text:
Notice: On April 23, 2014, Statalist moved from an email list to a forum, based at statalist.org.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: st: Calling Linux's "cat" command using -shell- in Stata MP 12
Phil Clayton <firstname.lastname@example.com>
Re: st: Calling Linux's "cat" command using -shell- in Stata MP 12
Tue, 5 Jun 2012 16:52:39 +1000
I haven't got my Linux installation in front of me but on the Mac each -shell- command runs independently, starting its own session - so the "cd" from the first command won't apply to the second command.
Try something this instead:
* begin code
shell cd ~/data/txt/board_ownership; cat *_2.txt > board_ownership.txt
* end code
On 05/06/2012, at 4:30 AM, Richard Herron wrote:
> I am trying to use -shell- in Stata MP 12 to call "cat" in Linux to
> concatenate a directory of 800 tab-delimited text files. The
> tab-delimited text files all end in _2.txt and should match the wild
> card *_2.txt. I tried two variants, which both fail. First I tried:
> * begin code
> shell cd ~/data/txt/board_ownership
> shell cat *_2.txt > board_ownership.txt
> * end code
> which fails with "cat: *_2.txt: No such file or directory". However,
> in the Stata console, if I -shell- to get the command prompt, then I
> can successfully issue the "cd" and "cat" commands. I get the same
> result if I replace the wild card * with an existing file.
> Second I tried
> * begin code
> shell cat "~/data/txt/board_ownership/*_2.txt" >
> "~/data/txt/board_ownership/board_ownership.txt"
> * end code
> which fails with "/bin/bash:
> ~/data/txt/board_ownership/board_ownership.txt: No such file or
> directory"
> Can I automate this from within Stata? Or is this best done explicitly
> in the command line?
> Thanks!
> Richard Herron
> *
> * For searches and help try:
> * http://www.stata.com/help.cgi?search
> * http://www.stata.com/support/statalist/faq
> * http://www.ats.ucla.edu/stat/stata/
* For searches and help try:
* http://www.stata.com/help.cgi?search
* http://www.stata.com/support/statalist/faq
* http://www.ats.ucla.edu/stat/stata/


text:
The speed of sound in a gas depends on the "springiness" of the gas. That is, it depends on how the volume of the gas responds to changes in pressure. We have already seen one measure of this response, called the isothermal compressibility,
(1)Equation one gives a parameter that determines how the gas responds to changes in pressure if the temperature remains constant.
Sir Isaac Newton assumed that the speed of sound was an isothermal process and used the parameter defined by Equation 1 to calculate the speed of sound in a gas. His answer did not agree with experiment.
It turns out that sound transmission in a gas is an adiabatic process rather than an isothermal process. The sound wave causes oscillations in pressure but the oscillations are fast enough that heat can not move from compressed regions to rarified regions in order to keep the temperature constant. Before the heat can be conducted away from the compressed regions the compression has moved on so that sound propagation is adiabatic.
We define the adiabatic compressibility as,
(2)We can calculate the adiabatic compressibility in terms of quantities that we already know (using the Euler cyclic rule twice, once the normal way and once in reverse).
(3a, b, c)where we have used Euler's cyclic relation to go from Equation 3a to 3b and the chain rule in the denominator and numerator of 3b to go to 3c.
We already know that
(5a, b)In Equation 5b we can use Euler's cyclic rule in reverse to write
(6a,b)Since Cp > CV The isothermal compressibility is always greater than the adiabatic compressibility.
For a monatomic ideal gas, where Cp = 5nR/2 and CV = 3nR/2 we see that
Adiabatic Gas Expansion Revisited
Early in the course we derived the equation for the adiabatic expansion of an ideal gas,
(8a, b)where,
(9)You may recall that the derivation was sort of "round-about." Here we would like to use some of our new thermodynamics tools to provide a much more direct derivation.
The goal is to discover how the pressure changes with volume if entropy is held constant. That is, we would like to find the derivative,
Then we can integrate this derivative to find an expression for p as a function of V. First, let's find the derivative. Notice that this derivative is just the reciprocal of the derivative in Equation 2 so most of the work has already been done. Using the same procedures we used above we fin that,
(10a, b, c, d, e, f)Equation 10f is a general thermodynamic relationship. It contains no approximations. To proceed further we must decide what material we want to consider. The equation we were trying to derive was based on the ideal gas for which
(11a, b)So,
(12)Set up Equation 12 for integration, (don't forget to put all the p stuff on one side and all the V stuff on the other)
(13)and integrate between p1, V1 and p2, V2,
(14)where we have made the approximations that γ is independent of volume and factored it out of the integral. Equation 14 integrates to
(15a, b, c)from which we conclude that
Just for the record, we add that the correct formula for the speed of sound is
(17)where ρ is the density of the gas (in kg/m3).
Copyright 2004, W. R. Salzman
Return to the local Table of Contents,
Return to the Table of Contents for the Dynamic Text, or
Return to the WRS Home Page.

subset: commoncrawl


text:
While you were sleeping: Fed minutes, Tiffany shines
May 22 (BusinessDesk) – Wall Street gained as the minutes from the latest US Federal Reserve meeting bolstered expectations that policy makers will keep easy money flowing to help accelerate the pace of growth in the world's largest economy.
"I suspect they are going to continue this low interest rate environment, very accommodative monetary policy, for a very long period of time in an effort to help markets feel a little bit calmer as it relates to a hike in interest rates," Joseph Tanious, global market strategist at JP Morgan Asset Management, told Reuters.
Policy makers said they were not concerned that inflation might accelerate as a result of the central bank's efforts to bolster the rate of job creation.
"Because inflation was expected to remain well below the Committee's 2 percent objective and the unemployment rate was still above participants' estimates of its longer-run normal level, the Committee did not, at present, face a tradeoff between its employment and inflation objectives, and an expansion of aggregate demand would result in further progress relative to both objectives," according to the minutes.
With about an hour of trading left in the day in New York, the Dow Jones Industrial Average rose 0.88 percent, the Standard & Poor's 500 Index added 0.66 percent, while the Nasdaq Composite Index gained 0.65 percent.
Gains in shares of Goldman Sachs, up 2 percent, and United Technologies, up 1.4 percent, led the Dow higher.
Policy makers discussed the importance of communicating their plans to unwind monetary stimulus.
"Participants generally agreed that starting to consider the options for normalisation at this meeting was prudent, as it would help the Committee to make decisions about approaches to policy normalisation and to communicate its plans to the public well before the first steps in normalising policy become appropriate," according to the minutes.
"Early communication, in turn, would enhance the clarity and credibility of monetary policy and help promote the achievement of the Committee's statutory objectives," the minutes showed.
"Because the Federal Reserve has not previously tightened the stance of policy while holding a large balance sheet, most participants judged that the Committee should consider a range of options and be prepared to adjust the mix of its policy tools as warranted," according to the minutes. "Participants generally favoured the further testing of various tools, including the TDF [term deposit facility], to better assess their operational readiness and effectiveness."
In the latest US earnings, Tiffany surpassed expectations and raised its full-year profit outlook. Its shares gained 8.6 percent.
"This is an excellent and encouraging start to the year," Michael Kowalski, Tiffany chief executive officer, said in a statement. "We were pleased with the strong and broad-based sales growth across most regions and product categories and our ability to leverage those improved sales into very significant growth in operating and net earnings."
Thomson Reuters data through Wednesday showed that of 478 companies in the S&P 500 that have reported earnings so far this season, 68 percent surpassed expectations.
"The economy is shifting gears, and the biggest risk to business profits is the failure to recognise that labour turnover rates and compensation could soar in the latter part of this year and especially in the first part of 2015," Joel Naroff of Naroff Economic Advisors told Reuters.
In Europe, the Stoxx 600 Index finished the day with an increase of 0.6 percent from the previous close, as did Germany's DAX. The UK's FTSE 100 added 0.3 percent, while France's CAC 40 rose 0.4 percent.
Here, signs of increased consumer confidence helped lift the mood. The European Commission's preliminary measure of consumer sentiment in the euro zone increased to minus 7.1 in May, the highest level since October 2007, up from minus 8.6 in April.
Even so, many expect the European Central Bank to ease monetary policy at its next meeting in June, as flagged by its president, Mario Draghi.


text:
Clinical Practice Guidelines
Clinical Practice Guidelines (CPGs) are adopted by BCBSOK, and are incorporated into Condition Management Programs. CPGs are updated at least every 2 years or more frequently, as needed. You may request a hard copy of a CPG by calling 866-670-6681. If you would like to comment on the CPGs adopted by BCBSOK, please email Dr. Douglas Stewart.
The links below provide information about the CPGs.


text:
Water issues in the Middle East
Internet resources about water, scarcity and conflict in the Middle East in general
In an other section, Waternet focuses on the Jordan River basin.
In this section, Waternet offers a selection of interesting information on international water resources in the Middle East on a wider geographical scope: the Euphrates and Tigris basin with Turkey, Syria, Irak and Iran as its riparians, the Nile basin and its involvement of 10 different riparian states from Ethiopia and Central Africa in the south, to Sudan and Egypt in the north, among other cases.
- J. Anthony Allan, Middle East water: local and global issues.
- Aquastat is an information system on water in agriculture and rural development. It produces regional analyses and country profiles on water resources development, with emphasis on irrigation and drainage. For the Near East region, Aquastat presents a general summary with information about climate and population, water resources, water withdrawals, irrigation, and salinization, drainage and environment. A list of tables and several maps illustrate the information. AQUASTAT has been launched by the Land and Water Development Division of FAO. Subscribe on their free electronic newsletter.
- Arid Land Newsletter on conflict resolution and transboundary water resources (fall/winter 1998).
- C. Chesnot, La bataille de l'eau au Proche-Orient, Le Monde Diplomatique, Avril 1994.
- Article by the Turkish president Suleyman Demirel on the importance of transboundary water basin management, published by the Turkish Daily News, 4/9/2004.
- H. Elver, Emerging Water conflict in the Middle East? The Case of the Euphrates and the Tigris Rivers Basin.
- Green Cross International, Averting Water Crisis in Middle-East: Report of the Workshop in Paris on 18 March 1998.
- Krieg um Wasser - die neue Gefahr für den Weltfrieden? in: G°O.de - Geoscience online (German)
- Green Cross International, . Updated project proposal for the Water Forum (21 - 23 March 1999 in Cairo).
- International Development Research Centre (IDRC), Water balances in the Eastern Mediterranean (2000), a book edited by David B. Brooks and Ozay Mehmet, and now available online.
- M. Lowi, Political and Institutional Responses to Transboundary Water Disputes in the Middle East.
- Med - Intelligence: L'eau au Maghreb et au Moyen Orient.
- S. Myllylä, Cairo - A mega-city and its water resources, The third Nordic conference on Middle Eastern Studies: Ethnic encounter and culture change, Joensuu, Finland, 19-22 June 1995.
- The Middle East and African Water Review of the School of Oriental and African Studies' (SOAS) Water Issues Group.
- K. Pamukcu, Water-related cooperation between Turkey and Israel.
- M. Saleth, A. Dinar, Water Challenge and Institutional Response (A Cross-Country Perspective), World Bank, 1999, 55 p.
- I. Serageldin (Vice President for Special Programs, World Bank) , Moving from Conflict to Cooperation.
- D. Sitton, Development of Limited Water Resources: Historical and Technological Aspects. American-Israeli Cooperative Entreprise, 2001.
- United Nations Dag Hammarskjöld Library, Water Resources in the Middle East : a bibliography. Last updated February 1999.
- Water-related issues by the Turkish Ministry of Foreign Affairs
- General reflections on water issues by the government of Turkey, within a national and regional context.
- Water: A source of conflict of cooperation in the Middle East?
- Water issues between Turkey, Syria and Iraq.
- The Manavgat water supply project.
- A long list of documents, presentations, speeches, etc. related to waterissues.


text:
The angels have found a new Charlie: Victor Garber is the new voice of the boss on ABC's remake of Charlie's Angels, premiering Thursday (8 ET/PT).
Garber, a Broadway and film actor best known to TV viewers as Jennifer Garner's dad on Alias, will — of course — be unseen in the role, first voiced by John Forsythe in the original series, which ran from 1976-81.
Robert Wagner, another 70s TV star, had been tapped for the new role, but producers changed their minds.
Sign up for Lifeline Live e-mail alerts


text:
The oppostite of feeling good. Someone or something made you feel insecure, or phsically not feeling good. Like if you cut your self. It's not going to feel good. It will feel bad and hurt.
If you get burned from a stove. You ( your hand, foot, ext.) will not feel good, you will feel bad. You will be feeling bad
by Human that feels bad January 22, 2014
The Urban Dictionary Mug
One side has the word, one side has the definition. Microwave and dishwasher safe. Lotsa space for your liquids.Buy the mug


text:
I have been studying Spanish since 4th grade and have been fascinated with Spanish culture for most of my life. When I found out that Saint Louis University had its own campus in Madrid, I was hooked. I completed my application to the school within a week and started to find myself drifting into daydreams about sampling tapas or passing my afternoons studying in La Plaza Mayor.
I am now a sophomore at Saint Louis University studying Political Science, Social Work, and Spanish. I spent my summer working over 40 hours a week and planning weekend adventures in Europe so that I would be ready for the trip of a lifetime during the Spring 2012 semester. One summer evening, as I was checking my e-mails, I saw an application for the Fall Fellow Program with Organizing for America. Having worked on the 2008 campaign, I jumped at the chance to become a more committed volunteer and to get a true behind-the-scenes look at what goes on.
I have been a Fall Fellow in the St. Louis area for a mere two weeks. Yet when I take a break to think about the work we're starting now, I can already feel the rumbling energy. I hear the excitement in the voices of people on the other end of my phone when I invite them to a phone bank. I see the look in student's eyes when they register their first voter. I feel the struggles of the people we talk to who don't have health care or have lost their job, and how badly they want to see serious change for the people of our country. There is something incredible about being a part of a movement like this.
This campaign is bigger than my roommate keeping her Pell Grant to go to school or Joe being able to defend his country openly, or Nancy being able to keep her healthcare with a pre-existing condition, or any other struggle we may face individually. For me, it's even bigger than Spain. I have decided to postpone my semester in Spain so that I can stay on and continue to work with Organizing for America through the spring semester. The work we do through the next year not only determines who lives in the White House for the next four years, but determines the livelihoods of my neighbors, my friends, my family, and my fellow Americans. It would be foolish to turn down an opportunity to be a part of something like this. Madrid can wait. America's future can't.,
Join Catherine. Volunteer!


text:
£3.2m revamp for Royton estate
Date published: 10 July 2014
A MAJOR refurbishment programme in Royton will bring about the transformation of 218 homes.
What started as the installation of new windows and bathrooms in 161 flats at Royton Hall Park estate last November, has now been expanded into a £3.2 million, five-year project which will include new heating systems, new staircases and work on external pathways, gardens and drainage systems.
This year the current electric storage heaters will be replaced with new slimline energy-efficient heaters that give the customers more control over their heating and energy bills.
Sean Barnett, area maintenance manager for Guinness Northern Counties, said: "While the small-scale investment so far has helped sustain the scheme, the long-term viability of the scheme could be in jeopardy without a comprehensive plan of future investment.
"We are delighted to be able to commit to a five-year investment plan of environmental and capital-replacement work required to improve the estate and we hope as well as helping to improve the overall aesthetics of the estate that it will also help to create a sustainable environment where people choose to live and stay.
Further improvements planned for the next three years include work to the car park and footpaths, the design of new garden areas, external painting and new drainage, including improvement works to the 57 houses on the estate.
For a full version of this story see the digital edition or buy the Chronicle.
Just wait until all the Shaw whingers read about this.
When something gets done in Shaw we might just stop Winging.
Metrolink stop with free park and ride, giving better connections to the whole of the conurbation + modern retail outlet + safer road junction + park improvements + borough-wide investments for all of Oldham. You do know that you are allowed to venture out of Shaw.
How can spending 3.2 million help people to save money ? 218 homes will Never waste 3.2million ££s. Ever. The spend outweighs the problem ! Our Goverment want to spend Billions on useless projects ? If the same Goverment gave every person in this country 1 million £s then everyone one would spend that cash on making improvements themselves, and it wouldn't run into Billions.
I Will Not Lower Myself.
Have Your Say
Post New Comment
To post a comment you must first Log in. Don't have an account? Register Now!


text:
Need help? Check out our Support site, then
Back to WordPress.com Forums
- Member Since
- July 12, 2012 (5 years)
- Website
- http://amessengerofthelight.wordpress.com
User Activity
Recent Replies
- Orange links just poping up User last replied: 4 years ago. Most recent reply: 4 years ago
Threads Started
No more topics posted.


text:
Derrick Rose is probably very popular with McDonald's executives Wednesday, but some Chicago Bulls fans are miffed with the NBA's reigning MVP.
Rose had a chance last night to make the burger chain deliver on its promise to give every fan in attendance a free Big Mac any time the Bulls score 100 points at home.
But even though he scored 32 points while leading Chicago to a victory against Chicago, it was Rose's two missed free throws with 4.3 seconds remaining that left the final score at 99-95.
According to ESPN.com, Rose heard boos from some in the sellout crowd of 21,919 while he was interviewed on the court after the game.
Rose likened his failure to the Jackie Moon character in Will Ferrell's Semi-Pro movie. In that case, Ferrell played an owner-coach who tried to thwart a corn-dog giveaway.
"I feel like Jackie Moon off of Semi-Pro. That's all I was thinking about, man," Rose told ESPN.com. "I saved McDonald's a lot of money, so they should be happy."
Reid Cherner has been with USA TODAY since 1982 and written Game On! since March 2008.
He has covered everything from high schools to horse racing to the college and the pros. The only thing he likes more than his own voice is the sound of readers telling him when he's right and wrong.
Michael Hiestand has covered sports media and marketing for USA TODAY, tackling the sports biz ranging from what's behind mega-events such as the Olympics and Super Bowl to the sometimes-hidden numbers behind the sports world's bottom line.


text:
We have some GREAT deals over at CVS for you today. There's an unadvertised deal on their diapers and training pants this week! Here are your deals:
At CVS:
Buy ONE CVS Training Pants Jumbo Pack, sale price $7.99 (through 9/24)
Get $3 ECB for buying one Training Pants Jumbo Pack
Use one $2/1 off Any CVS Health Training Pants printable coupon (preclipped)
Price at register: $5.99 but get $3 ECB
Net Price: $2.99!
Buy ONE CVS Diapers Jumbo Pack, sale price $7.99 (through 9/24)
Get $3 ECB for buying one Diapers Jumbo Pack
Price at register: $7.99 but get $3 ECB
Net Price: $4.99!
Thanks, WildforCVSExtreme Couponing Tip: You can usually get two prints of most internet coupons. To find them in the easiest possible way, use our preclipped links that take you right to the coupon. Then come back and click the same link to get your 2nd print. This will save you the time spent searching for the coupon.
Never miss another hot coupon, deal or freebie again! "Like" Couponaholic .NET on Facebook, Follow us on Pinterest, Follow us on Twitter, Follow us on Instagram or Subscribe to our Daily Email Newsletter!


text:
Performances in national "Wicked" tour fall flat
Christine Dwyer, playing Elphaba the green witch, furiously chanted magical spells on a dark, bare stage.
"I am wicked through and through," she said, and her new philosophy became clear.
The national tour of the Broadway smash hit "Wicked" is now playing at downtown Syracuse's Landmark Theatre through Dec. 9. Despite considerable standouts and heavily lauded production value, the company and production did all but defy gravity.
In the scene's final moments, Elphaba defiantly declared, "No good deed will I do again!" The power Dwyer exhibits was palpable, but the empty stage served as a metaphor for her company among the ranks of noteworthy performances.
The Tony and Grammy award-winning musical — with music and lyrics by Stephen Schwartz, book by Winnie Holzman and direction by Joe Mantello — tells the untold story of the two witches of Oz: Elphaba and Glinda. Or as they are more famously known, the wicked and the good.
Once friends and school roommates, the two go their separate ways to become the witches we know them to be. But "Wicked" gives insight into their relationship. They helped each other, pined for the same boy and had dreams about what awaited them in the Emerald City.
All the creative components in this production of "Wicked" are the same as those that entertain crowds at the Gershwin Theatre inNew York City. The Broadway show has the highest gross in the past eight years and has earned more than $2.8 billion worldwide from domestic and international runs.
It goes without saying that there is a "Wicked" formula that works. Mantello's direction is dramatic and grand without turning the prequel into a joke. If critical acclaim is not enough to indicate success, it's the crowds' reactions to the scene that contains their favorite songs.
In fact, members of a typical "Wicked" audience can most likely be seen mouthing the words along with the actors, if not singing them full out.
This is due to Schwartz's wonderfully campy yet brilliantly written score. By now he can be considered no less than a genius for creating music that has captured an entire generation of musical theater.
But an audience member's rendition would have been welcomed in this circumstance, as Jeanna de Waal displayed the overall vocal technique and precision of an amateur. Her Glinda did not live up to the bright, clean delivery that Kristin Chenoweth gave in the original Broadway soundtrack dominating theater geeks' iPods.
At the other end of the spectrum, the audience finds Dwyer's sheer triumph as the conflicted yet powerful Elphaba. In a cast of relative unknowns, she earned the only applause upon her first appearance. Though the role naturally commands such a response, Dwyer used every second as an opportunity to transform into the iconic role.
The pinnacle of this trait comes at the climax of the show's absolute showstopper, "Defying Gravity." She showed true mastery of her character and belted out notes and musical runs that rival her role's predecessors.
Her success is not due to her performance's similarity to Idina Menzel's original undertaking, not to mention their uncanny resemblance. Rather, it can be chalked up to embodying comparable conviction in her scenes and precision in vocal ability. Unlike her counterpart, Dwyer's performance can hardly be considered green.
The ensemble cast, a supporting character in and of itself, falls flat in crucial scenes that call for spectacular performances while shining brightly in others. The opening number, "No One Mourns The Wicked," which serves as the audience's introduction to the show's overall tone, proved to be disappointing in what can only be compared to a pre-professional rendition.
Despite moments when the production flat lined, the mere prospect of seeing a performance of "Wicked" induced childish, giddy excitement.
Just replace those that don't measure up with the soundtrack's performances.
Published on December 3, 2012 at 12:32 am
Contact Noah: firstname.lastname@example.com


text:
Research in Organizational Behavior, Volume 21
Robert I. SuttonISBN: 0762305738; 9780762305735;
Издательство: Elsevier Science Ltd
Hardbound. Volume 21 of Research in Organizational Behavior continues the tradition of innovation and theoretical development with eight diverse papers. Most of these papers present theory and propositions that make linkages between different levels of analysis. The subjects addressed include: a multilevel theory of self-serving behavior; individual, organizational and institutional processes which lead to environmental destruction; the role of collective mindfulness in high reliability organizations; the effect of digital communications technologies on work and organizations; and organizational identification.


text:
of our UK undergraduate students are in employment or further study within six months of completing their studies
(according to the 2014/15 DLHE survey)
You'll join a friendly community of almost 19,000 staff and students
At CCCU we're proud that we attract students and staff from all over the world and from all kinds of backgrounds. We value diversity and believe that everyone deserves an equal opportunity to succeed. Equality, Diversity and Inclusion are central to our ethos and underpin everything that we do.
The Equality, Diversity and Inclusion Unit support a number of different projects to assist staff and students.
Find out more
The Equality, Diversity and Inclusion Unit and associated Staff Networks run various events, lectures, showpieces and promotions during the year.
View our latest events
CCCU has a number of independent Staff Networks which are supported by the Equality, Diversity and Inclusion Unit. Each Network serves a slightly different purpose.
An A-Z List of policies, procedures, papers and guidelines.
Please get in touch if you wish to raise a question or issue, or share some information
Get in touch
Browser does not support script.
View our social media directory
University Switchboard: +44 (0)1227 767700 Admissions Enquiry Team: +44 (0)1227 782900
University Switchboard:+44 (0)1227 767700
Admissions Enquiry Team: +44 (0)1227 782900
© 2017 Canterbury Christ Church University
Last edited: 15/02/2017 09:24:00


text:
Hello all.
I have a script that I would like to run every few minutes or so. I've been trying to get it running
repetitively with minicron, but I believe that I'm doing something wrong, because it does not get
called at the interval I specfied.
For example, the script I want to call is called "keepalive.php". I have put it in the
/usr/local/www/ folder. It gets called once after bootup (which works fine), and the I use the line:
exec("/usr/local/bin/minicron $interval {$g['varrun_path']}/minicron.cp.pid " .
(where $interval has been set to 300, 120, 60.... without success).
CAn anyone tell if I'm doing something wrong. Has anybody else used Manuel's minicron to accomplish
something successfully??
Ben Z


text:
Click to Watch in HD > Virgins or Non-virgins? - Tell Me More: EP 6
Watch On this episode of TELL ME MORE, Kelly goes to the streets to find out if people would rather date virgins or non-virgins... Would YOU prefer dating a virgin or someone whos not? Let us know in the comment section down below! Like our Facebook page: http://www.facebook.com/theincentral Kelly on Instagram: http://www.instagram.com/blowawaykisses Visit our website for more: http://www.theincentral.com Twitter: http://www.twitter.com/theincentral Instagram: http://www.instagram.com/theincentral Facebook: http://www.facebook.com/theincentral
Youtube Channel / THE IN CENTRAL
share on twitter
share on facebook
share on google plus
share on linkedin
share on stumbleupon
share on pinterest
Related Videos
Cat Cafe - The In Thing: EP 5
Is Anime Similar To Hentai? - Tell Me More: EP 5
Slimming Products - Treasure Trash: EP 4


text:
Today is the day for hearts and love and lots of Hallmark happiness, which, luckily for my husband, I have never gotten swept up in. I'm a practical girl. AKA cheap. Tight with my money. Thrifty. No need to spend hundreds on roses that will be dead within 48 hours, or mediocre chocolate. I'll tell you what I do love on Valentine's Day or any other day though. A new toy for my kitchen 🙂 , and that's just what I got this year!
I've wanted an ice cream maker forever. I've had this vision that I would create healthier ice creams, frozen yogurts, sorbets, you name it, and post them on my blog all year long. Mind you I can't possibly eat all of these frozen treats. I just want to experiment and let you try them. It's kind of how I love to cook for other people, but when I'm alone I'm fine with a bowl of cereal. Continue Reading..


text:
Residents have had their first look at the £11.5 million refurbishment of the Purley Hospital.
An artist's impression of how the building may look by next summer was also unveiled at a public meeting last week.
Croydon Health services are working with private contractor Millers HPS, to redesign and refurbish the existing out-patient and diagnostic areas.
The plan also involves bringing wards that are currently disused, back into use as clinics and a GP practice.
The design is near completion and building work is due to start next month, members of Millers HPS, the Trust's own estates experts and project manager Cerian Henshaw, attended the meeting to explain both the design and the programme of building works.
Most services are being moved to other locations while the work is carried out, with all patients being offered new appointments, mostly at Croydon University Hospital.
The Urgent Care Centre (UCC), supported by diagnostics, will continue to operate from the site, but when the diagnostic services moves off-site in December, the UCC will be unable to provide access to X-rays for about three weeks.
Once the supporting diagnostics services are back in place the UCC will become fully functional, this is scheduled for March 2013.
All other services and the rest of the site will remain closed until work is completed in June 2013.


text:
Heidi Klum Ditches Make-Up for Children's Charity — 24 Other Stars Who've Gone Au Naturel (GALLERY)
Heidi Klum has revealed her bare-faced beauty — all for a good cause.
The Project Runway star, 39, took off her trademark eye shadow, mascara, blush, foundation and lipstick in a recent photo shoot to support the BBC 'Children in Need' campaign. The organization gives out millions of pounds every year in grants to support children's charities across the United Kingdom.
The mother-of-four also wore the campaign's trademark tiny paw print on her cheek, to lend her name to the cause.
Klum is not alone in her naked beauty. Indeed, many other celebrities have gone au naturel, as evidenced with this Celebuzz gallery of natural beauties who don't need makeup.
Klum split from her husband, singer Seal, in Jan. 2012 and is now dating her bodyguard Martin Kristen.
As Celebuzz previously reported, Klum confirmed she was dating Kristen in September, telling Katie Couric: "He's cared for our entire family, mostly for our four children. [He] helped us tremendously. I trust him. I trust him with my children's life. He's a great man. And we just got to know each other from a completely different side."


text:
Not really. Think about this, today on Rachel Maddow's show I listened to Nancy Pelosi talk about the press conference were Luke Russert asked if she was going to step aside because of her age, she was right to call the question rude, if it wasn't asked of the men who are her age or older in the Senate and House, that is a problem, but, not the biggest one. The biggest one we have is the idea that we have to separate voters by gender, race, sex, and sexual orientation, and that Ms. Pelosi has decided that we need to separate the new members of the House and Senate the same way. Here's the thing Ms. Pelosi, we are all Americans, we all vote, and our votes count the same no matter who we are.
In this the most recent election I thought that maybe things would be different after President Obama won again, but I can see that what is needed is a swift kick in the head, so, I hope this is it. It does not matter if you are a woman. It does not matter if you are "a member of the LGBT" community, it does not matter if you are Hispanic, it does not matter if you are African-American, it does not matter if you are Chinese, Japanese, Native American, White, Irish, Scottish, German, heck it does matter if you are a Martian, if you where born in the U.S. or you are a legal citizen of the United States your vote counts the same as anyone elses, and you have a right to serve in the government when you are elected to that office, and none of the stuff above should matter a lick. Anyone who brings this stuff up is just patting themselves on the back, or race baiting. And don't get me started on religion, I don't care if you are a Christian, Muslim, Pagan, Buddhist, Maoist (well maybe), Hindu, whatever, if you are an American and you care about this country then none of this matters, what matters is caring what happens to this country and its people.
Ms. Pelosi in my opinion was wrong to pat herself on the back in the interview over the fact that there is a larger number of "other than white straight men" as Rachel Maddow put it in both the House and Senate than in past years. Here's a fact that a lot of people on both sides don't want to admit, the number of white men in this country is getting smaller, or the number of other than white men in this country is getting larger, one of the two, and that is something I'm actually glad to see, because, the majority of white men that I know are bigots or closet bigots, they are afraid of the other, the other of course is anyone who doesn't think and feel the same way as they do.
Why can't we all get along? Because, there are too many people out there who think that they are doing something great if some of the "others" get a small chance at being big every now and then. Or, they don't want the "others" to get any where because it would mean "losing their America" to the "others". This is the way it's always been in this country and this is the way it will always be in this country until we all wake up and realize that we are ALL AMERICANS, and we all have a vote and that vote counts the same as everyone elses vote.


text:
Priti NYC: Priti Summer Day Kit
The names of the colors are reason enough to love this line of nail care. But the absence of toxins is what makes Priti so environmentally pretty.
100% Biodegradable, non-toxic, and non carcinogenic. It is derived from farm crops and does not contain any petroleum ingredients.Added 5 Years Ago from Pritinyc


text:
Looks like Stone Ranch at Westover Hills is no longer available on Rent.com which means this information is likely out of date.
Make sure to check out these similar properties in the area.
Stone Ranch at Westover Hills is located in Nortwest San Antonio off of highway 151 and is part of the master-planned Westover Hills Resort, business and residental community. Our brand new 1, 2 and 3 bedroom apartment homes offer an impressive array of designer home features and amenities. Enjoy easy access to downtown San Antonio, International Airport and Sea World. Spoil yourself at Stone Ranch at Westover Hills!
Please call below to find out about lease terms.
No breed or weight restrictions and up to 2 pets per apartment.
Cats Allowed. Dogs Allowed. Call for service animal policy.
142 units
Don't have a Rent.com account? Create one.
Creating an account allows you to acccess your saved and contacted properties on any device. Already have an account?
Log In
We are experiencing technical difficulties at the moment. Please try again later.


text:
FDA: Wash. company will keep cheese off market
YAKIMA, Wash. (AP) – The U.S. Food and Drug Administration says a Washington state cheese processor has agreed not to sell its products until they are proven safe for consumption.
Sponsored Links
The FDA said in a statement Monday that Del Bueno of Grandview, Wash. had agreed to terms of a consent decree on April 3. Under the agreement, Del Bueno cannot process or distribute food until it has developed a program to eliminate Listeria from its production facility and products.
Listeria is a foodborne pathogen that can cause serious illness and death.
The statement noted that inspectors have documented numerous deficiencies in Del Bueno's processing facility since 2009. The company's Queso Fresco Fresh Cheese was linked to a case of listeriosis in 2010, and the FDA issued a warning letter to Del Bueno last year.
Posted | Updated


text:
Click on the links below to access webpages created by Mr. Foley for use in the classroom:
Remembering September 11
A page of links to archives relating to the attacks of 11 September 2001.
Strike to be more human!
An on-line exploration of the anti-Vietnam War protests at the University of Illinois at Urbana/Champaign in May, 1970. These pages are designed to guide students into a deeper understanding of the nature of anti-war protest by using a case study from U of I. This is also a growing archive of documents relating to the protests, including student-created oral histories.
The Case of the Curfew
During the Vietnam War era many communities responded to protests by instituting curfew laws. Some of these laws were found to be illegal, for various reasons. In this lesson students will use primary sources to explore the actions of their local government in creating a curfew law, and the response of the protest community resulting in the law being overturned. Finally, students will examine current curfew laws in their community and reflect of the meaning of these laws.
The Potawatomi Trail of Death
A website built in conjunction with the Early American Museum in Mahomet, IL. This site uses primary sources to tell the tragic tale of the Potawatomi Trail of Death, which passed through Champaign County in the late summer of 1838.
The Plantation Books On-Line
A website built on
James Henry Hammond's Plantation Manual,
this site is designed to expose the realities of slavery on plantations in South Carolina during the 19th century.
Say it Plain Teacher Resources
A unit of study based around the radio program Say it Plain, which examines African-American leaders and their famous speeches.
Back to homepage
– Last update: 2011.9.7 by
M. Foley


text:
|Comments on Photo
|Add Comment
By bhoran
From: Boulder, CO
Feb 10, 2009
|This is one of Illinois great sandstone traverses. I'm not sure of the status of this area but it used to be a hot spot for local climbers Adam Grawsoski and Adam Carrier to name a few and an ultimte challenge for visitors. Is Makanda Bluff still open?
By Woodchuck ATC
Nov 22, 2009
|I have no idea if it's still open. Isn't this a classic John Gill traverse from the 60's?
By Dave Hug
From: Carbondale, Illinois
Jul 4, 2014
|Hey guys, I am happy to let you know that Giant City State Park is still open to climbing and will continue to be for a long time to come.
|Avg Score
|0.0 from 0 votes
|Your Score


text:
posted by Joanna .
A volume of gas v at temperature T1 and pressure P, is enclosed in a sphere. It is connected to another sphere of volume v/2 by tube and stopcock. This second sphere is initially evacuated and the stopcock is closed. If the stopcock is now opened and the temperature of the gas in the second sphere becomes T2, while the first sphere is maintained at the temperature of T1, show that the final pressure P' within the apparatus is P' = 2P T2/2 T2 + T1


text:
|Re: [Qemu-devel] Re: [RFC] Disk integrity in QEMU
|Avi Kivity
|Tue, 14 Oct 2008 18:37:12 +0200
Ryan Harper wrote: > fio --name=guestrun --filename=/dev/vda --rw=write --bs=${SIZE} > --ioengine=libaio --direct=1 --norandommap --numjobs=1 --group_reporting > --thread --size=1g --write_lat_log --write_bw_log --iodepth=74 > > How large is /dev/vda? Also, I think you're doing sequential access, which means sequential runs will improve as data is brought into cache. I suggest random access, with a very large /dev/vga. >> OK, but in this case the size of the cache for "cache=off" is the size >> of the guest cache whereas in the other cases the size of the cache is >> the size of the guest cache + the size of the host cache, this is not >> fair... >> > > it isn't supposed to be fair, cache=off is O_DIRECT, we're reading from > the device, we *want* to be able to lean on the host cache to read the > data, pay once and benefit in other guests if possible. > > My assumption is that the memory would be better utilized in the guest (which makes better eviction choices, and which is a lot closer to the application). We'd need to run fio in non-direct mode to show this. -- Do not meddle in the internals of kernels, for they are subtle and quick to panic.
|<Prev in Thread]
|Current Thread
|[Next in Thread>
|Previous by Date:
|[Qemu-devel] Re: [kvm] Re: [PATCH 0/5] bios: >4G updates, Glauber Costa
|Next by Date:
|Re: [Qemu-devel] Re: [RFC] Disk integrity in QEMU, Avi Kivity
|Previous by Thread:
|Re: [Qemu-devel] Re: [RFC] Disk integrity in QEMU, Ryan Harper
|Next by Thread:
|Re: [Qemu-devel] [RFC] Disk integrity in QEMU, Rik van Riel
|[Date] [Thread] [Top] [All Lists]


text:
Thursday, August 6, 2015
What Laika BOSS means to NIDS
As explained in my plea for NIDS to adopt an interface for external analysis of payload objects, the motivation for this separation comes down to specialization/Unix philosophy and general need for file analysis capabilities. There is a market for really good NIDS. I see the need for really good file-centric IDS (FIDS). They should be plumbed together, but the file analysis systems need to support more than just NIDS sources. If Laika BOSS's relatively simple zeroMQ message format becomes the de-facto interface NIDS use to provide files for external analysis, I'll be flattered.
Some NIDS will be tempted to try to build Laika BOSS style analysis into their core engine. While some steps towards greater payload visibility will always be welcome, going too far down this path will be a distraction. This will ultimately be similar to NIDS that have tried to bring in external log analysis/SIM functionality. A NIDS specific file analysis framework will always lag in content compared to a general purpose file IDS. More importantly though, there is still much to be done in the realm of network protocol analysis. The security community is much better served with NIDS engines that focus on support for protocols such as RDP, SMB, and HTTP2 over file formats such as JAR, SWF, and PDF. If a NIDS project wants to implement their own FIDS, I'd recommend keeping them separate, similar to Snort/Razorback.
In addition to opportunity cost, today's NIDS just can't support the depth of analysis on files that some users want. This isn't to say that current NIDS aren't making an effort to provide these features. Both Bro and Suricata are both making strides towards this goal. I think the lua based rules that Emerging Threats has developed for Suricata, including functionality such as decompressing a JAR and analyzing constituent files, has given the community a taste of what must be.
However, today's NIDS, at least as currently architected, can't support the depth of analysis that is needed for today's complex file formats. It's not just the complexity of desired workloads that is a problem, it's also inability to scale to ever increasingly parallel and economic platforms. It's easy to pay for servers totaling dozens of CPU cores, but current NIDS architectures can't scale well beyond about 16 threads, let alone operate on cloud resources. Suricata is the only mainstream NIDS that I know of that supports dynamic load balancing, but in practice this doesn't scale well, with most high speed implementations using static load balancing for relatively independent worker threads. (And no, mechanisms such as the AF_PACKET rollover option do not help if they balance packets from the same stream to different workers, breaking stream reassembly).
The Laika BOSS white paper reports statistics from a real network using Laika BOSS configured with many modules including CPU intensive detection mechanisms for some file formats. Most object scan times are under 50ms but the average time spent processing a portable executable is 83s. My previous studies on this topic have convinced me that this level of variance in throughput will never be feasible in the current NIDS paradigm because as one scales up the number of NIDS threads, the limit on scalability remains the worst case load distribution. However, many want to be able to do this depth of analysis and are more than happy to pay for commodity CPUs to do it. Most users are willing to put depth of analysis in front of IPS capabilities and the associated real time constraints. If NIDS provide files to Laika BOSS asynchronously, the additional layer of dynamic load balancing makes this level of analysis feasible.
We're very close to being able to provide payload files to external systems in current NIDS. Both Suricata and Bro can write files out to a filesystem. Furthermore, lua scripts in Suricata have access to reassembled file payloads. Bro has a new file analysis framework. There are a few limitations with all of these approaches. In many cases, providing network layer context for a file is not straightforward. In other cases, access to the file is provided in chunks instead of in a single buffer. However, I hope that in the near future, we'll see efficient integration of Laika BOSS with NIDS, allowing the offloading of analysis of all objects passing through the network. In the meantime, there are organizations using Vortex/Ruminate derivatives to provide network payloads in a scalable, if not ugly way.
I heartily endorse Laika BOSS. I'm proud that Lockheed Martin has made this tool open source. I feel it has a good shot at becoming the file analysis engine that the community needs. I believe that the ease of creating modules and the general interface suitable for many use cases will make it popular among users. I hope that NIDS engines are soon able to efficiently integrate with Laika BOSS to offload file-centric analysis.
Saturday, June 21, 2014
Tactics for Storing Security Event Data
I'd like to share some tactics that I have found to be useful for storing and retrieving security event data. These approaches can certainly be backed by theory, but I've also come to learn their value through real world experience, including some hard knocks. One impetus for finally putting these thoughts down is to explain the motivation behind MongoR, a wrapper around MongoDB which was written by a close colleague and recently open sourced by my employer. However, MongoR only addresses some of these considerations, and I believe these issues should be addressed by all data stores that want to better support users who warehouse security event data. Many data stores already utilize these tactics or make it possible for the user to do it on their own, but few leverage all the optimizations possible for storing logs.
Storing and retrieving security event data, such as network infrastructure or sensor logs, is non-trivial due to the high insert rate required. In addition to large volume, most off-the-shelf data stores are poorly tuned to rolling window style of data retention that is usually desired. For example, a typical use case would be to store 90 days of logs and to be able to search them based on key indicator types such as IP addresses.Security event data typically has the following properties:
- Organized primarily by time
- Limited, Fixed Retention
- Immutable
- Not Highly Relational
- Very high insert to query ratio
- Core indicator types (ex. IP) comprise most searches
- Searches are typically for rare data (ex. attack activity)
These properties are nearly diametrically opposed to that of a typical database driven app such as a service ticket, e-commerce, or ERP system. As such, it's not surprising that it requires some work to adapt databases to storing event streams and that many systems that are successful look more like search engines than databases.
Why Mongo?
NoSQL data stores like MongoDB work very well for security event data, fitting the not highly relational property well, and providing a lot of flexibility when a fixed schema just isn't possible. Ex. Storing and accessing arbitrary HTTP headers in something like Mongo is great. When there are search engines like Elastic Search that store documents with flexible schemas, why would you even use something like Mongo? There are a few reasons, but one major driver is that Mongo and similar databases readily support alternative access methods, such as map/reduce. In speaking about tactics for log storage, I'm generally not going to differentiate between NoSQL databases like MongoDB and search engines like ElasticSearch as the delineation between them is blurry anyway. I merely wanted to note that there is room for both approaches in the security event storage realm.
Events are Stored to be Deleted
Providing the capacity to support an adequate insert rate can often be difficult, but paying nearly as much for deleting an old event as inserting a new event adds insult to injury. The time honored approach is to use some sort of time based data partitioning where each shard contains a time slice of events, whether the trigger for a new shard be date based or size based. Glossing over issues such as fragmentation, the expensive part here is not pruning the data itself, but removing entries from indexes. Trimming documents out of the indexes is expensive and significantly increases the database's working set. Deleting event data should be cheap. Many data stores don't support date based sharding with efficient deletes so this must be done by the user. This is one of the core benefits of MongoR: pruning old data is a simple collection (table) drop.
Working Set Blues
Generalizing beyond efficient deletes, the major driver for data partitioning is keeping the working set of a database manageable. The only way to maintain high insert rates is to keep most of the area of active writing cached in RAM. This is especially imperative for indexes as these usually involve very random writes (the document data itself can usually be written sequentially). Sharding helps keep the working set manageable by bounding the size of the data actively written. The downside to this approach is that you have to check every shard during a query, multiplying IOPS by shard count. For security event data, this is very often a wise trade-off. This is the other major benefit MongoR adds on top of MongoDB: managing many collections that are small enough to fit in RAM.
Tiered Storage Please
While MongoR addresses some of the most fundamental issues required to make MongoDB serviceable for high rate security event data, there is more to be done and it's not specific to MongoDB. One my pet peeves are databases that don't readily support separating indexes from raw data. There are many people who want to index a relatively small part of raw events, say just the IP address from web server logs. When indexes are mingled with document data, the IOPS required for writing the indexes can be much higher because the indexes may be spread over a larger number of blocks than would occur if indexes are grouped together. To the degree that document data and indexes have different read/write patterns and especially when indexes are smaller than base data, using tiered storage is beneficial.
Indexing the Kitchen Sink
Many systems used to store security event data support indexing a portion of the data in event records, while some support an all or nothing approach. Some are flexible in what fields can be indexed and some are fixed. Flexibility is always appreciated by advanced users who can say in advance what they will typically search. The all or nothing approach can make the use of the system very expensive and can lead to excluding data useful for analysis but not likely to be searched directly.
Stop the Sync Shell Game
One of the fundamental trade-offs a data store has to make is between efficiency and data safety. You can cache heavily and get high performance or constantly sync data to disks and get data safety, but not both. This dichotomy, however, neglects a few optimizations. First of all, security event data is by design immutable. If done right, the raw event data would be dumped with simple sequential writes and loaded with unsynchronized reads.
Another optimization lies in the presumption of some sort of sharding where only the current data collection needs to be loaded in RAM (and for proper performance needs to be wholly in RAM). If the indexes are the expensive part of a data store, requiring all sorts of IOPS to keep synced, why are they written to disk before the shard is finished? In the event of a failure, the indexes can always be re-created from the source data (sequential access). This also opens the door to using efficient data structures for the in memory indexes that may well differ from what is best for the on disk indexes or indexes that are created incrementally. Once you've relegated yourself to keeping your current shard in memory, embrace it and leverage the resulting possible optimizations.
There is no Trie
Moving beyond binary trees for indexes is liberating. Various alternative indexing mechanisms, most of them involving hashing of some flavor, can provide constant time lookups and require fewer IOPS than binary trees. For example, I've been using discodbs based on cmph, and have had fantastic results. The minimal perfect hash functions used result in indexes that are less complex than a binary tree, involve much fewer IOPS for queries, and are much smaller than an optimal bloom filter. The trade-off is that they are immutable and cannot be efficiently updated or created incrementally, but that is not a concern for immutable log data.
Proponents of binary trees will claim that prefix matches are a killer feature. I'm not sure they are, and they are easily provided through other techniques anyway. Domain names are a prime example of a data type that does not work well with the prefix searches supported by typical binary tree indexes. Sure, you can reverse the domains and then prefix matching works, but you could also extract the prefixes you want searchable and insert them each as keys in your constant time lookup indexes. The point is that you often have to invest extra effort to make binary trees work for many common security event indicator types.
The security domain analogues of all the pre-processing that goes into full text indexing (tokenization, stemming, stopwords, natural language analysis, etc.) are all very immature. As this field matures, I feel we'll be better able to say what is required to support any searching beyond exact term matches. Regardless, once you move past storing IP addresses as integers, it's not clear whether binary tree prefix matching buys much in queries on security event data. In a day when general purpose and reliability focused filesystems are using alternatives to binary trees (ex. htree of ext4), security event data stores should be too.
Lower the Resolution Please
One place I think the security community should look for cost savings is in lowering the resolution of indexes from the per event/row level to groups/block of events. I've seen great savings in this in practice and in some cases it can even improve performance on an absolute scale, let alone economics. When the desired result is a very small number of records, low resolution indexes coupled with processing of a very small number of blocks to do the final filtering can beat out bigger, more expensive, and more precise indexes. One use case that benefits from this approach is pivoting on indicators of threat actors, which are increasingly often exchanged in threat intelligence sharing communities. In these searches, it is most often desirable to search the widest time window possible (full data set), to search on a common indicator type, and for there to be few or no results. Often the low resolution answer is adequate--there is no need to drill down to individual events. I've seen low resolution indexes that are orders of magnitude smaller than the raw source data provide utility through low latency query times that row level indexes can never touch because of fundamental differences in size. Significantly ameliorating the cost of very common terms, ex. your web server's IP, and thereby naturally diminishing the need for stopword mechanisms is a nice side effect of dropping index resolution.
Trading CPU for IOPS
I'm reticent to mention compression as a method of improving performance for fear of being flamed as a heretic, but I think it has to be mentioned. I know disk is cheap, but IOPS aren't. Getting adequate IOPS is often among the biggest considerations (and cost) of the hardware for security event data stores (RAM used for disk caching is usually up there too). Huge sequentially accessible gzipped files are expensive to use, especially to retrieve a small number of records. But compression doesn't have to be that way. You can use smaller blocks to get good compression ratios and reasonable random access. Considering only simple tweaks to gzip, pigz and dictzip address the single threaded and random access limitations of standard gzip.
As an oversimplified example, imagine you have a server with a disk drive that provides 150 MB/s sequential read rate, CPU cores that do decompression at about 20 MB/s (compressed size) per core/thread, and data that compresses with a compression rate of 5:1. If you want to do analytics, say map/reduce or zgrep/awk, on the whole data store, you are better off using compression if you can dedicate 2 or more cores to decompression. If you can dedicate 8 cores, you are going to be able to stream at 750 MB/s instead of 150 MB/s.
The CPU/IOPS tradeoff is not just about improving sequential compressed log access, that is just a simple example that everyone who has ever zgreped text logs understands. A better example is the very compact indexes created using perfect hash functions such as done in discodb which require relatively high CPU but low IOPS to query.
Security event data has special characteristics that enable various optimizations. For the data stores that do not yet make these techniques easy, there is an opportunity to better cater to the security log use case. MongoR demonstrates temporal data partitioning that keeps the working set in memory resulting in scalable, fast inserts and efficient deletes.
Saturday, October 19, 2013
BlueLight: A Firefox Extension for Notification of SSL Monitoring
There are many tools, and no shortage of Firefox extensions, that relate to SSL security and detecting MitM attacks. CipherFox and similar extensions are very useful, but didn't fit my specific need because they aren't quite noisy enough--I wanted more active and intrusive notification when CA's of interest were used. Certificate Patrol and similar systems are useful for detecting the introduction of SSL inspection, but these systems don't fit the scenario of overt, consensual, and long term SSL inspection. BlueLight is based heavily on Cert Alert. In fact, if the alerting criteria in Cert Alert wasn't hardcoded, I'd probably be using it for this purpose.
BlueLight is useful when SSL Inspection is occurring, usually through a MitM scenario on web proxies using organizational PKI. Obviously, being notified of this on a per site basis is only useful when the organization is selective about what traffic is inspected—if everything is MitM'd then this notification provides no value.
Some claim that users are more secure when their traffic is subject to the organizations protections and monitoring. In this case, BlueLight provides re-assuring feedback to the user, letting them know that they are covered. Others may want to use BlueLight to know when they are under the purview of surveillance. It may deter them from taking some action while being subject to monitoring. In the case that monitoring should not occur on specific traffic, it provides useful notification to the user, so that the erroneous inspection can be rectified. In this vein, I've seen BlueLight be particularly useful as it alerts for all SSL elements of the page, not just the main URL (it alerts on the first occurrence, and only the first occurrence).
BlueLight isn't designed to be useful for other scenarios such as detecting unauthorized SSL MitM attacks or any other covert SSL malfeasance. However, since BlueLight can be configured to alert on basically any certificate issuer, it may well be useful for other similar uses.
BlueLight has to be configured by the user to be useful. As it is, it's probably only useful to reasonably technically savvy folk. In sharing BlueLight with the larger community, I hope it might be useful to others. BlueLight can be downloaded from addons.mozzilla.org or from csmutz.com/bluelight.
Monday, August 5, 2013
Intelligence Compliance: Checklist Mentality For Cyber Intelligence
As someone who seeks to apply technology to incident response, I see great promise in standards, technology, and investments to accelerate the distribution and application of threat intelligence. I've spent years developing capabilities to perform security intelligence and have seen first-hand the benefits of information sharing. The amount of security data exchanged will likely continue to grow. However, I have concerns about the shift from security intelligence to intelligence compliance and about the fundamental benefit of comprehensive distribution of threat intelligence.
Compliance Supplanting AnalysisInformation sharing has been critical to the success of intelligence based network defense. Direct competitors from various industries have come together to battle the common problem of espionage threats. Threat intelligence sharing has been wildly successful as sharing has included relevant context, has been timely, and as the attackers have been common to those sharing. Years ago, much of this sharing was informal, based primarily in direct analyst to analyst collaboration. Over time, formal intel sharing arrangements have evolved and are proliferating today, increasing in count of sharing venues, the number of participants, and the volume of intel.
The primary concern I have with this increase in intel sharing is that it is often accompanied by a compliance mindset. If there's anything we should have learned from targeted attacks, it is that compliance based approaches will not stop highly motivated attacks. It's inevitable that conformance will fail, given enough attacker effort. For example, targeted attackers frequently have access to zero-day exploits that aren't even on the red/yellow/green vulnerability metric charts, let alone affected by our progress in speeding patching from months to days. The reactive approach to incident response is focused primarily on preventing known attacks. As a community, we have developed intelligence driven network defense to remedy this situation. It allows us to get ahead of individual attacks by keeping tabs on persistent attackers, styled campaigns in the vernacular, in addition to a proper vulnerability focused approaches. The beauty of intelligence driven incident response is that it gives some degree of assurance that if you have good intelligence on an attack group, you will detect/mitigate subsequent attacks if they maintain some of the patterns they have exhibited in the past. This may seem like a limited guarantee, and indeed it is narrow, but it's the most effective way to defeat APT. Intelligence compliance, on the other hand, promises completeness in dispatching with all documented and shared attacks, but it makes no promise for previously unknown attacks.
To explain in detail, the point of kill chain and associated analysis isn't merely to extract a proscribed set of data to be used as mitigation fodder, but to identify multiple durable indicators to form a campaign. This has been succinctly explained by my colleague, Mike Cloppert, in his blog post on defining campaigns. The persistence of these indicators serves not only as the method of aggregating individual attacks into campaigns, but the presence of these consistencies is the substance of the assurance that you can reliably defeat a given campaign. By definition, individual attacks from the same campaign have persistent attributes. If you have a few of these, 3 seems to be the magic number, across multiple phases of the kill chain, you have good assurance that you will mitigate subsequent attacks, even if one of these previously static attributes change. If you can't identify or your IDS can't detect enough of these attributes, security intelligence dictates that you either dig deeper to identify these and/or upgrade your detection mechanisms to support these durable indicators. Ergo, defense driven by intelligence dictates you do analysis to identify persistent attack attributes and build your counter-measures around these.
Intelligence compliance, on the other hand, provides no similar rational basis for preparation against previously unseen attacks. Surely, a compliance focused approach has some appeal. It is often viewed as seeking to ensure consistency in an activity that is highly valuable for security intelligence. In other cases, less critical drivers overshadow primary mission success. Intel compliance provides a highly structured process that can be easily metered—very important in bureaucratic environments. The one guarantee that intelligence compliance does give is that you have the same defenses, at least those based on common intelligence, as everyone else in your sharing venue. This is important in when covering your bases is the primary driver. This provides no guarantee about new attacks or the actual security of your data, but does allow you to ensure that known attacks are mitigated, which is arguably most important for many forms of liability. Lastly, giving, taking, or middle manning intel can all be used as chips in political games ranging from true synergies to contrived intrigues. Intelligence compliance provides a repeatable and measurable process which caters to managerial ease and is also able to be aligned with legal and political initiatives.
There are limitless ways in which intelligence compliance can go wrong. Most failings can be categorized as either supplanting more effective activities or as a shortcoming in the mode of intelligence sharing which reduces its value. It is also fair to question if perfect and universal intelligence compliance would even be effective. Remember, intelligence compliance usually isn't adopted on technical merits. The best, if not naïve, argument for adoption of this compliance mindset is that intel sharing has been useful for security intelligence, hence, by extrapolation, increasing threat data sharing must be better. Sadly, the rationale for a compliance approach to intel sharing frequently digresses to placing short-sighted blame avoidance in front of long term results.
The primary way in which intel compliance goes awry is when it displaces the capacity for security intelligence. If analysts spend more time on superfluous processing of external information than doing actual intelligence analysis, you've got serious means/ends inversion problems. Unfortunately, it's often easier to process another batch of external intel verses digging deeper on a campaign to discover resilient indicators. This can be compared to egregious failings in software vulnerability remediation where more resources are spent on digital paper pushing, such as layers of statistics on compliance rates or elaborate exception justification and approval documentation, than is expended actually patching systems. An important observation is that the most easily shared and mitigated indicators, say IP addresses (firewalls) or email addresses (email filters), are also easily modified by attackers. For that reason, some of the most commonly exchanged indicators are also the most ephemeral, although this does depend on the specific attack group. If an indicator isn't reused by an attacker, then sharing is useful for detecting previous attacks (hopefully before severe impact) but doesn't prevent new attacks. A focus on short-lived intel can result in a whack-a-mole cycle that saps resources cleaning up compromises. This vicious cycle is taken to a meta level when human intensive processes are used despite increased intel sharing volume, putting organizations too far behind to make technological and process improvements that would facilitate higher intel processing efficiency. This plays into the attacker's hand. This is exactly the scenario that security intelligence, including kill chain analysis, disrupts--allowing defenders to turn an attacker's persistence into a defensive advantage.
Another intel sharing tragedy occurs when attack data is exchanged as though it is actionable intelligence and yet it's no more than raw attack data. There are many who would advocate extracting a consistent set of metadata from attacks and regurgitating that as intelligence for sharing to their peers. I'm all for sharing raw attack data, but it must be analyzed to produce useful intelligence. If the original source doesn't do any vetting of the attack data and shares a condensed subset, then the receiver will be forced to vet the data to see if it's useful for countermeasures, but often with less context. The canonical example which illustrates the difference between raw attack data and intelligence is the IP address of an email server that sent a targeted malicious email, where that server is part of a common webmail service. Clearly this is valid attack data, but it's about as specific to the targeted attacker as the license plate number of a vehicle the terrorist once rode in is to that terrorist, given that vehicle was a public bus. Some part of this vetting can and should be automated, but effective human adjudication is usually still necessary. Furthermore, many of the centralized clearinghouses don't have the requisite data to adequately vet these indicators, so they are happily brokered to all consumers. To make matters more difficult, different organizations are willing to accept different types of collateral mitigation, the easiest solution being to devolve into the common denominator for the community which is a subset of the actionable intelligence for each organization. For example, given an otherwise legitimate website that is temporarily compromised to host malicious content, some members of a community may be able to block the whole website while others may not be able to accept the business impact. The easiest solution is for the community is to reject the overly broad mitigation causing collateral impact, while the optimal use of the intelligence requires risk assessment by each organization.
While ambiguity between raw attack data and vetted intelligence is the most obscene operationally, because it can result blocking benign user activity, there are other issues related to incomplete context on so called intelligence. An important aspect of security intelligence is proper prioritization. For example, many defenders invest significantly more analyst time in espionage threats while rapidly dispatching with commodity crimeware. If this context is not provided, improper triage might results in wasted resources. Ideally, this would include not only a categorization of the class of threat, but the actual threat identity, i.e. campaign name. Similarly, often intelligence is devoid of useful context such as whether the IP address reported is used as the source of attacks against vulnerable web servers, for email delivery, or for command and control. This can lead to imprecise or inappropriate countermeasures. Poorly vetted or ambiguous intel is analogous to (and sometimes turns into) the noisy signatures in your IDS—they waste time and desensitize.
With all that being said, I'm an advocate of intel sharing. I'm an advocate of sharing raw attack data, which is useful for those with the capacity to extract the useful intelligence. Realizing that this isn't scalable, I'm also an advocate of sharing well vetted intelligence, with the requisite context to be actionable. However, even if your shop doesn't have the ability to process raw attack data at a high volume, sharing that data with those who can ostensibly results in sharing of intel back to you that you couldn't synthesize yourself. My main concern with intelligence compliance is that it robs time and resources from security intelligence while providing no guarantee of efficacy.
Intelligence Race to ZeroBeyond supplanting security intelligence, my other concern with the increase in information sharing is that as we become more proficient at ubiquitous sharing, the value of the intelligence will be diminished. This will occur whether the intelligence is revealed directly to the attackers or if lack of success causes them to evolve. Either way, I question if intelligence applied universally for counter-measures can ever be truly effective. Almost all current intelligence sharing venues at least give lip service to confidentiality of the shared intelligence and I believe many communities do a pretty good job. However, as intel is shared more widely, it is increasingly likely that the intel will be directly leaked to attackers. This principle drives the strict limitations on distribution normally associated with high value intelligence. It is also generally accepted that it's impractical to keep data that is widely distributed for enforcement secure from attackers. The vast majority of widely deployed mitigations, such as AV signatures and spam RBLs are accepted to be available to attackers. In this scenario, you engage in an intelligence race, trying to speed the use of commodity intel. This is the antithesis of security intelligence which seeks to mitigate whole campaigns with advanced persistent intelligence.
Note that even if your raw intel isn't exposed to attackers, the effects are known to the attacker—their attacks are no longer successful. Professional spooks have always faced the dilemma of leveraging intelligence versus protecting sources and methods. If some intelligence is used, especially intelligence from exclusive sources, then the source is compromised. As an example, the capability to decrypt axis messages during WWII was jealously protected. The tale that Churchill sacrificed a whole city to German bombers is hyperbole, but it certainly is representative of the type of trade-offs that must be made when protecting sources and methods. Note that this necessity to protect intel affects it's use through the whole process, not just merely the decision for use at the end. For example, if two pieces of information are collected that when combined would solidify actionable intelligence, but these are compartmentalized, then the dots will never be connected and the actionable intelligence will never be produced. We see this play out in so called failures of the counter-terrorism intelligence community, where conspiracy theorists ascribe the failings to malice but the real cause is, more often than not, hindrances to analysis.
It's worth considering how sources and methods apply specifically to network defense. Generally, I believe there is a small subset of intelligence that can be obtained solely through highly sensitive sources that is also useful for network defense. In most cases, if you can use an indicator for counter-measures, you can also derive it yourself, because it must be visible to the end defender. Also, while some sources may be highly sensitive, the same or similar information about attack activity (not attribution), is often available through open sources or through attack activity itself. Obviously, this notion isn't absolutely true, but I believe it to be the norm. As a counter-example, imagine that a super sensitive source reveals that an attacker has added a drive by exploit to an otherwise legitimate website frequented by the intended victim audience. In this example the intel is still hard to leverage and relatively ephemeral: one still has to operationalize this knowledge in a very short time frame and this knowledge is by definition related specifically to this single attack.
Resting on the qualitative argument of indicator existentialism, the vast majority of counter-measures can be derived from attacker activity visible to the end network defender. This is necessarily true of the most durable indicators. Therefore, I don't consider protecting sources (for network defense) the biggest consideration and advocate wide sharing of raw attack data. However, that certainly doesn't mean that the analysis techniques and countermeasure capabilities are not sensitive. Indeed, most of my work in incident response has been about facilitating deeper analysis of network data, allowing durable and actionable intelligence to be created and leveraged. Competitive advantage in this realm has typically been found by either looking deeper or being more clever. In a spear phishing attack, for example, this may be in analysis of obscure email header data or malicious document metadata or weaponization techniques. Often the actionable intelligence is an atomic indicator, say a document author value, which could presumably be changed by the attacker if known. Some may require more sophistication on the part of the defender: requiring novel detection algorithms, correlations, or computational techniques such as that which my pdfrate performs. Either way, the doctrine of security intelligence is based in the premise that persistent indicators can be found for persistent attackers, even if it requires significant analysis to elucidate them. This analysis to identify reliable counter-measures is what security intelligence dictates and is often the opportunity cost of intelligence compliance. I've seen some strong indicators continue to be static for years, allowing new attacks to be mitigated despite other major changes in the attacks.
It is my belief, backed by personal experience and anecdotal evidence, that if what would otherwise be a strong mitigation, if kept secret, is used widely, then the lifespan of that indicator will be decreased. In the end I'm not sure it matters too much if the intelligence is directly revealed or if the attackers are forced to evolve due to lack of success, but that probably affects how quickly attackers change. In my experience, it is true that the greater the sophistication on the part of the defender and the greater the technical requirements for security systems, then the less likely useful indicators are to be subverted. However, it's possible that continued efficacy has more to do with narrow application due to the small number of organizations able to implement the mitigation rather than difficulty of attackers changing their tactics. Often I wonder if, like outrunning the proverbial bear, today's success in beating persistent adversaries may be more about being better than other potential victims than actually directly beating the adversary. While intelligence driven security, and by extension information sharing, is much more effective than classic incident response, I think it is yet to be proven if ubiquitous intel sharing can actually get ahead of targeted attacks or if attackers will win the ensuing intelligence/evolution race.
One benefit of the still far from fully standardized information sharing and defense systems of today is diversity. Each organization has their own special techniques for incident prevention--their own secret sauce for persistent threats. It's inevitable that intelligence gaps will occur and some attacks, at least new ones, will not be stopped as early as desired. The diversity of exquisite detections among organizations combined with attack information sharing, even that of one-off indicators, allows for a better chance of response to novel attacks, even if this response is sub-optimal. A trend to greater standardization of intelligence sharing, driven by compliance, will tend to remove this diversity over time, as analysts, systems, and processes will be geared to greater intel volume and lower latency at the expense of intelligence resiliency.
Long Road AheadWhile I'm primarily concerned about being let down when we get there, it's also important to note that as a community, we have a long pilgrimage before we make it to the ubiquitous intelligence sharing promised land. Mitre's STIX et al are widely being accepted across the community as the path forward, which is great progress. Now that the high level information exchange format and transport is agreed upon, we still have a lot of minutia to work out. For example, much of that actual schema for sharing is still wide open. For example, many indicator types still have to be defined; standards for normalization and presentation still need to be agreed upon, and the fundamental meaning of the indicators still need to be agreed upon across the community.
I think it's instructive to compare the STIX suite to the CVE/CVSS/CWE/CWSS/OVAL suite, even though the comparison is not perfect. These initiatives were designed to drive standardization, automation, and improve latency of closing vulnerabilities. There is plethora of information tracked through these initiatives: from (machine readable) lists of vulnerable products, to the taxonomy of the vulnerability type, to relatively complicated ratings of the vulnerability. Despite this wealth of information, I don't think we've achieved the vulnerability assessment, reporting, and remediation nirvana these mechanisms were built to support. Of all the information exchanged through these initiatives, probably the most important, and admittedly the most mundane, is the standardized CVE identifier, which the community uses to reference a given vulnerability. This is one area where current sharing communities can improve—standardized identifiers for malware families, attack groups, and attacker techniques. While many groups have these defined informally, more structured and consistent definitions would be helpful to the community, especially as indicators are tied to these names to provide useful context to the indicators (and provide objective definitions of the named associations). Community agreement on these identifiers is more difficult than the same for vulnerabilities, and building the lexicon for translations between sharing communities is also necessary, as defining these labels is less straightforward and occurs on a per community basis. As we better define these intelligence groupings and use them more consistently in intel sharing, we'll have more context for proper prioritization, help ensure both better vetted intel and more clear campaign definitions, and have better assurances that our intelligence is providing the value we aim to achieve out of sharing.
In helping assess the effectiveness of information sharing, I think the following questions are useful:
- How relevant to your organization is the shared intelligence?
- Is the intelligence shared with enough context for appropriate prioritization and use?
- How well is actionable intelligence vetted? Is raw attack data shared (for those who want it)?
- How durable is the shared intelligence? How long does it remain useful?
- How timely is the shared intel? Is it only useful for detecting historical activity or does it also allow you to mitigate future activity?
- Do you invest in defensive capabilities based on shared intelligence and intelligence gaps?
- Do you have metrics which indicate your most effective intelligence sources, including internal analysis?
- Do you have technology that speeds the mundane portion of intelligence processing, reserving human resources for analysis?
Closing ArgumentI'm sure that there are some who will argue that it's possible to have both security intelligence and intelligence compliance. I must concede that it is possible in theory. However, as there is plenty of room for progress in both arenas, and resources are scarce, I don't believe there is an incident response shop that claims to do either to the fullest degree possible, let alone both. Also, the two mindsets, analysis and compliance, are very much different and come with a vastly different culture. Most organizations are left with a choice—to focus on analysis and security intelligence or to choose box checking and information sharing compliance.
Similarly, I question the seemingly self-evident supposition that sharing security data ubiquitously and instantaneously will defeat targeted attacks. While there will almost certainly be some raising of the bar, causing some less sophisticated threats to be ineffective, we'll also likely see an escalation among effective groups. This will force a relatively expensive increase in speed and volume of intel sharing among defenders while attackers modify their tactics to make sharing less effective.
As we move forward with increased computer security intelligence sharing, we can't let the compliance mindset and information sharing processes become ends unto themselves. Up until the time when our adversaries cease to be highly motivated and focused on long term, real world success, let's not abandon the analyst mindset and security intelligence which have been the hallmark of the best incident responders.
Saturday, October 27, 2012
PDFrate Update: API and Community Classifier
I am very pleased with the activity on pdfrate.com in the last few weeks. There have been a good number of visitors and some really good submissions. I'm really impressed at the number of targeted PDFs that were submitted and I'm happy with the pdfrate's ability to classify these. I really appreciate those who have taken the time to label their submissions (assuming they know if they are malicious or not) so that the service can be improved through better training data.
There is now an API for retrieval of scan results. See the API section for more details, but as an example, you can view the report (JSON) for the Yara 1.6 manual.
This API may be unconventional, but I do like how easy it is to get scan results. You submit a file and get the JSON object back synchronously. I've split the metadata out from the scan results for a couple reasons. First, the metadata can be very large. Second, the metadata is currently presented as text blob, and I wasn't sure how people would want it stuffed into JSON. If you want both, you have to make two requests. You can also view the metadata blob for the Yara 1.6 manual.
I'm happy that there have already been enough submissions, including ones that weren't classified well by the existing data sets, that I've generated a community classifier based on PDFrate.com user submissions and voting. I'm thrilled that there were submissions matching categories of malicious PDFs that I know are floating around but simply aren't in the existing data sets. I expect that if the current submission rate stays the same or goes up, the community classifier will become the most accurate classifier, because it will contain fresher and more relevant training data. Again, as an example, you can check out the report for the Yara 1.6 manual which now includes a score from the community classifier.
If a submission had votes before Oct 25th, it was included in the community classifier. Some users will note that even though they themselves did not vote on their submissions, they have votes. I reviewed many interesting submissions and placed votes on them so that they could be included in the community classifier. I decided to not do a bulk rescan of all documents already submitted. It wasn't for technical reasons. Note that the ratings occur solely based on the previously extracted metadata and as such are very fast. I did so because I didn't want to provide potentially deceptive results to users. If a document is in the training set, it is generally considered an unfair test to use the resulting classifier on it, as the classifier will almost always provide good results. Regardless, if you want to have a submission re-scanned, just submit the file over again.
Again, I'm pleased with the PDFrate so far. I hope this service continues to improve and that it provides value to the community.
Saturday, September 15, 2012
Announcing PDFrate Public Service
I've been working on this research since 2009, which was a year where the stream of PDF 0-days being leveraged by targeted attackers was nearly unbroken. I've refined the underlying techniques to a place where they are very effective in real operations and are addressed rigorously enough for academic acceptance. Note that I originally designed this for the purpose of detecting APT malicious documents but have found it to be largely effective on broad based crimeware PDFs also. Furthermore, it is pretty effective at distinguishing between the two. I can speak from personal experience that mechanisms underlying PDFrate provide a strong compliment to signature and dynamic analysis detection mechanisms.
Those that are interested should head over to the pdfrate site and check out the "about" page in particular which explains the mechanisms and points to some good examples.
PDFrate demonstrates a well refined mechanism for detecting malicious documents. This currently operates on PDF documents. I am close to extending this to office documents. But I see this paradigm extending much farther than just malicious documents. I see wise (and deep) selection of features and machine learning being effective for many things other things such as emails, network transactions such as HTTP, web pages, and other file formats such as SWF and JAR.
I'm happy to provide the PDFrate service to the community so that others can leverage (and critique) this mechanism. Providing this as a service is a really good way for others to be able to use it because it removes a lot of the difficulty of implementation and configuration, the hardest part of which is collecting and labeling a training set. High quality training data is critical for high quality classification and this data is often hard for a single organization/individual to compile. While the current data sets/classifiers provided on the site are fine for detecting similar attacks, there is room for improvement and generalization which I hope will come from community submissions and ratings. So please vote on submissions, malicious or not, as this will speed the development and evolution of a community driven classifier. This service could benefit from some additional recent targeted PDFs.
In addition to the classification that PDFrate provides, it also provides one of the best document metadata extraction capabilities that I've seen. While there are many tools for PDF analysis, the metadata and structure extraction capabilities used by PDFrate provide a great mix of speed, simplicity, robustness, saliency, and transparency. Even if you aren't sold on using PDFrate for classification, you might see if you like the metadata it provides. Again, the about provides illustrative examples.
I hope this service is useful to the community. I look forward to describing in depth in December at ACSAC!


text:
The Latest News On The API Economy
Searching: No Search Term , Filtered By API: "Skybuffer Cloud Checklist"
API Spotlight: Nexmo, Walk Score, and Listrak APIs
Of the many APIs we published this week, eleven were highlighted on the blog by our team of bloggers. In this post, we will launch those eleven into the spotlight, which include the TitanTV API. TitanTV is an online TV guide service that provides accurate over-the-air and satellite TV line-ups for a user's specific area, utilizing geo-location technology. The TitanTV API allows users to access information on these line-ups as well as retrieve recording schedule entries. To learn more about the TitanTV APi visit the TitanTV site as well as the TitanTV API blog post.
Create Virtual Checklists in Existing Apps with Cloud Checklist API
Skybuffer, web application developer, offers its web based checklist (i.e. Cloud Checklist) via the Skybuffer Cloud Checklist API . Users create work lists, schedule activities, and plan outings with Cloud Checklist. Through API integration, developers can include the entire suite of Cloud Checklist functionality directly in existing apps and workflows.


text: Selected Piano Works Look Inside Selected Piano Works Piano solo - SMP Level 8 (Early Advanced)Piano Solo. Composed by Theodor Kirchner (1823-1903). Edited by Kurt Hofman, Ernst Herttrich. Piano (Harpsichord), 2-hands. Henle Music Folios. Pages: X and 88. Softcover. G. Henle #HN445. Published by G. Henle (HL.51480445). Usually leaves our warehouse: Within 3 to 5 business days More info Add to Cart { "catalogRefId":"3766914", "productId":"prod3766914", "quantity":"1" }


text:
This category lists 11th-level creatures in 4e.
"The hydralisk is noted as being one of the most fierce and sadistic of the zerg strains. In the...Hydralisk (4e Monster)
"Spiderlings are young spiders which are still young enough to be found with their mothers...Spiderling (4e Monster)
Pages in category "Level 11"
The following 4 pages are in this category, out of 4 total.


text:
Inspiration Board: Katie Holmes' Simple and Chic Look
Katie Holmes looks fantastic stepping out recently in NYC with Tom and Suri. Her pleated maroon pants are effortlessly combined with a Mandarin collar button-down and cropped jacket, and the lust-worthy shoes keep the whole look super fashion-forward. We've taken inspiration from this color-blocked look to put together one for you at the fraction of the price — including a designer item that's on crazy sale. Take a look after the jump!
- Adidas by Stella McCartney Jacket, $150 (on sale!), Net-A-Porter
- Blouse, $42, Dorothy Perkins
- Golden Decadence Watch, $47.25, Endless.com
- Heels, $37.99, ModCloth
- Trousers, $70, Topshop


text:
Darius Rucker New Song Spotlight On Today's Daily Duel
Lady Antebellum now has 5 straight wins with yesterday's defeat of the new song from Kenny Chesney, which now means Lady A will face a new challenger.
And today's challenger on the Daily Duel comes from Darius Rucker.
Give both songs a listen after the jump.
First, here's the champion, Lady Antebellum with the latest 'Just A Kiss'
And here's our challenge song 'I Got Nothin' from Darius Rucker.
Alrighty…have you made up your mind. Vote for your favorite at our survey section of the KNUE Country Club.