text:
March 24, 2014
To help doctors give their patients the best possible care, the American Society of Clinical Oncology (ASCO) asks its medical experts to develop evidence-based recommendations about specific topics in cancer care. This recommendation is about the use of sentinel lymph node biopsy for patients with early-stage breast cancer. This guide for patients is based on ASCO's recommendations.
Key Messages:
- A sentinel lymph node biopsy is a surgical procedure that helps the doctor find out if breast cancer has spread to the lymph nodes.
- An axillary lymph node dissection may also be needed to learn more about how the cancer has spread and to remove cancerous lymph nodes.
- Talk with your doctor about what kind of procedures are recommended to diagnose cancer and what the results will mean.
Breast cancer begins when normal cells in the breast change and grow uncontrollably, forming a mass called a tumor. A tumor can be cancerous or benign. A cancerous tumor is malignant, meaning it can spread to other parts of the body. A benign tumor means the tumor will not spread. A cancerous tumor spreads when cells break off from the tumor and enter the body's blood or lymph fluid.
Lymph fluid flows through tubes called lymphatic vessels that drain into lymph nodes, which are the tiny, bean-shaped organs that help fight infection. Groups of lymph nodes are located in different areas throughout the body, such as under the arm and in the neck, groin, and abdomen. The lymph nodes can trap cancer cells that were traveling away from the original tumor before the tumor was removed during surgery. Knowing whether the cancer has spread helps the doctors determine the stage and approach to treatment. Because cancer that has spread to the lymph nodes may be treated differently than cancer that has not spread to the lymph nodes, it is important to find out whether any of the lymph nodes near the breast contain cancer. There are two ways to look for cancer in the lymph nodes near the breast:
Sentinel lymph node biopsy. When cancer spreads through the lymphatic system, the lymph node or group of lymph nodes the cancer reaches first is called the sentinel node. In breast cancer, these are usually the lymph nodes under the arms called the axillary lymph nodes. In a sentinel lymph node biopsy, often shortened to sentinel node biopsy, or SNB, one to three or more of the axillary lymph nodes are removed and examined for signs of cancer. Usually, if there is no cancer in these sentinel nodes it means the remaining axillary lymph nodes will not have cancer.
To locate the sentinel node, the surgeon injects a harmless, radioactive substance and/or a dye into the breast near the tumor. Sometimes, the injection is given under the areola, which is the darker area that surrounds the nipple. Then, the surgeon makes an incision under the arm and either follows the radioactive signal or finds the lymph nodes that are stained from the dye and removes them. A doctor called a pathologist will carefully examine the sentinel node(s) for signs of cancer. A pathologist specializes in interpreting laboratory tests and evaluating cells, tissues, and organs to diagnose disease.
Axillary Lymph Node Dissection. During an axillary lymph node dissection, most lymph nodes under the arm are removed and examined for signs of cancer. Because more lymph nodes are studied, the doctor may have more evidence of whether the cancer has spread.
In general, if you have early-stage breast cancer that can be removed with surgery and your underarm lymph nodes are not enlarged, sentinel lymph node biopsy is the standard of care. This includes the following situations:
- You have tumors in more than one location in the breast.
- You have a type of breast cancer called ductal carcinoma in situ (DCIS) and you are having a mastectomy.
- You have previously had breast surgery, surgery to the underarm or axillary area, or chemotherapy before surgery.
If cancer is found in your sentinel lymph nodes after the sentinel lymph node biopsy, the next step depends on the results:
- If only one or two sentinel lymph nodes have cancer and you plan to have a lumpectomy and radiation therapy to the entire breast, an axillary lymph node dissection is not needed. A lumpectomy, also called breast-conserving surgery, is the removal of the tumor and some surrounding healthy tissue.
- If you have cancer in sentinel lymph nodes and have chosen to have a mastectomy rather than a lumpectomy, an axillary lymph node dissection is an option.
A sentinel lymph node biopsy alone is usually not recommended for early-stage breast cancer in the situations listed below. Then, an axillary lymph node dissection is recommended.
- You have a large breast tumor or the cancer has spread throughout the breast
- You have inflammatory breast cancer
- You have DCIS and are planning to have a lumpectomy
- You are pregnant
What This Means for Patients
For many patients with smaller tumors, a sentinel lymph node biopsy is an appropriate procedure to determine whether cancer has spread outside of the breast and can be performed instead of an axillary lymph node dissection. The side effects of a sentinel lymph node biopsy and an axillary lymph node dissection are similar and include lymphedema, nerve damage, shoulder pain, and loss of mobility in the arm and shoulder.
Lymphedema is the abnormal buildup of fluid in soft tissue due to a blockage in the lymphatic system. For people with breast cancer who develop lymphedema, it usually occurs in the arm where the lymph nodes were removed. Although, the risk of lymphedema does not go away if you've had lymph nodes removed, there are steps you can take to lower your risk and manage lymphedema if you develop it.
Because the risk of lymphedema increases with the number of lymph nodes and vessels that are removed or damaged during cancer treatment, women who have a sentinel lymph node biopsy tend to be less likely to develop lymphedema than those who have an axillary lymph node dissection. Talk with your doctor about whether a sentinel lymph node biopsy is an option for you and the risks and benefits of this procedure compared with an axillary lymph node dissection. It is important to remember that your health care team will work with you to weigh your risk of the cancer coming back with any potential changes to your quality of life to make the best treatment decision for your specific situation.
Questions to Ask the Doctor
Consider asking your doctor the following questions:
- Do you recommend that I have a sentinel lymph node biopsy? Why or why not?
- Do you recommend an axillary lymph node dissection instead? Why or why not?
- What are the risks of the procedure you recommend?
- What is lymphedema? How can it be managed? What steps can I take to prevent or minimize it?
- Can you recommend an experienced surgeon to perform this procedure?
- When will I know the results? How will they be communicated to me?
- What further tests will be necessary if the results are positive (indicates cancer)? What if they are negative? What follow-up care will I need after the procedure?
- Will I have a surgical drain after surgery?
- What can I expect in terms of range of motion in my arm?
- Will I need to do daily exercises after surgery? Does exercise help lymphedema?
- What is a lymphedema sleeve? What is lymphatic massage? Will they help manage lymphedema?
- Where can I find more information?
More Information
Read the entire clinical practice guideline at www.asco.org/guidelines/breastsnb.
Buildup of Fluid or Lymphedema
Additional Resource


text:
Condition: 8/10
Color: Orange/Black
Upps: Trigger (have stock also), Eigenram
Known Problems: None
Asking Price: $220
Shipping options: USPS
Trades of interest: Ego, Mag
Location: Winnemucca, NV
What is included: Gun, barrel, grips
Usuall wear on the feed neck, front of the trigger frame by the reg. Really good overall condition.
Comes with barrel and grips, rest of the pictures are so you can see the condition of the marker.
Video shot Jan,16, 2012
Asking $220. Don't play anymore but if I saw the right Ego I might do a trade.
Ask any questions!
Edited by Mikey b, 16 January 2012 - 04:31 PM.

subset: commoncrawl


text:
view full screen
Style: 570068589
Out of Stock
Dual-movement hoops drop from a charmed black and white beaded chain to fill an open V-neckline. Drop Circle Earring and Circle Charm Bracelet match the necklace.
- Adjustable length 17.75"-19.75".
- Lobster claw clasp.
- Jet black faceted glass rondelles and twisted coin beads; white/silver foil beads. Rhodium-finish, nickel-free metal.
Read more… Read less…


text:
|By Cloud Best Practices Network
Article Rating:
|January 7, 2013 03:30 PM EST
Every year has threatened to be "the year of the Cloud" but my main prediction for 2013 IT industry developments will be that yes, this is the year that it cements its role as the most major of technology disruptions.
It's hard for Cloud to be defined in such a delineated manner, as it has been underway as a technology trend for many years, there is a wide spectrum of categories of what's involved which are all continually evolving and also customer adoption has also been underway for many to various extents.
So it's already been the Cloud for quite some time and so a bit late to make it the Year Of.
Probably the best context is Crossing the Chasm terms, where we can be thought of as still being in the Early Adopter phase of the cycle, while it is a large-scale, slow moving process.
Hence it could be considered The Year of the Cloud when we cross this chasm, when the mass market moves to also migrate the bulk of their IT systems. This scale of shift is what drives the analysts to start the describing the $$ many billions growth markets, and despite the various technical challenges we see now ultimately the trend is inevitable and so it's an investors paradise, really.
As Telus described in this news release last year here the primary concern users have about the Cloud is data security and compliance, and so we can see addressing this is the principle requirement for this large scale adoption.
So in short with this being a key area of the Cloud industry that will mature in 2013, combined with an already general ongoing acceptance and steady adoption, there will be an explosive accelerating effect that will propel progress across the chasm.
With an irrefutable capability to assure Cloud environments to meet regulatory compliance needs will provide the foundation that makes 2013 The Year of the Trusted Cloud.
For a more detailed discussion of this topic, check out our latest TRANSFORM e-magazine, which explores these Cloud Security best practices in detail, and how they might be applied to high-growth sectors like E-Health.
Read the original blog entry...
"We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 8, 2016 06:30 AM EST Reads: 1,110
Internet of @ThingsExpo has announced today that Chris Matthieu has been named tech chair of Internet of @ThingsExpo 2017 New York The 7th Internet of @ThingsExpo will take place on June 6-8, 2017, at the Javits Center in New York City, New York. Chris Matthieu is the co-founder and CTO of Octoblu, a revolutionary real-time IoT platform recently acquired by Citrix. Octoblu connects things, systems, people and clouds to a global mesh network allowing users to automate and control design flo...
Dec. 8, 2016 04:30 AM EST Reads: 730
With 15% of enterprises adopting a hybrid IT strategy, you need to set a plan to integrate hybrid cloud throughout your infrastructure. In his session at 18th Cloud Expo, Steven Dreher, Director of Solutions Architecture at Green House Data, discussed how to plan for shifting resource requirements, overcome challenges, and implement hybrid IT alongside your existing data center assets. Highlights included anticipating workload, cost and resource calculations, integrating services on both sides...
Dec. 8, 2016 04:00 AM EST Reads: 3,796
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 8, 2016 04:00 AM EST Reads: 1,045
Unless your company can spend a lot of money on new technology, re-engineering your environment and hiring a comprehensive cybersecurity team, you will most likely move to the cloud or seek external service partnerships. In his session at 18th Cloud Expo, Darren Guccione, CEO of Keeper Security, revealed what you need to know when it comes to encryption in the cloud.
Dec. 8, 2016 04:00 AM EST Reads: 4,814
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
Dec. 8, 2016 02:45 AM EST Reads: 1,298
The WebRTC Summit New York, to be held June 6-8, 2017, at the Javits Center in New York City, NY, announces that its Call for Papers is now open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 20th International Cloud Expo and @ThingsExpo. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web co...
Dec. 8, 2016 01:45 AM EST Reads: 1,409
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
Dec. 8, 2016 12:30 AM EST Reads: 1,135
The Internet of Things (IoT) promises to simplify and streamline our lives by automating routine tasks that distract us from our goals. This promise is based on the ubiquitous deployment of smart, connected devices that link everything from industrial control systems to automobiles to refrigerators. Unfortunately, comparatively few of the devices currently deployed have been developed with an eye toward security, and as the DDoS attacks of late October 2016 have demonstrated, this oversight can ...
Dec. 8, 2016 12:15 AM EST Reads: 1,359
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle's head unit, devices, and systems and to manage the ...
Dec. 7, 2016 10:30 PM EST Reads: 884
"Once customers get a year into their IoT deployments, they start to realize that they may have been shortsighted in the ways they built out their deployment and the key thing I see a lot of people looking at is - how can I take equipment data, pull it back in an IoT solution and show it in a dashboard," stated Dave McCarthy, Director of Products at Bsquare Corporation, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 7, 2016 10:00 PM EST Reads: 1,196
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, discussed the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Dec. 7, 2016 08:15 PM EST Reads: 2,230
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, will discuss how AI can simplify cloud operations. He will cover the following topics: why clou...
Dec. 7, 2016 05:15 PM EST Reads: 939
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
Dec. 7, 2016 05:15 PM EST Reads: 1,765
Everyone knows that truly innovative companies learn as they go along, pushing boundaries in response to market changes and demands. What's more of a mystery is how to balance innovation on a fresh platform built from scratch with the legacy tech stack, product suite and customers that continue to serve as the business' foundation. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, discussed why and how ReadyTalk diverted from healthy revenue and mor...
Dec. 7, 2016 04:30 PM EST Reads: 1,684
The many IoT deployments around the world are busy integrating smart devices and sensors into their enterprise IT infrastructures. Yet all of this technology – and there are an amazing number of choices – is of no use without the software to gather, communicate, and analyze the new data flows. Without software, there is no IT. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Dave McCarthy, Director of Products at Bsquare Corporation; Alan Williamson, Principal...
Dec. 7, 2016 04:15 PM EST Reads: 445
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
Dec. 7, 2016 03:45 PM EST Reads: 2,275
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
Dec. 7, 2016 03:30 PM EST Reads: 1,794
Successful digital transformation requires new organizational competencies and capabilities. Research tells us that the biggest impediment to successful transformation is human; consequently, the biggest enabler is a properly skilled and empowered workforce. In the digital age, new individual and collective competencies are required. In his session at 19th Cloud Expo, Bob Newhouse, CEO and founder of Agilitiv, drew together recent research and lessons learned from emerging and established compa...
Dec. 7, 2016 02:30 PM EST Reads: 951
"IoT is going to be a huge industry with a lot of value for end users, for industries, for consumers, for manufacturers. How can we use cloud to effectively manage IoT applications," stated Ian Khan, Innovation & Marketing Manager at Solgeniakhela, in this SYS-CON.tv interview at @ThingsExpo, held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 7, 2016 02:30 PM EST Reads: 4,329


text:
WASHINGTON, D.C. - As Memorial Day weekend approaches, 55 drowning and 63 near-drowning incidents in 29 states and territories have already been reported by the media in the first five months of 2011. The U.S. Consumer Product Safety Commission (CPSC) today kicks off the summer swimming season and the second year of its Pool Safely: Simple Steps Save Lives campaign. The Pool Safely campaign is a national public education effort to reduce child drownings and nonfatal submersion and entrapment incidents in swimming pools and spas.
CPSC's new statistics show:
- An annual average of 383 pool and spa-related drownings for children younger than 15 occurred from 2006 to 2008; about 76 percent of the reported fatalities involved children younger than five.
- An estimated average of 5,100 pool or spa emergency department-treated submersions for children younger than 15 occurred each year from 2008 to 2010; children younger than five represented 79 percent of these-injuries.
- Children between the ages of one and three (12 to 47 months) represented 66 percent of these fatalities and 64 percent of the injuries.
- About 72 percent of the fatalities from 2006 through 2008, and 55 percent of the estimated injuries from 2008 through 2010 that involved children younger than 15 occurred in a residential pool or spa; children under five made up the majority of incidents at residential locations, with 84 percent of fatalities and 61 percent of injuries, respectively.
- Tragically, based on reported statistics, 96% of victims involved in a submersion incident will die. Fatalities usually occur the day of the drowning event (72%). For the victims who survive the event, most will succumb to their injuries within a week (24%). Only 4% of near drowning victims will survive beyond a week, and many will have severe injuries and require intensive medical care.
- There were no reported entrapment fatalities for 2010. CPSC received three reports of entrapment injury incidents during 2010.
For the complete reports see: Pool and Spa Submersions 2011 (pdf) and Circulation/Suction Entrapments 2011 (pdf). The years for reported injury and fatality statistics differ due to a lag in fatality reporting.
"CPSC's new data show that the number of drownings and near-drownings involving children younger than five are still a serious public health issue," said Chairman Tenenbaum. "CPSC is committed to reducing the number of drowning and near-drowning incidents in swimming pools and spas in the country. The Pool Safely campaign and its partners encourage parents and children to take as many water safety steps as possible to help save a life."
"As a parent, I know how important it is that I take every precaution to ensure the safety of my children in and around the water," said Janet Evans, five-time Olympic medalist in swimming. "Whether it's providing swimming lessons, installing a pool alarm, or just keeping a close eye on them while they're in the water-all of these steps will help prevent an incident. Pool Safely has a simple, but important, message: adopt as many safety measures as you can in and around the water to protect your loved ones."
The Pool Safely campaign is a key part of the CPSC's efforts to carry out the requirements of Section 1407 of the Virginia Graeme Baker Pool and Spa Safety Act (P&SS Act), federal legislation signed into law in 2007, mandating new requirements for pool and spa safety. It includes a requirement for a national public education campaign designed to raise public awareness, support industry compliance, and improve safety at pools and spas.
"The City of Chula Vista embraces the Pool Safely campaign. We are honored to host the CPSC in kicking-off the summer campaign this year," said Chula Vista Mayor Cheryl Cox. "In southern California, we can swim almost year-round, so we understand how important it is to be vigilant about pool and spa safety. The CPSC's Pool Safely campaign is an effective public education campaign that encourages parents and children to be safe in and around the water every day."
The U.S. Consumer Product Safety Commission is charged with protecting the public from unreasonable risks of injury or death associated with the use of
thousands of types of consumer products under the agency's jurisdiction. Deaths, injuries, and property damage from consumer product incidents cost the
nation more than $1 trillion annually. CPSC is committed to protecting consumers and families from products that pose a fire, electrical, chemical or
mechanical hazard. CPSC's work to help ensure the safety of consumer products - such as toys, cribs, power tools, cigarette lighters and household
chemicals -– contributed to a decline in the rate of deaths and injuries associated with consumer products over the past 40 years.
Federal law bars any person from selling products subject to a publicly-announced voluntary recall by a manufacturer or a mandatory recall ordered by the
To report a dangerous product or a product-related injury go online to www.SaferProducts.gov or call CPSC's Hotline at 800-638-2772 or teletypewriter at
301-595-7054 for the hearing impaired. Consumers can obtain news release and recall information at www.cpsc.gov, on Twitter @USCPSC or by subscribing
to CPSC's free e-mail newsletters.
Please use the below phone number for all media requests.
Phone: (301) 504-7908
Spanish: (301) 504-7800
View CPSC contacts for specific areas of expertise
The link you selected is for a destination outside of the Federal Government. CPSC does not control this external site or its privacy policy and cannot attest to the accuracy of the information it contains. You may wish to review the privacy policy of the external site as its information collection practices may differ from ours. Linking to this external site does not constitute an endorsement of the site or the information it contains by CPSC or any of its employees.
Click Ok if you wish to continue to the website; otherwise, click Cancel to return to our site.


text:
While the state of Hawaii didn't suffer nearly as much as Japan, the tsunami damaged significant parts of the state, especially boat harbors across the islands.
Two years after the March 11, 2011 tsunami, there are some places that have transformed, while others remain the same.
Hours after the tsunami struck the coast of Japan, the quick rise in water level across the islands moved hundreds of boats back and forth and ripped them off its moorings.
"My finger pier was totally gone," said Michael Bryan.
The Keehi Marine Center, lost more than 140 slips.
Nearby, the Keehi Small Boat Harbor, the state's second largest facility, lost 40 slips.
More than 25 vessels sunk to the point of no return, as the tsunami caused more than $2 million in damage in the harbor.
"All docks had to be removed and we rebuilt pile caps," said Department of Land and Natural Resources Director William Aila.
The Department of Land and Natural Resources received nearly $1.5 million in federal aid, while the state paid approximately 25% of the cost to fix the harbor.
"About 95 percent of reconstruction of the 800, 900, and 1000 piers have been completed already. We're finishing up the electrical or water lines to those areas now," said Aila.
But many boaters aren't happy about the amount of time it's taken to fix the piers.
"Hopefully they'll get to these two piers that were damaged during the tsunami. They haven't touched them since then. Hopefully, they'll try to get these up like the other ones," said Bryan.
While some harbors have been transformed, other landmarks like the Kona seawall remain unrepaired because of permitting issues.
There's also the problem of dealing with tsunami debris that continues to wash ashore the vast coastlines.
"Our concern is about the large items floating around, items come ashore with unknown contents," said Aila.
DLNR says none of the confirmed pieces of tsunami debris have tested above the normal levels for radiation.
As for the new boat docks, they're expected to last 45-to-65 years.


text:
Democrats make list for session, check it twiceBy Neal P. Goswami
VERMONT PRESS BUREAU | December 20,2013MONTPELIER Senate Democrats agreed Thursday that oversight of the states online health insurance exchange and tackling problems with mental health care in the state are top priorities for the upcoming legislative session right behind crafting a budget that closes a $70 million gap and helps create jobs.
The caucus, which boasts 23 of the 30 members of the Senate and easily controls its agenda, gathered at the Capitol Plaza Hotel to wrangle over the priorities of its members. Some potential fault lines emerged, especially over the states energy policy.
Senate President Pro Tem John Campbell, from Windsor County, was optimistic that the projected budget shortfall could be overcome without significant harm to the states most vulnerable populations.
We probably will be able to find ways to address some of that without relative pain. However, it is going to be a very challenging session, extremely challenging, he said.
Orange County Sen. Mark MacDonald expressed frustration over dealing with budget shortfalls year after year in the same manner cutting programs and services. Lawmakers have seen this movie five times in which low- and middle-income Vermonters lose ground, he said.
I think each and every one of us is very frustrated because we are watching it happen before our very eyes and we appear hopeless in how we as a state Legislature can make a difference, MacDonald said.
Democrats, who have held majority status in both the Senate and House chambers for several years, cannot continue to just argue that it would be worse under GOP control, MacDonald told the caucus.
I dont know how many years in a row we can do that, he said. I think its cast a pall upon each one of us that ... think that the script has been written for us.
Median income is lower now than it was a decade ago, said Sen. Anthony Pollina, of Washington County. He urged colleagues to consider how raising incomes can help generate more state revenue and close the budget gap.
Jobs are not going to be created just because we talk about them, Pollina said.
Lawmakers, who will reconvene Jan. 7, have largely been watching from the sidelines as the states health exchange, Vermont Health Connect, stumbled out of the gate Oct. 1. Some components, including the ability to accept online payments or enroll small businesses directly, remain elusive.
Campbell said the problems are mostly related to software and will be fixed.
There are people who are going to try and take that and theyre going to try and embellish that, he said.
To them I say, You know what? Youve never shown us any other way, No. 1, Campbell said. No. 2, what were doing is required by the federal government, and, No. 3, I think were doing a hell of a job despite the problems that were facing.
The caucus also listed a shoreline bill and cleaning up lakes and waterways as top priorities, along with labor and workforce issues.
The labor issues including paid sick leave, which could emerge as one of the most controversial issues for lawmakers. Tackling rapidly rising state costs to maintain pensions must also be addressed, Campbell said.
The state could harness the success of recent college graduates developing applications for smartphones and tablets, Campbell said.
Energy, which was not listed among the top six priorities, quickly became a hot-button issue at Thursdays meeting. Sen. John Rodgers, of Orleans County, who reiterated his opposition to large-scale wind projects, urged his colleagues to rewrite the states energy policy.
Citing a recent Massachusetts Institute of Technology study, Rodgers said the wind industry produces as much or more radioactive material as the nuclear industry but just 1.5 percent of the power.
Rodgers argued that wind turbines require rare minerals mined in China that are largely controlled by vicious gangs. And the mining is destroying farmland, he said.
Is that OK to pollute their environment to produce so-called green energy here? he said. Its not nearly as green as the industry would like us to think.
Senate Democrats also want to address the states food stamp program, 3SquaresVT, which is facing fines from the federal government because of payment errors. And they want to look at raising the minimum wage, creating a state bank and the rising problem of Vermonters abusing opiates and heroin.
Gov. Peter Shumlin addressed the caucus and touted areas of success, including the fifth-lowest unemployment rate in the country. He said states ahead of Vermont are involved in the coal and oil industries and are destroying the planet while theyre at it.
The states that are beating us have some advantages, he said. If they didnt have those assets, wed be beating all of them.
Shumlin asked the caucus to help with plowing the ground in the upcoming session for the single-payer health care system his administration plans to introduce in 2015. He noted tough issues lawmakers have faced in the past, including civil unions, same-sex marriage and the states education funding system.
Votes on a universal, single-payer health care system will be tougher, Shumlin said.
Those lifts will be relatively easier compared to what Im going to ask you to do in 2015 a publicly financed, sensible, affordable health care system, he said.
Shumlin said his administration will provide lawmakers options on how such a system will be paid for.
We must, together, figure out the smartest way, the most equitable way, to finance this opportunity, he said. We will come to you with plans. Weve got a great team thats going to give you all the options. What I ask you to do is spend some time this winter plowing the ground because you cant make these changes in a day, in a week or in a month.
The governor also said he will present his own plan on how the state can address drug abuse.
I promise I will come to you early in the session with things that I think will help, Shumlin said. I cannot think of an issue where the stakes are higher and where we are losing so badly so quickly.
Shumlin also promised to work better with lawmakers in his own party than last year, when some of his policy ideas caught lawmakers by surprise and drew little support.
I know that there were times last year where we didnt always agree, Shumlin said. I can tell you with conviction that when I dont get along with the people I love it bothers me. And I look at it and examine it.
He added, Despite what they say about me, I do have the ability to reflect, I do have the ability to learn, I do have the ability to grow.
It was clear that some policy areas would see no new agreement, though.
Sensing an opportunity, Rodgers asked Shumlin to identify places where he thought wind power was inappropriate in the state.
I love you, Rodgers, but no, were not going to agree on wind, Shumlin replied. I dont think were going to debate this in a way that Im going to change your mind or youre going to change my mind.
neal.goswami @timesargus.comMORE IN Vermont NewsMONTPELIER Rep. Peter Welch, D-Vt. Full StoryVermont Attorney General Bill Sorrell plans to join the U.S. Full StoryMONTPELIER Gov. Full Story
- Most Popular
- Most Emailed


text:
A cure for cabin fever: The Great Backyard Bird Count
February 9, 2012 —
About this time during the winter, many people yearn for spring; it's cold, the holidays have passed, and trout and spring gobbler seasons are many weeks away. Fortunately, there is an event coming up real soon that the whole family can participate in, and in doing so, can also provide scientists and researchers with a real-time snapshot of which birds are where. The event is the 15th annual Great Backyard Bird Count (GBBC).
A joint project of several U.S. and Canadian partners, the GBBC is a four-day count that takes place from February 17 through 20. Anyone can participate, and you don't have to be an expert birder; just report the species you know. You can count for as long as you like, or just count for 15 minutes on a single day. You can travel far afield, or just look out your back window at the bird feeder for birds. Bird feeders will likely draw in birds that would normally be harder to find in the field.
Instructions for conducting the count and data submission can be found at www.birdsource.org/gbbc. As the count progresses, real-time updates will be posted on that site of what species of birds are where. Archives of past years' results can also be found there for comparison. This year's upcoming count may yield some interesting sightings with the milder than usual winter so far. A few turkey vultures have been spotted in the region in the past month, and the irruption of snowy owls that is taking place this winter holds some potentially tantalizing sighting opportunities for GBBC 2012.


text:
Some debates are harder to watch than others. Take a look back at 12 cringe-worthy moments in debate history.
Ford's Communism Conundrum -- Gerald Ford stumbled in a 1976 debate with Jimmy Carter when he said there was no Soviet Union domination of Eastern Europe at the time and "there never will be under a Ford administration." When asked to clarify, Ford dug an ever deeper hole, saying each of those countries was independent and autonomous.


text:
In the market for a new ride? Starting today you can bid On 'Air Force One'. Learn about the plane up for auction as well as other Presidential transportation through the years here
Iconic Presidential Modes of Transportation
Published On: May 15 2013 03:09:04 AM HST Updated On: May 15 2013 03:10:01 AM HST
The views expressed are not those of this site, this station or its affiliated companies. By posting your comments you agree to accept our terms of use.blog comments powered by Disqus


text:
"I found Catholic Answers Live, and was engaged immediately. 'Hooked' is the right word. I was astounded at the things I had mis-learned. God bless you and I hope you never go off the air."
"If the pope is rejected, it follows that not one bishop, but the whole episcopate threatens to fall."


text:
It appears the page you have requested is either out of date or no longer exists.
If you typed in the address to get to this page, make sure your spelling is correct.
Try searching again or look within the top categories and latest deals below.
Alternatively, please contact us on 1 800 930139 or email email@example.com.
Payment Methods
Misco partners
Register to receive offers
Misco rent, sell or share your email address with third parties. View our privacy policy
© Copyright 2015, Misco Ireland Limited, registered in Ireland,
Registered office address: 39/40 Upper Mount Street, Dublin 2.
Registered number: 427492.
VAT number: IE 9580326A.
MISCO is a registered trademark of Misco UK Inc. All others trademarks and copyrights mentioned herein are the property of their respective owners.
All prices mentioned (euros) exclude postage and packaging. All orders to Misco terms and conditions.
price after manufacturer mail-in cashback, Cashback amount illustrated includes VAT. Restrictions apply.


text:
"I listen to Catholic Answers Live via the internet all the time. Your show is truly edifying! You always present our great Catholic Faith in a clear and concise manner. Indeed, you speak the truth in love. Thank you for all that you do. Keep fighting the good fight!"
"We call sacred orders the deaconship and priesthood, for we read that the primitive Church had only those orders."


text:
OpenBSD's PF packet filter has grown in power and appeal since its introduction in OpenBSD 3.0. With the imminent release of OpenBSD 3.5, Federico Biancuzzi interviewed several leading OpenBSD developers for their thoughts on PF and new features.
This is Part 1 of a two-part series. BSD PF Developers Interview, part two is also online.
Federico Biancuzzi: Can you give us a short introduction about yourself and your role as open source developer?
Daniel Hartmeier: I'm 29 years old and live near Zug in Switzerland. I dropped out of university after the first year and am working as programmer since. Unmarried, no kids, two cats.
It was around November 1999 when I installed OpenBSD (2.5 by then) for the first time. I was working at a small company and we were looking for an OS to use as an Internet gateway. I didn't have much prior experience with Unix, but after a while, that gateway handled most network services we needed. Since then, I run OpenBSD on all servers and desktops I use.
Henning Brauer: Well, I am 25, running an ISP here in Hamburg/DE, mostly doing infrastructure, server- and backend-stuff, and, of course, and unfortunately, some administrivials.
I've been an OpenBSD developer since sometime early in 2002, doing a lot of stuff in pf (biggest single thing was the altq merge I lead and did big parts of myself); Apache maintenance in our tree, where I wrote the chroot extensions as well; various stuff in the network area from NIC drivers to ip layer, and so on, as well as various userland stuff.
Mike Frantzen: I live outside Washington D.C. where I enjoy the biking and hiking trails. I'm an engineer at NFR Security working on its intrusion detection system, where I tell my boss that I browse the web all day long. I hack on OpenBSD in my copious lack of spare time.
Cedric Berger: I'm 34 years old and live in the French-speaking part of Switzerland, near the city of Neuchatel. Five years ago, I went to California with my wife in the hopes of improving my English skills, and after nine months there I started to work for Wireless Networks, Inc., a startup company that currently provides wireless B2B services for the banking industry.
There we developed a little wireless router, and we decided to use OpenBSD TCP/IP stack in it because it was, at that time, the only free OS that had decent IPSec support. So, besides doing hardware design, network/database design, and everything else you'd have to do in a startup, I extracted part of OpenBSD kernel and ported it to a real-time kernel on an ARM processor. This is how I got involved with the Unix world.
Two years ago I came back to Switzerland, when my wife was expecting. I still work for Wireless Networks as a consultant, and when I'm not hacking or babysitting, I like hiking and skying, like the average Swiss person. :)
Ryan McBride: When I wear a suit, I'm an information security consultant; nowadays, I'm just an open source software addict trying to get my daily fix. I currently live in the woods near a small town north of Vancouver, Canada, so when I'm not working on OpenBSD things I'm likely outside chasing deer from my garden or chopping firewood.
Can Erkin Acar: I am 32 years old and I live in Ankara, Turkey with my wife Zeynep. I have (finally) completed my PhD work last June and got married in July. I have been the network administrator of the department during my graduate studies, and now I am working for a network security company.
Federico: How did you join OpenBSD?
CB: I've used PF since 3.0 in an environment where I need to filter thousands of IP addresses individually, and that configuration was not handled very efficiently with early version of PF. So, two years ago I started to think about the table extension and wrote a working prototype of the "table" feature in December 2002. I submitted it to the PF mailing list, most people liked it, and I got invited to join the OpenBSD developer team by Daniel and Theo.
HB: Well, I was using OpenBSD for quite some time at work, and at a certain point the time had come to get more involved. In my case that is strongly related to pf; I apparently was the first one who tried to use pf in a major setup after 3.0 was released. It didn't quite work out, so I had a longish debugging session with Daniel. Turned out I had triggered a bug in an error path in pf, but it took us weeks to find out. After posting my results to misc@ I got this mail from Theo...
MF: Dug Song tricked me! Bad Dug. I wrote a firewall called mongoose for fun during a break from university. A year later OpenBSD dropped IPF in a copyright dispute and Dug invited me up to the MIT hackathon. We rightly chose to go with Daniel's PF for a replacement firewall which was more complete than mongoose and mine had a bunch of portability cruft to let it work under both OpenBSD and Solaris (hey, I like sparc gear).
RM: I've been involved with OpenBSD as a user since 2.3 or so; As far as development... When PF was first added to the tree, I was not working full-time and had been playing around with IPv6. I decided that PF should support IPv6, and the in keeping with the "shut up and hack" motto of OpenBSD development, I sat down and wrote it.
CEA: While searching for an operating system that would replace our Netware servers at the department, I installed OpenBSD 2.7 and instantly felt at home. I was thrilled by pf and subsequent pace of development and started using it immediately. Felt the need and wrote pflogd, and it was imported in to the tree. Also wrote pftop, a state visualization tool, and contributed some minor fixes and improvements to pf. I was invited to the last hackathon by Henning and became a developer.
I am mostly working on userland tools these days, especially privilege separation. There is too much to explore/learn and hack and very little time.
DH: In short, there was a dispute over IPFilter's license (we assumed it had a BSD license, Darren Reed said he never granted the right to distribute modified versions, which is what OpenBSD wanted), and Theo removed IPFilter from OpenBSD after 2.9 was released. I had some spare time and wanted to give it a try. I think it came as a surprise to everyone involved that pf was working so soon and got imported into CVS. Looking back, I'm grateful for the license argument, as I doubt there would have been enough motivation to replace and, eventually, surpass the existing code otherwise.
Federico: What PF parts have you worked on from 3.0 to 3.4?
HB: All.
For a lot of stuff in pf, there is a leading developer, the one who had the idea, or who started working on what was obvious. The result however is in almost all cases a joint effort.
That said, the biggest subproject I did in pf was the altq merge — again, a joint effort, without kenjiro laying the grounds from altq's side, theo's visions and quite some help from daniel this would not have worked. At the last hackathon I did the tagging stuff, which is very powerful. Over the time I did a [lot] of work in the parser, bringing more flexibility to the language, and learned to love yacc while doing so. And much more, but I don't remember everything offhand ... it's been some time and a lot of changes.
Related Reading
BSD Hacks
MF: The TCP state engine (shamelessly based on Guido van Roij's). The scrubber/normalizer which fits right in with the IDS I work on professionally (err, all the web browsing I do at work). The passive fingerprinting. Making fun of Henning and how little beer he can drink.
RM: After the IPv6 work, I added support for multiple translation or routing target addresses, which allows PF to do various types of load balancing of connections; it makes possible things such as using a PF firewall with two different ISP's, or balancing incoming http traffic against multiple web servers. But besides adding new features, I've done a fair bit of work cleaning up and simplifying the internals. I always feel best about my commits which result in a net reduction in the pf codebase.
CEA: I have written the pflogd pre 3.0 and improved the original (binary) log format of pf logs. What started as a project to safely parse pflogs for generating ASCII logs resulted in security extensions to bpf (berkeley packet filter which is used for capturing packets from the net and reading the pf logs) and privilege separation of pflogd, and tcpdump.
Federico: The 3.4 release page shows five new features. How does each one work?
Packet tagging (filtering on tags added by a bridge based on MAC address).
HB: Well, packet tagging allows you — as the name
says — to add a "tag" to a packet, and read it out later on. Basically,
that's it. It is so simple, and that is what makes it so powerful. You can use
tags to express trust relations between interfaces (tag
int1 on
int1, and allow all packets with this tag out on
int2 unconditionally), you can use tags to split classification
and policy (tag packets so you end up with several "groups", where each group is
one tag, and do the pass/block decision based on tags only), and you can even
tag from outside pf — that's what i did for the bridge filters, we can
tag packets from there as well, based on mac address for example.
Stateful TCP normalization (prevent uptime calculation and NATdetection)
MF: Stateful TCP normalization is a set of techniques to remove or resolve ambiguities in network traffic. One of the techniques most important to the average user is TCP timestamp modulation. Most operating systems with high performance networking include a timestamp in every TCP packet.
Since that timer starts ticking when the machine was booted, a server (or anyone in between) can look at a packet and know the machine's uptime. An attacker could look at a machine's responses to know it hasn't been rebooting since the last patch came out so it is probably still vulnerable. Alternately a stingy internet service provider that charges extra for home networks can look at all of the timestamps coming from a link and count the number of NATted machines by the number of unique timestamps. The PF firewall can scramble both uptime calculation and NAT detection by modulating the timestamps with a random number. There are a variety of other normalization techniques done and others still in development.
Passive OS detection (filter or redirect connections based on source OS).
MF: Passive operating system fingerprinting has been suprisingly controversial feature. The underlying premise is that various operating systems' TCP stacks have evolved and diverged in different ways over the years. The firewall can look at packets and determine which operating system they came from by looking at those differences. Not only can it differentiate between Linux and Windows, but it can tell between Linux 2.2 and 2.4; it can even determine if you're using Opera. The integration into the firewall allows the administrator to filter or redirect connections based on the operating system of the client. Your enterprise has phased out Windows 98? Redirect them to a web site telling people to upgrade to a newer version (or a free Unix *hint* *hint*). Hate SCO? Redirect all SCO Unixware/OpenServer connections to a web page rant. Find email worms annoying? Block mail that came directly from Windows machines instead of going through a UNIX mail server. Getting slashdotted? Give Unix web browsers a larger share of the bandwidth than non-Unix users. Passive OS fingerprinting in PF has been my gift to BoFHs everywhere ;-)
SYN proxy (protect servers against SYN flood attacks).
DH: When a TCP connection is established, the so-called TCP handshake takes place. The source of the connection sends a SYN packet, the destination replies with a SYN+ACK, and the source replies with an ACK. After that, the TCP connection is established, and both peers can send data.
A malicious party can cause a denial of service (DoS) attack by sending large amounts of TCP SYN packets to a server, while picking random fake source addresses (spoofing). The server will send SYN+ACK replies to the random source addresses and wait for the handshake to get completed by an ACK. But the recipients of the SYN+ACKs have never sent the SYN which initiated the handshake, so they will either reply with an RST or not reply at all. In both cases, resources are allocated on the server. Though this is only temporary, the server can suffer to varying degrees of the resource starvation caused by a significant flood of SYNs. Not all operating systems deal with this optimally, some may even become completely unresponsive.
pf's synproxy sits in between the vulnerable server and potential attackers (usually in form of a border firewall). Instead of forwarding TCP handshake packets as they are seen (when they are valid and allowed), the synproxy intercepts the SYN packet and first completes the TCP handshake itself with the source peer. Afterwards, it replays the SYN with the destination peer, completing the handshake itself again. Once the handshake is completed with both peers, further packets are forwarded as usual.
This has little impact on legitimate connections, but in case of the attack described above, the first handshake will never complete (as the true sender of the spoofed packet will not see the SYN+ACK, and the recipient of the SYN+ACK does not expect a connection). Before the first handshake is completed, no packet reaches the protected server. The attack can no longer allocate resources on the server. Instead, the resources are allocated on the firewall, which is built with this case in mind and can withstand such attacks more gracefully. In short, synproxy takes the burden of a SYN flood attack off the real server.
The way synproxy is implemented in pf causes no additional resource allocation, when filtering statefully. A state entry (created on the initial SYN packet) already contains sequence numbers modulators (used to randomize initial sequence numbers, another feature of pf), which is all the synproxy needs. No additional connection tracking or SYN cookies are needed. And all existing features dealing with state table size (adaptive timeouts, limiting state entries created from specific rules, etc.) can be used to address attempts to starve resources on the firewall.
Adaptive state timeouts (prevent state table overflows under attack)
HB: That is easy — we can scale the state timeouts down based on the number of current states. It helps fighting state table exhaustion.
When your state table is completely full (i.e., you hit the states limit),
no new connections are possible. Thus, you really want to prevent this. Now,
when you don't have many states in the table, you might want to run with the
"normal" timeouts (set optimization normal). The closer you get to the state
table limit, the more agressive you want to be about timing out old states to
prevent the said state stable exhaustion. This is exactly what adaptive state
timeouts are for. One you hit the
adaptive.start number of states,
pf starts to scale down timeouts — the closer you get to
adaptive.end, the more.
Federico: Mike, how did you get the idea to include p0f features in PF?
MF: One of my coworkers, Greg Taleck, added p0f features to NFR's IDS to resolve traffic abiguities. And then a damn SMTP worm hit. That annoyed me and I wanted to filter all Windows boxes from connecting to my mail server for the duration of the worm. So I talked to Michal Zalewski who wrote p0f v1 and he was cool with integrating p0f into PF but the guy who had been maintaining p0f never responded to relicense the fingerprints. Michal then started p0f v2 which was not encumbered with the maintainer's copyright; I got it working in PF; and then blocked all Windows boxes from connecting to my mail server for the duration of the worm. Hurray! Never underestimate the annoyed developer.
Federico: What are you working on for 3.5?
MF: Working on brewing my own beer. Made a pretty good boston style ale, needed a little more hopping though. A golden ale is next. Theo has been calling me a nasty hobbittsesss lately too, so I've been working on growing hair on my feet. Hopefully, I'll get back to TCP scrubbing and normalization in time for 3.5.
HB: well, the focus this time is obviously
bgp, the Border Gateway Protocol, is what ISPs speak to each other to
announce reachability of their networks through certain paths. A bgp daemon
announces its own networks to its neighbors, and its neighbors announce their
networks and all networks including the paths to reach them they learned from
their respective neighbors. In the usual so-called full-mesh setup that results
bgpd having a table of about 130 thousand networks (prefixes),
and multiple paths to reach each. Of those it picks the "best" path (the
algorithm for that decision is actually rather easy), and enters the resulting
route into the kernel routing table.
Now, that is a bit more complicated than described here, and it is quite obvious that keeping these huge tables and working on them with reasonable performance is not that easy.
There are a few more or less free bgp implementations, but they all have
major design flaws, and the resulting runtime problems. As I've been bitten by
those I was considering doing a
bgpd for some time, but was a bit
scared by the projects size. When I was in Calgary in September I finally
talked to theo about it who tricked me into starting coding. Back in Germany I
finally did mid-November, and much to my surprise I had a fully working bgp
session engine, fully implementing the Finite State Machine described in RFC
1771 as core, withing 9 days, and had sessions established and hold up to other
bgp speakers. We found a few bugs later, but it is basically still what I had
then. I talked to a few people and showed code, and fortunately, Claudio Jeker joined. He did an incredible amount of work implementing what we call the RDE,
Route Decision Engine, that holds the tables of prefixes and paths. At the same
time I started working on the code to interface the kernel routing table, which
includes holding an internal view of it.
Well, nowadays we are feature complete for the basics.
We have no showstopper bugs we are aware of, heck, I am not aware of any bug
right now (tho', let me assure you, there are a few). We learn routes, sync the
one picked as best into the kernel routing table, can send them to our
neighbors, and can announce our own networks. We have a control utility,
bgpctl, too, which can be used to gather and show run-time data,
take single sessions up/down, reload configuration, etc. And we have something
that I have not seen anywhere before: we can couple and decouple the internal
view from the kernel routing table.
So you can start up decoupled, adjust your settings while evaluating the
internal view of the routing table, and then, after you are satisfied, you can
issue a
bgpctl fib couple and the routes enter the kernel. In the
same vein a
bgpctl fib decouple removes them again, leaving the
kernel routing table as it was before coupling. Oh, and opposed to the other
bgpd notices when you statically enter routes to
the kernel routing tables and doesn't mess with them. It even tracks interfaces
showing up and being removed at runtime like it is possible with PCMCIA and
USB-based ones, and cloneable devices like
tun and
vlan. For most Ethernet devices it can even notice when you pull
the cable (or the link gets lost for other resons) and react accordingly.
bgpd is 11500 lines of code as of tonight, of which about 500
are manpages. And it is very fast...
CB: I'm working on many little enhancements in the way PF deals with interfaces.
That includes better support for dynamic/cloneable interfaces, the ability to lock states to a single or group of interfaces, better handling of interface aliases and other related things. I believe there was 12 little points to the commit message. :)
RM: I've been mainly working on the components necessary to deploy OpenBSD in high availability and load balancing configurations, including the Common Address Redundancy Protocol (CARP), which handles IP address failover, and pfsync enhancements which synchronise state between two or mosynchronizes. I also added source ip tracking, which keeps track of states by source IP address, but this work was actually done before 3.4, at the hackathon in Calgary.
CEA: As you may have noticed, I have moved away from pf to
privilege separation and bpf. Already worked on privsep for named in 3.5, and
now there is at least the DHCP tools waiting for privilege separation. Henning
is already working on
dhclient. If I can find some time, I want to
design some kind of framework for developing userland proxies.
Federico: The OpenBSD 3.5 release page lists six new PF improvements. Could you each explain your own work?
Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state).
CB: This change ensures that when you type
pfctl -f
pf.conf, then the entire content of
pf.conf will be loaded
into PF kernel memory, or nothing at all if there are errors. Before that
change, it was possible in rare circumstances that only half of the
pf.conf ruleset would be loaded inside the kernel.
So for example, you could have the new RDR rules loaded, but not FILTER rules.
Or, if your main
pf.conf contains
load anchor
entries, and some of the anchor files had a syntax error, then only part of the
anchors would be loaded.
This change does not bring any new functionality to PF, but it makes
pfctl -f more reliable in case of errors (syntax errors,
pfctl gets
kill(1)ed, not enough memory is available,
A 30% reduction in the size of state table entries.
RM: Basically I found a little trick of storing the tree indexes inside the state structure, rather than having separate tree nodes that point to the state structure. It's actually a pretty obvious thing in retrospect, but nobody had really considered it. For the end user, all this means is that they can have more states in the same ammount of memory.
Source-tracking (limit the number of clients and states per client).
RM: Source IP tracking allows you to create an entry for the source of connections and link states to it. This is useful for a number of reasons: first, it allows you to use a round-robin address allocation mechanism for translation or redirection, but ensure that the connections for a particular client are always mapped the same way. This functionality is important for some applications or protocols which rely on source address for identification, or in the case of server balancing, where the application keeps state across multiple connections, so the client must always connect to the same server.
Second, it allows you to set limits on how many distinct sources can connect to a service, and how many simultaneous connections each source can have. This can be used to connection limit internal clients, or mitigate certain kinds of denial-of-service attacks.
Sticky-address (the flexibility of round-robin with the benefits of source-hash).
RM: When sticky-address is enabled, we create source-tracking entries for each source ip address, and states are associated with it. In this entry, we store the translation address that was selected by round robin, and the subsequent connection from this source, which hits the nat or rdr rule, will get this translation address rather than the next round-robinaddress. The source-tracking entries last at least as long as there are states associated with it, plus an additional configurable lifetime.
So if you're redirecting traffic to a pool of web servers, and the first time a client connects, they get redirected to server 4, all connections afterward from that client will hit server 4, so long as the source-tracking entry exists.
This is very similar in behaviour to source-hash, except it removes the restriction that the pool must be specified as a CIDR netblock; it can be a list of addresses, including network blocks, or more powerfully, it can be a table.
Invert the socket match order when redirecting to localhost (prevents the potential security problem of mis-identifying remote connections as local).
DH: It is common practice to redirect incoming TCP connections to local daemons using pf, for instance to force HTTP connections through a proxy, or to redirect spam to a tarpit.
Often, the daemon was bound to 127.0.0.1 and the redirection used 127.0.0.1 as replacement destination. While using the loopback address is convenient in such cases (it's always present), that can have security implications.
Many daemons assume that the loopback interface is isolated from the real network, i.e., that connections to sockets bound to 127.0.0.1 are local, and may grant some privileges based on this assumption.
pf redirecting foreign connections to the loopback address is violating that assumption, now suddenly foreign peers might be able to connect to daemons listening on loopback sockets.
To deal with this potential risk, the network code has been changed so that foreign connections to loopback addresses are first matched against listeners on unbound sockets (listening on any address). Only if no such socket is found, the connection is matched against a specific loopback listener.
So, if you're running a daemon listening on both 127.0.0.1 and
ANY, and use pf to redirect external connections to 127.0.0.1,
these connections will now connect to the
ANY socket, instead of
the 127.0.0.1 one, where the daemon might wrongly assume a local
This problem only occurs with daemons that follow this pattern (listen on 127.0.0.1 in addition to other addresses, treat 127.0.0.1 as privileged local connections), many daemons are don't.
Significant improvements to interface handling.
CB: Let's look at the commit message, since it describes things pretty clearly:
1) PF should do the right thing when unplugging/replugging or cloning/destroying NICs.
2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in.
3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all".
4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers.
5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour.
pass in from www.openbsd.org:0 will only select the first IP
returned by resolver, while
pass in from www.openbsd.org will
select all IPs. Similarily,
pass in from fxp0:0 or
pass in
from (fxp0:0) will not take into account address aliases on
6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)".
pass [...] from (ifspec) is now equivalent in all
cases to
pass [...] from ifspec, except that the
ifspec -> IP address resolution is done in the kernel, i.e.,
will adapt automatically to interface address changes (dhcp, hot plug removal,
7) Scrub rules now support the !if syntax.
scrub in on !fxp0 now works.
8) States can be bound to the specific interface that created them or to a group of interfaces for example:
pass all keep state (if-bound)
pass all keep state (group-bound)
pass all keep state (floating)
9) The default value when only keep state is given can be selected by using the "set state-policy" statement.
if you put
set state-policy if-bound then all rules declared
keep state like
pass out on fxp0 keep state will
be if-bound.
10) "pfctl -ss" will now print the interface scope of the state.
Another piece I wrote on the pf@ mailing list gives a few more details about state binding.
Federico: The 3.5 presentation page says "Interface 'cloning', accessed by
ifconfig(8) commands create and destroy. For example,
vlan100 create'." How does it work?
HB: That's a very cool addition. Let's take vlan, for example.
Previously, you had a fixed number of vlan interfaces in your kernel config. If you needed more, you needed a new kernel and a reboot. Now, you don't have any vlan interface by default — but the kernel has a "template". You create the interfaces as needed on the fly. So, when you configure you first vlan, you could do something along
# ifconfig vlan0 create
# ifconfig vlan0 vlan 100 vlandev fxp0 192.168.0.1 up
Of course, you can collapse those into one, but it is even nicer: ifconfig creates the interface for you when you configure it, without an explicit create:
# ifconfig vlan0 vlan 100 vlandev fxp0 192.168.0.1 up
is sufficient. When you don't need the interface any more, you just destroy it, and it is gone:
# ifconfig vlan0 destroy
Federico: The 3.5 presentation page says "authpf(8) now tags traffic in pflog(4) so that users may be associated with traffic through a NAT setup." How does it work?
DH: This is best explained with the example in the authpf(8) man page. You can use the following in authpf.rules (the ruleset which is loaded for each user who authenticates)
nat on $ext_if from $user_ip to any tag $user_ip -> $ext_addr
pass in quick on $int_if from $user_ip to any
pass out log quick on $ext_if tagged $user_ip keep state
Nothing special about the usage of tag/tagged here, except that we use a macro that gets expanded to the user's IP address, for instance NATed connections from 10.1.2.3 get tag 10.1.2.3.
The point of adding a unique per-user tag on the internal interface is so that we can pass connections on the external interface, after translation, with a unique rule as well. Without tags, connections from different source addresses would all pass by the same rule on the external interface.
The reason for this construct is that tcpdump on pflog0 shows anchor and ruleset name of the rule that created the matched state, and the ruleset name conveniently contains the user name and pid of the authpf process authenticating the user, for example
# tcpdump -n -e -ttt -i pflog0
Oct 31 19:42:30.296553 rule 0.bbeck(20267).1/0(match): pass out on fxp1: }
18.104.22.168.60539 > 188.8.131.52.22: S 2131494121:2131494121(0) win }
16384 <mss 1460,nop,nop,sackOK> (DF)
bbeck part is the name of the user that created the
connection. This information can be used for logging, accounting or
Federico: Finally, OpenBSD introduced new tools for filtering gateway failover. Quoting from the 3.5 presentation page:
1) CARP (the Common Address Redundancy Protocol) carp(4) allows multiple machines to share responsibility for a given IP address or addresses. If the owner of the address fails, another member of the group will take over for it.
Ryan, could you explain the new Common Address Redundancy Protocol (CARP)?
RM: The Common Address Redundancy Protocol allows multiple hosts to transfer an IP address amongst each other, ensuring that this address is always available. CARP is much like VRRP, although it improves on it in many ways: it supports IPv6 addresses, provides strong authentication via a SHA1 HMAC, and supports a limited degree of load balancing via an "arp balancing" feature.
CARP is the direct result of our frustration with the current IETF standards process: Cisco maintains that they hold a patent which covers VRRP and none of the right people at the IETF are willing to stand up and tell them their patent is irrelevant. It's a specific case of the general problem of vendors involving themselves in the standards process, then producing patents after the standard is finalised. The same sort of thing is happening with the various IPSec standards. We'd like very much for the IETF to put an end to this, and use a non-RAND intellectual property policy, much as the w3c has done. An open standard is not really an open standard if you have to enter into licensing agreements to use it.
Author's note: The OpenBSD web site has some interesting commentary on Cisco Patents.
2) Additions to the pfsync(4) interface allow it to synchronise state table entries between or more firewalls which are operating in parallel, allowing stateful connections to cross any of the firewalls regardless of where the state was initially created.
Federico: Ryan, how would state table synchronization work?
RM: The pfsync protocol works by sending out state creations, updates, and deletions via multicast on a specified interface. Other firewalls listen for such messages, and import the changes into their state table. There is some additional complexity, of course: we implement some methods for minimizing pfsync traffic, and minimizing the mechanism for recovering from missed messages.
The net benefit of all this is that you can have two firewalls running in parallel and have one firewall backup for the other. In many situations this will be combined with CARP.
I've written an article that gives an overview on why pfsync and CARP are necessary, how they work, examples of how they can be used, and a sample configuration.
If you're considering building yourself a redundant firewall cluster, you'll probably want to read this.
Federico Biancuzzi is a freelance interviewer. His interviews appeared on publications such as ONLamp.com, LinuxDevCenter.com, SecurityFocus.com, NewsForge.com, Linux.com, TheRegister.co.uk, ArsTechnica.com, the Polish print magazine BSD Magazine, and the Italian print magazine Linux&C.
Return to the BSD DevCenter.
Copyright © 2017 O'Reilly Media, Inc.


text: We headed up to Copper Mountain to see what the most recent storm had produced. The parking lot had about 4-5" of fresh snow. Surprisingly, at 830am the parking lot was already filling up. Ww thought it wasn't the best sign but, as it turned out the mountain was not that crowded.


text:
18-Mar-2013 - 19-Mar-2013
Expert meeting: Identifying potential marine sites of Outstanding Universal Value in the High Seas
Conservation of biodiversity and ecosystem functioning of the High Seas has risen on the international agenda over the past years. ...
05-Mar-2013 - 19-Mar-2013
E-discussion on "Science, technology and innovation, and the potential of culture, for promoting sustainable development and achieving the MDGs" for the 2013 Annual Ministerial Review (AMR) of UN ECOSOC
UN DESA, UNDP and UNESCO are leading the e-discussion on the theme of the ECOSOC session "Building the future we want with science, ...
19-Feb-2013 - 30-Jun-2013
National Museum of Cambodia and UNESCO inaugurate "Our Common Heritage: Exploring World Heritage Sites of Cambodia, Laos and Viet Nam"
The National Museum of Cambodia, founded in 1920, possesses one of the world's greatest collections of Khmer artefacts. They include sculpture, ...


text:
Embrace those rainy days with waterproof jackets like the North Face Venture Jacket, Patagonia's Torrentshell or Marmot's Strato Jacket and goretex boots.
DenaliOutdoor.com features all the best outdoor gear Denali and Trailblazer stores have to offer. Located in Connecticut and Rhode Island and open 7 days a week, you will find a huge selection of The North Face, Patagonia, Merrell, UGG, Marmot, New Balance, Nike and more. Visit our locations page to find the Denali or Trailblazer near you!
866-451-3795 - Customer Service Hours: Mon-Fri 7:30am-3pm EST or email firstname.lastname@example.com


text:
USU President Stan L. Albrecht
Stan L. Albrecht was named Utah State University's 15th president and assumed his new position on Feb. 1, 2005.
At the time of the announcement, Albrecht was serving as executive vice president and provost at Utah State, a position he held since 2001. He previously served as its dean of the College of Humanities, Arts and Social Sciences from 1998-2001.
During his tenure as President, Albrecht has announced a comprehensive fund-raising campaign with an official fundraising goal of $200 million.
"The campaign will take its place among the most significant moments in Utah State University's history," said Albrecht. "This journey will be transformative in its long-term impact on the university."
Another major initiative under Albrecht's direction has been to strengthen USU's branch campuses to reflect a stronger, more cohesive Utah State University system and provide greater access to higher education opportunities.
As part of his commitment to USU students throughout the state, he helped secure funds to hire 40 faculty members from 2007 to 2009. Most of the faculty members will teach in rural communities served by the university.
"Many of our new professors were hired for our regional campuses and partnership institutions, and this will dramatically impact our ability to extend Utah State's academic reach throughout the state," said Albrecht.
Prior to his arrival at Utah State, Albrecht served as an administrator and professor at the University of Florida from 1993-98. He also served for 18 years at Brigham Young University (1974-92), including three years as academic vice president and associate provost. He began his career as an assistant professor of sociology at Utah State University in 1970 through 1974.
A sociologist, Albrecht has written extensively, including as a co-author of the textbooks Social Psychology and Social Science Research Methods, both published by Prentice- Hall. He has authored numerous scholarly papers on a wide range of topics, including the environment, energy development and rural health.
Albrecht received his doctorate from Washington State University in 1970, a master's degree from Washington State University in 1968 and bachelor's degree from Brigham Young University in 1966. All three degrees were in sociology.
He is a member of the Science Committee for the Minerals Management Service of the U.S. Department of Interior. He has served as a council member of the Society for Human Ecology and as vice president of the Rural Sociological Society.
Albrecht is married to Joyce Albrecht, Director of Advancement in the Caine College of the Arts.


text:
So long streak here's my "Blog of the Week"
3/14/09 00:02 AM Sorry, I don't blog on Friday the 13th it's unlucky.
So the Rockies dropped one. I'm in the glass is half-full kind of mood today so as I sit back and look at our record which now 6-8 and I think..I'm ok with that.
It's spring training. I hear tell from Mr. Harding over at "Hardball in the Rockies" that Brad
Hawpe will be appearing in tomorrows game against Seattle.
Apparently the boo-boo finger is healed and Hawpe is ready to bop.
I'm starting to get my baseball stuff in order. The regular season is fast approaching. If I was older and retired I'd be in Phoenix for the Rockies first game against the D-Backs. But no, I'm still too young and sexy to retire so that road trips not gonna happen for a few decades.
If you've wondered what the RPR Sports Memorabilia History and RR # Verification link on my sidebar is I'll tell you. I'm cataloging my autograph collection. I figure it's easier to write the story of how each autograph was obtained while I can still remember the details. It's part of my Pre-Alzheimer's checklist.
Don't laugh, I already have a few items that I don't remember when I had them autographed.
If I feel so inclined I can go back through my blog entries and track every piece, but having them listed in one place with easy access will be nice. Don't try and comment on that page. I've turned the comments off.
Just so you know, at this point none of my stuff is for sale unless you offer me a ridiculous amount of money. Or I'll trade it all for a REALLY good camera.
Check out my new Bobblehead.
It cost a chunk of change but it came with a truck. There was a big car sale at Invesco Field at Mile High and if you bought a car you got a bobblehead. By far the most expensive bobblehead I own but I really like this truck.
Most of you who are younger than me won't get this but I've always wondered why older folks take the stairs one at a time. My whole life I've always cruised up the stairs two at a time. It's faster and better for you. Today I was taking the stairs and I caught myself going up them one at a time.
Entering your 40's you start to notice many moments like the one I experienced.
Get's me to thinking what's next? Hair growing in my ears?
(<——-This is actually this dudes ear hair)
At what age to I start to jack up my pants?
Will the Ranter's trademark sunglasses switch to those big ash ones you see retired people wearing.
Will I start carrying around hard candy?
No worries yet, I'm aging gracefully and I can still hop the bleachers in the Pavilion two at a time (knock on wood).
So far this season, I've snagged 12 baseballs and one live homerun baseball. So if you think you can out snag this old man you better pack a lunch and bring an extra six bucks for a Rockie Dog…I'm not play'n this year, it's the real deal and it's on like Chaka Khan,……Chaka Khan, Chaka Khan, I feel for you🙂
This little Rockies blog is starting to get some attention. My page hits are up from spring training and staying there. My thanks again to Rox Girl over at the Purple Row for the recent props.
Enough of my ideas have been "borrowed" here that I feel it's ok to "borrow" one myself. I plan to do a "Ranter's Blog of the Week" and spotlight other bloggers. However instead of being intimidated by other Rockies bloggers (chew on that), I plan to spotlight Rockies bloggers.
My original goal with blogging was to bring more love/attention to my team and I figure a great way to do that is to promote our promoters if you get me?
There will be no special order in which I do these and I might not do one every week. I like people who are passionate about their team.
The first "Ranter's Blog of the Week" goes to:
Missy from: View from the Rockpile
I read her blog and you can tell that this woman loves her team and her job with the Rockies. I have to tell you this, Missy sent me an email the other day and mentioned that she had a lot of Rockies pictures and wanted to put them in a separate blog. But she didn't want to do it if I felt she was copying the "Rockpile Ranter's Picture Blog". I told her please do it, but the fact that she had the decency and respect to write me first really blew me away.
To me that's the actions of a good-hearted person.
So congrats Missy, thank you for working for and promoting the Rockies, and thank you for being a stand up blogger in a sit down world full of Wal-Mart shopping carts with one F'kd up wheel.
Go Rockies, or I'll push…D
8 Comments
EWWW! If that's really ear hair, that is just SOO gross! ("Morning Wood" – Ha! Is that a real album? I've gotta check that out!)
Rants, Raves, and Random Thoughts
Hey D,
Sometimes age can be a good thing. But after you turn 21, it does seem like the yearly ritual does fall by the wayside a bit more every year. But the good thing is that some day I can sit in a chair and stare either east at the mountains or west at the sea and know I have 12 more hours of this until i go to sleep again.
The best thing about getting old is that you can make your own choices. No more brussel sprouts for me, or those silly meals in the boxes we got as kids. But the best thing is that we can remember those home runs and those magical moments in the stadium and actually can say in full honesty, "I was there!".
Congrats to " View from the Rockpile" . You have no given me some insight on another blog, and it will also begin to be one of my daily jaunts to check out the "Rockie Writing Revolution" every day.
Rays Renegade
D, please don't ever jack your pants up like that. Please, please, please. I'm begging you. That is the worst look EVER. Well, maybe next to that guy's ear hair.
SUE-The album is as real as his ear hair.
RAYSREN-As usual words of wisdom from an awfully smart fella. I bet you've got some concert/life stories brotha :)…D
JEN-lol, it would be hard to label myself as the "Worlds Coolest Blogger" if I had hi-risers like that.
OMFG! I'z the very first "Blog of the Week" peep?! I can't believe it! Thank you very much RPR!
I'm to speachless I dunno what more to say.Missyhttp://rocktober-2007.mlblogs.com
Hey D,
Oooooooh, you got one of those bobbleheads! I so want one but I'm cool with my current set of wheels. Tempting though.
That ear hair and hiked up pants……….. what are people thinking?
R-LUV-I got two, always get two.
MISSY-Nothing required on your end. Keep up the good blogging…D
D- With age comes wisdom and you reach the stage in your life where you don't care if people are embarrassed by you. Enjoy it – don't fight it! – you'll have a much better time. Trust me; I know!


text:
Forget Halloween.
Today can be one of the scariest days of the year. We call it Dirty Tricks Thursday. With just a few days before the election, ghouls and goblins creep out from their lairs with warnings of doom.
You don't ring their doorbell; they ring yours. They don't offer candy, only cryptic emails, phone messages or letters and faxes from the more technically challenged creatures of the dark. They won't use their own names, but gleefully provide names of political candidates whom they don't like, listing a series of crimes against humanity perpetrated by the candidate often without proof, credibility or the slightest bit of dignity.
The motivation is evident – they don't want Candidate X to win, but it's wise to hide their allegiance to Candidate Y. Wise is a generous adjective for this behavior because it rarely produces the desired results.
What is hoped is that journalists will take the unverified information at face value, which never happens, or that they'll slap together some haphazard set of facts and push a story through on deadline when it's too close to the election to rectify any damage caused. If key parts of the story are not put into appropriate context or omitted because they can't be determined within a few days time, it's too late.
From the tipster's point of view, they have nothing to lose. They operate in shadows. If the information is being unfairly characterized, partially false, or complete fiction, no one knows who they are. They won't look bad. The candidate who was unfairly attacked and the news organization who fell for it will.
So that's the first question you've got to ask yourself. If this information was so vital to an election, why are we just hearing about it now? You assume that you're being rushed on purpose. They're playing on the pressure to get the story first. But who wants to bear the responsibility for changing the results of an election through irresponsible reporting?
The problem for journalists is that once in a great while, the information is not only true, but important to voters and the public at large. We have to make that decision. Most of the time it's easy. Sometimes it's not.
What does the public have a right to know about a candidate? Quite a bit, but what about personal details? Do you need to know all about the divorce of someone running for township board? It's hard to imagine why. Say someone's kid got into trouble. What does his kid have to do with the village board?
But there's no formula for this. Obviously, sometimes peoples' private lives intersect with their public lives. Maybe a divorce file contains allegations of public corruption. Anyone who's ever read a divorce file knows that doesn't make them true, but you can't just ignore them. Maybe someone's kid had a run-in with the law and the village board member pressured police to drop the charges.
The point is that if you're trying to attack Candidate X for valid reasons regardless of motivation, those allegations need to be made well before the waning days of a campaign so they can be vetted – not dumped in reporters' laps a few days before the election.
Otherwise most of them end up as ghost stories, not news stories, or worse – blog entries. Now that's scary.
• Kevin Lyons is news editor of the Northwest Herald. Reach him at 815-526-4505 or email him at firstname.lastname@example.com.


text:
view full screen
Sleeveless High-low Henley Shell Top
Style: 570115531
Out of Stock
Divinely silky woven top is a little slice of heaven— relaxed shape and high-low hem is sure to flatter while easily dressed up or down for day or night occasions. Side slits and pleat from the back yoke add to the free-flowing silhouette.
- Relaxed fit.
- Functional silvertone shirting buttons down center front. Decorative epaulettes at shoulder.
- Shiny combo fabric on placket.
- 100% silk. Hand wash, cold. Imported.
- Approximately 29" from shoulder.
Read more… Read less…


text:
Danny Ruther, 21, was driving east on U.S. 60/84 when his car hit the median and slammed into a tree on the south side of the road. (Staff photo: Eric Kluth)
CNJ staff
A Portales man involved in a one-car crash Tuesday night between Clovis and Cannon Air Force Base died Wednesday morning at a hospital in Lubbock.
Danny Ruther, 21, was driving east on U.S. 60/84 when his car hit the median and slammed into a tree on the south side of the road, a preliminary investigation shows.
Ruther was ejected from the vehicle when the car hit the tree, according to Curry County sheriff's deputies who investigated the incident.
Ruther was transported to Clovis' Plains Regional Medical Center and then airlifted to Covenant Medical Center in Lubbock, where he died just after 9:30 a.m Wednesday, according to hospital officials.
His grandmother, Diane Ruther, did not know where her grandson was going at the time of the accident, but said he had some friends in the area.
"He was a really easy going kid that everybody enjoyed being around," she said, explaining that he would stop by her home in Clovis sometimes just to visit. "Not many 21-year-old grandsons will do that."
She also said her grandson was doing well in life, thinking of going back to school and working hard for Herbert Lumber company in Portales.
The owner of the company, Kenneth Herbert, said Ruther showed a lot of potential over the last six or seven months at the company.
"He was a very bright and energetic kid, very personable to customers," Herbert said. "I'm saddened that he's gone."
Diane Ruther said she is turning to faith to get her through this tragedy.
"I tried real hard to look at it as what God had planned," she said. "I have to look at it that way or I can't deal with it."
Police said the accident investigation is ongoing.


text:
Roadside Assistance Products
Sort By:
Giving away roadside assistance products can project a sensitive and caring image of your company into the community, letting the public know that you look into the needs of your customers and employees. Help your customers in their hour of need by supplying these useful items and see the gesture reciprocated ten times over. After all, giving people useful items like these makes them feel valued. This, in turn, can make your customers speak highly of your brand, thus enhancing your corporate identity. From handy survival first aid kits, which are both cost effective and practical items, to items designed to be stowed safely in the trunk of an automobile, any safety item has the potential to save lives. Regardless of whether the driver actually needs to use your roadside assistance products in the event of a mishap, merely receiving the gift will cause recipients to recognize the genuine concern and care which your brand takes for the well-being of your clients and employees.


text:
If you replace the plains of Africa with Hollywood and Highland and think of U2 as a herd of zebras
I really WANT to dig Cumberbatch, but I have only seen him in the really bad Star Trek movie and all I could think was "where's the feathered grey air and bubble vest???". No Ricardo Montalban he.ReplyCancel
You have to see Cumberbatch in a real movie, try Tinker Tailor Soldier Spy.
I love his photobombing. That boy is not jaded yet.ReplyCancel
He is also great in a film with Tom Hardy, called Stuart A Life Lived Backwards but hard to find, it was made for UK TV.ReplyCancel
I am trying! But all I see is someone really in love with his own cleverness. I will reserve judgement until I see that movie!ReplyCancel
@TTM, give Sherlock a try. Totally.ReplyCancel
@TTM, one word: SHERLOCK.
I don't find him conventionally attractive but put him and Martin Freeman together and —
Uh, what was I saying?
(I've not seen him in anything else except his glorious photobombs.)ReplyCancel
Okay, I will check it oot, thanks, ladies!
I have an irrational love of all things Montalban, so that probably skewed everything. Plus I was distracted by the sweaty coke-bloat that was Chris Pine, acting solely with his eyebrows. And I fell asleep.ReplyCancel
Oh, doll, I saw the first Star Trek reboot and only stayed awake for Zachary Quinto and my man Simon Pegg. Chris Pine just bores me to tears.ReplyCancel
And FWIW I looooved this video. The DETERMINATION with which he gets over there and JUMPS… I was literally LOLing.
@Seven, TOTALLY.ReplyCancel
He makes me smile!ReplyCancel
Sherlock is perfection. I didn't even realize he was Smaug (yet another Cumberbatch/Freeman pairing)
I have a friend who curates a "Daily Dose of BC" newsletter. She's sick this week, so I'm going through withdrawal. In interviews, he seems so self-effacing. LOVE him.ReplyCancel
BC is going to be in Minneapolis for the Mpls ComicCon. I didn't even know we had one. A bunch of other celebs that I forgot about will be here too. May 2-4.ReplyCancel
Actually he will be there on May 3rdReplyCancel
Thats an amazing movie. Oldman and Firth are in it!ReplyCancel
He was also good in Atonement which should be required viewing for all.ReplyCancel
TTM, to me, BC always looked like one of the aliens from "Close Encounters…." Then he opened his mouth. I'm a sucker for a deep, resonant voice.ReplyCancel
That movie was all Quinto for me. He carried that movie. He carried "Heroes." He also carried "So NoTORIous." (No judgment, please.) 😉
Seven, did you see "The World's End?"ReplyCancel
He hasn't been confirmed for the Minneapolis con yet, but I sure hope he shows up for the Sherlocked cons that are supposed to be coming this yearReplyCancel
@Guildish and @Ray, I will be adding them to my "Must See" list. Thanks!!! 🙂ReplyCancel
@loopy, yes! I laughed so hard! SO & I are saving the re-watch for our long weekend where we can marathon all three movies. Shaun of the Dead will probably always be my favorite because it was the first, Hot Fuzz killed me, and World's End, I could not stop laughing! Except… now it's over. {sob}ReplyCancel
Omg yes! He is at his finest in Sherlock. So sooo fineReplyCancel
@Seven, I totally agree about "Shaun." How awesome was the backyard record scene? I love him and Nick Frost together. "Hot Fuzz" was great as well and I loved Steve Merchant in it (for the three minutes he was there). I'm hoping the Pegg/Frost collaborations are not going to end just because the trilogy is finished.ReplyCancel
I've only seen him in "12 Years", but it was enough to win me over. He is also very intelligent and well-spoken, and comes off well in interviews.ReplyCancel
did you see Ellens backstage video where she's trying to get to the stage dressed as Glenda the good witch and he's in the way saying :i feel like i'm being attacked by a giant queen……and she says oh like its the first time ZINGReplyCancel
BC's mother Wanda Ventham was a British Blonde Bombshell (BBB) in the 60's. You'd never know it to look at him.


text:
Learn more about the staff and campers
The guardians, friends, and mentors that make it possible
How this all started
Check out what we do here at camp
Founded in 1968 by Helen Herz Cohen, The Main Idea is an extraordinary and unique ten-day, residential summer camp program that provides economically disadvantaged girls with a life-changing camp experience.
Sharing the same idyllic setting as Camp Walden in Denmark, Maine, The Main Idea provides girls, ages 8 – 14, with a close-knit, family-oriented camp environment that allows each girl the chance to develop her personality, increase her self-confidence, and acquire new skills ranging from belaying on the ropes course to team problem solving to conflict resolution…
Learn More
Activities at Main Idea are scheduled to allow ample opportunity for learning skills and developing competence while assuring plenty of time for forming friendships and having fun.
The well- structured and flexible schedule is designed to meet each camper's needs and interests. Counselors are trained to teach in positive and encouraging ways, and each camper is allowed to develop both individually and as a team member…
Learn More
Camp Dates: August 18th — August 28th
Administrative staff arrival: August 14th
All Staff Arrival: August 15th (pre-camp training)
Please mail all paperwork to Dawn Plourde
381 Oak Pond Rd #7
Skowhegan, ME 04976
Inquiries or specific details can be obtained from our Director, Dawn Plourde.
E-Mail: email@example.com