text:
U.S. Rep. Randy Hultgren issued the following news release on Monday:
WASHINGTON, D.C. – Congressman Randy Hultgren (IL-14) has learned that he has been appointed to the House Committee on Science, Space and Technology for the 113th Congress. Hultgren also served on the committee during the 112th Congress.
"I'm truly thrilled to be named to the Science Committee again," said Hultgren. "We made great progress in the 112th Congress getting to know stakeholders in the research community and promoting the importance of federal investment in national labs like Fermi and Argonne, and I look forward to continuing that work."
Hultgren was named a Champion of Science for his previous work on the Committee by the Science Coalition in October.
Fermilab Director Pier Oddone said, "Representative Hultgren has quickly become the champion of science in the House of Representatives. The country needs such champions!"
Hultgren also founded the bipartisan House Science & National Labs Caucus in December. The group's stated purpose is to reinforce federal investment in research and the national laboratories.
Hultgren was also appointed to serve on the House Committee on Financial Services for the 113th Congress. In the 112th Congress, he served on the Agriculture and Transportation & Infrastructure Committees.


text:
Zakka (Earth-616)/Gallery
< Zakka (Earth-616)
172,507pages onAdd New Page
this wiki
this wiki
Ad blocker interference detected!
Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers
Wikia is not accessible if you've made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.
Character Gallery: Zakka (Earth-616)
This page contains all images on the database pertaining to this character or subject. If you have found an image that exists on the database, but that is not seen on this page please add it. All new images added to the database should be added to the appropriate gallery as soon as possible for future reference.
Gallery : Character Gallery : Z : Zakka (Earth-616)
Gallery : Character Gallery : Z : Zakka (Earth-616)
See Also
- Main Article: Zakka (Earth-616)
- Image List: Zakka (Earth-616)

subset: commoncrawl


text:
Dear Members,
Keep in mind that Character Bashing is now prohibited. Making fun of certain characters/character pairings leads to a pointless thread filled with insults and general rule breaking.
Also, remember that Versus threads are allowed only in the Versus section.
Thank you, NarutoBase Staff
Play me if u have xbox. "BlondeBOMBer DE"
naw im a ps3 person srry
Will do when I've got Black Ops 2 out of my system :D
I'll play you next week this week I'm going to busy with school work but around next week ill most likely be free to play storm G
Forum Rules


text:
In 1971, June was admitted to Bee County College, where she was on the Dean's Scholastic Honors List, a member of the honor society, and a member of Who's Who in American Junior Colleges. She graduated from the Dental Hygiene program in 1973. After passing the board examination with the highest grade in her class and upon receiving certification by the Texas State Board of Dental Examiners, June began her career as a Registered Dental Hygienist in Harlingen, TX. Over the next 20 years, she worked for David A. Woolweaver, D.D.S. and the Texas Department of Health, Region 11. During her career she was known as a pioneer in the history of dental hygiene in the Rio Grande Valley because of her commitment to dental hygiene education. As a public health Dental Hygienist, she provided dental hygiene education, dental cleaning, application of sealants and fluoride treatment to poor children in the Rio Grande Valley. She also provided dental hygiene education to people in nursing homes and other underserved settings. Her Dentist colleagues thought of her as an outstanding, skilled professional.
June was a tireless advocate for community dental health and earned numerous awards including Dental Hygienist of the Year and Outstanding Grassroots Dental Hygienist in Texas. She held membership and leadership positions in many professional organizations: the American Dental Hygienists' Association; the Texas Dental Hygienists' Association; the Texas Public Health Association (Dental Health Chairman); Texas State Technical College's Dental Hygiene School Advisory Committee member; and was the co-founder and first president of the Rio Grande District Dental Hygiene Society.
June was a member of the Order of Eastern Star for over 60 years, serving as Past Matron and various other offices. In Zonta International, a professional women's organization, she served in several offices, including Director. While living in Harlingen, she was an active member of Covenant Presbyterian Church.
June loved spending time with her family, playing cards and dominoes, taking care of her plants, and watching the hummingbirds. She was a devoted fan of the Texas Rangers and the Dallas Cowboys.
She is preceded in death by her parents Carl "Pop" and Lila Ann "Memo" Livingston. She is survived by her brother James Livingston and his wife Avis; her brother Glenn Livingston and his wife Johnnie; and her sister Bette Moore. She is also survived by her three children: daughter Diane "Dee" Sportsman; son Gary Sportsman and his wife Sally; and daughter Rebecca "Becki" Thomason. "Mama June" had eight grandchildren, eight great-grandchildren, and four nieces and nephews.
Private family viewing will be held 1:00 pm to 1:30 pm, Saturday, February 2, 2013 at Green Funeral Home, 207 S. Wood Street in Ferris, Texas. Graveside service will be held 2:00 pm Saturday, February 2, 2013 at Ferris Memorial Park North with Pastor Brian Smith officiating. Funeral arrangements are under the direction of Green Funeral Home.


text:
Pavel Datsyuk - As Pavel has grown up in front of our eyes here in Detroit he has quickly become one of the best players in the league with his quick hands and elusiveness!
Jimmy Howard - Jimmy stands tall in net for the wings.
Todd Bertuzzi - Tuzzi has made a name for himself here in Detroit with his flashy shootout goals and gritty style of play!
Henrik Zetterberg - Hank took over the coveted "C' on his chest this year as Nick Lidstrom hung up his skates.
Jordin Tootoo - Tootoo has already made a reputation for himself here as the new enforcer in town!! Twice now this season he has dropped the mitts only seconds into the game to get the crowd pumped up and get the boys riled up to bring the Wings some early momentum!
Damien Brunner - As one of the freshest faces in Detroit Brunner has already made some noise with a flashy game winner in a shootout and a few more goals to go with it!
Categories: Detroit Features Photo Galleries Photos Poll


text:
Home List of Titles Subspace analysis to alleviate the volumetric locking in the 3D solid-shell EFG method
Please use this identifier to cite or link to this item: http://hdl.handle.net/1959.3/236580
- Title
- Subspace analysis to alleviate the volumetric locking in the 3D solid-shell EFG method
- Author(s)
- Graca, Ana; Cardoso, Rui P. R.; Yoon, Jeong Whan
- Abstract
- The main objective of this work is to reduce the volumetric locking pathology at the Element Free Galerkin (EFG) 3D solid-shell meshless method. For this purpose, a subspace analysis is performed in order to extract the linearly independent incompressible deformation modes that can be reproduced by different background integration cells. Additional deformation modes reproduced by a cell configuration produces more flexibility for the meshless formulation. The Enhanced Assumed Strain (EAS) method is blended with the EFG formulation in such a way that additional (mathematical) variables are included in the formulation increasing its flexibility for nearly incompressible materials. Three numerical examples show the effect of the EAS formulation in alleviating the locking pathology for an almost incompressible material condition.
- Publication type
- Journal article
- Research centre
- Swinburne University of Technology. Faculty of Engineering and Industrial Sciences
- Source
- Journal of Computational and Applied Mathematics, Vol. 246 (Jul 2013), pp. 185-194
- Publication year
- 2013
- FOR Code(s)
- 0102 Applied Mathematics; 0103 Numerical and Computational Mathematics; 0906 Electrical and Electronic Engineering
- Keyword(s)
- B-bar approach; EAS; EFG; Element Free Galerkin; Enhanced Assumed Strain; Meshless methods; Subspace analysis
- Publisher
- Elsevier
- 0377-0427
- Publisher URL
- Copyright
- Copyright © 2012 Elsevier B.V. All rights reserved.
- Additional information
- The authors acknowledge support from the Fundacao para a Ciencia e Tecnologia (FCT), under Ph.D. grant SFRH/BD/71483/2010 and the Ministerio da Ciencia e Ensino Superior (FCT-Portugal) under PTDC/EME-TME/105237/2008.
- Peer reviewed


text:
The intruders were all turned over to agents with the United States Border Patrol and eventually sent back to Mexico.
Carrizales was speaking to a crowd of more than two dozen residents and Tea Party Patriots of Beeville members in a meeting room of the Joe Barnhart Bee County Library Thursday evening, Aug. 7, when he told them the numbers.
The sheriff said deputies are no longer just apprehending Mexicans or even Central Americans. They are coming across the Texas-Mexico border from all over the world.
Deputies discovered one of the illegals who came across the border recently had citizenship in both Great Britain and Libya.
"He kept chanting death to America, and he was turned over to the FBI."
The increase of illegal immigrants coming up from Central America has resulted in the capture of suspected members of drug gangs from that part of the world.
Carrizales said his deputies have even found members of MS-13 in the groups of immigrants who cross the Rio Grande.
There is big money for the drug cartels in Mexico who are branching out into the immigrant smuggling business.
Mexicans and "other than Mexicans" (OTMs) are paying from $3,000 to $5,000 a person to be smuggled into this country. The farther away from the Texas border the immigrant is when he starts the journey, the more he or she pays the smugglers.
Years ago, Chinese immigrants were paying $10,000 a person to the coyotes to be smuggled into Texas.
"OTMs are given a court date. Unless you are a Mexican national you aren't deported," the sheriff told those at the meeting.
Carrizales said if someone from China is apprehended and given a court date three years from the date he is apprehended, he gets on the telephone, calls his cousin in China and says, "Come on over."
The sheriff then showed a series of dash camera videos taken in recent months by his deputies as they chased down and eventually stopped vehicles carrying illegal immigrants through Bee County.
One of those videos showed a deputy driving 90 miles per hour along a country road trying to catch a vehicle in June.
He said there were 18 immigrants in the vehicle, and only four were apprehended.
In the past, coyotes drove vehicles provided by their bosses. The Bee County Sheriff's Office could confiscate those vehicles and either sell them at auction or convert them to patrol vehicles.
"The trend has changed," Carrizales said. These days, the smugglers use rented cars or stolen vehicles to transport immigrants and illegal substances into the country. Those vehicles must be returned to the owners.
"When I took office in 2005, I realized there weren't enough resources to deal with the problem," Carrizales said.
Illegal immigration is not a new problem. Carrizales said the business of smuggling immigrants into the United States has been going on for years, long before he was elected sheriff.
Recently, the situation has gotten worse.
Shortly after Carrizales was elected, he and Sheriff Michael O'Connor of Victoria teamed up to form the Texas Sheriffs Association. Today, lawmen from 22 Texas counties belong to the organization.
Several years ago, Carrizales and O'Connor used the clout of the association to get more counties in Texas included in the federal government's Operation Border Star program. Until then, only counties right on the border were receiving funds to help them stop illegal immigrants from entering the country.
Today, Operation Border Star provides more than a half million dollars to counties to help pay their deputies overtime for apprehending illegal immigrants.
After showing another dash camera video of a vehicle full of illegals running through fences to escape deputies, one of the women at the meeting asked who would be responsible for repairing the damage.
Carrizales said there are no funds available for the county to assist in repairing fences.
Another woman at the meeting asked why deputies do not set up roadblocks to catch illegals. Carrizales said that the dedicated efforts of his deputies have had a similarly positive outcome on traffickers.
The sheriff said coyotes are given road maps showing the best routes for their smugglers to take when entering the country and on a lot of those maps, Bee County has been crossed off, suggesting that they should avoid the county. But they come through this county anyway.
When one woman asked why the federal government will not station National Guard troops on the border to stop the flow of immigrants, Tea Party President Anna Diaz said the current administration in Washington, D.C. refuses to take that step.
One man at the meeting asked Carrizales if his deputies had found any "safe houses" used by coyotes in Bee County. He said they have and more than 600 pounds of marijuana was discovered in one such house not long ago.
Carrizales urged those who live in the countryside to call his department whenever they see something suspicious; "but not to engage these people," the sheriff warned.
"Protect yourselves. This is Texas. You have that right," Carrizales said.
The sheriff said his deputies have not yet experienced a dramatic increase in unaccompanied juveniles coming through the county. Those children are being stopped in the counties south of here.
The sheriff said he believes the increase in the number of young children coming across the Texas-Mexico border is a way to "clog up the system" in the U.S.
"There is no other country in the world that if you cross the border illegally they won't put you in jail," Carrizales said.
The sheriff asked those at the meeting to:
•Be aware of your surroundings.
•Check your property.
•Report suspicious behavior.
•Do not approach suspicious persons or packages.
•Call the sheriff's office at 362-3221 or call 911 if the situation is an emergency.
Carrizales also asked residents in the countryside to lock their vehicles and take the keys with them.
"Take care of yourself," the sheriff said. "That's priority number one."
He also agreed with one woman who said, "Get a dog."
Deputy Lt. John Davis told the group that the department is asking the commissioners court for more deputies and a patrol sergeant.
Carrizales said state and federal agencies are getting most of the increased border funding. Local agencies are not getting the money.
Larry Smith, a candidate for Congressional District 34, told the group that because OTMs are given a court date three years into the future and then released, "If you cross the Rio Grande, you're basically an American for three years."
Gary Kent is a reporter at the Bee-Picayune and can be reached at 343-5220, or at firstname.lastname@example.com.


text:
Additional Item Enchantments
|Jun 29, 2014
|What is this? You want more armor enchantments and you also miss the old enchantments 'Life Detection' and 'Invisibility' from Oblivion. This modification contain 29 new enchantments and one new follower (wip). Everything will start in Riften. You'll find a corpse of a troll. How strong are these enchantments? Right now Im trying to make them more lore friendly. So there's a formula basing on your enchanting skills. The better you enchanting is the better are the enchantments. This will maybe...
Add on armors
|Apr 23, 2012
|New armor and weaponry for the Dragonborn
Adopt a child
|Aug 31, 2012
|This mod will allow you to adopt a child from the Honorhall Orphanage in riften. To adopt the child simply talk to the constance Mitchel in Riften. Pay the One time Adoption Fee and You are ready to adopt the child. Take a child with you in your adventure or simply ask them to go to your house. They can stay at any place. If you keep them happy they even play games with you. Fully Compatible with killable Children Mod. Fully Compatible with EFF Mod. Fully Compatible with Killable Children...
- A ENB HD6 Cinematic Lighting Enhancement
|Jan 13, 2012
|HD6 Additions and Tweaks to ENB v0102 - For Filmic Days and adjustable Darker Nights / Caves Available also from Skyrim Nexus Included are a normal nights and darker nights variant, along with ability to alter how dark night / interiors are WHILE playing with a keypress (1 + pageup / pagedown). Along with various additions to enbeffect.fx such as color balance / brightness / contrast / saturation for day and night and the addition of an adjustable vignette to make it easier for you to tweak...
all shrines & stones @ Dragonreach
|Dec 16, 2011
|All the Shrines & Stones are at Dragonreach - Cheat this mod makes all 9 of the shrines to the divines and all 13 constellation standing stones are all placed in the throne of castle Dragonreach (Whiterun's castle) so now you dont have to run all over to find them. the shrines are on the floor to the left when you enter Dragonreach, the 13 stones are on the right balcony above the throne. ________________ If you could donate, it would be great, I spent many hours before the creation kit was...
Alternate Skyrim cursors
|Nov 18, 2011
|Installation Place the cursor (ex. enhanced.swf) in [Skyrim installation folder]/Data/Interface and rename file to 'cursormenu.swf' Uninstallation Simply remove the cursor file! - Enjoy :) Mod by: Kenney Vleugels www.kenney.nl
Antiallias and sharpen effect
|Nov 15, 2011
|The sharpen effect is applied by default. To deactive sharpen effect : open shader.fx and scroll till you see : #include "Sharpen.h" Put 2 // in the begining of the line. = //#include "Sharpen.h" INSTALL: Extract the content inside the D3D9 folder to The install dir. Where the executable is. Usually here: Program Files (x86)\Steam\steamapps\common\skyrim PEOPLE WHO HAVE PROBLEM WITH CRASHING READ HERE: It seems that Fps monitoring programs and tray tools such as ati tray tools cause the game...
Armies Mod
|Dec 01, 2013
|This mod allows the AI generals in the game and, bandit "Captains" (will come with the mod), to assemble armies from the games generic NPC populace(Meaning it doesn't use named or important characters), but will give captains names(Like "Captain Cornelius or Thorgir One-Eye Etc.) But the faction generals also require food and money to sustain their armies, so if you take over their farms and steal their gold they'll lose troops pretty quick.
Arrowsmith - Simple Fletching
|Aug 03, 2012
|Arrowsmith allows you to craft arrows in bundles of 50. -- HOW TO INSTALL -- Vanilla Users: Download the Vanilla Edition. If not using the Curse Client, extract Arrowsmith.esp and Arrowsmith.bsa to Skyrim\Data. Also available on Steam Workshop: http://steamcommunity.com/sharedfiles/filedetails/?id=7417 Dawnguard Users: Download the Dawnguard Edition. If not using the Curse Client, extract Arrowsmith-dawnguard.esp and Arrowsmith-dawnguard.bsa to Skyrim\Data. Also available on Steam Workshop:...
Asylum: West Wing
|Nov 24, 2011
|You find yourself in a mental Asylum, but its dark, alone and there's something hunting you. in the shadows, but its your past, can you face it? or will it consume you? After writing a screenplay or college I originally wrote this for Amnesia but due to limitations on the engine i have put it off. and i feel its best to bring it to skyrim. Also, this sadly wont be out until I can get the creation kit when its released, so please wait. if anyone knows how to mod skyrim without it, let me know...
Aurane + Sonja - Savegames
|Nov 18, 2011
|---------------------------- Aurane + Sonja - Savegames by pLAN_S ( former zipfile ) ---------------------------- 2 female characters. Screenshots included. Enjoy. /pLAN_S exclusively on skyrimforge.com -------------------------------------------------------------------------- YOU ARE NOT ALLOWED TO UPLOAD THIS ON THE NEXUS-NETWORK, THIS INCLUDES SKYRIMNEXUS, NEWVEGASNEXUS, OR ANY OTHER OF THEIR SITES. --------------------------------------------------------------------------
bag of holding
|Nov 12, 2011
|adds a bag of holding to your inventory, so all the packrats out there can keep hoarding
BATH - Beautiful Aela The Huntress
|Sep 24, 2012
|First, sorry for my bad english, I'm a French modder so I will try to explain as the best I can ! This is my first Skyrim mod, so please be forgiving ! I've never find a mod that really change Aela, so I made one. /!\ If the download link doesn't work please try it again soon, this will be a host maintenance problem /!\ ________ Program used: -Skyrim NPC Editor 0_75_1 -by foretrenty- (you can also download it on curse here) Bodys used: -Calientes Female Body Mod Big Bottom Edition CBBE -by...
Better Beast Races
|Dec 29, 2011
|This mod gets rid of the angular shapes of the beast races (Argonian & Khajiit) caused by compressed object space normal maps. The following object space normal maps will be replaced: head, mouth, hands, body. For these races it was a lot harder to do than the human and elven races, due to all the small details of fur and scales. I did my best to keep the loss of detail at a minimum. The new updated version also adds more detailed diffuse- and specular maps. Now this mod is like a combination...
Body Aura - 3 Colors
|Nov 30, 2011
|Here is a video showing off this effect for all 3 colors changes as well as the original: http://www.youtube.com/watch?v=8dYBPrH1RRg If you can spare the time I would really appreciate feedback on this/what you would like to see done with this in the future, thanks in advance. This mod uses the Ebony Mail chestpiece OR my ring mod. Here is a link to my ring mod: http://www.curse.com/mods/skyrim/ring-shadows And put it on, now anytime you go into combat or crouch the effect will turn on. Note:...
Bodyhair Nude Male HD
|Jan 02, 2012
|- Added nude body mesh - cut and uncut version - 4K version of my bodyhair Mod. - Xtra Pattern "furball" with backhair - hair on arms and legs Installation: 1. Put the files from "needed" into [X]:\Program Files (x86)\Steam\SteamApps\common\skyrim\Data\textures\actors\character\male (X = your Steam installation HDD) >> if you don't have these folders already create them << 2. Choose your favorit pattern 3. Copy all files inside the patternfolder to [X]:\Program Files...
Book of Treasures
|Dec 18, 2011
|You will find the maps in whiterun, under the tree, see picture for example. Info: This is a work in progress. Right now it is just two new maps with two new treasures but that is no where near where I want it to go. Once I figure out how it works, I want to have a book full of treasures.. I have figured out half of it, just need to understand it a little more, but for testing purposes I'm releasing this to test map placement/treasure placement on a larger scale. The Treasures are not...
Bookshelf Patch
|Dec 24, 2011
|This small patch deals with collision issues with bookshelves, items tend to float if they are on the third shelf of a bookshelf. I found this to be a huge issue when decorating, if you find anymore you need fixed let me know and I will fix them. This will evolve into some bug fixing for bookshelves as well, like activator lock up and triggers going away etc. Fixes collision for: 0.2 - Proudspire Bookshelves - Breezehome Bookshelves 0.1 - Honeyside Bookshelves Let me know if you find any...
Breezehome Bookshelves
|Dec 28, 2011
|Mod Description: 0.2 Breezehome Bookshelves by Shawk - Adds two new Bookshelves to Breezehome in the Alchemy room. Both working. - Collision fixed. Issues: - You will need to Zone out of Breezehome then back in if you loaded into Breezehome the first load. - You may find that sometimes the Activator doesn't show your books after you put them on the shelf. You will just need to individually remove the books. - Some collision issues, but I will fix them over holidays or after.
Breezehome First Wing
|Jan 10, 2012
|This mod adds a new wing to Breezehome, but it isn't that easy, the door is locked and you will need to find the key to open the door. You will find your first clue in front of the door. This is the 1st part of a 4 part series of quests that involve upgrading breezehome. Enjoy. Includes: - 2 Mannequins - 20 Weapon Racks - Skinning Rack, Workbench, Smithy - Storage (Pouch and Chest) The key can be found through the quest, or if you are lazy or just cannot find the key I have added a 2nd key...


text:
Venison class teaches safety and cooking
As the deer firearms season quickly approaches, thousands of hopeful hunters are preparing for what will hopefully be a bountiful harvest.
Many are beginning to go through the usual checklist of scouting out the favorite hunting location, checking trail cameras, and sighting in the favorite deer rifle. There is one more item to add to your checklist this year and that is the Venison 101 Training.
Venison 101 is a workshop that will take you step by step from that final shot to enjoying that fine venison on the dinner table.
The workshop will be offered Nov. 12 from 6 to 9 p.m. at the Heart and Hand Market in Philippi. The cost is free but pre-registration is required for the course. Participants must contact the Barbour County WVU Extension Office. For more information or to register, call 304-457-3254.
Various topics to be covered include: proper field dressing techniques, meat processing and identifying cuts of meats to meet your dinner plans, as well as food safety and proper canning techniques. This will be a hands-on learning experience so come prepared to get a bit dirty.
The training will include a presentation from the DNR on whitetail management strategies and herd health in the Mountain State. This will cover current management strategies being used in West Virginia and will also take a look at some of the health issues that our deer herd can face.


text:
Product Description
A rare live album from the vintage line-up of Krautrock heroes Guru Guru never before released on the commercial market!
Features over 60 minutes of brain melting improvisational magic with selections from the band's best known early albums UFO and HInten!
Packaged in a deluxe black box with full liner notes, collectible button, poster and balloon!


text:
Lightweight Rug Pad
- Summary
Our standard rug pad provides a nonskid layer between lightweight carpets—from crewels to cotton flat-weaves—and the floor. Made from recycled synthetic fibers, it's part of our Green Collection.
- Nonskid pad prolongs rug life.
- Made from 100% recycled synthetic fibers, backed with natural and synthetic rubber.
- Reversible, for use on hard floors as well as over carpet.
- Pliable and easily trimmed for the perfect fit.
- Keeps rugs smooth and flat for ease of maintenance.
- Guaranteed to not damage or discolor your floor.
- Made in USA.
This item is part of our Green Collection. Our Green Collection creates truly great design with an eco-friendly point of view. These Green products are distinguished by any one of the following characteristics: Organic, Re-cycled, Re-claimed, Sustainable.
- Shipping
Shipping Information
Please allow 2 to 4 weeks for delivery. Larger sizes are delivered with our White Glove Delivery Service and should be delivered within 2 to 4 weeks. For White Glove Delivery, items are brought into your home and placed in the room of your choice. Delivery is by appointment, Monday – Saturday; our delivery service will call to arrange a day. Available in the 48 contiguous states. Please call 888.922.4108 for additional assistance.
Shipping Rates
The shipping rate varies depending on your order total and shipping destination. View Shipping Options and Charges.
With Unlimited Flat Rate Furniture & Freight Delivery, an unlimited number of eligible furniture and select non-furniture items in your order can be delivered for a single flat rate. The exact shipping charges, listed below, are based on our shipping location and will be applied in the Checkout Payment & Review page.
Local $159
Regional $259
National $399
Return Policy
At Williams-Sonoma, we take great pride in the quality and craftsmanship of our products. If, within 30 days, you are not completely satisfied with your purchase for any reason, please return the item for an exchange or refund of the merchandise value. Final Sale items ending in .97 or .99 are not returnable or cancellable. View Full Return Policy.


text:
Every now and then you come across a powerful photo that demands a gut reaction: outrage, laughter, nausea, arousal. Who among us hasn't shed a tear while rifling through a copy of National Geographic or Art Doll Quarterly?
Art Doll Quarterly
My two favorite photos are "Migrant Mother" and this one.
Then there are pictures that prompt questions where emotions should be. "What am I looking at?" "Is that a Photoshop job?" "Am I ON THE NEW MTV2 SHOW PICTURE PUNK'D????" Here are four baffling historical pictures with amazing true backstories.
4Hans Massaquoi: The Black Nazi
Question: Have you ever seen a black Nazi ... wearing a sweater vest? Well you have now. The little boy in the center of the picture above is Hans Massaquoi, one of the few biracial Germans who were born and raised under the Nazi regime. So if you ever feel like you were born in the wrong time and place in history, shut up, because unless you're a black child goose-stepping around with a swastika sewn to your sweater, you have no idea what it means to be in the wrong place at the wrong time.
I spoke too soon.
Hans was born in Hamburg in 1926, the son of a German nurse and a Liberian law student whose dad happened to be the Liberian consul for Germany. Not long after his birth, Hans' father and grandfather both moved back to Africa, leaving the little boy and his mom to navigate through the ins and outs of living under an Aryan regime on their own. Both the title and the picture above are a little misleading, though, because Hans never actually made it into the Nazi Party, although he tried. In third grade, Hans was so eager to prove that he was a good German that he persuaded his babysitter to sew a swastika onto his sweater. His teacher snapped a picture on the one day Hans wore the emblem, but his mom unstitched it that night, hopefully while defiantly singing whatever the German version of "Edelweiss" is.
Some say the swastika was only worn in rebellion over this sailor suit/baggy sock combo.
The funny thing about being a kid is that you're so entrenched in kidness that you can't see or understand the big picture of the world around you. Even if you're knee-high to pure evil, from your perspective everyone swims around in a hazy pool of authority and rightness. Even though he was the polar opposite of what the Nazi Party was looking for, Hans couldn't see why he couldn't join the party, literally. At age 10, he tried to join the junior division of Hitler Youth for the same reason you and I join the hippie drum circle at the farmer's market:
"They had cool uniforms and they did exciting things -- camping, parades, playing drums."
Bundesarchiv, Bild 146-2004-0031/Weinrother, C./CC-BY-SA
"... chicken fighting on land ... you know. The fun stuff."
The big question is why wasn't Hans persecuted? In later years, he said he thought it was because blacks were so low in the hierarchy of groups to attack: right after people who couldn't do cartwheels, but before mimes of Chinese descent. Massaquoi actually operated in Nazi society easier than you'd expect. During his teen years, he worked at a government-run job center where an SS officer advised him that he'd be useful to the party once Germany reclaimed their old African colonies. The biggest dangers Hans faced during the war were the bombs from the Allies and getting caught dancing to Nazi-banned swing music.
Pete Harrison & Nick White/Ikon Images/Getty Images
If there's one thing Nazis didn't get, it was the power of dance.
Once the war was over, Hans and his mom moved to America on a student visa, where he was accidentally drafted into the Korean War, which he also survived. By this point, Hans was over the Nazi thing and Americanized his ideology nicely. So naturally he ended up a managing editor of Ebony magazine. Of course he did.
3The Stuffed Lion That Looks Like a Dog
Imagine you're an alien and someone hands you a bag of bones, some hair, and the hollow carcass of a freshly dead human. Then they ask you to recreate your best version of a person. Besides being shocked by the horrific task placed before you, not to mention disappointed at your choice of companions, what would you come up with? I'm guessing a cross between a Picasso portrait and a Picasso portrait painted by a blind elephant.
Pablo Picasso
Or just a regular Picasso portrait.
It's an unlikely scenario, but something similar happened in 1731, when the King of Sweden got an unusual gift from an Algerian chieftain -- a live lion. We don't know if it was the shock of seeing all the pales, Sweden's cold climate, or the fact that this was a very regal yet suicidal lion, but the animal wasn't destined for a long life.
Jupiterimages/liquidlibrary/Getty Images
How the lion had the dexterity to tie the noose is lost to history.
Here's where things get screwbally. Up until this point, it was a typical "lion meets Sweden and mysteriously offs himself" story. But the taxidermist on the receiving end of the bag of bones had never seen a lion before. Not in books or works of medieval art or on a flag, not on a lionish gargoyle or in the arms and back of a lionish chair laying around the castle.
Nothing. It was 1731, so the printing press was up and running nicely. The taxidermist couldn't hop over to a monastery and ask if they had some cool lion tapestries or illuminated art of lions farting at each other or anything? He couldn't find a regular-size cat to sketch for reference? Just one? "I got this," he probably said while happily petting his slow-witted but endlessly loyal golden retriever named Bjorn Bjud.
GK Hart/Vikki Hart/Stone/Getty Images
The result of the effort was a lion that looked like the fruit of a dog/cat orgy, a creature so ridiculously off the mark that even visiting hyenas thought it looked stupid. Not helping his "I'm a lion!" cause are the white block teeth, so horrifically misplaced and sturdy that they should be guarding a high security prison cell, nor the steak-tongue of a monster. Between the tongue and the teeth, you almost miss the glassy eyes too narrowly placed together to be condoned by Mother Nature. Poor King Frederick's lion ended up more of a future cautionary tale against GMO animals than the exotic display he was hoping for.
UNLESS you take a step back and look at it from the perspective the taxidermist intended all along.
Suddenly our steaming plate of fur and ignorance just got a little more fierce. His posture looks about right, and that sloppy grin takes on the look of a growl. Even his previously baby-doll-esque eyes look menacing. Which makes the taxidermist the greatest artist of all time. He invented beer goggles and tested them on a stuffed lion. From far away, the lion is magnificent. Up closer, it's an actual dog.


text:
I hope we find the answers soon, I really do. As I anxiously anticipate my first MDGOP convention this weekend, these topics are on the forefront for me. Earlier today, my first contribution to The Brenner Brief was posted. This evening, the lovely Teri Christoph of Smart Girl Politics and ShePAC posted a link to this article by Erick Erickso [...]
Jackie Wellfonder
President at Wellfonder Group
Jackie Wellfonder is a proud conservative activist and strategist. She started blogging in 2012 and spreading a common sense message of fiscal conservatism, limited government, and transparent governance. Because of her passion for supporting right of center candidates, Wellfonder started a consulting firm, Wellfonder Group, to help candidates and small businesses maximize their reach via social media and a strategic communications plan. Visit our contact page to send a message and share your thoughts or find out more information!
Latest posts by Jackie Wellfonder (see all)
- Fake Andy Harris Twitter Account Fuels Senate Run Speculation - March 9, 2015
- Dan Bongino Forms Battle Ground Resistance PAC - March 4, 2015
- Bar Fights, STD's and….Fracking?!? - February 13, 2015


text:
I like the lad, just makes too many mistakes (MHO)
Games Played 26
Tries scored 25
Assists 5
Errors 20
Miss tackles 26
He will not been 1st or 2nd choice winger on the team sheet next year.
and he will have to improve errors and miss tackles to dislodge hicks or king.
Opinions are what make the worldgo round and the discussion about this is great, I'll watch him from a different perspective next time that's for sure! Wow an actual discussion about a player and technique this definitely wouldn't happen on rlfans!


text:
Click on image to zoom
Ram Clutches Force 9.5 Complete Dual Disc Organic Clutch Assembly 75-2250
28oz/in. Balance - 1 1/16-10 Spline - 157 Teeth - Incl. Flywheel - Disc - Pressure Plate
Pricing: $969.00
Ram Clutches - Force 9.5 Complete Dual Disc Organic Clutch Assembly P/N 75-2250 Features:
- Ideal Entry Level Dual Disc Clutch For Street Use
- For Use In The 400-700 ft./lb. Range
- Handles Small Blower Or Turbo Installations
- Provide A Light Pedal Effort Similar To The Stock Clutch
- Strap Drive Eliminates Any Floater Plate Rattle At Idle
- Compatible w/Factory Hydraulic Release Mechanisms
- Features 300 Series Friction Material
- Reduces Change Of Chatter On Take Off
- Strictly Factory Warranty Only
For over 40 years, RAM has produced the world's top performing competition and street performance clutch systems. We have developed, improved, and produced in house, tried and true clutch components and systems that provide the highest performance value. Today, every RAM product incorporates critical features that are absent from many of the products of those who choose to compete with us. What is absent in our program is the mythology, and hype masking the deficiencies of products produced by others.
- 75-2250
- 75-2250
- 809009384704
- Ram Clutches
- New
Shipping Information
- Item Requires Shipping
- 35.0 lbs.
- W14.0000" x H5.0000" x L15.0000"
Customer Reviews
Total Reviews (0)
Write the First Review!
You must login to post a review.
- We don't just want your business today. We want to EARN your business for LIFE!
- USA Owned, Operated & Employed
- Installers & Resellers Click Here to Apply
We Specialize In:
- GM LS Conversions
- Engine & Trans Combo Kits
- Unique Ready to Run Engines
- Have a question?
- to Email our Sales & Tech Staff
- 888-748-4655 Mon-Fri 8AM-6PM EST
- Click above for 24/7 Live Chat Service.


text:
This is a Digitized Sky Survey image of the Pegasus constellation with DSS crop and galaxy group location marker. This image was used in the video zoom of Stephan's Quintet.
Object Name: Pegasus
Image Type: Astronomical/Illustration
Credit: Digitized Sky Survey (DSS), STScI/AURA, Palomar/Caltech, and UKSTU/AAO
To access available information and downloadable versions of images in this news release, click on any of the images below:


text:
|WI High School Competitions 2012
Memories from Wisconsin HS Competition #2 at Wisconsin Rapids
Original size (2048 x 1536, 1138 KB) // Back to thumbnails
|Web gallery auto-generated by Swuggle running on Linux
|[Contact Us] [Privacy Policy] :: [Home]
|All original content is Copyright 2011 by the Figure Skater's Website. Permission is granted for clubs and rinks to reproduce for instructional or non-profit purposes, with attribution. This site is produced privately as a service to skaters and is not endorsed by the USFSA. Images representing skaters are for private viewing only, and are not to be used for any commercial purposes.


text:
GV Now
Kutsche office begins partnership with GAAH
Posted on September 23, 2013
Grand Valley and community leaders crowded into the Cook Library Center, 1100 Grandville Ave., September 23 to celebrate the start of a yearlong partnership with Grandville Avenue Arts and Humanities.
The event also served to commemorate the 45th anniversary of the founding of a Hispanic civil and human rights organization, the Young Lords.
The partnership focuses on GAAH's Cook Library Scholars program, designed to provide 30 elementary and middle school students from the surrounding neighborhood with academic support and leadership training. Grand Valley faculty members, students and the Kutsche Office of Local History will work with GAAH staff members to facilitate the program.
Melanie Shell-Weiss, director of Grand Valley's Kutsche Office of Local History, said the partnership exemplifies the work the office has done in the past to support marginalized groups in West Michigan.
Anne Hiskes, dean of the Brooks College of Interdisciplinary Studies, told the audience that when her family came to the U.S. from the Netherlands, they settled in the Grandville neighborhood. "I remember my mother and my grandparents telling me their struggles in this neighborhood," Hiskes said. "It's the same dreams that inspired the Young Lords, dreams of equal opportunity, housing, employment and education. Those dreams helped shape my values."
The Cook Library Scholars program will also connect young students with area Hispanic leaders for mentorship and leadership skill building. Some of those leaders were portrayed in an exhibit, "Tengo El Pueblo En Mi Corazón: Latino Civil Rights and Community," that remains up at the center through October 18. Grand Valley students, led by Paul Wittenbraker, associate professor of art and design, helped with the exhibit.
George Heartwell, mayor of Grand Rapids, said it's important to be involved in civil rights efforts within the Hispanic community. "This is an important part of our history," Heartwell said. "And it's a piece that needs to be remembered by us."
Many audience members then took a walking tour of the neighborhood; some continued on a tour bus, sponsored by the Kutsche Office, to Chicago's Lincoln Park neighborhood, the birthplace of the Young Lords civil rights movement in 1968.


text:
My LO has a swollen belly (very big). We took her to the ped yesterday and they are a little concerned, so she is going for an ultrasound today. The ped also wanted to see if she is getting over fed, so I went to a lactation consultant yesterday. We found that only after sucking for about 5 minutes, LO got almost 3 ML of milk. The lactation consultant said that is enough (which I was thrilled about because that is a short feeding), but I am now very worried...LO usually wants to suck for 10 or more minutes or if she comes off the breast she wants to go back on. I am worried I am overfeeding her...
1. how do I know if she is getting too much?
2. If I stop her from going back on the breast, how do I keep her content?
3. Is it in her best interest if I pump and bottle feed so I can regulate her intake?
I really need help because I am concerned her stomach is swollen do to overfeeding.


text:
Don't toss out that stale breakfast cereal! Instead, check out these ways to ensure that none of it goes to waste.
I suppose defining Peeps, a favorite of my childhood, as "good" food that goes bad, might be a bit of a stretch.
Those marshmallow chicks that come in an array of unnatural colors go stale REALLY quickly. [more]
Feijoada (pronounced "fayj-wada") is Brazil's national dish. Although it's simple enough to be eaten on a daily basis, feijoada is often prepared in huge batches for big parties. [more]
Become a fan
Follow us
Enter your email address to subscribe:


text:
My daughter was born at 36 weeks and is now 2 weeks old. She spent 10 days in the NICU where we didn't really attempt breastfeeding. I also had a breast reduction 10 years ago. I have been religiously pumping since day 1, every 2-3 hours, throwing in a power pump 1x a day. I have started putting little one to the breast a few times a day. My question is, I am only getting <30ml per pumping session, taking Fenugreek and am not seeing an increase. Is this as much as I can expect? I'm having a horrible time trying to juggle time at the breast, bottle feeding, pumping plus clean up of everything that I feel I am getting NO time to just cuddle my baby. I'm extremely discouraged and we don't really have any support of LC in my area.
How long should I give it to see an actual supply? I'm also not sure when I can really push breastfeeding with my baby as we are concerned about her weight (current 4.5 lbs). We have a pedi appt Wed and will ask about that then. How long should I keep trying? I hate to give up, but I'm not sure I can handle this, emotionally at least.


text:
This is the third article in a series of Java vs. .NET security comparisons. It deals with the issues of code protection and distribution, and Code Access Security (CAS) mechanisms on those platforms. Previous articles of this series covered configuration and code containment in Part 1, and cryptography support and the mechanisms of communication protection in Part 2.
Once code or an algorithm has been written, it becomes an asset that requires protection. Such a protection is needed not only against theft, but also against unauthorized or unintended use. On the other hand, when somebody purchases a software package, he wants to be confident that he is not dealing with a counterfeit product. To answer all of these challenges, various techniques, broadly divided into cryptography-based and everything else, are employed for code protection and verification.
Code-access security is also known as policy-based security. It allows minimizing the risks of executing certain application code by providing policies restricting it to only a particular, well-defined set of operations that the code is permitted to execute. Of course, the underlying services (platform or application) have to actually carry out those checks for the policy to become effective.
Issues discussed in this section are applicable, to a certain degree, to both platforms. They also employ similar protection mechanisms to combat those problems.
The possibility of the reverse engineering of distributed bytecodes needs to be taken into account when planning the security aspects of an application, because bytecode formats are well-documented for both Java and .NET (see also GotDotNet), so any hardcoded data or algorithms may be easily restored with readily obtainable decompiling tools. This point is especially important for avoiding hardcoding user credentials or non-patented algorithms in client-based application modules.
While there is no ideal way around this issue, short of shipping encrypted code and providing just-in-time decryption, an average perpetrator's task may be made harder by using so called obfuscators; i.e., tools that intentionally scramble bytecodes by using unintelligible names and moving entry points around. In addition to the obfuscator tool available with VS.2003, a number of decompiling/obfuscating tools can be found at the Microsoft web site. For Java, a great number of commercial or free Java decompilers and obfuscators can be found by running a simple search on the Web.
Finally, OS-level protection mechanisms need to be utilized, along with the platform ones, in order to ensure good protection of the stored data. All of the hard work at the platform level is useless if code or data can be obtained and inspected as raw binary files. Therefore, any normal OS operation security rules (like
ACL, minimizing attack surface, the principle of "least privilege," etc.) should be employed in addition to the platform-specific ones, in order to ensure blanket protection.
Before addressing cryptography-based code protection features, the issue of certificate management in general needs to be covered, because all cryptography-based solutions deal, in one way or another, with certificates or keys. First of all, certificates need to be created and stored, and then accessed from the applications. Both platforms supply tools to issue certificate requests, as well as APIs for accessing the stored certificates.
.NET, as usual, heavily relies on Windows certificate stores to deal with certificates — they are used to store X509 certificates and certificate chains of trusted signers. There are a number of tools included with the .NET SDK to help accessing those stores, manage certificates, and sign assemblies using those certificates.
.NET's Certificate API is represented in its
System.Security.Cryptography.X509Certificates namespace, where the
X509Certificate class is of particular interest to us. Unfortunately, this class is rather poorly designed; it does not support accessing certificates in certificate stores, but works only with binary ASN.1 DER format, and does not provide any way to use it in asymmetrical encryption. The official suggestion from Microsoft is to stick with using unmanaged
CryptoAPI (CAPI) functions, in particular
CryptExportKey/CryptImportKey. See MSDN articles for details of bridging .NET's managed certificate implementation with CAPI.
Another, much better alternative is using WSE (already covered in Part 2). It provides the
Microsoft.Web.Services.Security.X509 namespace with several useful classes, among them another version of
X509Certificate, derived from the .NET-supplied one. This class recognizes the shortcomings of its predecessor and provides a very convenient interface for accessing certificate stores, as well as extracting public/private key information in a format appropriate for asymmetric encryption. As an added benefit, it can read certificates stored in
Base64 text format. Together with the
X509CertificateStore class, they make .NET's certificate API pretty well rounded. The following MSDN example shows how they can be used together:
// Open and read the Personal certificate store for
// the local machine account.
X509CertificateStore myStore =
// Search for all certificates named "My Certificate"
// add all matching certificates
// to the certificate collection.
X509CertificateCollection myCerts =
"My Certificate");
X509Certificate myCert = null;
// Find the first certificate in the collection
// that matches the supplied name, if any.
if (myCerts.Count > 0)
myCert = myCerts[0];
// Make sure that we have a certificate
// that can be used for encryption.
if (myCert == null ||
throw new ApplicationException(
"Service is not able to encrypt the response");
return null;
The Java platform implements RFC 3280 in the
Certification Path API, which is supplied in the default "SUN" provider. This API, however, allows read-only — retrieving, accessing attributes, etc. — access to certificates, because they are considered to be immutable entities in Java. Classes implementing
Certification Path API, belong to the
JCA framework and can be found in the
java.security.cert package. There are three classes of interest there:
Certificate: An abstract class for dealing with certificates.
X509Certificate: An abstract class for dealing specifically with X.509 certificates, stored using
Base64 encoding, with
BEGIN CERTIFICATE/END CERTIFICATE markers serving as delimiters.
CertificateFactory: A factory for generating certificate objects from their encoded formats.
Java uses so-called keystores for storing certificates. They can have different formats, as supplied by JCA providers (see Part 2); the default is Sun's proprietary JKS format. There are common keystores that contain keys, both public and private (or symmetric, if desired), and truststores, which are used to establish certificate chains. The JVM uses truststores (lib/security/cacert by default) to store the trusted certificates, and keystores for accessing key information. Having keystores as separate files is a nice feature in Java, as it is easy to move them around and manage them (compared to .NET's reliance on CAPI containers). Both stores can be specified as parameters on the command line, or accessed directly from code:
java -Djavax.net.ssl.keyStore=MyKeyStore
-Djavax.net.ssl.trustStore=MyTrust MyClass
Compared to the standard .NET certificate implementation, Java provides very convenient facilities of working with certificates. The examples below demonstrate how easy it is to obtain certificates from a keystore:
FileInputStream fin = new FileInputStream("MyKeyStore");
KeyStore ks = KeyStore.getInstance("JKS");
Certificate cert = ks.getCertificate("MyEntry");
or from a file:
FileInputStream fin =
new FileInputStream("MyCert.cer");
CertificateFactory factory =
X509Certificate cert = (X509Certificate)
Java provides a tool for generating keys,
keytool, which has a number of options. Among them are importing/exporting certificates, creating test certificates, creating certificate signing requests, etc. This tool picks up the keystore types (JKS, PKCS#12, etc.) defined in the java.security configuration file, and can use plugged-in provider types to operate on various types of keystores. By default,
keytool generates only X.509 v1 certificates, which may be restricting for some applications.
Becoming a Certificate Authority (CA) on your own is problematic, but not impossible, with Java. One can either purchase a commercial library, or build his or her own CA using
sun.security.x509 classes, although they only work with JKS keystores. However, the latter solution is neither portable nor documented. There are also a number of open source libraries that allow you to deal with certificate management, including CA functionality. A good free implementation is OpenSSL.
Note: Java provides a solid API for dealing with certificates. .NET programmers have to turn to unmanaged CAPI functions to access certificates, unless they use WSE, which adds a lot of useful functionality.
Cryptography-based mechanisms include certificates, digital signatures, and message digests, which are used to "shrink-wrap" distributed software and data. They establish software origin and verify its integrity with a high degree of reliability, subject to the strength of the underlying cryptography algorithm.
In their simplest forms, CRC or digests are used to verify software integrity. For more involved implementations, Message Authentication Code (MAC), or Hash-based MAC (HMAC), specified in RFC 2104, may be applied, which add cryptographic protection (using symmetric secret keys) for improved protection. Both platforms support most common digest, MAC, and HMAC functions in their respective cryptography namespaces. See Part 2 of this series for details of supported algorithms. Numerous code samples are available on the Web for both Java and .NET (also see MSDN).
These sample applications for .NET and Java demonstrate signing capabilities.
For application distribution, .NET supports software signing to prove application or publisher identities. For the first task, it provides so-called strong names, and for the second, signing with publisher certificates. These approaches are complementary and independent; they can be used individually or jointly, thus proving the identities of both the application and publisher. The users can configure .NET CAS policy based either on strong names, or on the software publisher, because they both provide strong assurances about the signed code. Because of their high levels of trust, strong-named assemblies can call only strong-named assemblies.
Strong names are used to prove authenticity of the assembly itself, but they have no ties to the author, as it is not required to use the developer's certificate to sign an assembly. A strong name can be viewed as a descendent of GUID mechanism, applied to the assembly names, and composed of text name, version number, culture information, plus the assembly's digital signature and a unique public key, all stored within the assembly's manifest, as shown in Figure 1:
The same key pair should not be reused for signing multiple assemblies — unique key pairs should be generated for signing different assemblies. Note that a version is not guaranteed by the strong name due to applying CLR versioning policy, as the same key will be reused to sign a newer version of the particular assembly. .NET provides a tool named
sn.exe to generate key pairs and perform a number of validation steps related to strong names. Generated keys can either be picked up by
AssemblyLinker, or added to the assembly declaratively by using an attribute:
[assembly: AssemblyKeyFile(@"CommonLib.snk")]
Clients, linked against a strong-named assembly, store a
PublicKeyToken representing the assembly, an eight-byte hash of the full public key used to create its strong name, as shown in Figure 2. This is done transparently by the compiler when a strong-named assembly is referenced. This is an example of early binding.
Late binding can be achieved by using
Assembly.Load and calling the full display name of the assembly, including its token:
Version= 1:0:1385:17444,
The CLR always verifies an assembly's key token at runtime, when it loads the referenced assembly. Two strong names are configured in security policy by default: one for Microsoft code, another for .NET's components submitted to ECMA for standardization.
Publisher certificates establish the identity of the code distributor by requiring him to use a personal certificate to sign a whole assembly or individual files in an assembly. The signature is then stored inside of the file and verified by the CLR at runtime. .NET provides the
Signcode.exe tool to perform the publisher signing operation. To do its job, it should have access to both the publisher certificate (with a valid trust chain), and the private key for that certificate, which will be used to sign the file(s).
Publisher certificates, as opposed to the strong names concept, are used to sign multiple applications and cannot uniquely identify a particular code module, nor are they intended to. Their intent is to identify a broad set of applications as originating from a particular vendor, in order to assign appropriate permissions based on the level of trust in this company.
As far as signing distributives goes, Java offers a single route that is similar the publisher-signing paradigm in .NET. However, there are significant differences in the approaches, since JAR specifications permit multiple signers and signing of a subset of the JAR's content.
Quite surprisingly, in Sun's default distribution of JDK 1.4.2, only
jce.jar is signed -- all of the other libraries do not have any signature. As a standard part of the JDK, Sun ships the
jarsigner tool, which works with Java keystores to obtain private keys and certificates for signing and verification to validate certification chains. This tool operates on existing JAR files (it does not create them), which are a standard distribution format in Java.
jarsigner -keystore PrivateKeystore.jks
-sigfile DP -signedjar DemoApp_Sig.jar
DemoApp.jar denis
When a JAR file is signed, its manifest is updated and two new files are added to the META-INF directory of the archive (see the JAR Guide for details): class signature and signature block.
The manifest file is called MANIFEST.MF and contains digest records of all signed files in the archive (which may be a subset of the archive!). Those records conform to the RFC 822 header specification and consist of a file name and one or more tuples (digest algorithm, file digest). As a rule, either
SHA1 or
MD5 digest algorithms are used. It is the manifest itself, not the physical JAR file, that is signed, so it is important to understand that once a JAR is signed, its manifest should not change -- otherwise, all signatures will be invalidated.
Manifest-Version: 1.0
Created-By: 1.4.2-beta (Sun Microsystems Inc.)
Name: javax/crypto/KeyGeneratorSpi.class
SHA1-Digest: HxiOMRd8iUmo2/fulEI1QH7I2Do=
Name: javax/crypto/spec/DHGenParameterSpec.class
SHA1-Digest: zU+QpzVweIcLXLjmHLKpVo55k0Q=
A signature file represents a signer, and an archive contains as many of these files as there are signatures on it. File names vary, but they all have the same extension, so they looks like
<Name>.SF. Signature files contain "digests of digests" they consist of entries with digests of all digest records in the manifest file at the time of signing. Those records conform to RFC 822 header specification and have the same format as the manifest's ones. Additionally, this file also contains a digest for the entire manifest, which implies that the JAR manifest may not be changed once signed. Incidentally, this means that all signers have to sign the same set of files in the JAR — otherwise, if new files have been added to the JAR prior to generating another signature, their digests will be appended to the manifest and invalidate already existing signatures.
An important point to observe is that when a JAR file is signed, all of the files inside it are signed, not only the JAR itself. Up until JDK 1.2.1, signed code had a serious bug: it was possible to alter or replace the contents of a signed JAR, and the altered class was still allowed to run. This problem was rectified starting with version 1.2.1 by signing each class inside of a signed JAR.
Signature-Version: 1.0
Created-By: 1.4.2-beta (Sun Microsystems Inc.)
SHA1-Digest-Manifest: qo3ltsjRkMm/qPyC8xrJ9BN/+pY=
Name: javax/crypto/KeyGeneratorSpi.class
SHA1-Digest: FkNlQ5G8vkiE8KZ8OMjP+Jogq9g=
Name: javax/crypto/spec/DHGenParameterSpec.class
SHA1-Digest: d/WLNnbH9jJWc1NnZ7s8ByAOS6M=
A block signature file contains the binary signature of the SF file and all public certificates needed for verification. This file is always created along with the SF one, and they are added to the archive in pairs. The file name is borrowed from the signature file, and the extension reflects the signature algorithm (RSA|DSA|PGP), so the whole name looks like
The JAR-signing flexibility comes from separating digest and signature generation, which adds a level of indirection to the whole process. When signing or verifying, individual signers operate on the manifest file, not the physical JAR archive, since it is the manifest entries that are signed. This allows for an archive to be signed by multiple entities and to add/delete/modify additional files in the signed JAR, as long as it does not affect the manifest (see the explanations in the signature file paragraph).
Note: Strong names in .NET offer an improved approach to versioning. JAR files, on the other hand, have more options for signing, so this category is a draw.
Once a piece of software's origin and integrity have been established, non-cryptographic approaches may be used to ensure that the code can not be used in an unintended manner. In particular, this implies that the platform's package- and class-protection mechanisms cannot be subverted by illegally joining those packages or using class derivation to gain access to protected or internal members. These types of protection are generally used to supplement CAS and aimed at preventing unauthorized execution or source code exposure.
Reflection mechanisms on both platforms allow for easy programmatic access to code details and very late binding of arbitrary code, or even utilize code generation capabilities -- see, for instance,.NET technology samples, or the Java Reflection tutorial. One common example of such a threat would be a spyware application, which secretly opens installed applications and inspects/executes their functionality in addition to its officially advertised function. To prevent such code abuse, granting reflection permissions (
System.Security.Permissions.ReflectionPermission in .NET,
java.lang.reflect.ReflectPermission in Java) in CAS policy should be done sparingly and only to highly trusted code, in order to restrict capabilities for unauthorized code inspection and execution.
In .NET, application modules are called assemblies, and located at runtime by a so-called probing algorithm. By default, this algorithm searches for dependent assemblies only in the main assembly's directory, its subdirectories, and the
Global Assembly Cache (GAC). Such a design is used to guard against possible attempts to access code outside of the assembly's "home." Note that it does not prevent loading and executing external assemblies via reflection, so CAS permissions should be applied as well.
Types in .NET are organized into namespaces. One may extend an already established namespace in his own assemblies, but will not gain any additional information by doing so, since the keyword
internal is applied at the assembly, and not namespace, level. Strong names are used as a cryptographically strong measure against replacement of the existing types.
If the designer wants to completely prohibit inheritance from a class or method overloading, the class or method may be declared
sealed. As an additional means of protection against source browsing, the C# language defines a
#line hidden directive to protect against stepping into the code with a debugger. This directive instructs the compiler to avoid generating debugging information for the affected area of code.
During execution of a Java application, class loaders are responsible for checking at loading/verification time that the loaded class is not going to violate any package protection rules (i.e., does not try to join a
sealed or
protected package). Particular attention is paid to the integrity of system classes in
java.* packages — starting with version 1.3, the class-loading delegation model ensures that these are always loaded by the null, or primordial class loader (see "Secure Class Loading" for details).
The Java platform defines the following options for protecting packages from joining:
Sealed JAR files
These are used to prevent other classes from "joining" a package inside of that JAR, and thus obtaining access to the protected members. A package,
com.MyCompany.MyPackage.*, may be sealed by adding a
Sealed entry for that package to the JAR manifest file before signing it:
Name: com/MyCompany/MyPackage/
Sealed: true
Configuration restrictions for joining packages
These can be used to control which classes can be added to a restricted package by adding them to the java.security file. Note that none of Sun-supplied class loaders performs this check (due to historical reasons), which means that this protection is only effective with a custom class loader installed:
# List of comma-separated packages that start
# with or equal this string will cause a security
# exception to be thrown when passed to
# checkPackageDefinition unless the corresponding
# RuntimePermission ("defineClassInPackage."+package)
# has been granted.
# by default, no packages are restricted for
# definition, and none of the class loaders
# supplied with the JDK call checkPackageDefinition.
Configuration restrictions for accessing packages
SecurityManager is installed, it checks the package-access policies defined in
java.security file. A package can have restricted access so that only classes with appropriate permissions can access it. For instance, all
sun.* packages are restricted in the default installation:
# List of comma-separated packages that start
# with or equal this string will cause a security
# exception to be thrown when passed to
# checkPackageAccess unless the corresponding
# RuntimePermission ("accessClassInPackage."+package)
# has been granted.
A sample Java application, demonstrating declarative access control to packages, can be obtained here.
Note: Configuration options in Java add a convenient method for declarative code protection, which gives it a slight edge over .NET in this category.
Code-access permissions represent authorization to access a protected resource or perform a dangerous operation, and form a foundation of CAS. They have to be explicitly requested from the caller either by the system or by application code, and their presence or absence determines the appropriate course of action.
Both Java and .NET supply an ample choice of permissions for a variety of system operations. The runtime systems carry out appropriate checks when a resource is accessed or an operation is requested. Additionally, both platforms provide the ability to augment those standard permission sets with custom permissions for protection of application-specific resources. Once developed, custom permissions have to be explicitly checked for (demanded) by the application's code, because the platform's libraries are not going to check for them.
.NET defines a richer selection here, providing permissions for role-based checks (to be covered in the "User Access Security" section of Part 4) and evidence-based checks. An interesting feature of the latter is the family of Identity permissions, which are used to identify an assembly by one of its traits -- for instance, its strong name (
StrongNameIdentityPermission). Also, some of its permissions reflect close binding between the .NET platform and the underlying Windows OS (
EventLogPermission, RegistryPermission).
IsolatedStoragePermission is unique to .NET, and it allows low-trust code (Internet controls, for instance) to save and load a persistent state without revealing details of a computer's file and directory structure. Refer to MSDN documentation for the list of .NET Code Access and Identity permissions.
Adding a custom code access permission requires several steps. Note that if a custom permission is not designed for code access, it will not trigger a stack walk. The steps are:
CodeAccessPermission (to trigger a stack walk).
IPermission and
Attribute class.
A sample of custom code-access permission can be found in the demo application. Also, check MSDN for additional examples of building and registering a custom permission with declarative support.
.NET permissions are grouped into
NamedPermissionSets. The platform includes the following non-modifiable built-in sets:
Nothing, Execution, FullTrust, Internet, LocalIntranet, SkipVerification. The
FullTrust set is a special case, as it declares that this code does not have any restrictions and passes any permission check, even for custom permissions. By default, all local code (found in the local computer directories) is granted this privilege.
The above fixed permission sets can be demanded instead of regular permissions:
In addition to those, custom permission sets may be defined, and a built-in
Everything set can be modified. However, imperative code-access checks cannot be applied to varying permission sets (i.e., custom ones and
Everything). This restriction is present because they may represent different permissions at different times, and .NET does not support dynamic policies, as it would require re-evaluation of the granted permissions.
Permissions, defined in Java, cover all important system features: file access, socket, display, reflection, security policy, etc. While the list is not as exhaustive as in .NET, it is complete enough to protect the underlying system from the ill-behaving code. See the JDK documentation for the complete list, and the Java permissions guide for more detailed discussions of their meaning and associated risks.
Developing a custom permission in Java is not a complicated process at all. The following steps are required:
java.security.Permission or
grant entry.
Obviously, the custom permission's class or JAR file must be in the
CLASSPATH (or in one of the standard JVM directories), so that JVM can locate it.
Below is a simple example of defining a custom permission. More examples can be found in the demo application or in the Java tutorial:
//permission class
public class CustomResPermission extends Permission {
public CustomResPermission (String name,
String action) {
//library class
public class AccessCustomResource {
public String getCustomRes() {
SecurityManager mgr =
if (mgr == null) {
//shouldn't run without security!!!
throw new SecurityException();
} else {
//see if read access to the resource
//was granted
new CustomResPermission("ResAccess","read"));
//access the resource here
String res = "Resource";
return res;
//client class
public class CustomResourceClient {
public void useCustomRes() {
AccessCustomResource accessor =
new AccessCustomResource();
try {
//assuming a SecurityManager has been
//installed earlier
String res = accessor.getCustomRes();
} catch(SecurityException ex) {
//insufficient access rights
J2EE reuses Java's permissions mechanism for code-access security. Its specification defines a minimal subset of permissions, the so-called J2EE Security Permissions Set (see section 6.2 of the J2EE.1.4 specification). This is the minimal subset of permissions that a J2EE-compliant application might expect from a J2EE container (i.e., the application does not attempt to call functions requiring other permissions). Of course, it is up to individual vendors to extend it, and most commercially available J2EE application servers allow for much more extensive application security sets.
Note: .NET defines a richer sets-based permission structure than Java. At the same time, .NET permissions reveal their binding to the Windows OS.
Code Access Security is evidence-based. Each application carries some evidence about its origin: location, signer, etc. This evidence can be discovered either by examining the application itself, or by a trusted entity: a class loader or a trusted host. Note that some forms of evidence are weaker than others, and, correspondingly, should be less trusted -- for instance, URL evidence, which can be susceptible to a number of attacks. Publisher evidence, on the other hand, is
PKI-based and very robust, and it is not a likely target of an attack, unless the publisher's key has been compromised. A policy, maintained by a system administrator, groups applications based on their evidence, and assigns appropriate permissions to each group of applications.
Evidence for the .NET platform consists of various assembly properties. The set of assembly evidences, which CLR can obtain, defines its group memberships. Usually, each evidence corresponds to a unique
MembershipCondition, which are represented by .NET classes. See MSDN for the complete listing of standard conditions. They all represent types of evidence acceptable by CLR. For completeness, here is the list of the standard evidences for the initial release:
AppDirectory, Hash, Publisher, Site, Strong Name, URL, and
.NET's policy is hierarchical: it groups all applications into so-called Code Groups. An application is placed into a group by matching its Membership Condition (one per code group) with the evidence about the application's assembly. Those conditions are either derived from the evidence or custom-defined. Each group is assigned one of the pre-defined (standard or custom)
NamedPermissionSet. Since an assembly can possess more than one type of evidence, it can be a member of multiple code groups. In this case, its total permission set will be a union of the sets from all groups (of a particular level) for which this assembly qualifies. Figure 3 depicts code-group hierarchy in the default machine policy (also see MSDN):
Custom groups may be added under any existing group (there is always a single root). Properly choosing the parent is an important task, because due to its hierarchical nature, the policy is navigated top-down, and the search never reaches a descendent node if its parents'
MembershipCondition was not satisfied. In Figure 3 above, the Microsoft and ECMA nodes are not evaluated at all for non-local assemblies.
Built-in nodes can be modified or even deleted, but this should be done with care, as this may lead to the system's destabilization. Zones, identifying code, are defined by Windows and managed from Internet Explorer, which allows adding to or removing whole sites or directories from the groups. All code in non-local groups have special access rights back to the originating site, and assemblies from the intranet zone can also access their originating directory shares.
To add a custom code group using an existing
NamedPermissionSet with an associated
MembershipCondition, one only needs to run the
caspol.exe tool. Note that this tool operates on groups' ordinal numbers rather than names:
caspol -addgroup 1.3 -site
www.MySite.com LocalIntranet
Actually, .NET has three independent policies, called Levels:
Enterprise, Machine, and
User. As a rule, a majority of the configuration process takes place on the
Machine level — the other two levels grant
FullTrust to everybody by default. An application can be a member of several groups on each level, depending on its evidence. As a minimum, all assemblies are member of the AllCode root group.
Policy traversal is performed in the following order: Enterprise, Machine, and then User, and from the top down. On each level, granted permission sets are determined as follows:
Level Set = Set1 U Set2 U ... U SetN
where 1..N - code groups matching assembly's evidence. System configuration determines whether union or intersection operation is used on the sets.
The final set of permissions is calculated as follows:
Final Set = Enterprise X Machine X User
Effectively, this is the least common denominator of all involved sets. However, the traversal order can be altered by using
Exclusive and
LevelFinal policy attributes. The former allows stopping intra-level traversal for an assembly; the latter, inter-level traversal. For instance, this can be used to ensure, on the
Enterprise level, that a particular assembly always has enough rights to execute.
This demo application demonstrates the tasks involved in granting custom permissions in the policy and executing code that requires those permissions.
Each policy maintains a special list of assemblies, called trusted assemblies -- they have
FullTrust for that policy level. Those assemblies are either part of CLR, or are specified in the CLR configuration entries, so CLR will try to use them. They all must have strong names, and have to be placed into the
Global Assembly Cache (GAC) and explicitly added to the policy (GAC can be found in the %WINDIR%\assembly directory):
gacutil /i MyGreatAssembly.dll
caspol -user -addfulltrust MyGreatAssembly.dll
Figure 4 shows the
Machine-level trusted assemblies:
For Java, two types of code evidence are accepted by the JVM --
codebase (URL, either web or local), from where it is accessed, and
signer (effectively, the publisher of the code). Both evidences are optional: if omitted, all code is implied. Again, publisher evidence is more reliable, as it less prone to attacks. However, up until JDK 1.2.1, there was a bug in the
SecurityManager's implementation that allowed replacing classes in a signed JAR file and then continuing to execute it, thus effectively stealing the signer's permissions.
Policy links together permissions and evidence by assigning proper rights to code, grouped by similar criteria. A JVM can use multiple policy files; two are defined in the default
This structure allows creating multi-level policy sets: network, machine, user. The resulting policy is computed as follows: Policy = Policy.1 U Policy.2 U ... U Policy.N JVM uses an extremely flexible approach to providing policy: the default setting can be overwritten by specifying a command-line parameter to the JVM:
//adds MyPolicyFile to the list of policies
java -Djava.security.policy=MyPolicyFile.txt
// replaces the existing policy with MyPolicyFile
java -Djava.security.policy==MyPolicyFile.txt
Java policy has a flat structure: it is a series of
grant statements, optionally followed by evidence, and a list of granted permissions. A piece of code may satisfy more than one clause's condition — the final set of granted permissions is a union of all matches:
grant [signedBy "signer1", ..., "signerN"] [codeBase "URL"] {
permission <PermissionClassName> "TargetName", "Action"
[signedBy "signer1", ..., "signerN"];
This demo application defines a custom permission in the policy and executes applications requiring that permission.
Even locally installed classes are granted different trust levels, depending on their location:
Boot classpath:
$JAVA_HOME/lib, $JAVA_HOME/classes
These classes automatically have the full trust and no security restrictions. Boot classpath can be changed both for compilation and runtime, using command-line parameters:
-bootclasspath and
-Xbootclasspath, respectively.
Any code (JAR or class files) in that directory is given full trust in the default
grant codeBase "file:{java.home}/lib/ext/*" {
permission java.security.AllPermission;
Standard classpath:
$CLASSPATH ("." by default)
By default, have only few permissions to establish certain network connections and read environment properties. Again, the
SecurityManager has to be installed (either from command line using the
-Djava.security.manager switch, or by calling
System.setSecurityManager) in order to execute those permissions.
Policy-based security causes problems for applets. It's unlikely that a web site's users will be editing their policy files before accessing a site. Java does not allow runtime modification to the policy, so the code writers (especially applets) simply cannot obtain the required execution permissions. IE and Netscape have incompatible (with Sun's JVM, too!) approaches to handling applet security. JavaSoft's Java plug-in is supposed to solve this problem by providing a common JRE, instead of the browser-provided VM.
If the applet code needs to step outside of the sandbox, the policy file has to be edited anyway, unless it is an RSA-signed applet. Those applets will either be given full trust (with user's blessing, or course), or if policy has an entry for the signer, it will be used. The following clause in the policy file will always prevent granting full trust to any RSA-signed applet:
grant {
permission java.lang.RuntimePermission "usePolicy";
Note: Policy in .NET has a much more sophisticated structure than in Java, and it also works with many more types of evidences. Java defines very flexible approach to adding and overriding default policies -- something that .NET lacks completely.
Code access checks are performed explicitly; the code (either an application, or a system library acting on its behalf) calls the appropriate Security Manager to verify that the application has the required permissions to perform an operation. This check results in an operation known as a stack walk: the Runtime verifies that each caller up the call tree has the required permissions to execute the requested operation. This operation is aimed to protect against a luring attack, where a privileged component is misled by a caller into executing dangerous operations on its behalf. When a stack walk is performed prior to executing an operation, the system can detect that the caller is not allowed to do what it is requesting, and abort the execution with an exception.
Privileged code may be used to deal with luring attacks without compromising overall system security, and yet provide useful functionality. Normally, the most restrictive set of permissions for all of the code on the current thread stack determines the effective permission set. To bypass this restriction, a special permission can be assigned to a small portion of code to perform a reduced set of restricted actions on behalf of under-trusted callers. All of the clients can now access the protected resource in a safe manner using that privileged component, without compromising security. For instance, an application may be using fonts, which requires opening font files in protected system areas. Only trusted code has to be given permissions for file I/O, but any caller, even without this permission, can safely access the component itself and use fonts.
Finally, one has to keep in mind that code access security mechanisms of both platforms sit on top of the corresponding OS access controls, which are usually role or identity-based. So, for example, even if Java/.NET's access control allows a particular component to read all of the files on the system drive, the requests might still be denied at the OS level.
A .NET assembly has a choice of using either imperative or declarative checks (demands) for individual permissions. Declarative (attribute) checks have the added benefit of being stored in metadata, and thus are available for analyzing and reporting by .NET tools like
permview.exe. In either case, the check results in a stack walk. Declarative checks can be used from an assembly down to an individual properties level.
//this declaration demands FullTrust
//from the caller of this assembly
Name = "FullTrust")]
//An example of a declarative permission
//demand on a method
Unrestricted = true)]
public static string ReadData()
{ //Read from a custom resource. }
//Performing the same check imperatively
public static void ReadData()
CustomPermission MyPermission = new
//Read from a custom resource.
In addition to ordinary code access checks, an application can declaratively specify
LinkDemand or
InheritanceDemand actions, which allow a type to require that anybody trying to reference it or inherit from it possess particular permission(s). The former applies to the immediate requestor only, while the latter applies to all inheritance chain. Presence of those demands in the managed code triggers a check for the appropriate permission(s) at JIT time.
LinkDemand has a special application with strong-named assemblies in .NET, because such assemblies may have a higher level of trust from the user. To avoid their unintended malicious usage, .NET places an implicit
LinkDemand for their callers to have been granted
FullTrust; otherwise, a
SecurityException is thrown during JIT compilation, when an under-privileged assembly tries to reference the strong-named assembly. The following implicit declarations are inserted by CLR:
Consequently, if a strong-named assembly is intended for use by partially trusted assemblies (i.e., from code without
FullTrust), it has to be marked by a special attribute --
[assembly:AllowPartiallyTrustedCallers], which effectively removes implicit
LinkDemand checks for
FullTrust. All other assembly/class/method level security checks are still in place and enforceable, so it is possible that a caller may still not possess enough privileges to utilize a strong-named assembly decorated with this attribute.
.NET assemblies have an option to specify their security requirements at the assembly load time. Here, in addition to individual permissions, they can operate on one of the built-in non-modifiable
PermissionSets. There are three options for those requirements:
RequestMinimum, RequestOptional, and
If the
Minimum requirement cannot be satisfied, the assembly will not load at all. Optional permissions may enable certain features. Application of the
RequestOptional modifier limits the permission set granted to the assembly to only optional and minimal permissions (see the formula in the following paragraph).
RequestRefuse explicitly deprives the assembly of certain permissions (in case they were granted) in order to minimize chances that an assembly can be tricked into doing something harmful.
//Requesting minimum assembly permissions
//The request is placed on the assembly level.
using System.Security.Permissions;
Flags = SecurityPermissionFlag.UnmanagedCode)]
namespace MyNamespace
CLR determines the final set of assembly permissions using the granted permissions, as specified in .NET CAS policy, plus the load-time modifiers described earlier. The formula applied is (P - Policy-derived permissions): G = M + (O<<P) - R, where M and O default to P, and R to Nothing.
Applications on .NET platform may affect the stack-walking process by executing special operations on individual permissions or permission sets:
Assert, Deny, PermitOnly. The application itself should be granted the affected permissions, as well as the
SecurityPermission that grants the rights to make assertions.
Assert option explicitly succeeds the stack walk (for the given
PermissionSet or any subset of it, as determined by the
Intersect function), even if the upstream callers do not have the required permissions (it fails if sets intersections are not empty).
Deny and
PermitOnly effectively restrict the available permission sets for the downstream callers.
This demo application demonstrates the effects of applying stack-walk modifications. Figure 5 represents an overview of the Code Access Security permission grants and checks in .NET:
In Java, permissions are normally checked by the
SecurityManager (or installed derivative), by using the
checkPermission function. It defines a helper for each major group of permissions, such as
checkWrite for the
write action of
FilePermission. All checks are imperative; there are no declarative code access checks in Java language. Each JVM can have at most one
SecurityManager (or derivative) installed -- once set, they cannot be replaced, for security reasons. Browsers always start
SecurityManager, so any Internet Java application executes with enabled security. Locally started JVMs have to install a
SecurityManager before exercising the first sensitive operation; this can also be done programmatically:
System.setSecurityManager(new SecurityManager());
or using a command-line option:
java -Djava.security.manager MyClass
In Java 2, when determining application permissions,
SecurityManager delegates the call to
java.security.AccessController, which obtains current snapshot of
AccessControllerContext to determine which permissions are present.
SecurityManager's operations may be influenced by the
java.security.DomainController implementation, if one exists. It instructs an existing
SecurityManager to perform additional operations before security checks, thus allowing security system extensibility without re-implementing its core classes. JAAS uses this functionality to add principal-based security checks to the original code-based Java security (see section "User Access Security" in Part 4).
When making access control decisions, the
checkPermission method stops checking if it reaches a caller that was marked as "privileged" via a
doPrivileged call without a context argument. If that caller's domain has the specified permission, no further checking is done and
checkPermission returns quietly, indicating that the requested access is allowed. If that domain does not have the specified permission, an exception is thrown, as usual.
Writing privileged code in Java is achieved by implementing the
java.security.PrivilegedAction or
PrivilegedExceptionAction interfaces. This approach is somewhat limiting, as it does not allow specifying the exact permissions to be asserted, while still requiring the callers to possess others -- it is an "all or nothing" proposition.
public class PrivilegedClass implements PrivilegedAction {
public Object run() {
//perform privileged operation
return null;
Suppose the current thread traversed m callers, in the order of caller 1 to caller 2 to caller M, which invoked the
checkPermission method. This method determines whether access is granted or denied based on the following algorithm:
i = m;
while (i > 0) {
if (caller i's domain
does not have the permission)
throw AccessControlException
else if (caller i is marked as privileged) {
if (a context was specified
in the call to doPrivileged)
i = i - 1;
// Next, check the context inherited when
// the thread was created. Whenever a new thread
// is created, the AccessControlContext at that
// time is stored and associated with the new
// thread, as the "inherited" context.
A complete application demonstrating privileged code in Java can be found here.
Note: .NET arms developers with an impressive arsenal of various features for access checks, easily surpassing Java in this respect.
In this article, code protection and Code Access Security features of Java and .NET platforms were reviewed. While code protection came out more or less even, CAS features in .NET are significantly better than the ones Java can offer, with a single exception -- flexibility. Java, as it is often the case, offers ease and configurability in policy handling that .NET cannot match.
The final article of this series, Part 4, is going to cover authentication and User Access Security (UAS) on both platforms, as well as provide overall conclusions to the series.
Denis Piliptchouk is a senior technical member of BEA's AquaLogic Enterprise Security group, participates in OASIS WSS and WS-I BSP standards committees, and regularly contributes to industry publications.
Return to ONJava.com.
Copyright © 2009 O'Reilly Media, Inc.


text:
i wasn't sure if this belonged here or in pumping/milk production issues so i'm sorry if this is the wrong forum. i think that supplementing for a brief period of time has led to a blocked milk duct in my right breast. one side of the breast is very tender and when you touch it you can feel a small lump. i've been trying wet heat and hand expression as recommended in the womanly art of breastfeeding but i was wondering if there were any other remedies some of you could recommend, i'm terribly sore.
i've also switched to block nursing in order to try and rectify the situation.


text:
Fitch Places U.S. on Rating Watch Negative, Markets Slump
NEW YORK (TheStreet) -- Major U.S. stock markets slumped Tuesday as Republicans and Democrats failed to show any meaningful progress in negotiations to raise the nation's borrowing limit. Shortly after the close, Fitch Ratings placed the U.S. 'AAA' credit on rating watch negative.
The S&P 500 dropped 0.71% to 1,698.06. The Dow Jones Industrial Average dipped 0.87% to 15,168.01. The Nasdaq decreased 0.56% to 3,794.01.
Speaker John Boehner said earlier on Tuesday that Republicans and House Democrats continued to engage in dialogue about the debt ceiling and budget but that there was no guarantee for a resolution of the three-week old impasse.
Senate talks had paused by Tuesday afternoon as Senate Minority Leader Mitch McConnell waited to see if House Republicans would pass their own version of a deal, according to Politico, citing aides and senators close to the talks. At the closing bell of the markets, the House was still fleshing out a proposal.
In company news, Teradata
Charles Schwab
FLIR Systems
The benchmark 10-year Treasury was down 11/32, lifting the yield to 2.734%.
-- Written by Andrea Tse and Joe Deaux in New York


text:
North Central College presents "Explore the Sound IV: Untraveled Worlds" in identical Feb. 22 and 24 concerts that invite listeners to hear several of the College's choral and instrumental ensembles and discover the stunning acoustics of Wentz Concert Hall.
Ensembles will perform in every possible location—from the side balconies, aisles, sound chambers, side stairways, loft, stage and more. "Explore the Sound IV" will take place at 7:30 p.m. Wednesday, Feb. 22 and Friday, Feb. 24, in Wentz Concert Hall at the Fine Arts Center, 171 E. Chicago Ave. Tickets are $5/adults, $3/students and senior citizens; call the North Central College Box Office at 630-637-SHOW (7469) or visit northcentralcollege.edu/showtix.
The program will feature the College's 50-voice Women's Chorale and the 20-voice mixed Chamber Singers—both under the direction of Ramona Wis, Mimi Rolland Professor in the Fine Arts, professor and chair of music—and the 55-voice Cardinal Chorus, under the direction of Jacqueline Schutt, visiting instructor of music.
The choral ensembles will be joined by the Flute Choir, directed by lecturer of music Marie Bennett, and the String Ensemble, directed by lecturer of music Mara Gallagher. Additional performances include Barbara Vanderwall, adjunct assistant professor of music, Frank Caruso, instructor of jazz and classical piano, Jonathon Kirk, assistant professor of music, student percussionist Brian Riordan and guest harpists.
"The focus of Explore the Sound is a seamless performance of a wide variety of choral and instrumental music, performed from virtually every nook and cranny in Wentz Concert Hall," Wis says. "With theatrical lighting and unusual staging, Explore the Sound is more of a sound and visual experience than a traditional concert and always features surprises for the audience."
Highlights of this year's program include Paul Halley's "Untraveled Worlds," based on the Alfred, Lord Tennyson poem which gives this year's concert its subtitle; Stephen Hatfield's wordless "La Lluvia," complete with a percussive "rainstorm" created by the performers; Eric Whitacre's evocative "Little Birds" and beautiful "Five Hebrew Folk Songs"; Ivan Hrusovsky's challenging "Rytmus"; and a new composition by faculty composer Jonathon Kirk, assistant professor of music, featuring Bennett on flute. The performances will feature a variety of flute, string and piano pieces, as well as music using electronic sound sources.
"Explore the Sound" is hosted by the Women's Chorale and evolved from an off-campus series of annual concerts the Chorale gave in Oak Park with invited faculty and student guests. This year's event is a fundraiser for the Women's Chorale's upcoming tour of Ireland in June, with proceeds going to help offset costs for the singers, who are paying their own way.
North Central College offers undergraduate programs of study in music, jazz studies and music education in choral and instrumental. Students take a combination of core music classes, private lessons, ensembles and other classes suited to their area of specialization or interest. For more information about the College's music program visit northcentralcollege.edu/music.
USG Corporation and Navistar, Inc. are underwriting sponsors of North Central College's 2011-2012 Sesquicentennial Fine & Performing Arts Season. This program is partially supported by a grant from the Illinois Arts Council, a state agency. This performance is one of many ongoing programs at North Central College to enrich and broaden the cultural and academic outlook for the College and community. North Central offers a variety of venues accommodating a rich range of local and world-class events, performances and space needs for the public. For a comprehensive schedule of musical performances, theatrical and dance productions, art exhibits and lectures, visit northcentralcollege.edu/show or call the box office at 630-637-SHOW (7469).