text:
Like the seasons in the year, investors often follow a cycle that changes with the weather. Knowing about the cycle and how it affects finances can help advisors and investors.
"Clients have three seasons: spring, summer and fall," says Andy Rice, vice president of Money Management Services, an independent RIA firm in Birmingham, Ala.
The seasons, Rice says, move to different rhythms. "Spring is all about taxes. Summer is time for vacation and to relax. Fall is the time to get everything done; the kids go back to school, and of course, Christmas is coming," he says.
While summer has its own set of traps for investors, all the seasons have distractions, a fact that Diane Winland, a CFP, CPA and resident financial planner at Financial Finesse, underscores. "There's a fall hangover," she says, when the credit card bills from spending on summer vacations and back-to-school clothes and supplies come due. "Then there's a Christmas hangover in January" when the presents have to be paid for.
Both Rice and Winland say the problems all come down to the same thing.
"It all gets back to setting goals," Winland says. "What do I need to reach these goals? You probably need to save money."
Planning, for vacations, the purchase of a summer home, and even Christmas presents, must start at the beginning of the year.
"Clients have so much focus on their daily lives," Rice says. "The biggest mistake is not budgeting for big ticket items throughout the year."
Most people's biggest investment is their home. If they have a vacation home, that ups the ante. And it's likely a vacation home is an area that is subject to hurricanes and other storms that strike coastal areas. It's important that clients consider the cost of getting a home storm-proofed when they decide to buy a vacation home and when they make a yearly budget.
2) Summertime and the Living Is Easy—If You Save for It
Summertime means relaxing, but kicking back often comes at a price. The days of the "staycation" seem to be just a memory. Winland says people these days think, "been there, done that. We need to go somewhere." Vacations and summer homes can be costly. Paying for them can blow a hole in any savings plan. That's why it's important to plan ahead and look for bargains. Using frequent flyer miles to get to your vacation destination can help ease the cost and leave some money for having fun once you arrive.
One way not to fund your summer vacation: a 401(k) loan. Data from Charles Schwab show requests for 401(k) loans jump about 16% on average during the June through August period.
"Borrowing from a 401(k) plan may seem like a quick cash fix—but it's almost never a good idea," the bank said in a statement, citing factors including the opportunity costs of not contributing to your plan while repaying the loan and the risk of losing or leaving your job—and seeing the entire balance come due in as little as 30 days.
3) Taxes, Taxes, Taxes, Taxes
As noted above, the focus for spring is on taxes. But your clients need to keep their eye on those quarterly payments. It's easy to forget about them as they head off to relax on some island or take the kids far from the routines of daily life.
4) Jingle Bells, Jingle Bells—in January?
Christmas might seem far away at the start of the year, but that's the time to start planning. Make a list (of who you want to give gifts to and how much you want to spend) and, like Santa, check it twice. Make sure your spending desires fit the size of your budget; that way you won't be left scrambling to pay off the bills as a new year dawns.
5) Keep Your Eye on the Portfolio
Traditional wisdom might say the markets go into summer doldrums, but that's no reason not to stay on top of investments. This year, Winland says, everyone is watching the election cycle and waiting to see if Congress will do anything on the tax front. Rice says it's important for families "to consider hiring a CEO or CFO for their household" in the guise of a financial advisor.
That can take some of the burden off the client. Of course, the client still needs to check in to see how things are going.
Mike Patton, president of Integrity Wealth Management, says vacation doesn't stop him from protecting his clients: "When I go on vacation, I take my laptop with me."


text:
Here is one question to ponder as Mark Sanchez embarks on his 66th chance to prove he is a worthy NFL quarterback: When, exactly, did Rex Ryan become one of those coaches he used to ridicule?
The company man. The risk-avoider. The one who treats the most insignificant information as state secrets. Ryan not only promised he'd be the opposite of that when he took over the Jets, but he also poked fun at the drab Belichick clones that were everywhere else in the league.
"I speak from the heart — that's who I am," Ryan said back then, clearly not like those other guys who are just mouthpieces for their teams. He was the guy who'd break the mold, the straight shooter.
Turns out, he's no different from anybody else with a failing record, just coaching for his job. Because if Ryan was really the brash risk-taker, he would have stuck with his hunch that this team needed a change at quarterback and given Greg McElroy another shot against Jacksonville this weekend.
Instead, Ryan announced he was going back to the Same Old Sanchez. He insisted Wednesday that this was "a decision I feel great about" and that he was "looking forward to seeing Mark play," but he looked as enthusiastic as a hostage holding up a newspaper as proof of life.
Starting Sanchez isn't the right move, but it is the safe move. Had Ryan gone with McElroy or even Tim Tebow, he would have had to answer all the questions about that contract extension the Jets gave Sanchez in the offseason, about the $8.25 million the quarterback is owed for 2013.
He insisted the money had "absolutely zero" to do with the decision. But when a fourth-year starter already has 18 turnovers in 12 games — and five in the last two alone — what else can it be? The Jets declared that Sanchez was their franchise quarterback when they gave him that extension, and Wednesday Ryan dutifully stuck with that script the way any good company man would.
No one is suggesting that McElroy is Johnny Unitas. There's a reason most seventh-round draft picks don't go higher, and his performance in the victory over Arizona (5-of-7 passing, 29 yards) didn't exactly make the country adjust their fantasy football rosters.
It's also possible, maybe likely, that no Jets quarterback could have a productive season with the lack of talent at the skill positions. Still, McElroy gave this team a jolt when he entered the game in the third quarter. It felt right, like Ryan had the pulse of his team and made the kind of change that could unify it.
If there was anybody who would keep rolling the dice on a third-stringer, it was that brash guy who talked about shaking President Obama's hand that first day on the job. But that coach is gone.
"I believe Mark has a skill set that's pretty impressive," he said Wednesday, as if GM Mike Tannenbaum was holding a cue card in the back of the room. "He can make all the throws."
Sometimes, even to the right team!
"Obviously, I have to get this decision right," the head coach said, "and I believe I have."
On the first part of that, he's right. From the moment the team traded up to draft Sanchez in 2009, Ryan knew his head coaching career would be tied to the kid from Southern Cal.
Sanchez was diplomatic Wednesday. He called the benching "the worst and best experience of my life" and insisted that Ryan was sending him a message. "It was well-received. I know. I got it."
So he'll get yet another shot, and maybe against the weak schedule to end the season, he'll turn it around. But then what? Unless the Jets find a trade partner convinced they can turn Sanchez into a winner, Ryan is stuck with him in 2013 — and, if the Jets miss the playoffs this season, he'll be battling for his coaching life.
This was Ryan's chance to try something different, to see if McElroy was the answer. Sanchez is completing 55 percent of his passes again — remember the heady days when the Jets wanted him to break into the mid 60s? — but somehow, he's harder to fire than a tenured professor.
Out in Seattle, a former Jets coach tossed Matt Flynn — who had just signed a three-year, $19.5 million deal with $10 million guaranteed — to the bench in favor of a third-round pick named Russell Wilson. Now Pete Carroll and the Seahawks are in a position to make the playoffs with Wilson, who is widely regarded as one of the promising young quarterbacks in the league.
Ryan, with a chance to be bold, stuck with the Same Old Sanchez. Turns out, the coach who was supposed to be the risk-taker is just another company man trying to keep his job.
Steve Politi: firstname.lastname@example.com; Twitter: @StevePoliti

subset: commoncrawl


text:
Venus Express main engine burn starts
At 09:17 CEST today, Venus Express started its main engine burn. The burn, to last 50 minutes, will slow down the spacecraft and allow the capture into orbit around Venus. The main engine burn started a few minutes after the firing of the spacecraft thrusters, to make sure the propellant settles in the feed lines to the main engine.
This thrust is aimed at reducing the initial velocity of 29 000 kilometres per hour (in relation to Venus) by 15 percent, to allow capture by the planet's gravity. Thanks to this burn, Venus Express will settle into its preliminary, elongated nine-day orbit.
Only the spacecraft low-gain antenna, carrying a feeble but instantly recognisable signal, is transmitting throughout all VOI manoeuvres. This allows ground controllers to monitor the velocity change during the burn, using NASA's Deep Space Network's 70-metre antenna near Madrid, Spain. No other means of communication with the Earth is possible during the capture burn.
During the burn, at 09:45 CEST, Venus Express will disappear behind the planet and will not be visible from Earth. This is known as its 'occultation' period, in which the only signal coming from the spacecraft – the carrier signal from the low gain antenna - will become unavailable for ten minutes.


text:
Weiss: Communication key as replay evolves
SCOTTSDALE, Ariz. -- With the mechanics of instant replay still being discussed, Rockies manager Walt Weiss said the club is trying to figure out how it will handle possible replay challenges.
Most likely, the Rockies will have to assign some personnel on a rotating basis -- it won't be one person for 162 games -- to monitor replays and try to deliver word to Weiss in the dugout whether to challenge a call. But how that will occur, especially with video rooms in different places depending on the park, and who will do it are variables.
"We don't have all the answers yet," Weiss said. "There's got to be some kind of rapport there between the manager and whoever is up there watching."
Video rooms must be in an area where a door may be closed and can't be in the dugout. The rule is to prevent signs from being stolen by the opposition and relayed to players. At Coors Field, for example, the Rockies' video room is down a runway from the dugout, up a short flight of stairs, then down a hallway. How word will be relayed from the video monitor, and how quickly that can happen, are to be determined as well as who will be doing the monitoring and communicating.
It's different from football, where coaches are seeing the video and relaying info into a headset to the head coach. It sets up for someone possibly unknown to the public, being in position to provide crucial information that could determine a baseball game. Weiss said he will not ever make that person a fall guy if the challenge goes wrong.
"The way I look at it, it's never going to be that guy's fault," Weiss said. "Ultimately, I'm the one.
"Whoever it is, that's how I'll communicate it to him: 'It's going to be on me. It's not going to be on you.'"


text:
We are thankful for the generosity of companies that provide pro bono support for the Make-A-Wish® mission. Every contribution helps us maximize every dollar to advance our vision of granting the one true wish of every eligible child.
These companies provide Make-A-Wish with software or other technical donations.
These companies have helped advance the Make-A-Wish® story through marketing, advertising, and digital channels.
Stay in Touch!
Sign up to receive email from Make-A-Wish.


text:
This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Front Range OWASP Conference 2013
- Introduction
- Registration
- Venue
- Conference Schedule
- Speakers
- Presentations
- Event Sponsors
- Hotel and Travel
- Capture the Flag
- Presentation Materials
Welcome to SnowFROC 2013 - the 5th Annual Front Range OWASP Security Conference
The Colorado OWASP chapters are proud to present the 5th annual SnowFROC. Join 300 other developers, business owners, and security professionals for a day-and-a-half of presentations, training, and Birds-of-a-Feather (BoaF) sessions. The SnowFROC 2013 keynote speaker is Neal Ziring, Technical Director of InfoProtection at NSA.
The conference will occur on Thursday, March 28th at the Denver Marriott City Center and will feature four primary tracks:
- High-Level Technical
- Deep-Dive / Hands-on Technical
- Management
- Legal
Running in parallel to the conference proceedings will be a capture the flag (CTF) hacking competition developed exclusively for SnowFROC by Boulder OWASP chapter members. The day will conclude with a moderated panel discussion featuring top industry leaders.
On Friday, March 29, Aaron Weaver will teach a course in secure coding. This training is free to SnowFROC attendees!
Friday will also offer BoaF sessions. Join like-minded industry leaders and discuss pressing issues facing the industry and you. BoaF sessions are self-lead and may address and issue you would like. Pitch your idea and get the ball rolling!
Finally, Friday will feature a postmortem of the CTF tournament. In addition to discussing solutions, techniques, and tools, we will encourage participants to attack the previously out-of-bounds CTF framework. Itching to break into the scoreboard and rack up the points? The gloves come off Friday morning.
Conference Committee
Mark Major: Director
Brad Carvalho: Sponsorship, Executive events
Craig Klosterman: Merchandise
Steve Kosten: Sponsorship, Executive events
Glen Matthes: Planning
Chris Rossi: CTF, Networking events
Greg Foss: CTF
Colorado Chapter Hosts
OWASP Boulder chapter: Mark Major
OWASP Denver chapter: Steve Kosten, Brad Carvalho (acting)
Conference Location
SnowFROC 2013 Schedule
Joe Brady
| Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development, IT risk management, and security. He works consultatively with customers and prospects to help them evaluate a Veracode solution for managing their application security risk.
His professional experience includes advising customers on end point data encryption solutions at Credant Technology (now Dell); IT risk and portfolio management at Prosight (now Oracle); and, UNIX symmetric multiprocessor computing for high performance databases and parallel programming research at Sequent Computers (now IBM). In addition, he has experience architecting and developing software applications, as a developer and manager. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a M.S. degree in Applied and Engineering Physics.
Helen Bravo
| Helen Bravo is the Product Manager at Checkmarx. Helen has more than fifteen years of experience in software development, IT security and source-code analysis.
Prior to working at Checkmarx, Helen has worked in Comverse one of the biggest Israeli Hi-tech firms as a software engineer and product manager for security matters. Helen holds a B.A. in Economics and Business Administration from the Israeli University of Haifa and started her development career at the age of 11.
Jason Chan
|Jason Chan is an Engineering Director at Netflix, currently working on the security of Netflix's cloud deployment. His areas of responsibility include application, infrastructure, and operational security for the Netflix streaming video service. Prior to joining Netflix, he led the information security team at VMware and spent most of his earlier career in security consulting for firms such as @stake and iSEC Partners.
Danny Chrastil
|Danny Chrastil is a security consultant with BT Assure who has specialized in information security for over 3 years. Danny has a strong background in application development and server administration which led him into the security field after being asked to remediate a compromised server for a large eCommerce application. Using his experience as both a security consultant and programmer, Danny works with developers on the awareness of security principles and their importance within the development lifecycle.
Larry Conklin
|Please visit Larry's OWASP profile page.
Gregory Disney-Leugers
|Gregory Disney-Leugers is a systems engineer from Athens, OH with his wife Kait, He attended United Stares Air Force Institute of Technology and Defense Acquisition University. He is the developer of OWASPMantra OS and The Onion Server.
Maureen Donohue Feinroth
| Maureen D. Feinroth, Esq, CIPP/IT, CIPP/E is the Founder and CEO of Capital Privacy Solutions, a consulting firm dedicated to providing clients with privacy consulting, training & education and data management services.
Maureen is a recognized subject matter expert in international compliance, particularly the EU Directive, the Hong Kong Data Protection Ordinance and transborder data flow issues in the international marketplace. She is experienced with the provisions of DNC, FOIA, ECPA, FISMA, the Federal Privacy Act, Paperwork Reduction Act, Computer Security Act, OMB Circular A-130, FISCAM, HIPAA/HITECH, GLBA, FCRA, EFTA, COPPA, ECPA, PATRIOT Act and Sarbanes-Oxley. She assisted in development of NIST standards across information security including implementation measures for HSPD 12 compliance. Her consulting responsibilities and career information security privacy experience include the identification, research and analysis of all legislation at the state, federal and international levels, as well as the self-regulatory programs.
Andrew Earle
|Andrew Earle is a Security Solutions Architect for HP Enterprise Security Products (ESP). Andy has spent 3+ years designing and delivering application security programs, technology, and services for US Federal and commercial customers, specifically around HP's Fortify appsec products. Andy was previously the product manager for a high assurance multi-level secure operating system at BAE Systems, and Presales Engineer for various web development and mobile security firms. Early experience includes software engineering, mobile application development, and lifeguarding at his neighborhood pool. Andy has a B.S. in Systems Engineering from the University of Virginia.
Tom Glanville
| Tom is the founder and CEO at Identity Theft Loss Prevention, LLC. Tom served in the United States Air Force as an Avionics Flight Control System Specialist during Desert Storm. He received a metal for his heroic efforts for saving lives and aircraft. Following his military service, he worked as a government contractor on highly sophisticated security systems for Classified and Top Secret information.
Due to Tom falling victim to ID Theft and Fraud 4 times between 1996 and 1998. At that time identity theft was relatively new with very few resources for victims. Learning from his personal experience, combined with his military training, Tom founded Identity Theft Loss Prevention to educate individuals, families, and businesses. The company has become nationally recognized for practice assessment, management, and training to identify and limit information exposure.
Recently, Tom was invited to participate in an elite group that advises the Federal Bureau of Investigation Cyber Crimes Division and the Dept of Homeland Security on matters of national security.
Alan Jex
|Alan is a Chief Security Architect at HP and is a CISSP. He is responsible for performing penetration tests and implementing security best practices for the PPS organization on web connected printers. Alan worked at Symantec as a Principle Software Engineer on enterprise security products. He worked at Novell as a Senior Software Engineer on desktop and server management. Alan graduated from BYU with a B.S. in Computer Science. He participates in the local Salt Lake OWASP chapter.
Robert Lelewski
| Robert Lelewski is an Engagement Lead for IBM's Emergency Response Service and is the lead of IBM's Computer Security and Incident Response Plan (CSIRP) offering. He has worked on numerous cases involving the topics of intellectual property theft, malware analysis, embezzlement, child pornography, and other issues. He has testified before state and federal courts and has been endorsed as an expert on computer forensics.
Robert holds a Bachelor degree in Economic Crime Investigation from Syracuse University, a Masters degree in Technology Management and a certificate in Research and Development Management from the University of Denver, and is currently pursuing a Masters of Business Administration from the University of Northern Iowa. Additionally, Robert holds several computer forensic and security related certifications including the EnCE, ACE, CCE, CISSP, CISA, CISM, Security+, and CASP.
Jim Manico
|Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.
Jon McCoy
|Jon McCoy is focused on .NET Framework Application Security, releasing a number of tool and whitepapers in the area of .NET Framework Security. He runs www.DigitalBodyGuard.com a ThinkTank Firm that engages in development, protecting & penetration-testing digital assets from desktop applications to enterprise infrastructure. DigitalBodyGuard has a focus on .NET Application Security well beyond Reverse Engineering and Anti-Reverse Engineering.
Dan Rojas
| Dan is a Vice President at IntraNext Systems. As Vice President and Chief Product Evangelist Mr. Rojas' responsibilities include strategic planning, business development and execution to enable rapid growth of the IntraNext SafeData offering.
Before joining IntraNext, Mr. Rojas was a Director and Managing Director at Coalfire, a leading IT systems security and compliance company. Mr. Rojas' was responsible for national PCI, HIPAA and Federal practices.
Mr. Rojas has over 20 years of communications and information technology industry experience in the areas of Corporate Strategy, IT Operations, Business Development and Executive Management.
Previously, he was Vice President of Technology at Alpine Access, a virtual BPO service provider from 2007 to 2011. At Inflow, a complex web hosting company, (1998-2005) Mr. Rojas led many major worldwide client programs delivering systems and information technology architecture, design, security and implementation for its global clients. Management of secure and highly reliable infrastructure and data network services including firewall management, operating systems management, data storage and backup, monitoring, BC/DR and consulting services around e-business and web architecture. Mr. Rojas also held executive management positions in start-up enterprises as well as product development and management positions within the U.S. Air Force.
Jon Rose
| Hacker, developer, product manager, and trainer, Jon Rose has been working in the security industry for his entire career. His current mission is to make security accessible to developers, startups, and service providers through a variety of ventures. Outside technology, his other interests include running, camping, coffee, robots, and beer.
Russell Shumway
| Russ is the Computer Forensics Lead Aerstone. Russ has over 18 years of experience as an Information Security Consultant, providing technical incident response, computer security, forensics, and electronic discovery advice to both public and private sector organizations. Previous clients include large financial institutions in the U.S. and Europe, including 7 of the 10 largest banks in the U.S. and 13 of the top 50 in the world, as well as health care, insurance and high tech manufacturing organizations.
Prior to joining Aerstone, he spent 5 years as the Technical Director for Electronic Discovery and Forensics for SNR Denton, one of the top 25 law firms in the world, where he assisted clients and attorneys in technical investigations, discovery collection and processing, and the development of discovery protocols. His experience also includes consulting with Guardent and Global Integrity Corporations. As the Technical Director for Response Services for Global Integrity he managed the company's Open Source Monitoring Program and assisted in the development and implementation of the Information Sharing and Analysis Center (ISAC) for the financial services sector. He has provided incident response consulting on major security breaches where potential losses exceeded $50 million dollars.
As a U.S. Army Reserve Officer, he performed vulnerability assessments and audits of classified and unclassified military computer networks for the Army Computer Emergency Response Team. He was the first person (military or civilian) to be certified to execute penetration tests on Army systems.
Mr. Shumway is a Certified Information Systems Security Professional (CISSP). He graduated from the University of Pennsylvania in 1983 and received a M.S. in the Management of Information Systems and an M.B.A. from the Katz Graduate School of Business in 1995.
Mr. Shumway has developed and taught graduate level courses at the University of Virginia and at the University of Fairfax.
Casey Smith
|Casey is an Information Security Analyst at FirstBank.
Aaron Weaver
| Aaron Weaver is Principal Security Analyst at Pearson Education, the leading learning and publishing company. He has played various roles including software developer, system engineer, embedded developer to IT security. He also leads OWASP Philadelphia. Experience includes mobile security, web application security, penetration testing and embedded development. Aaron has also worked on developer and QA awareness to increase security in the software development lifecycle and has held numerous training sessions.
Aaron has spoken at regional chapter events including OWASP, Infragard, ISSA, Cloud Security Alliance, Philadelphia Secure World and ISACA.
When he has time Aaron likes to make sawdust in his workshop.
Dan Wilson
| Dan is a managing consultant at IBM Security Services and directs Penetration Testing and Emergency Response Services for IBM in the North Amercian region. Dan's team assists clients in proactively identifying existing security threats to company assets and assists them in developing plans to reduce the risk of and prepare for the handling of cyber-incidents. When incidents do occur, his team will respond 24x7 to assist the client in quickly eliminating the threat.
Dan has been with IBM for 18 years, with 12 years in Information Security. He graduated with a Bachelors degree in Computer Science from Brigham Young University, and has completed an MBA with Regis University. Dan has worked in numerous areas of security at IBM including: Infrastructure security policy and best practices, malware threat prevention, vulnerability management, penetration testing and application security, and incident and forensic response.
David Willson
| David is a leading authority in cyber security and the law. He is a licensed attorney in NY, CT, and CO, and owner of Titan Info Security Group, a Risk Management and Cyber Security law firm, focused on technology and the law, and helping companies lower the risk of a cyber-incident and reducing or eliminating the liability associated with loss or theft of information. He also assists companies with difficult legal/cyber-security issues.
David is a retired Army JAG officer. During his 20 years in the Army he provided legal advice in computer network operations, information security and international law to the DoD and NSA and was the legal advisor for what is now CYBERCOM. He has published many articles, such as, "Hacking Back In Self-Defense: Is It Legal; Should It Be?", and recently, "Cyber War or Cyber Cold War?".
His speaking engagements include: the FBI ICCS conf., RSA, CSI, HTCIA, ISSA, FBCINC, the 4th Int'l Cyber Crime Conf., Australia, Cornerstones of Trust, FISSEA, ASIS, and others. He holds the CISSP & Security + certifications and has two LLM's in International Law and in Intellectual Property law. He is a VP of his local ISSA chapter and a member of InfraGard. He was recently quoted in a Fox News Exclusive, and his recent article was published on Fox News: Is the US Already Engaged in a Cyber War?
Zachary Wolff
|Zak is an Advanced R&D Engineer at LogRhythm Labs.
Neal Ziring
| Mr. Neal Ziring is the Technical Director for the National Security Agency's Information Assurance Directorate (IAD), serving as a technical advisor to the IAD Director, Deputy Director, and other senior leadership. Mr. Ziring is responsible for setting the technical direction across the Information Assurance mission space. Mr. Ziring tracks technical activities, promotes technical health of the staff, and acts as liaison to various industry, intelligence, academic, and government partners. As part of his role, he guides IAD's academic outreach program, acting as a technical liaison to several universities that are participants in the National Centers for Academic Excellence - Research (CAD-R) program. His personal expertise areas include router security, IPv6, VM-based secure systems, cloud computing, cross-domain information exchange, and mobile code security.
Mr. Ziring received B.S. degrees in computer science and electrical engineering (1985), and an M.S. in computer science (1986), all from Washington University in St. Louis. Since then, he has also taken courses from Columbia University and University of Maryland Baltimore County.
Virtually Mr. Ziring's entire government career has been based in the NSA Information Assurance Directorate. He joined NSA in late 1988, working on software tools and cryptosystem simulation. In the 1990s he began working in IA Evaluations and, except for brief tours, has been there ever since. From 2003 to 2005 he held the position of technical director for the IA Evaluations System and Network Attack Center (SNAC). Between 2006 and 2010 he was detailed to the NSA Mission Systems Development group as the security architect.
Mr. Ziring is maintains his Cisco Certified Security Professional (CCSP) certificates. Prior to joining NSA, Mr. Ziring was a member of technical staff at AT&T Bell Laboratories. In addition to work, Neal enjoys martial arts, running, and playing classical guitar. He holds a 3rd degree black belt in Shorinji Kempo.
Keynote Address: 08:30 - 09:30
Data Protection for the 21st Century
Neal Ziring
| Mr. Neal Ziring is the Technical Director for the National Security Agency's Information Assurance Directorate (IAD), serving as a technical advisor to the IAD Director, Deputy Director, and other senior leadership. Mr. Ziring is responsible for setting the technical direction across the Information Assurance mission space. Mr. Ziring tracks technical activities, promotes technical health of the staff, and acts as liaison to various industry, intelligence, academic, and government partners. As part of his role, he guides IAD's academic outreach program, acting as a technical liaison to several universities that are participants in the National Centers for Academic Excellence - Research (CAD-R) program. His personal expertise areas include router security, IPv6, VM-based secure systems, cloud computing, cross-domain information exchange, and mobile code security.
Mr. Ziring received B.S. degrees in computer science and electrical engineering (1985), and an M.S. in computer science (1986), all from Washington University in St. Louis. Since then, he has also taken courses from Columbia University and University of Maryland Baltimore County.
Virtually Mr. Ziring's entire government career has been based in the NSA Information Assurance Directorate. He joined NSA in late 1988, working on software tools and cryptosystem simulation. In the 1990s he began working in IA Evaluations and, except for brief tours, has been there ever since. From 2003 to 2005 he held the position of technical director for the IA Evaluations System and Network Attack Center (SNAC). Between 2006 and 2010 he was detailed to the NSA Mission Systems Development group as the security architect.
Mr. Ziring is maintains his Cisco Certified Security Professional (CCSP) certificates. Prior to joining NSA, Mr. Ziring was a member of technical staff at AT&T Bell Laboratories. In addition to work, Neal enjoys martial arts, running, and playing classical guitar. He holds a 3rd degree black belt in Shorinji Kempo.
Session 1: 10:00 - 10:45
DevFu: The inner ninja in every application developer
Many times we try to draw a distinct line between developers and penetration testers. This creates a barrier that developers often feel intimidated to cross. The truth is that developers have an innate ability and perspective to become great penetration testers themselves.
Developers in the security industry carry a unique toolset as ethical hackers / security consultants that sets them apart from traditional penetration testers. By incorporating these skills as developers and combining them with the understanding and experience of building applications, developers can take web application penetration testing a step further than the rest.
This presentation will go over the various aspects to the developer DevFu toolbox including: deep programming knowledge, ability to write scripts on the fly, common shortcuts and their pitfalls, speaking the language, and secure coding practices. We will go over specific examples of scripts that increase productivity and extend functionality of existing pen testing programs.
Track: Technical
Speaker: Danny Chrastil
SIP-Based Cloud Instances
This presentation will demonstrate the practical applications of SIP protocol for local cloud instances and how to create secure connections the cloud using SIP forwarding. Further it will present methods of securing cloud and data by using a Linux firmware router to host local based cloud domains, as well as showing secure methods of deploying these systems. In addition, the talk will show secure methods of using PHP and databases using Sqlite and MongoDB while using distributing computing between a Linux server and a Linux based firmware network appliance.
Several practical applications presented will include:
- Using Cloud-based SIP as replacement for Samba for file sharing in a corporate environment with S3 and WebDAV
- Creating a local domain such https://cloud.router.sip.com
- Connecting to the cloud from a mobile phone using SIP forwarding with SSL tunneling
- Using SIP based domains on VPNs to create a private clouds with a single point of access
There will be a demonstration on how to properly setup a Linux server to host local based domains for secure deployment, including proper deployment of Cherokee and Apache web servers for hosting SIP domains. Finally, the presentation will demonstrate properly configuration of SIP domains to the Linux based firmware network appliance.
At the end of the presentation a viewer will know how to properly deploy Linux server for SIP domain hosting and how to create secure cloud instances with SIP.
Track: Deep Dive
Speaker: Greg Disney-Leugers
Digital Bounty Hunters - Decoding Bug Bounty Programs
Amid the growing trend to "crowd source" services, a few progressive enterprises are taking a new approach to information security. A potential game-changer, these companies are shifting the traditional model of IT risk assessment by opening their doors -- and their wallets -- to freelance hackers who break in without fear of legal repercussions. Bug Bounty Programs pay cash money to hackers for responsibly disclosing security vulnerabilities on production applications and networks.
This presentation will examine who these freelance digital bounty hunters are, their motivations, and their perspective on the value of bug bounty programs. It is equally as important to understand the perspective of the individuals that run these programs, how the programs fit into a comprehensive, information security framework, as well as key successes and failures to date of this new crowd-sourced model. As part of this, the discussion will review metrics from an existing program and highlight some of the more interesting bugs discovered.
Ultimately, what is the future for these bug bounty programs? Will they disrupt the existing marketplace for professional security consultant services by offering a cheaper, more effective crowd-sourced approach? Or are these programs simply a tool for the most advanced, most daring companies to take their security programs to the next level?
Track: Management
Speaker: Jon Rose
Electronic Discovery for System Administrators
As the Federal Rules of Evidence have evolved over the last several years, and as the volume of information in digital format has overtaken traditional printed media, electronic discovery had become more important than traditional paper-based discovery in litigation. While vendors can help with production, system administrators play a key role in the acquisition and production of Electronically Stored Information (ESI).
This presentation is designed to present an overview of the discovery process, explain how it differs from traditional computer forensics, and offer tips for administrators and managers to better assist in the production of ESI in the event of litigation (and hopefully to reduce the costs associated with production).
Track: Executive/Legal
Speaker: Russ Shumway
Session 2: 10:55 - 11:40
Adventures in Large Scale HTTP Header Abuse
While the technique of sending malicious data through HTTP Header fields is not new, there is a conspicuous lack of information on the topic.
This presentation explores research and testing results of random auditing of 1.6 million websites. The speaker will address the history of HTTP Header attacks, the logic that went into the creation of an HTTP Header Audit tool, and the most interestingly the findings of the test run.
How many vulnerable websites were discovered? What attacks were they most susceptible to? Which Header fields are most likely to be vulnerable?
Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities.
Track: Technical
Speaker: Zak Wolff
How Malware Attacks Web Applications
Modern malware has outpaced the ability for traditional defenses to detect and contain the threats. The core of the presentation will address several techniques used by malware to attack web applications, including:
- WebInjects (aka Man-in-the-Browser)
Files that contain JavaScript and HTML in order to alter the user experience in the application.
- Form-Grabbing
The technique for capturing web form data within browsers.
- Session Hijacking
The ability to redirect control of a session to an attacker.
- Persistence and Stealth
How does the malware go undetected, for so long?
- Countermeasures
How to detect malware interacting with your web applications.
Track: Deep Dive
Speaker: Casey Smith
Linking Security to Business Value in the Customer Service Industry
The value of trust cannot be understated when discussing Superior Customer Service.
"The main benefit of trust is customer loyalty, which in turn leads to a longer term relationship, greater share of wallet, and higher advocacy or word of mouth. Results from our consumer survey show that emotional and rational trust drive between 22% and 44% of customer loyalty." - Study by ESCP Europe Business School
Privacy protection is a pillar of trust. Studies show PRIVACY is of paramount importance to consumers and is growing in importance. A 2012 Ponemon Institute study on the "Most trusted companies on privacy" found that while the importance of privacy has grown over the last seven years, the loss of control over privacy has also grown as well.
The Call Center industry is at the confluence of these competing social and business priorities. On the one hand, the customer service representative (CSR) must engender competence and trustworthiness and on the other hand CSR must ask the caller for a credit card number or social security number, the most private and personal valuable pieces of information a consumer possesses.
Where there is a gap in expectations between consumers and businesses, there is an opportunity for business to differentiate themselves and fill the gap and win market share. This opportunity is being realized by emerging technology designed to satisfy Compliance standards as well as real consumer demand for privacy protections.
Call Centers as well as other types of businesses that can address consumers demand for privacy protections can improve their long term bottom line through TRUST and customer loyalty.
Track: Management
Speaker: Dan Rojas
Legal Issues of Forensics in the Cloud
Have you ever thought about how you would conduct a forensic investigation on your data if it was all in the Cloud; or, if your company suffers a data breach and all your data is in the Cloud how you would get the information you need to determine what happened and the extent of the damage? The Cloud presents many issues and new challenges. The best thing you can do is be prepared, but how?
This lecture will discuss the issues associated with attempting to deal with a data breach in the Cloud as well as conducting a forensic investigation in the Cloud. How do you prepare? What needs to be included in your contract or service level agreement? Finally, if you were not able to prepare, is all lost? What can you do, legally?
Track: Executive/Legal
Speaker: David Willson
Session 3: 12:40 - 13:25
Angry Cars: Hacking the "Car as Platform"
Renault announced "what it describes as a 'tablet,' an integrated Android device built into its next range of cars, effectively opening the way to the car-as-a-platform. The car is becoming a new platform. We need developers to work on apps." Not to be left behind Ford has introduced the OpenXC platform, which it sees as a channel for collaboration between Ford and 3rd party application developers.
What role will security play in shaping this newly emerging technology, when your car can tweet it needs an oil change? Cars rely heavily on small embedded microprocessors running on a network that was never designed to be secure. This talk will look at the current technologies used CAN bus, OBDII, and tire pressure monitoring systems and demonstrate their inherent weaknesses. What should be considered in the future when most cars will be connected to the Internet?
Track: Technical
Speaker: Aaron Weaver
Top Ten Web Application Defenses
We cannot 'firewall' or 'patch' our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day.
Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently.
This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.
Track: Deep Dive
Speaker: Jim Manico
Using SaaS and the Cloud to Secure the SDLC
This session will cover Software as a Service (SaaS) offerings and how they can be effectively utilized in web security development efforts. Over the last few years, cloud services (i.e. SaaS) have been increasingly used as both a starting point for application security efforts and as a full outsourcing of the appsec program. However, by the very nature of cloud outsourcing and delivery, it is difficult to evolve this approach into a mature secure development lifecycle. Developer involvement is a necessity, and the solution has been to bring vulnerability assessment technologies in house. But recently, organizations have started to deploy a mixture of on-premise and cloud appsec solutions as an alternative to the all or nothing paradigm of on-premise or SaaS.
Topics covered include:
- Overview of vulnerability assessment using SaaS
- Overview of on-premise vulnerability scanning in the SDLC
- Challenges of on-premise and SaaS implementations
- Private cloud variations of on-premise and SaaS offerings
- Hybrid on-premise/cloud implementations in the SDLC
- Use of automation and integration with development infrastructure to ease developer adoption of on-premise/cloud appsec implementations
- How organizations can use SaaS to get started with application security and mature into a robust software security assurance program featuring on-premise and cloud deployments.
Track: Management
Speaker: Andrew Earle
CISPA Why Privacy Advocates Hate This Legislation
Reintroduced in the House of Representatives on February 13, 2013, the Cyber Intelligence Sharing and Protection Act (CISPA) is a proposed US law which would allow for the sharing of Internet traffic information between the U.S. government and certain technology and manufacturing companies. The stated aim of the bill is to help the U.S government investigate cyber threats and ensure the security of networks against cyberattack.
CISPA has been criticized by advocates of Internet privacy and civil liberties, such as the Electronic Frontier Foundation, the American Civil Liberties Union, and Avaaz.org. Those groups argue CISPA contains too few limits on how and when the government may monitor a private individual's Internet browsing information. Additionally, they fear that such new powers could be used to spy on the general public rather than to pursue malicious hackers. CISPA has garnered favor from corporations and lobbying groups such as Microsoft, Facebook and the United States Chamber of Commerce, which look on it as a simple and effective means of sharing important cyber threat information with the government.
Some critics saw CISPA as a second attempt at strengthening digital piracy laws after the anti-piracy Stop Online Piracy Act became deeply unpopular. Intellectual property theft was initially listed in the bill as a possible cause for sharing Web traffic information with the government, though it was removed in subsequent drafts.
Track: Executive/Legal
Speaker: Maureen Donohue Feinroth
Session 4: 13:35 - 14:20
DevOps and Security: It's Happening. Right Now.
How do you integrate security within a Continuous Deployment (CD) environment - where every 5 minutes a feature, an enhancement, or a bug fix needs to be released? Traditional application security tools which require lengthy periods of configuration, tuning and application learning have become irrelevant in these fast-pace environments. Yet, falling back only on the secure coding practices of the developer cannot be tolerated.
Secure coding requires a new approach where security tools become part of the development environment – and eliminate any unnecessary code analysis overhead. By collaborating with development teams, understanding their needs and requirements, you can pave the way to a secure deployment in minutes. Steps include:
- Re-evaluate existing security tools and consider their integration within a CD environment
- Deliver a secured development framework and enforce its usage
- Pinpoint precise security code flaws and provide optimal fix recommendations
Track: Technical
Speaker: Helen Bravo
A Demo of and Preventing XSS in .NET Applications
This presentation will cover a variety of approaches toward discovering XSS vulnerabilities in .NET applications, including:
- Microsoft's Web Protection Library/AntiXSS
- OWASP's AntiSamy.NET project
- CAT.Net
Track: Deep Dive
Speaker: Larry Conklin
Measuring Security Best Practices With OpenSAMM
Security is becoming a competitive advantage in the marketplace. How do we ensure that security is built into products for our customers?
Security vulnerabilities can be introduced at any phase of the software development life cycle (SDLC). The Open Software Assurance Maturity Model (OpenSAMM) is lightweight, flexible framework that helps prevent vulnerabilities and improve security during software development.
This talk advocates adopting OpenSAMM to measure security best practices and improve our security processes, tools, and knowledge.
Track: Management
Speaker: Alan Jex
Crafting a Plan for When Security Fails
A computer security incident, whether an exposed system with protected data or a hacked application, requires a planned response to quickly address and contain the threat. We exist in a world where having a plan is a necessity. Companies in various industries possess vast amounts of regulated and confidential data; this arrangement places a great amount of responsibility on the custodian. Unfortunately, in today's world, it is almost inevitable that you will be the target of an attack or mishandle data that may cause a potential exposure. Do you have a codified plan that helps guide your response?
CSIRPs are robust documents that are difficult to create. Developing a CSIRP that takes into account organizational culture and existing structure, creates buy-in from various departments, and is applicable in a wide array of emerging and existing threats while balancing substance and brevity may be a herculean task.
This presentation will provide the basis for the need for a CSIRP, discuss pitfalls and strategies when crafting CSIRPs, explore common ways they fail, and offer tips to create a healthy, viable, and useful process to use when confronting a computer security incident.
This presentation is geared towards those wishing to learn more about creating a viable computer security incident response plan (CSIRP).
Track: Executive/Legal
Speaker: Robert Lelewski
Session 5: 14:30 - 15:15
Real World Cloud Application Security
This presentation will provide the audience with a case study of how real world organizations using the public cloud are approaching application security. Netflix, one of the largest AWS and public cloud users in the world, will serve as the subject of the case study.
The discussion will cover a variety of topics of interest to application security personnel, including:
- Automating and integrating security into CI/CD environments
- Large scale vulnerability management
- Continuous security testing and monitoring, including Netflix's Security Monkey and Exploit Monkey frameworks
- Cultural integration of security in DevOps/agile organizations
Track: Technical
Speaker: Jason Chan
Data Mining a Mountain of Zero Day Vulnerabilities
Every day, software developers around the world, from Bangalore to Silicon Valley, churn out millions of lines of insecure code. This presentation evaluates an anonymized vulnerability data set derived from static binary analysis on thousands of applications belonging to large enterprises, commercial software vendors, open source projects, and software outsourcers.
By mining this data we can answer some interesting questions. What types of mistakes do developers make most often? Are we making any progress at eradicating XSS and SQL injection? How long does it really take to remediate software vulnerabilities? How secure are third party software components?
The discussion will answer these questions and many others, giving you a deep dive into metrics not found anywhere else.
Track: Deep Dive
Speaker: Joe Brady
Defending Desktop (.NET/C#) Applications: Mitigating in the Dark (A Case Study Remix)
This presentation is on the case study(s) of desktop applications undergoing a cracking/hacking/attacking life cycle. This is the summation of multiple software projects undergoing attacks from a detected and focused attacker. This presentation follows a Product Owner(s) and Coder(s) going from a self directed response.
Your software project has been going for years, your client base is growing, your making deadlines then one day some e-mail shows up and your world starts to crumble. Crack after Crack keeps coming out every version; Your new Upgrades/Code keep showing up in a competing product; Malware keeps hitting your clients. See the steps taken by day-to-day product Owner(s) and Coder(s) as they respond to security events that never crossed their minds as potential threats.
Track: Management
Speaker: Jon McCoy
Information Control: The Critical Need for a Defensible Position - Securing the Information Ecosystem
Given an overview of Identity Theft, fraud and information exposure participants will discover that the liability of these issues is much broader than they are prepared to manage.
Given case studies and stories from field experience, participants will identify gaps in information compliance policies and practices that place every organization at risk beyond areas of commerce, compliance, and technology.
Upon completion of the session participants will recognize critical gaps in their information ecosystem that need to be addressed in order to create a defensible position in the case of a breach.
Track: Executive/Legal
Speaker: Tom Glanville
Friday Sessions (3/29): 09:00-13:00
Secure Coding
Refine your skills at this expert-lead course (included in the price of the conference!). From junior developers to senior, this class is a Must for everyone who writes code.
Specific topics include remediation (in code) of:
- SQL Injection
- Password storage strategies
- Authentication best practices
- Clickjacking
- Multifactor authentication
- CSRF defense
- WAF/Virtual Patching
Track: Training
Speaker: Aaron Weaver
Capture the Flag: Postmortem
Ask questions about challenges from Thursday's competition, give suggestions on how to improve for next year, and participate in a FLOSSHack-style assessment of the CTF's underlying infrastructure. This gloves-off pen test will target the unintended and malicious acquisition of flags, keys, hints, and points. Cheating, lying, and dirty tricks are highly encouraged as we hack away at the scoreboard and the distributed VM.
Track: Testing
Speaker: Mark Major
Current Sponsors
|Aerstone provides strategic and technical cyber security consulting services including assessments, planning, architecture designed incident response, regulatory compliance, and computer forensics. We provide services and products for medium to large healthcare providers, financial services organizations and legal firms, and law enforcement. Clients range from local businesses to government agencies.
Applied Trust
| AppliedTrust provides IT infrastructure, security, and opensource consulting services. Our clients are organizations where effective IT is critical to the reputation and growth of their business, and hail from a variety of industries including healthcare, financial services, hospitality, recreation, and government. Our specialty areas include:
| Checkmarx - Source Code Analysis Made Easy
Checkmarx is the developer of next generation Static Code Analysis (SCA) solutions. The company pioneered the concept of a query language-based solution for identifying technical and logical code vulnerabilities. Checkmarx provides the best way for organizations to introduce security into their Software Development Lifecycle (SDLC) which systematically eliminates software risk. The product enables developers and auditors to easily scan un-compiled / un-built code in all major coding languages anywhere, anytime. CxSuite's application security testing is available in both "On Premise" and "On Demand" configurations. The security testing scans for the most prevalent security vulnerabilities as determined by OWASP Top 10, SANS, and other major standards. Checkmarx was recognized by Gartner as sole visionary in their latest SAST magic quadrant and as Cool vendor in application security. Customers include Fortune 500, government organizations and SMBs in over 30 countries.
|HP is a leading provider of security and compliance solutions for the modern enterprise that wants to mitigate risk in its hybrid environment and defend against advanced threats. Based on market leading products from HP ArcSight, HP Fortify, and HP TippingPoint, the HP Security Intelligence Platform uniquely delivers the advanced correlation, application protection, and network defenses to protect today's hybrid IT infrastructure from sophisticated cyber threats.
Security Pursuit
|Security Pursuit provides computer security services to help organizations protect their critical information systems. Based in Denver, Colorado, Security Pursuit's services include: IT Security Risk Analysis, Data Breach Incident Response, Network Penetration Testing and Vulnerability Assessments, Website Penetration Testing and Vulnerability Assessments, Wireless Network Security, Social Engineering Prevention, Security Awareness Training, Employee Termination Assistance and Virtual CISO consulting. We have conducted hundreds of security assessments for financial institutions, healthcare providers, retailers, utilities, airports, and municipal governments; many in support of PCI, GLBA, NCUA, and HIPAA compliance requirements. Security Pursuit's computer security services provide you with a higher level of awareness about the security posture of your organization.
|Escaping network insecurity means identifying and eliminating vulnerability at each and every level. At South Seas Corporation, we consider the big picture and the finest details of your information technology, from computers to routers to servers and the cabling between, from intranets to the internet, from mobile devices to web applications to remote networks across the globe. We also address administrative issues, including security policy and federal compliance. Of course, your budget is top of mind from the beginning. The end result is a tailored solution designed to secure every byte of information traveling through, to and around your organization at every point, installed by certified experts trained to work hand in hand with your IT department. Take a load off your mind with South Seas Corporation.
|Today most global enterprises live under the constant threat of being hacked, which begs this critical question – how do they innovate and rapidly release new and improved applications required to be an industry leader while still securing their organizations critical IP and data assets? Before Veracode, application security was widely thought to slow innovation, but not anymore. With the Veracode Platform, application security and innovation can go hand-in-hand. Whether applications are built, brought or outsourced, Veracode's patented testing technology provides the intelligence needed to quickly secure them from the most common forms of attack.
Denver Marriott City Center
Denver Attractions
- Monty Python's Spamalot at the Buell Theatre (3/28-30)
- World-class exhibitions at the Denver Art Museum
- Guided walking tours of downtown's microbreweries
- The Denver Nuggets host the Brooklyn Nets (3/29 @ 7pm)
- Free tours of the US Mint
- Plus all the standard downtown stuff: shopping, more shopping, an aquarium, a zoo, comedy clubs, local music, and many clubs, restaurants, and art galleries.
Colorado Attractions
Out-of-town visitors may be interested in staying for the weekend to enjoy all Colorado has to offer, including:
- Red Rocks amphitheatre
- The Butterfly Pavilion
- Garden of the Gods (Colorado Springs)
- Royal Gorge (Canyon City)
- Coors, New Belgium, and many other Colorado breweries
The SnowFROC staff is pursuing a chartered bus and negotiated discounts for premier ski resorts and lift tickets. Check back soon for details!
Capture the Flag Overview
Test your skills with a capture the flag (CTF) hacking competition created specifically for SnowFROC by members of the Boulder OWASP chapter.
Competitors will be provided a series of web applications containing a variety of vulnerabilities. Each discovered vulnerability will earn points. The harder the hack, the more points earned. At the end of the day, the team with the most points wins.
All conference attendees may participate in the CTF tournament for no additional cost. If you would prefer to attend the general conference proceedings, the competition will be made available to attendees after SnowFROC ends.
Contestants will be provided a virtual machine which will run locally on self-provided devices. This is a BYOD event and all contestants are responsible for providing their own machine. No "loaners" will be made available.
All contestant machines should have:
- A virtual machine player that supports .vmdk files, such as VMware Player, VirtualBox, or Parallels.
- Appropriate penetration testing tool (BackTrack, SamuraiWTF, Mantra OS, and OWASP ZAP will fit in well).
Acceptable behavior
Competitors are only permitted to attack targets running on their local systems. Network traffic will be monitored to ensure there will be:
- No attacking the scoreboard. Misuse will result in punitive action.
- No targeting the VM. Do not mount the VM and harvest flags from within.
- No attacking other teams, whether through coercion, DoS, theft, sabotage, or other malicious activity.
- No collusion. Work only within your own team.
Small prizes will be awarded to winners. Anyone who worked on the project or who has access to project-related repositories is ineligible to win prizes.
Both team and individual prizes will be awarded based on merit and other achievements.
Getting Started
Content acquisition
This information will be released closer to the day of the event.
Installation and configuration instructions
- Add the following entries to your hosts file:
10.50.65.12 training.theagency.owasp, theagency.owasp 10.56.65.87 theagency.owasp, Im.theagency.owasp 10.50.65.26 www.pla.owasp, secretlogin.pla.owasp, download.pla.owasp, www.pla.pt 10.50.65.187 shadowcorp.owasp 198.19.147.198 ctf.snowfroc.com
- The first network adapter must be a bridge network adapter.
- Configure the second network adapter to be a host-only network on your VM with IP address 10.50.65.254/24
- Load the .vmdk files
- Make sure you are using a browser other than Internet Explorer which for security reasons is not supported by the scoreboard.
- Make sure you are on the CTFSnowFROC wifi network (or plugged in directly at a table).
- Start by copying VM over to your machine. While that is going on, move on to the next steps.
- Make sure hosts file has the entries provided above.
- Within VirtualBox, go to file --> preferences --> network --> add host only network adapter.
- Edit this new adapter - put in 10.50.65.254 255.255.255.0
- In the VirtualBox main page- go to New, give the VM a name, set type to BSD, click next, set mem to at least 1 GB, Use Existing Virtual HD. Point it to the ctf.vmdk file you copied onto your machine. Create.
- Select VM in the VirtualBox main window, at top click settings. go to network, adapter 1, change to "Bridged Adapter". Adpater 2, enable network adapter, make it a host only adapter and select the adapter you created earlier. Hit ok.
- Start VM. Follow directions provided in VM.
Registration instructions
Coming soon.
Gameplay instructions
2013 presentations
Keynote Address: Data Protection for the 21st Century
Panel Discussion
Technical Track
DevFu: The inner ninja in every application developer
Adventures in Large Scale HTTP Header Abuse
Angry Cars: Hacking the "Car as Platform"
DevOps and Security: It's Happening. Right Now.
Real World Cloud Application Security
Deep-Dive Track
SIP Based Cloud Instances
How Malware Attacks Web Applications
Top Ten Web Application Defenses
A Demo of and Preventing XSS in .NET Applications
Data Mining a Mountain of Zero-Day Vulnerabilities
Management Track
Digital Bounty Hunters - Decoding Bug Bounty Programs
Linking Security to Business Value in the Customer Service Industry
Using SaaS and the Cloud to Secure the SDLC
Measuring Security Best Practices With Open SAMM
Defending Desktop (.NET/C#) Applications: Mitigating in the Dark (A Case Study Remix)
Legal Track
Electronic Discovery for System Administrators
Legal Issues of Forensics in the Cloud
CISPA: Why Privacy Advocates Hate This Legislation
Crafting a Plan for When Security Fails
Information Control: The Critical Need for a Defensible Position - Securing the Information Ecosystem
Previous conferences
2012 presentations are available here.


text:
(Reuters) - Five-division world champion Floyd Mayweather Jr. will face Marcos Maidana of Argentina in a welterweight title fight on May 3, the American announced on Monday.
Mayweather, who turns 37 on Monday, revealed the news via Twitter, ending months of speculation about his next opponent.
Mayweather defeated Saul Canelo Alvarez in his most recent bout in September and subsequently announced the May 3 fight without identifying his next opponent. The site for the matchup has yet to be announced.
Mayweather has a perfect 45-0 record while Maidana is coming off an impressive win against Adrien Broner to be 35-3.
(Writing by Jahmal Corner in Los Angeles; editing by Amlan Chakraborty)


text:
She's a Nashville-based blogger and mom to two-year-old Matilda Jewel, who writes two blogs, Whoa, Wait, Walmart? and A Girl James. We love the way she edits the fashion market (and beyond)—not just for herself and her family–but really for her friends and readers. She has great taste, a generous spirit, and is always thinking about the price. We're so glad we met her.
Give us a little background on yourself/what you do/how you came to it.
I don't care where things come from; I care how they look and make me feel. Money doesn't have to impact the ability to be stylish.I grew up in Walmart's hometown: Bentonville, Arkansas. Growing up, my sisters and I were taught to hunt for a good deal, even at Walmart. Going to line reviews with my Walmart-buyer mother inspired me to major in Fashion and Interiors Merchandising in college. After a short stint in product development on furniture and several retail jobs, I decided I should step back and decide what was important to me. Climbing a corporate ladder or working in retail weren't going to make me happy. I love people; I wanted to help people. Setting aside the creative field, I got a Masters of Arts in Teaching English Language Learners. I spent the next five years teaching the most precious children in the Metropolitan Nashville Public Schools.
When my daughter was born, I chose to stay home with her (part-time at first, fulltime now) and our income was cut in half. (Good thing shopping for a bargain is a rush for me!) I had always wanted to start a blog. Being home fulltime with Matilda gave me the opportunity to do it. A Girl James is a space created for sharing deals I find and things I make. As I said earlier, I love helping people. In this season of life, I'm not helping them learn how to read, but rather helping them enjoy the things around them (in simple, inexpensive ways).
Throughout my life, I have constantly had exchanges that include someone saying, "That's from Walmart?" Those reactions were the inspiration for a regular post on my blog called, Whoa, wait. Walmart? It focused on the amazingly cute products you can find on their aisles. Don't get me wrong sometimes you have to dig. (Remember, I love the hunt.) I was toying with the idea of letting Whoa, wait. Walmart? stand on it's own. My dear friend and (as she put it) style soul mate, Amanda Jerkins, encouraged me to do it. So, I asked her to come along for the wonderful ride. You can find us on Instagram, Tumblr, Facebook, and Twitter. It has been a blast!
Do you work in a home office, and if you do, how do you deal with working from home (while parenting)?
My version of a home office is my living room, bedroom, or kitchen. I get most of my work done during naptime or in the evenings. My husband is great about helping out when he is home. It's amazing what you can accomplish during 20 minutes at home while they run to the store!
What would you say is your "mom uniform"?
I've been living in cutoffs or jeggings, a flowing top, and my Walmart sandals. (The ones featured on Momfilter.)
Do you cook much–if you don't, what are your ways around not cooking, and if you do, what are your go-tos–both for yourself, and for your kid?
I love to cook! Although, being the worlds worst menu planner often inhibits what ends up happening at dinner. Our dinners usually end up being last minute, whatever we have in the house. The one meal we make every single week is pizza. We are obsessed with Trader Joe's. Have you tried their pizza dough? Oh man, it's delicious. Our favorite is the regular, but they have whole wheat as well. It costs $1.99. The best part is that pizza making it is a family event. My husband rolls out the dough. Matilda spreads pizza sauce, while I chopped fresh spinach in the food processor. Then we add some basil and top it off with mozzarella. It bakes on a pizza stone (what I bake everything on) at 425 degrees for 15 minutes. So simple and we get another veggie in Matilda's mouth.
What's your weeknight family dinner routine?
My husband usually gets home from work around 5:30 pm. We eat together at our bar or dining table around 6:00 pm. Eating together is important to us. Some nights Matilda eats something (baked sweet potatoes and avocados are her favorites) before us if we're going out on a date. We still sit down at the table with her.
How do you celebrate your child's birthdays?
Birthdays are very important to me. Not my birthday necessarily, but I want my husband and daughter to feel special and loved. Matilda's first birthday was huge, with tons of people. I kept telling myself her second birthday was going to be simple and small. It wasn't simple or small. I can't contain myself when it comes to giving her joy. Having said that, elaborate and big doesn't have to mean expensive. Her party this year had a circus theme. I made almost everything: pennant banners, cages for the stuffed animals, and signs. My mom made the adorable cake. The whole party cost less than $75, including her presents.
Best kid purchase/bang for your buck?
Matilda loves Ikea toys! They are unique, adorable, and inexpensive.
Any rules about TV/screens?
We just try keeping it in moderation. She loves to watch TV or play games on our iPhones or iPad. It has been so sweet to relive my favorite Disney movies through her eyes. The TV is only on if we are actually watching something. It doesn't stay on; the unnecessary noise and waste of electricity drive me crazy. Oh, and no screens during mealtime.
What websites inspire you and for which parts of your life? Preferred social media is….?
My favorite blogs are A Beautiful Mess and Design*Sponge. They inspire me to keep creating and equip me with fresh ideas. My preferred social media is Instagram. Who doesn't love it?
What's a typical weekend like?
Friday nights we usually go out to eat as a family (I choose Mexican; my mister chooses burgers. We always agree on sushi.) and then after Matilda goes to bed, we watch West Wing on Netflix or TiVoed Shark Tank episodes. Saturdays include a slow, lazy morning: homemade breakfast, dancing to Michael Kiwanuka or Josh Ritter on vinyl, and sipping coffee. After we get around, we usually do some grocery shopping and head to the park or pool. Sundays are busy and slow all at once with church, naptime or projects, and preparing for the week.
What's the thing that always stays on your to-do list and never gets crossed off and nags at you?
Being a creative, I hoard things that have potential. Our garage is full of projects. There is this huge card catalog (free from the university my husband works for) that I've been planning on painting and putting wheels on. Thrift store chairs ($10 for the pair) that have beautiful frames, but just need to be recovered. This cycle will never end, and I love it.
Do you have a fail-safe beauty product or routine?
I've been washing my face with coconut oil for almost six months. I still have minor breakouts, but it has kept my skin clearer than any other product I've tried. My anxiety was through the roof when I rubbed oil on my face for the first time. I was raised to only use oil-free products.
Best family trip?
To save money, most of our vacations are planned around work trips for my husband. Back in May, my husband had a conference in St. Louis, we went and enjoyed the city. Their zoo is free and enormous! They also have a great downtown splash park called Citygarden that Matilda loved. However, being at the beach with my family… not much can beat that.
Any small business advice–like what is something you wish someone had told you when you started your business?
This is more blog advice and less business advice, but they might go hand in hand. Elsie from A Beautiful Mess wrote a post called 5 Tips for Bloggers. It was a nice reminder that I could comment on and like tons of blog posts, Instagram pictures, or Facebook pages without feeling like they were the competition. It was liberating to share the love.
There is no possible way I could live without my iPhone 5. The majority of my business is managed from it. Plus, I would never show up for any events or appointments if an alert didn't tell me to.
Any personal/parenting "a-ha" tips?
Most of our days together, Matilda and I thoroughly enjoy each other's company. Sometimes on really difficult days (you know, the ones filled with tears and timeouts) I stop and reflect on the day. Most of those days, I wasn't parenting intentionally. I was probably trying to cross off too many things on my to-do list.
You feel your best when?
Creating has always been important to me. My husband lived in Italy several years ago, and one of his Italian friends worked as a deejay at night. He used to say that he deejayed to get his demons out. That is how I feel about making things or sharing my ideas; it gets my creative demons out.
Guiltiest pleasure?
Young-adult fiction is my vice. I will stay up all night for a book that has suspense and/or romantic tension.
Proudest moment in parenting?
My heart melts when Matilda says, "Thank you." without being reminded.
Best parenting advice you ever got?
When Adam and I were engaged, we were on a road trip with my grandpa. He asked if we were ready to get married. My husband said yes, but asked if he had any advice. My grandpa quickly replied, "Don't get mad at the same time." We sort of laughed it off at the time, but that advice has been a foundation for our marriage. Eventually, we learned how applicable it is to parenting as well. No one will get anywhere if more than one person is mad. Everyone just needs to take a deep breath.


text:
Today, Mitt Romney, a perennial finalist in the global Whitest Person Alive contest, spoke in front of a crowd at NAACP's national convention. It didn't go well.
In addition to the cascade of boos that followed Romney's promise to repeal Obamacare, the crowd's facial expressions did little to hide the contempt they felt for the presumptive GOP nominee.
You have to hand it to Romney, though — the fact that he spoke to that crowd of literally dozens (according to photos Tweeted from the event, the auditorium was pathetically empty) of people who were members of a voting bloc that voted for Obama in 2008 at a rate of 96% shows some giant metal balls. Unfortunately, they're the same sort of giant metal balls that might lead the charge into invading Iran or something.
Here's one of several photos of unamused audience members at the Romney event. Caption at will.


text:
If you've resolved to amp up (or start up) exercise in the new year, you might be wondering how to optimally fuel your workouts. For advice on the best foods to eat before lacing up and heading to the gym or park, I spoke to Nancy Clark, MS, RD, whose Sports Nutrition Guidebook was released in its fifth edition last October. While Clark stresses that the best pre-workout foods vary from person to person and are affected by variety of other factors (including the intensity and duration of your workout), there are some general guidelines to keep in mind:
Consider Your Last Meal: If you've eaten a healthy, balanced meal a few hours before exercise (or even if you had a substantial dinner the night before), Clark says you might not need to eat anything before your workout--especially if it's a regular gym session or jog of an hour or less at a moderate intensity (a pace you could maintain for more than 30 minutes, says Clark).
Aim for 100 to 200 Calories: If you are working out in the morning or it's been a long time since your last meal, you'll probably want to give your blood sugar a little boost (your body also draws fuel from the glycogen stored in your muscles, so you don't need ot get all your energy from your blood sugar). Clark says about 100 to 200 calories should do the trick for the average workout.
Keep It Light: Remember our suggestions for Foods That Make You Feel Full? Well, disregard it if you're about to workout, especially if you're running, taking an aerobics class, or doing other jostling exercises. You want foods that sit well and digest easily. That means foods that contain simple carbs and that are low in fiber, fat, and protein. Good bets include a banana, a piece of a bagel, pretzels, half an English muffin, and dry cereal, says Clark.
Experiment: When it comes to how much fiber, fat, and protein, and how much food in general you can eat before exercise without feeling overloaded or having gastrointestinal distress, "each person is an experiment of one," says Clark. "You have to learn what works for your body, how much you can tolerate, and what foods settle best." You might find you can add a little nut butter, cheese, turkey, or avocado to that English muffin or some low-fat yogurt or milk to your cereal.
Look to Real Foods: While energy bars and drinks are convenient, Clark says there are plenty of naturally energizing foods. In addition to those mentioned above, you might want to give dried fruit (dates, raisins, dried pineapple, dried apples) a try. In fact, raisins are better than gels for pre-workout fueling, according to Men's Health. And remember that sports drinks are best consumed during intense, longer workouts not before exercise (you generally don't need them for efforts under an hour).
Know When to Eat More: If your stomach is already growling and you have at least an hour before your workout to digest, step it up from the suggestions above and have a small meal with a bit of protein, healthy fat, and carbs. Try a half a turkey or peanut butter sandwich, a smoothie, or a small portion of leftovers, or any of the suggestions in our article on Eating for Energy. Runner's World also has some great ideas for Prerun Mini Meals.
Pictured: Mango, Berry, Banana Smoothie


text:
return_stmt: "return" [expression_list]
return may only occur syntactically nested in a function definition, not within a nested class definition.
If an expression list is present, it is evaluated, else
is substituted.
return leaves the current function call with the expression
list (or
None) as return value.
When return passes control out of a try statement with a finally clause, that finally clause is executed before really leaving the function.


text:
MIDTOWN — Madison Square Garden's bid to permanently renew an expired permit that allows it to operate as a high-capacity arena got the thumbs-down from Manhattan's Community Board 5 Thursday night.
CB5 instead recommended at its full board meeting to approve a 10-year permit for MSG, giving the community time to develop plans to relocate "The World's Most Famous Arena." Members want the arena to move in order to give room to expand the overcrowded Penn Station below.
"The committee thought that rather than granting the Garden a renewal in perpetuity, we thought we should create a planning period — a 10-year planning period …to find a better location for Madison Square Garden," Raju Mann, acting chairman of the board's land-use committee, explained Thursday night.
"We don't have a world-class arena, frankly, and we don't have a world-class [train] station. And we should have both."
CB5 also voted to reject MSG's plan to install four 10-story LED signs around the exterior of the building, calling on the city to oppose the proposed LED signs by arguing they would negatively affect nearby residents. They said the signs would confuse tourists into believing that Penn Station's Eighth Avenue entrance was instead an entrance to the arena.
In addition, the proposed electronic signs are "are totally inappapropriate" and "quite bright," Mann said.
The CB5 recommendation will next go before the borough president, who has 30 days to weigh in, and then to the city planning commission, before going officially before the City Council.


text:
Debate Digest: Teacher-student friendships on Facebook, Law school, Balanced budget amendment, US debt ceiling deal.
Climate change and clean energy portal
From Debatepedia
(Difference between revisions)
|Revision as of 15:48, 7 October 2011 (edit)
Brooks Lindsay (Talk | contribs)
← Previous diff
|Revision as of 15:49, 7 October 2011 (edit)
Brooks Lindsay (Talk | contribs)
(→Market and regulatory approaches)
Next diff →
|Line 40:
|Line 40:
|*[[Debate: Pickens US energy plan| Pickens US energy plan]]
|*[[Debate: Pickens US energy plan| Pickens US energy plan]]
|*[[Debate: US Renewable Electricity Standard| US Renewable Electricity Standard]]
|*[[Debate: US Renewable Electricity Standard| US Renewable Electricity Standard]]
|*[[Debate: Underground nuclear waste storage| Underground nuclear waste storage]]
|==Geoengineering approaches==
|==Geoengineering approaches==
Revision as of 15:49, 7 October 2011United Nations Foundation to outline the pros and cons of the major approaches to solving climate change and fostering a renewable energy economy. The articles below serve to inform the public and decision-makers about the comparative benefits and costs of each approach, helping to instruct policy and funding priorities.
Renewable energy technologies
- Hydroelectric dams
- Geothermal energy
- Nuclear energy
- Solar energy
- Tidal energy
- Wave power
- Wind energy
Future hydrocarbons
- "Clean coal"
- Natural gas
- Oil sands
- US offshore oil drilling
- Oil drilling in the Arctic National Wildlife Refuge
Alternative fuels
Clean transportation approaches
Market and regulatory approaches
- Carbon emissions trading
- Cap-and-trade versus carbon tax
- Vehicle fuel economy standards
- Pickens US energy plan
- US Renewable Electricity Standard
- Underground nuclear waste storage
Geoengineering approaches
- Geoengineering
- Carbon capture and storage
- Iron fertilization of algae blooms
- Solar shading
- Reforestation as a solution to global warming
International treaties
- Kyoto Protocol
- "Developed countries have a higher obligation to combat climate change"
- The UN should prioritize poverty over climate change
Climate change itself
Articles under development
- Feed-in tariffs for renewable energy
- Concentrated solar photovoltaic energy
- Concentrated solar thermal energy
- Underground nuclear waste storage
- Micro hydro power
- Oil drilling in the Arctic
- Phasing out fossil fuel subsidies
- Ban on Antarctic exploitation
- Clean diesel
- Climate change mitigation vs adaptation
- Conservation concessions
- Desert solar energy
- Carbon offsets
- Renewable energy on public lands
- Natural gas fracking
- Ban on Antarctic exploitation
- Carbon offsets
- EU Emissions Trading System
- Government incentives for petrol-free vehicles
- Liquified natural gas (LNG)
- Solar shading with airborne particles
- Space-based solar power
- Thorium based nuclear energy
- Solar energy on public lands
- Ecotax


text:
A sanctuary of love for gods
Cultural village of Europe for the year 2004, Paxi (or Paxoi) is the ideal island for a peaceful holiday. Fjord-shaped beaches, underwater caves, small bays and green hills welcome the lucky visitors. According to the legend, the island would be the southernmost tip of Corfu, if the God of the Sea, Poseidon, had not broken it off with his trident when he needed a god-deserving place to live his love with the Nereid Amphitrite.
Its capital and main port, Gaios (Gáios), is separated from its natural breakwater, the tiny island of Agios Nikolaos (Saint Nicholas), by a narrow channel, displaying one of the most beautiful port sceneries in Greece.
Not to be missed:
• the Venetian fortress of Agios Nikolaos
• the English Governor's House
• the Paxi Museum and the churches and chapels of the area.
Visit the picturesque villages of Lóggos, Lákka and Oziás, tucked away in pine and olive trees. In the areas of Oziás, Yaná and Glyfáda, sulphur thermal springs offer an alternative treatment for rheumatics and other health conditions. Innumerable ravishing beaches await the fitter ones as a starting point for scuba diving into underwater caves and shipwrecks, and for top-notch windsurfing.
It sounds pretty interesting to walk through the vast olive groves inland. In the area of Magaziá, don't forget to drop by the Olive Museum, once a traditional olive press. In the areas of Agia Eleoussa, Vlahopouliátika and Boycática look for the clusters of stone cisterns, carved on the rocks as rainwater collectors.
Sure "musts":
• caique-sailing around the island
• exploring the islets around Paxi (Antipaxi)
• visiting the extraordinary 40-odd sea caves with the majestic domes on the south coast of the island
• hiking the old trails, among which we suggest the Mousmoúli-Porto Oziás and the Manessátika-Ypapantí ones.
To host a classical music festival runs in the family of the Ionian Islands, but Paxi take great pride in organising the following two. At the beginning and at the end of summer the island hosts internationally famous Greek and foreigner soloists, whereas in July the traditional festival of "Water and Oil" is held dedicated to folk music. To fully enjoy the celebration, visitors will sample here bread soaked in water, olives, onions, boiled potatoes and local wine.
Visitgreece.gr is the official tourism web site for Greece, run by the Greek National Tourism Organisation, where you'll find information on the main tourist destinations, such as cities, beaches, as well as activities, events and much more!
All content included on this site consists intellectual property of GNTO and you are not allowed to reproduce the whole or part of this work in any way.
For information please contact: email@example.com. All Rights Reserved. GNTO © 2020.


text:
Boulet boots are renowned for their unsurpassed quality. Every pair is carefully handcrafted, respecting the old tradition of three generations. All adult boots are entirely leather lined for greater comfort. The famous Boulet brand is sold in North America and Europe and are well known by cowboys around the world for their durability, comfort, and being first in fit. **Per Boulet please allow 4-6 weeks for delivery**
Boulet Men's Challenger & Rubber Soles Challenger Style #6704
# 6704
Price: $218.00
Call us for any special needs you may have.


text:
This section contains detailed articles elaborating on some of the common issues phpBB users encounter while using the product. Articles submitted by members of the community are checked for accuracy by the relevant phpBB team. If you do not find the answer to your question here, we recommend looking through the Support section as well as using the improved search feature.
Below is a list of active articles currently in the Knowledge Base.


text:
Please Login to Remove!
Also, I've read a lot on the forums and other sites about problems with the wifi not working properly, internet not working properly like pages not opening all the time, videos not always working and the bridge not always working. I've read about other minor glitches. This may be a dumb question but those will be fixed in updates right? I won't be purchasing the playbook until about september or october so I hope the bugs are fixed but ultimately, I would like to know if this playbook will be good for a business class in University. I really hope it is, I love RIM and their products so far.
Ok, so, I'm going to university for my first year next year and am doing a BBA with an honours in accounting. For this I will need a word processor, a spreadsheet and a powerpoint, everything the playbook has. I also only care about those things, playing with some apps (apps don't matter too much to me) and surfing the web and some media things like videos and music so I feel that the playbook could easily replace a pc for me. However, I called futureshop to ask questions and the answer I got about the spreadsheet to go was that you could only review information, not actually put info into it and do much with it. Is this true? It seems odd that you can only review things on it. I would really like something I can do my accounting work on and I'd like people's opinions on the spreadsheet to go, would it be good for accounting work?


text:
Just now I wanted to explain why I was doing something, then I wrote "the purpose of doing something is blablabla". Immediately I wondered why I didn't write "the reason of doing something is blablabla" instead. It seems to me that the words purpose and reason are perfectly interchangeable in this context. On the other hand, however, the word purpose impresses me as "where is it going" while the word reason carries the connotation of "where is it coming from". In this sense, they seem to contradict each other.
Any one can explain this phenomenon to me? Maybe it is only me that is confused due to misconception of the two words.


text:
Recently added item(s)
You have no items in your shopping cart.
Olga Goose Candles
Availability: Out of stock
Originating in Japan, Olga Goose's playful and unique scented candles take inspiration from cartoonish film characters. 100% wax candles H: 10,0 cm / W: 8,0 cm / D: 2,5 cm Handmade in Japan "I hope you can draw an invisible force out of yourself with it. With love and curse!"
Out of stock
All our orders are shipped by Ups/Fedex or Bpost (for Benelux orders) which are both a trackable service to your door. We have a daily pickup by UPS and Fedex and will email you tracking details as soon as the parcel has been collected.
You can collect your order at our Morrison store in Antwerp. Please note that his is only possible for orders from Belgium or The Netherlands. When you finalize your purchase you can select the option "Pick Up In-Store". The order will then be ready for pick up from our shop in Antwerp on the following weekday. You have 7 days to collect the order before it is returned to the warehouse.Note that you must have your order number with you when picking up in-store in order for us to identify the correct order.
All our prices include 21% VAT. Customers outside of the European Union, can shop tax free and will not be charged for any tax. Please note that handling and custom fees may apply to packages sent outside the E.U. Any duties payable will be the sole responsibility of the customer and may need to be paid at the time of delivery.
Import notice for US orders:
Recently the United States government made a change in the duties/customs charges on all orders to the U.S.From now on US clients are able to order up to $800 free of import tax.
Please find our complete return and exchange policy overhere.If you would have any questions, please mail us at email@example.com
This site uses cookies.


text:
90th Anniversary of Ethnic Tragedy in Smyrna
2. Октобар 2012 - 11:21
On Sunday, September 23, 2012, His All-Holiness presided over the memorial service on the occasion of the 90th Anniversary since the ethnic tragedy in Smyrna in 1922. The service was held at St. Fokas Church in the Mesachorion Community. In attendance were Metropolitan Germanos of Theodoroupolis, the Hon. Nicholas Matthioudakis, Consul General of Greece in Istanbul with his wife Catherine Varvarigou, Consul of Greece in Adrianople, and the Secretary General of the Ministry of Information in Greece, Mr. I. Panagiotopoulos.
Source: Ecumenical Patriarchate


text:
Bladder problems seen more often among smokers than nonsmokers may be further motivation for women to quit smoking, a new study suggests.
Looking at 2,000 Finnish women ages 18 to 79, researchers found that smokers were three times as likely to say they frequently had to urinate, with fewer than two hours between trips to the bathroom.
They were also almost three times as likely to report "urgency." That means frequently feeling that you need to get to a bathroom quickly -- a problem often diagnosed as overactive bladder.
There was no clear link between smoking and the risk of having so-called urge incontinence, in which actual leakage follows a sudden, strong urge to urinate.
But that may be because too few women in the study had urge incontinence to be able to detect a connection to smoking, according to senior researcher Dr. Kari A. O. Tikkinen, of McMaster University in Ontario, Canada.
The findings, reported in the journal Obstetrics & Gynecology, do not prove that smoking, itself, causes bladder problems.
But there are already plenty of reasons to quit smoking, or never start, Tikkinen noted in an interview.
"If you smoke, definitely you should try to quit," he said. "This is one more potential reason."
The findings are based on questionnaires mailed to 3,000 women randomly chosen from a population register. Of the 2,000 who responded, seven percent reported frequent urination, while 10 percent reported urgency.
In addition, 11 percent had stress incontinence, the most common form of urinary incontinence, in which leakage happens when there's pressure on the bladder -- from things like exercise, heavy lifting or coughing. Another three percent of the women had urge incontinence.
Among current smokers (one-quarter of the group), between 10 percent and 15 percent reported frequency or urgency. When the researchers weighed other factors that affect the risk of bladder symptoms -- like age, body weight and childbirth -- current smokers were about three times as likely as non-smokers to have frequency or urgency.
There are reasons that smoking could directly affect those symptoms, according to Tikkinen. Based on animal research, nicotine may trigger excessive bladder muscle contractions. And over time, smoking may damage nerve function in the bladder.
Smokers did not, however, have a higher risk of incontinence, either the stress or urge types.
Tikkinen said the finding on urge incontinence should be interpreted cautiously; smokers did have a higher risk of the problem, but the difference was not significant in statistical terms.
As for stress incontinence, Tikkinen said it's not surprising there was no link. Some past studies have reached the same conclusion, he noted. And it may be that the underlying causes of stress incontinence -- like physical changes caused by childbirth or menopause -- are more important than nicotine's potential effects.
So will kicking the smoking habit improve bladder symptoms like frequency and urgency? There have yet to be clinical trials to answer that question, according to Tikkinen.
But, he said, "everybody knows that smoking is harmful. So you should try to quit."
The link to bladder symptoms, Tikkinen noted, might get more young smokers to consider quitting.
Well-known risks, such as lung cancer and heart disease, can seem like distant threats to young people, he pointed out. "But bladder symptoms, you can get when you're young."
ReutersLast Mod: 10 Eylül 2011, 11:41