchase!
Buy two T-shirts, get a free T-shirt! Buy two sweatshirts, get a free T-shirt!Ā
IMPORTANT: Use the "Add a Gift Note" box on the "Review Order" page to indicate the FREE T-shirt size(s) you want! Sizes M-XXL available. White T-shirts only.
At Electoral College Sportswear and Accessories, we sell unique, top quality T-shirts, sweatshirts, golf shirts, caps and gifts for those who take politics seriously--but not too seriously!
Go to theĀShop to purchase your own collegiate sportswear from America's Most Selective Four-Year Institution!
While you shop, take a peek in our Lecture Hall to learn what the "other" Electoral College is all about.
Connect with us for more political fun:
*** As seen on Yahoo! News!Ā***


text:
Beer dinner with top chefs on Feb. 25 will raise funds for veteran
The Best of Milwaukee Beer Dinners series -- which pairs food from top Milwaukee chefs with craft beer -- is back this month and raising funds for a badly injured veteran.
The veteran is a friend since childhood of Wolf Peach chef Daniel Jacobs. Sgt. Ed Matayka was severely injured in an IED blast in Afghanistan in 2010, which required the amputation of both legs. He also suffered a stroke as a result of the injuries. His rehabilitation continues, and he and his wife now are expecting twins. »Read Full Blog Post
Milwaukee Opera Theatre, Genghis Barbie rock the art song
Audiences at opera singers' recitals do not, customarily, pump their arms and cheer. Of course, singers at said recitals don't usually perform tunes by Queen and Guns N' Roses flanked by a quartet of female horn players, either.
Saturday evening's Milwaukee Opera Theatre presentation of Andrew Wilkowske in "Guns N' Rosenkavalier," directed by John Glover at the Wisconsin Conservatory of Music, was a riot of rule-breaking, genre-bending tunes from the worlds of art song and rock. »Read Full Article