text:
Anna was born in Warsaw. After 31 years in Poland, she decided to move to France, where she has made her home.
Her passion for drawing started when she was a young girl. Her mum knew that as long as she had pen and paper, she would be happy to spend all day drawing; so it was a piece of cake to be around her.
She considered becoming a fashion designer or interior designer, but after finishing her Master in Arts and working as a graphic designer in some advertising agencies, she focused on working as a freelance children’s illustrator. She thinks that one of the best thing about being a freelance illustrator is working with people around the world, as well as the new, exciting challenges.
Anna is an animal lover and owner of 2 crazy cats. She is huge fan of Harry Potter, The Lord of the Rings, and open world games.

lowercased:
anna was born in warsaw. after 31 years in poland, she decided to move to france, where she has made her home.
her passion for drawing started when she was a young girl. her mum knew that as long as she had pen and paper, she would be happy to spend all day drawing; so it was a piece of cake to be around her.
she considered becoming a fashion designer or interior designer, but after finishing her master in arts and working as a graphic designer in some advertising agencies, she focused on working as a freelance children’s illustrator. she thinks that one of the best thing about being a freelance illustrator is working with people around the world, as well as the new, exciting challenges.
anna is an animal lover and owner of 2 crazy cats. she is huge fan of harry potter, the lord of the rings, and open world games.


text:
Re-read the first Black Walls. Then Read this.
Proveing that Light can over power your vindictive Dark might.
© Copyright 2019 Loretta Jane. All rights reserved.
wow. I like this writing, especially not been afraid. Sorry Im not with a brillient comment im a bit off atm.

lowercased:
re-read the first black walls. then read this.
proveing that light can over power your vindictive dark might.
© copyright 2019 loretta jane. all rights reserved.
wow. i like this writing, especially not been afraid. sorry im not with a brillient comment im a bit off atm.


text:
The Whisker Pole Newsletter is the monthly voice of Singles on Sailboats. Do you like to write? Share stories of members’ travels and news? Take photographs? We want you to add to our newsletter. There are a number of members on this team, but volunteers are always welcome.
For more information about the Newsletter, contact Shirley Brooks-Hollendursky at [email protected].

lowercased:
the whisker pole newsletter is the monthly voice of singles on sailboats. do you like to write? share stories of members’ travels and news? take photographs? we want you to add to our newsletter. there are a number of members on this team, but volunteers are always welcome.
for more information about the newsletter, contact shirley brooks-hollendursky at [email protected].


text:
In organisations around the world employees are accidently merging their personal and professional cloud applications with dire results. Some of the issues include the routing of sensitive text messages to family members and the replication of confidential documents onto the servers of competitors.
Our personal and work lives are merging. When done well, this can be a huge boost to our productivity and personal satisfaction. The rise of the smart mobile device has been a major part of this merge, driving Chief Information Officers towards various flavours of Bring Your Own Device (BYOD) policies.
With the advent of a myriad of cloud services delivered over the internet, our individual cloud architectures are becoming far more complex. The increasing trend to move beyond BYOD to Bring Your Own Application (BYOA) means that the way individuals configure their own personal technology has the potential to directly impact their employer.
In this environment, one employee could be swapped out for another easily and all were prepared to conform to a defined way of working. Our offices were perhaps best compared to Henry Ford’s production line of the early twentieth century where productivity required conformity.
It’s no wonder that IT has put such a high value on a Standard Operating Environment.
However, new styles of working have taken hold (see Your insight might protect your job). Businesses and government are employing more experts on a shared basis. An increasing proportion of the workforce is best described as being made up of “knowledge workers” and a sizeable number of these people are choosing to work in new ways including spreading their week over several organisations. Even fulltime staff find that that their employers have entered into complex joint ventures meaning that the definition of the enterprise is constantly shifting.
Personal productivity is complex and highly dependent on the individual. The approach that works for one person is a complete anathema for another. Telling people to work in a standard way is like adding a straightjacket to their productivity. Employees should be allowed to use their favourite tools to schedule their time, author documents, create presentations and take notes.
Not only is the workplace is moving away from lowest common denominator software, the increasing integration between mobile, tablet and personal computers means that the boundaries between them are becoming less clear. It all adds up to the end of the Standard Operating Environment.
CIOs are right to worry that BYOD and BYOA will result in their data being spread out over an unmanageable number of systems and platforms. It is no longer workable to simply demand that all information be kept in a single source of truth physical database or repository. I’ve previously argued that the foundation of a proper strategy is to separate the information from the business logic or processes that create it (see Your data is in the cloud when…).
Some of the simplest approaches that CIOs have taken to manage their BYOD environment have involved virtualisation solutions where a virtual desktop with the Standard Operating Environment is run over a client which is available on many devices.
While this is progress, it barely touches the productivity question. While workers can choose the form factor of the device that suits them, they are still being forced into the straightjacket of lowest common denominator business applications.
The vendors are going to continue to provide better solutions which put the data in a standard form while allowing access to many (even competing) applications. It’s not about just one copy of the data on a database, but rather allowing controlled replication and digital watermarks that track the movement of this data including loss prevention.
For example, organisations constantly struggle with managing their staff master data, but in a world of personal social media employees will effectively identify themselves (see Login with social media).
Managing software licenses, even in the most efficient organisation, is still an imperfect science at best with little motivation for users to optimise their portfolio. When employees can bring their own cloud subscriptions to work, with an agreed allowance paid to them, the choices that they make are so much more tailored to their actual needs today rather than what they might need in months or even years to come.
Organisations that have grappled with provisioning new PCs are seeing the advantages of the consumer app stores with employees self-administering deployment between devices. Cloud and hardware providers are increasingly recognising the complex nature of families and are enabling security and deployment of content between members. The good news is that even the simplest family structure is more complicated than almost any enterprise organisation chart!
We see a hint of bad architecture when staff misconfigure their iPhones and end-up with their (potentially sensitive) text messages being shared with their spouse or wider family or when contractors use their personal cloud drive working across more than one organisation. Even worse is when it goes really wrong and a ransomware breach on a personal computer infects all of these shared resources!
The breadth of services that the personal cloud covers is constantly growing. For many, it already includes their telecommunications, voicemail, data storage, diary, expense management, timesheets, authoring of office documents, messaging (email and texts), professional library, project management, diagram tools and analytics. Architecture is even beginning to matter in social media with the convergence of the tools most of us use (see The future of social networks).
Some employers fear the trend of cloud, BYOD and BYOA will lead to the loss of their organisation’s IP. The smart enterprise, however, is realising that well-managed cloud architectures and appropriate taxonomies can help rather than hinder employees to know what’s theirs and what’s yours.
In the near future you may even start choosing staff based on the quality of their personal cloud architecture!

lowercased:
in organisations around the world employees are accidently merging their personal and professional cloud applications with dire results. some of the issues include the routing of sensitive text messages to family members and the replication of confidential documents onto the servers of competitors.
our personal and work lives are merging. when done well, this can be a huge boost to our productivity and personal satisfaction. the rise of the smart mobile device has been a major part of this merge, driving chief information officers towards various flavours of bring your own device (byod) policies.
with the advent of a myriad of cloud services delivered over the internet, our individual cloud architectures are becoming far more complex. the increasing trend to move beyond byod to bring your own application (byoa) means that the way individuals configure their own personal technology has the potential to directly impact their employer.
in this environment, one employee could be swapped out for another easily and all were prepared to conform to a defined way of working. our offices were perhaps best compared to henry ford’s production line of the early twentieth century where productivity required conformity.
it’s no wonder that it has put such a high value on a standard operating environment.
however, new styles of working have taken hold (see your insight might protect your job). businesses and government are employing more experts on a shared basis. an increasing proportion of the workforce is best described as being made up of “knowledge workers” and a sizeable number of these people are choosing to work in new ways including spreading their week over several organisations. even fulltime staff find that that their employers have entered into complex joint ventures meaning that the definition of the enterprise is constantly shifting.
personal productivity is complex and highly dependent on the individual. the approach that works for one person is a complete anathema for another. telling people to work in a standard way is like adding a straightjacket to their productivity. employees should be allowed to use their favourite tools to schedule their time, author documents, create presentations and take notes.
not only is the workplace is moving away from lowest common denominator software, the increasing integration between mobile, tablet and personal computers means that the boundaries between them are becoming less clear. it all adds up to the end of the standard operating environment.
cios are right to worry that byod and byoa will result in their data being spread out over an unmanageable number of systems and platforms. it is no longer workable to simply demand that all information be kept in a single source of truth physical database or repository. i’ve previously argued that the foundation of a proper strategy is to separate the information from the business logic or processes that create it (see your data is in the cloud when…).
some of the simplest approaches that cios have taken to manage their byod environment have involved virtualisation solutions where a virtual desktop with the standard operating environment is run over a client which is available on many devices.
while this is progress, it barely touches the productivity question. while workers can choose the form factor of the device that suits them, they are still being forced into the straightjacket of lowest common denominator business applications.
the vendors are going to continue to provide better solutions which put the data in a standard form while allowing access to many (even competing) applications. it’s not about just one copy of the data on a database, but rather allowing controlled replication and digital watermarks that track the movement of this data including loss prevention.
for example, organisations constantly struggle with managing their staff master data, but in a world of personal social media employees will effectively identify themselves (see login with social media).
managing software licenses, even in the most efficient organisation, is still an imperfect science at best with little motivation for users to optimise their portfolio. when employees can bring their own cloud subscriptions to work, with an agreed allowance paid to them, the choices that they make are so much more tailored to their actual needs today rather than what they might need in months or even years to come.
organisations that have grappled with provisioning new pcs are seeing the advantages of the consumer app stores with employees self-administering deployment between devices. cloud and hardware providers are increasingly recognising the complex nature of families and are enabling security and deployment of content between members. the good news is that even the simplest family structure is more complicated than almost any enterprise organisation chart!
we see a hint of bad architecture when staff misconfigure their iphones and end-up with their (potentially sensitive) text messages being shared with their spouse or wider family or when contractors use their personal cloud drive working across more than one organisation. even worse is when it goes really wrong and a ransomware breach on a personal computer infects all of these shared resources!
the breadth of services that the personal cloud covers is constantly growing. for many, it already includes their telecommunications, voicemail, data storage, diary, expense management, timesheets, authoring of office documents, messaging (email and texts), professional library, project management, diagram tools and analytics. architecture is even beginning to matter in social media with the convergence of the tools most of us use (see the future of social networks).
some employers fear the trend of cloud, byod and byoa will lead to the loss of their organisation’s ip. the smart enterprise, however, is realising that well-managed cloud architectures and appropriate taxonomies can help rather than hinder employees to know what’s theirs and what’s yours.
in the near future you may even start choosing staff based on the quality of their personal cloud architecture!


text:
What Service Mesh Architecture Should I Pick?
If you are building your software and teams around microservices, you’re looking for ways to iterate faster and scale flexibly. A service mesh can help you do that while maintaining (or enhancing) visibility and control. In this blog, I’ll talk about what’s actually in a Service Mesh and what considerations you might want to make when choosing and deploying one.
Looking at that list, you may think “I can do all of that without a Service Mesh”, and you’re correct. The same logic applies to sliding window protocols or request framing. But once there’s an emerging standard that does what you want, it’s more efficient to rely on that layer instead of implementing it yourself. Service Mesh is that emerging layer for microservices patterns.
Service mesh is still nascent enough that codified standards have yet to emerge, but there is enough experience that some best practices are beginning to become clear. As the the bleeding-edge leaders develop their own approaches, it is often useful to compare notes and distill best practices. We’ve seen Kubernetes emerge as the standard way to run containers for production web applications. My favorite standards are emergent rather than forced: It’s definitely a fine art to be neither too early nor too late to agree on common APIs, protocols and concepts.
Think about the history of computer networking. After the innovation of best-effort packet-switched networks, we found out that many of us were creating virtual circuits over them – using handshaking, retransmission and internetworking to turn a pile of packets into an ordered stream of bytes. For the sake of interoperability and simplicity, a “best practice” stream-over-packets emerged: TCP (the Introduction of RFC675 does a good job of explaining what it layers on top of). There are alternatives – I’ve used the Licklider Transmission Protocol in space networks where distributed congestion control is neither necessary nor efficient. Your browser might already be using QUIC. Standardizing on TCP, however, freed a generation of programmers from fiddling with implementations of sliding windows, retries, and congestion collapse (well, except for those packetheads that implemented it).
Next, we found a lot of request/response protocols running on top of TCP. Many of these eventually migrated to HTTP (or sequels like HTTP/2 or gRPC). If you can factor your communication into “method, metadata, body”, you should be looking at an HTTP-like protocol to manage framing, separate metadata from body, and address head-of-line blocking. This extends beyond just browser apps – databases like Mongo provide HTTP interfaces because the ubiquity of HTTP unlocks a huge amount of tooling and developer knowledge.
You can think about service mesh as being the lexicon, API and implementation around the next tier of communication patterns for microservices.
In a Library that your microservices applications import and use.
In a Node Agent or daemon that services all of the containers on a particular node/machine.
In a Sidecar container that runs alongside your application container.
The library approach is the original. It is simple and straightforward. In this case, each microservice application includes library code that implements service mesh features. Libraries like Hystrix and Ribbon would be examples of this approach.
This works well for apps that are exclusively written in one language by the teams that run them (so that it’s easy to insert the libraries). The library approach also doesn’t require much cooperation from the underlying infrastructure – the container runner (like Kubernetes) doesn’t need to be aware that you’re running a Hystrix-enhanced app.
There is some work on multilanguage libraries (reimplementations of the same concepts). The challenge here is the complexity and effort involved in replicating the same behavior over and over again.
We see very limited adoption of the library model in our user base because most of our users are running applications written in many different languages (polyglot), and are also running at least a few applications that aren’t written by them so injecting libraries isn’t feasible.
This model has an advantage in work accounting: the code performing work on behalf of the microservice is actually running in that microservice. The trust boundary is also small – you only have to trust calling a library in your own process, not necessarily a remote service somewhere out over the network. That code only has as many privileges as the one microservice it is performing work on behalf of. That work is also performed in the context of the microservice, so it’s easy to fairly allocate resources like CPU time or memory for that work – the OS probably does it for you.
The node agent model is the next alternative. In this architecture, there’s a separate agent (often a userspace process) running on every node, servicing a heterogenous mix of workloads. For purposes of our comparison, it’s the opposite of the library model: it doesn’t care about the language of your application but it serves many different microservice tenants.
Linkerd’s recommended deployment in Kubernetes works like this. As do F5’s Application Service Proxy (ASP) and the Kubernetes default kube-proxy.
Since you need one node agent on every node, this deployment requires some cooperation from the infrastructure – this model doesn’t work without a bit of coordination. By analogy, most applications can’t just choose their own TCP stack, guess an ephemeral port number, and send or receive TCP packets directly – they delegate that to the infrastructure (operating system).
Instead of good work accounting, this model emphasizes work resource sharing – if a node agent allocates some memory to buffer data for my microservice, it might turn around and use that buffer for data for your service in a few seconds. This can be very efficient, but there’s an avenue for abuse. If my microservice asks for all the buffer space, the node agent needs to make sure it gives your microservice a shot at buffer space first. You need a bit more code to manage this for each shared resource.
Another work resource that benefits from sharing is configuration information. It’s cheaper to distribute one copy of the configuration to each node, than to distribute one copy of the configuration to each pod on each node.
A lot of functionality that containerized microservices rely on are provided by a Node Agent or something topologically equivalent. Think about kubelet initializing your pod, your favorite CNI daemon like flanneld, or stretching your brain a bit, even the operating system kernel itself as following this node agent model.
Sidecar is the new kid on the block. This is the model used by Istio with Envoy. Conduit also uses a sidecar approach. In Sidecar deployments, you have one adjacent container deployed for every application container. For a service mesh, the sidecar handles all the network traffic in and out of the application container.
This approach is in between the library and node agent approaches for many of the tradeoffs I discussed so far. For instance, you can deploy a sidecar service mesh without having to run a new agent on every node (so you don’t need infrastructure-wide cooperation to deploy that shared agent), but you’ll be running multiple copies of an identical sidecar. Another take on this: I can install one service mesh for a group of microservices, and you could install a different one, and (with some implementation-specific caveats) we don’t have to coordinate. This is powerful in the early days of service mesh, where you and I might share the same Kubernetes cluster but have different goals, require different feature sets, or have different tolerances for bleeding-edge vs. tried-and-true.
Sidecar is advantageous for work accounting, especially in some security-related aspects. Here’s an example: suppose I’m using a service mesh to provide zero-trust style security. I want the service mesh to verify both ends (client and server) of a connection cryptographically. Let’s first consider using a node agent: When my pod wants to be the client of another server pod, the node agent is going to authenticate on behalf of my pod. The node agent is also serving other pods, so it must be careful that another pod cannot trick it into authenticating on my pod’s behalf. If we think about the sidecar case, my pod’s sidecar does not serve other pods. We can follow the principle of least privilege and give it the bare minimum it needs for the one pod it is serving in terms of authentication keys, memory and network capabilities.
So, from the outside the sidecar has the same privileges as the app it is attached to. On the other hand, the sidecar needs to intervene between the app and the outside. This creates some security tension: you want the sidecar to have as little privilege as possible, but you need to give it enough privilege to control traffic to/from the app. For example, in Istio, the init container responsible for setting up the sidecar has the NET_ADMIN permission currently (to set up the iptables rules necessary). That initialization uses good security practices – it does the minimum amount necessary and then goes away, but everything with NET_ADMIN represents attack surface. (Good news – smart people are working on enhancing thisfurther).
Once the sidecar is attached to the app, it’s very proximate from a security perspective. Not as close as a function call in your process (like library) but usually closer than calling out to a multi-tenant node agent. When using Istio in Kubernetes your app container talks to the sidecar over a loopback interface inside of the network namespace shared with your pod – so other pods and node agents generally can’t see that communication.
Most Kubernetes clusters have more than one pod per node (and therefore more than one sidecar per node). If each sidecar needs to know “the entire config” (whatever that means for your context), then you’ll need more bandwidth to distribute that config (and more memory to store copies of it). So it can be powerful to limit the scope of configuration that you have to give to each sidecar – but again there’s an opposing tension: something (in Istio’s case, Pilot) has to spend more effort computing that reduced configuration for each sidecar.
Other things that happen to be replicated across sidecars accrue a similar bill. Good news – the container runtimes will reuse things like container disk images when they’re identical and you’re using the right drivers, so the disk penalty is not especially significant in many cases, and memory like code pages can also often be shared. But each sidecar’s process-specific memory will be unique to that sidecar so it’s important to keep this under control and avoid making your sidecar “heavy weight” by doing a bunch of replicated work in each sidecar.
Service Meshes relying on sidecar provide a good balance between a full set of features, and a lightweight footprint.
Will the node agent or sidecar model prevail?
I think you’re likely to see some of both. Now seems like a perfect time for sidecar service mesh: nascent technology, fast iteration and gradual adoption. As service mesh matures and the rate-of-change decreases, we’ll see more applications of the node agent model.
As Shawn talked about in his post, we’ve been thinking about how microservices change the requirements from network infrastructure for a few years now. The swell of support and uptake for Istio demonstrated to us that there’s a community ready to develop and coalesce on policy specs, with a well-architected implementation to go along with it.
Istio is advancing state-of-the-art microservices communication, and we’re excited to help make that technology easy to operate, reliable, and well-suited for your team’s workflow in private cloud, public cloud or hybrid.
So just to clarify: in the sidecar approach you’d usually (always?) implement the sidecar in it’s own container, where that container is “paired” with a given application’s container. But how does that relate to pods? I.e. to what extent are applications typically arranged into a single container vs two or more? If I have an application that is arranged across two or more containers (in the same pod) how many sidecars would you have?
Therefore, is the notion of a sidecar specifically one that is at the application specific, container specific, or a pod specific?
Great question and one that we could have done a better job of being clear on in the post. It is a sidecar for every pod.
You can run the sidecar inside the same container as the service itself.
It’s docker religion that you should only run one user process in a container, but there’s no practical justification for it in the context of a service and its sidecar. The recommendation refers to separate, independent processes that provide different services, and need to be allowed to fail and evolve separately. You don’t want this with a service and its sidecar. Between those two you want the closest runtime coupling that can be – they should always live and die together. Which is what putting them in the same container helps achieving for cheap. When deployed into separate containers, you need to rely on the orchestration tool to ensure this.
Running the sidecar and the service inside the same container also reduces runtime overhead in terms of resources and latency (inter-container communication is cheap, when the containers run on the same host, but communication inside the container is even cheaper, and deploying half the number of containers, even with higher memory allocation, significantly increases deployment density).
Running the sidecar in the same container as the service is an even closer coupling than as a second container in the same kubernetes pod.
When the sidecar is a separate container in the same pod, it has at least a few defenses against bad behavior from the service. The sidecar can bring along its own filesystem, and gets its own process namespace. This allows for instance the sidecar to have certs & keys that are not available to the service. This is helpful if you want to rely on the sidecar; for example, you might trust the sidecar to apply a policy. Other services can trust that requests signed by the sidecar did have the policy enforced.
On the other hand, if you view the sidecar as really just a friendly application enhancer and not a strong policy enforcer, then it’s convenient to run the sidecar in the same container.
My experience with Kubernetes has been that it’s good at killing pods even if only one of the containers dies. It’s definitely possible to make or run your own container init system so you can run multiple processes and die if any die, but so far I haven’t found the need.
I’m not sure what you mean by “communication inside the container is even cheaper.” In Kubernetes, two containers in a pod share a network namespace, so communicating over localhost is the same whether two containers in a pod or two processes in a container. Are you thinking about using shared memory or shared filesystems?
Does deploying half the number of containers (but with each container being “twice” as big) actually increase deployment density significantly? In that case, it’s still the same amount of filesystem disk bytes, running the same processes, just with some extra namespace boundaries between them. I’d love to know more about this.

lowercased:
what service mesh architecture should i pick?
if you are building your software and teams around microservices, you’re looking for ways to iterate faster and scale flexibly. a service mesh can help you do that while maintaining (or enhancing) visibility and control. in this blog, i’ll talk about what’s actually in a service mesh and what considerations you might want to make when choosing and deploying one.
looking at that list, you may think “i can do all of that without a service mesh”, and you’re correct. the same logic applies to sliding window protocols or request framing. but once there’s an emerging standard that does what you want, it’s more efficient to rely on that layer instead of implementing it yourself. service mesh is that emerging layer for microservices patterns.
service mesh is still nascent enough that codified standards have yet to emerge, but there is enough experience that some best practices are beginning to become clear. as the the bleeding-edge leaders develop their own approaches, it is often useful to compare notes and distill best practices. we’ve seen kubernetes emerge as the standard way to run containers for production web applications. my favorite standards are emergent rather than forced: it’s definitely a fine art to be neither too early nor too late to agree on common apis, protocols and concepts.
think about the history of computer networking. after the innovation of best-effort packet-switched networks, we found out that many of us were creating virtual circuits over them – using handshaking, retransmission and internetworking to turn a pile of packets into an ordered stream of bytes. for the sake of interoperability and simplicity, a “best practice” stream-over-packets emerged: tcp (the introduction of rfc675 does a good job of explaining what it layers on top of). there are alternatives – i’ve used the licklider transmission protocol in space networks where distributed congestion control is neither necessary nor efficient. your browser might already be using quic. standardizing on tcp, however, freed a generation of programmers from fiddling with implementations of sliding windows, retries, and congestion collapse (well, except for those packetheads that implemented it).
next, we found a lot of request/response protocols running on top of tcp. many of these eventually migrated to http (or sequels like http/2 or grpc). if you can factor your communication into “method, metadata, body”, you should be looking at an http-like protocol to manage framing, separate metadata from body, and address head-of-line blocking. this extends beyond just browser apps – databases like mongo provide http interfaces because the ubiquity of http unlocks a huge amount of tooling and developer knowledge.
you can think about service mesh as being the lexicon, api and implementation around the next tier of communication patterns for microservices.
in a library that your microservices applications import and use.
in a node agent or daemon that services all of the containers on a particular node/machine.
in a sidecar container that runs alongside your application container.
the library approach is the original. it is simple and straightforward. in this case, each microservice application includes library code that implements service mesh features. libraries like hystrix and ribbon would be examples of this approach.
this works well for apps that are exclusively written in one language by the teams that run them (so that it’s easy to insert the libraries). the library approach also doesn’t require much cooperation from the underlying infrastructure – the container runner (like kubernetes) doesn’t need to be aware that you’re running a hystrix-enhanced app.
there is some work on multilanguage libraries (reimplementations of the same concepts). the challenge here is the complexity and effort involved in replicating the same behavior over and over again.
we see very limited adoption of the library model in our user base because most of our users are running applications written in many different languages (polyglot), and are also running at least a few applications that aren’t written by them so injecting libraries isn’t feasible.
this model has an advantage in work accounting: the code performing work on behalf of the microservice is actually running in that microservice. the trust boundary is also small – you only have to trust calling a library in your own process, not necessarily a remote service somewhere out over the network. that code only has as many privileges as the one microservice it is performing work on behalf of. that work is also performed in the context of the microservice, so it’s easy to fairly allocate resources like cpu time or memory for that work – the os probably does it for you.
the node agent model is the next alternative. in this architecture, there’s a separate agent (often a userspace process) running on every node, servicing a heterogenous mix of workloads. for purposes of our comparison, it’s the opposite of the library model: it doesn’t care about the language of your application but it serves many different microservice tenants.
linkerd’s recommended deployment in kubernetes works like this. as do f5’s application service proxy (asp) and the kubernetes default kube-proxy.
since you need one node agent on every node, this deployment requires some cooperation from the infrastructure – this model doesn’t work without a bit of coordination. by analogy, most applications can’t just choose their own tcp stack, guess an ephemeral port number, and send or receive tcp packets directly – they delegate that to the infrastructure (operating system).
instead of good work accounting, this model emphasizes work resource sharing – if a node agent allocates some memory to buffer data for my microservice, it might turn around and use that buffer for data for your service in a few seconds. this can be very efficient, but there’s an avenue for abuse. if my microservice asks for all the buffer space, the node agent needs to make sure it gives your microservice a shot at buffer space first. you need a bit more code to manage this for each shared resource.
another work resource that benefits from sharing is configuration information. it’s cheaper to distribute one copy of the configuration to each node, than to distribute one copy of the configuration to each pod on each node.
a lot of functionality that containerized microservices rely on are provided by a node agent or something topologically equivalent. think about kubelet initializing your pod, your favorite cni daemon like flanneld, or stretching your brain a bit, even the operating system kernel itself as following this node agent model.
sidecar is the new kid on the block. this is the model used by istio with envoy. conduit also uses a sidecar approach. in sidecar deployments, you have one adjacent container deployed for every application container. for a service mesh, the sidecar handles all the network traffic in and out of the application container.
this approach is in between the library and node agent approaches for many of the tradeoffs i discussed so far. for instance, you can deploy a sidecar service mesh without having to run a new agent on every node (so you don’t need infrastructure-wide cooperation to deploy that shared agent), but you’ll be running multiple copies of an identical sidecar. another take on this: i can install one service mesh for a group of microservices, and you could install a different one, and (with some implementation-specific caveats) we don’t have to coordinate. this is powerful in the early days of service mesh, where you and i might share the same kubernetes cluster but have different goals, require different feature sets, or have different tolerances for bleeding-edge vs. tried-and-true.
sidecar is advantageous for work accounting, especially in some security-related aspects. here’s an example: suppose i’m using a service mesh to provide zero-trust style security. i want the service mesh to verify both ends (client and server) of a connection cryptographically. let’s first consider using a node agent: when my pod wants to be the client of another server pod, the node agent is going to authenticate on behalf of my pod. the node agent is also serving other pods, so it must be careful that another pod cannot trick it into authenticating on my pod’s behalf. if we think about the sidecar case, my pod’s sidecar does not serve other pods. we can follow the principle of least privilege and give it the bare minimum it needs for the one pod it is serving in terms of authentication keys, memory and network capabilities.
so, from the outside the sidecar has the same privileges as the app it is attached to. on the other hand, the sidecar needs to intervene between the app and the outside. this creates some security tension: you want the sidecar to have as little privilege as possible, but you need to give it enough privilege to control traffic to/from the app. for example, in istio, the init container responsible for setting up the sidecar has the net_admin permission currently (to set up the iptables rules necessary). that initialization uses good security practices – it does the minimum amount necessary and then goes away, but everything with net_admin represents attack surface. (good news – smart people are working on enhancing thisfurther).
once the sidecar is attached to the app, it’s very proximate from a security perspective. not as close as a function call in your process (like library) but usually closer than calling out to a multi-tenant node agent. when using istio in kubernetes your app container talks to the sidecar over a loopback interface inside of the network namespace shared with your pod – so other pods and node agents generally can’t see that communication.
most kubernetes clusters have more than one pod per node (and therefore more than one sidecar per node). if each sidecar needs to know “the entire config” (whatever that means for your context), then you’ll need more bandwidth to distribute that config (and more memory to store copies of it). so it can be powerful to limit the scope of configuration that you have to give to each sidecar – but again there’s an opposing tension: something (in istio’s case, pilot) has to spend more effort computing that reduced configuration for each sidecar.
other things that happen to be replicated across sidecars accrue a similar bill. good news – the container runtimes will reuse things like container disk images when they’re identical and you’re using the right drivers, so the disk penalty is not especially significant in many cases, and memory like code pages can also often be shared. but each sidecar’s process-specific memory will be unique to that sidecar so it’s important to keep this under control and avoid making your sidecar “heavy weight” by doing a bunch of replicated work in each sidecar.
service meshes relying on sidecar provide a good balance between a full set of features, and a lightweight footprint.
will the node agent or sidecar model prevail?
i think you’re likely to see some of both. now seems like a perfect time for sidecar service mesh: nascent technology, fast iteration and gradual adoption. as service mesh matures and the rate-of-change decreases, we’ll see more applications of the node agent model.
as shawn talked about in his post, we’ve been thinking about how microservices change the requirements from network infrastructure for a few years now. the swell of support and uptake for istio demonstrated to us that there’s a community ready to develop and coalesce on policy specs, with a well-architected implementation to go along with it.
istio is advancing state-of-the-art microservices communication, and we’re excited to help make that technology easy to operate, reliable, and well-suited for your team’s workflow in private cloud, public cloud or hybrid.
so just to clarify: in the sidecar approach you’d usually (always?) implement the sidecar in it’s own container, where that container is “paired” with a given application’s container. but how does that relate to pods? i.e. to what extent are applications typically arranged into a single container vs two or more? if i have an application that is arranged across two or more containers (in the same pod) how many sidecars would you have?
therefore, is the notion of a sidecar specifically one that is at the application specific, container specific, or a pod specific?
great question and one that we could have done a better job of being clear on in the post. it is a sidecar for every pod.
you can run the sidecar inside the same container as the service itself.
it’s docker religion that you should only run one user process in a container, but there’s no practical justification for it in the context of a service and its sidecar. the recommendation refers to separate, independent processes that provide different services, and need to be allowed to fail and evolve separately. you don’t want this with a service and its sidecar. between those two you want the closest runtime coupling that can be – they should always live and die together. which is what putting them in the same container helps achieving for cheap. when deployed into separate containers, you need to rely on the orchestration tool to ensure this.
running the sidecar and the service inside the same container also reduces runtime overhead in terms of resources and latency (inter-container communication is cheap, when the containers run on the same host, but communication inside the container is even cheaper, and deploying half the number of containers, even with higher memory allocation, significantly increases deployment density).
running the sidecar in the same container as the service is an even closer coupling than as a second container in the same kubernetes pod.
when the sidecar is a separate container in the same pod, it has at least a few defenses against bad behavior from the service. the sidecar can bring along its own filesystem, and gets its own process namespace. this allows for instance the sidecar to have certs & keys that are not available to the service. this is helpful if you want to rely on the sidecar; for example, you might trust the sidecar to apply a policy. other services can trust that requests signed by the sidecar did have the policy enforced.
on the other hand, if you view the sidecar as really just a friendly application enhancer and not a strong policy enforcer, then it’s convenient to run the sidecar in the same container.
my experience with kubernetes has been that it’s good at killing pods even if only one of the containers dies. it’s definitely possible to make or run your own container init system so you can run multiple processes and die if any die, but so far i haven’t found the need.
i’m not sure what you mean by “communication inside the container is even cheaper.” in kubernetes, two containers in a pod share a network namespace, so communicating over localhost is the same whether two containers in a pod or two processes in a container. are you thinking about using shared memory or shared filesystems?
does deploying half the number of containers (but with each container being “twice” as big) actually increase deployment density significantly? in that case, it’s still the same amount of filesystem disk bytes, running the same processes, just with some extra namespace boundaries between them. i’d love to know more about this.


text: Biman Bangladesh Airlines will for the first time use its own aircraft only to fly Hajj pilgrims from the country this year."The first Biman flight with Hajj pilgrims will leave Dhaka at 7am on August 27. Biman will take care of all the Hajj flights with its own planes this time," Civil Aviation and Tourism Minister Rashed Khan Menon told bdnews24.com.He said, Biman would ferry at least 50,000 passengers this season. "But preparations will be made to handle 2,000 more."Chairman of the national carrier Jamal Uddin Ahmed said the airline will use three Boeing 777 to handle the pressure. "Apart from them, there will be 22 scheduled Hajj flights."Biman, however, will have to withdraw some regular flights to cope with the Hajj-bound traffic.Flights only on the Delhi and Hong Kong routes will be suspended during the Hajj season, Menon said. Biman resumed its Delhi and Hong Kong flights on May 4 and May 13 last year after a one-year gap. Based on moon sighting, the Hajj may take place on Oct 4. Hajj flights will start from Aug 27 and end on Sept 28, while the return flights will begin on Oct 8 and are likely to continue until Nov 8. Of the total 248 Hajj flights, Biman will fly 125 of them and rest 123 will be flown by Saudi Arabian Airlines and Nas Air. A total of 98,705 pilgrims from Bangladesh, under both private management and government arrangements, will take part this year in the biggest congregation of the Muslims.Meanwhile, all preparations at the Hajj Camp at Dhaka's Ashkona for the pilgrims have been completed, said the camp Director Mizanur Rahman."Under government arrangement, 1,600 people will go to Hajj this year and the rest will be going through 835 agencies.""Data entry has been done. Everyone has been given an ID from our website which will help them to get necessary information," he said.Rahman said, the pilgrims would have to report at the camp from Aug 24. "They will be given some training. Preparations including the immigration process of those who will take Biman flights will be done at the camp."Their medical check-up will be done at the Hajj Camp, too, he added.Mizanur Rahman said Prime Minister Sheikh Hasina would inaugurate the Hajj process on August 26.

lowercased: biman bangladesh airlines will for the first time use its own aircraft only to fly hajj pilgrims from the country this year."the first biman flight with hajj pilgrims will leave dhaka at 7am on august 27. biman will take care of all the hajj flights with its own planes this time," civil aviation and tourism minister rashed khan menon told bdnews24.com.he said, biman would ferry at least 50,000 passengers this season. "but preparations will be made to handle 2,000 more."chairman of the national carrier jamal uddin ahmed said the airline will use three boeing 777 to handle the pressure. "apart from them, there will be 22 scheduled hajj flights."biman, however, will have to withdraw some regular flights to cope with the hajj-bound traffic.flights only on the delhi and hong kong routes will be suspended during the hajj season, menon said. biman resumed its delhi and hong kong flights on may 4 and may 13 last year after a one-year gap. based on moon sighting, the hajj may take place on oct 4. hajj flights will start from aug 27 and end on sept 28, while the return flights will begin on oct 8 and are likely to continue until nov 8. of the total 248 hajj flights, biman will fly 125 of them and rest 123 will be flown by saudi arabian airlines and nas air. a total of 98,705 pilgrims from bangladesh, under both private management and government arrangements, will take part this year in the biggest congregation of the muslims.meanwhile, all preparations at the hajj camp at dhaka's ashkona for the pilgrims have been completed, said the camp director mizanur rahman."under government arrangement, 1,600 people will go to hajj this year and the rest will be going through 835 agencies.""data entry has been done. everyone has been given an id from our website which will help them to get necessary information," he said.rahman said, the pilgrims would have to report at the camp from aug 24. "they will be given some training. preparations including the immigration process of those who will take biman flights will be done at the camp."their medical check-up will be done at the hajj camp, too, he added.mizanur rahman said prime minister sheikh hasina would inaugurate the hajj process on august 26.


text:
Welcome to the Disney Parks Moms Panel. Much fun will you have at Star Wars Weekends in Disney's Hollywood Studios! I love that you're already planning to get into the spirit of this special event by wearing Star Wars-themed shirts!
At Disney's Design-a-Tee store in Downtown Disney you can create your own personalized custom-designed Hanes T-shirt on an interactive touch-screen kiosk. There is a wide variety of colors and styles available in infant, toddler, youth and adult sizes. You can choose artwork from more than 100 selections featuring Disney animation and movie characters. Some Star Wars artwork may be included among the selections. The finished product is screen-print quality and I love that premium environmentally friendly water-based inks are used to print the shirts.
Another option would be to purchase the special Star Wars Weekends 2013 apparel that will be available in select shops right in Hollywood Studios. Once you've chosen your new shirts, you could easily duck into a nearby restroom to change! Follow this link to Steven Miller's recent post on the Disney Parks Blog to check out the Star Wars Weekends 2013 logo and some of the cool new Star Wars merchandise that will be offered!
May the Force Be with You, Tina! Visit us again you must with any other questions before your trip!

lowercased:
welcome to the disney parks moms panel. much fun will you have at star wars weekends in disney's hollywood studios! i love that you're already planning to get into the spirit of this special event by wearing star wars-themed shirts!
at disney's design-a-tee store in downtown disney you can create your own personalized custom-designed hanes t-shirt on an interactive touch-screen kiosk. there is a wide variety of colors and styles available in infant, toddler, youth and adult sizes. you can choose artwork from more than 100 selections featuring disney animation and movie characters. some star wars artwork may be included among the selections. the finished product is screen-print quality and i love that premium environmentally friendly water-based inks are used to print the shirts.
another option would be to purchase the special star wars weekends 2013 apparel that will be available in select shops right in hollywood studios. once you've chosen your new shirts, you could easily duck into a nearby restroom to change! follow this link to steven miller's recent post on the disney parks blog to check out the star wars weekends 2013 logo and some of the cool new star wars merchandise that will be offered!
may the force be with you, tina! visit us again you must with any other questions before your trip!


text: Here is a difficult-to-find 13" deep dish bearing the three different 'Love' marks struck by an anonymous maker in Philadelphia between 1770 and 1820. The 'Love' marked pieces were high quality wares made by a successive line of craftsmen. A 'London' mark was used to indicate that this pewter was of the accepted high standard which was regulated in England. This well used dish is in good original condition.

lowercased: here is a difficult-to-find 13" deep dish bearing the three different 'love' marks struck by an anonymous maker in philadelphia between 1770 and 1820. the 'love' marked pieces were high quality wares made by a successive line of craftsmen. a 'london' mark was used to indicate that this pewter was of the accepted high standard which was regulated in england. this well used dish is in good original condition.


text:
There’s an old phrase that in the military, “Every day is Monday.” Here at CJTF-HOA, we fall into battle rhythms that form around the Commanders intent and mission prep. Sometimes we forget what day of the week it is because we are focusing on the mission.
This weekend, though, there are three special days worthy of remembering as not just another day: Father’s Day, Flag Day and the Army’s birthday.
For our fathers serving here, we can assure you that people are thinking of you and the sacrifices that you make by being away from your children to serve your country. Thomas Paine, the great early American patriot once said that "Those who expect to reap the blessings of freedom must ... undergo the fatigue of supporting it." These fathers know that fatigue. We thank you for the work you do here, but also the work you do at home.
June 14th is the Army’s 239th birthday. The United States Army is the main branch of the Armed Forces responsible for land-based military operations. It is also the largest and oldest branch in the U.S. Military. The militias that stood up to fight formed the backbone of all of our armed services. The freedoms we enjoy every day as Americans stem back to what our forefathers fought for—and against. We have historic Army units in CJTF-HOA, like the 1/18th Infantry Vanguards and the 2/16th Infantry Rangers. The 2/16th participated in one of the bloodiest beach landings on D-Day at Omaha Beach. We continue to serve with the best of the best in this joint environment. Sharing in the traditions and culture of each service is a great experience. Happy birthday to our soldiers in the United States Army, past and present.
June 14th is also Flag Day. In 1777, the Continental Congress approved the stars and stripes as our national flag. This is the flag that so many of our brothers and sisters in arms have carried into combat. It is the flag that we honor and the flag under which we serve. We call her “Old Glory” and she is the emblem of our country’s unity. Her character is that which we give her from generation to generation, the choices are ours. Although she is silent, she speaks to us through the history of the men and women who have gone before us.
Our flag has led us through many battles. She may have come out tattered at times, but she has always been there with her men and women leading the way. One of the greatest symbols of our military’s will to fight is the flag raising on Iwo Jima. She is draped across a casket on a service member’s final ride home, or presented to a family member on behalf of a grateful nation for their honorable service. Our flag is a symbol of honor, courage and commitment. Long may you wave Old Glory, long may you wave.
We need to be aware of these special days and what they mean to the families and communities that support us. We should be aware of our multinational teammates, their culture and traditions as well. As we look past the day’s agenda, we’ll see more than we ever thought we had in common.

lowercased:
there’s an old phrase that in the military, “every day is monday.” here at cjtf-hoa, we fall into battle rhythms that form around the commanders intent and mission prep. sometimes we forget what day of the week it is because we are focusing on the mission.
this weekend, though, there are three special days worthy of remembering as not just another day: father’s day, flag day and the army’s birthday.
for our fathers serving here, we can assure you that people are thinking of you and the sacrifices that you make by being away from your children to serve your country. thomas paine, the great early american patriot once said that "those who expect to reap the blessings of freedom must ... undergo the fatigue of supporting it." these fathers know that fatigue. we thank you for the work you do here, but also the work you do at home.
june 14th is the army’s 239th birthday. the united states army is the main branch of the armed forces responsible for land-based military operations. it is also the largest and oldest branch in the u.s. military. the militias that stood up to fight formed the backbone of all of our armed services. the freedoms we enjoy every day as americans stem back to what our forefathers fought for—and against. we have historic army units in cjtf-hoa, like the 1/18th infantry vanguards and the 2/16th infantry rangers. the 2/16th participated in one of the bloodiest beach landings on d-day at omaha beach. we continue to serve with the best of the best in this joint environment. sharing in the traditions and culture of each service is a great experience. happy birthday to our soldiers in the united states army, past and present.
june 14th is also flag day. in 1777, the continental congress approved the stars and stripes as our national flag. this is the flag that so many of our brothers and sisters in arms have carried into combat. it is the flag that we honor and the flag under which we serve. we call her “old glory” and she is the emblem of our country’s unity. her character is that which we give her from generation to generation, the choices are ours. although she is silent, she speaks to us through the history of the men and women who have gone before us.
our flag has led us through many battles. she may have come out tattered at times, but she has always been there with her men and women leading the way. one of the greatest symbols of our military’s will to fight is the flag raising on iwo jima. she is draped across a casket on a service member’s final ride home, or presented to a family member on behalf of a grateful nation for their honorable service. our flag is a symbol of honor, courage and commitment. long may you wave old glory, long may you wave.
we need to be aware of these special days and what they mean to the families and communities that support us. we should be aware of our multinational teammates, their culture and traditions as well. as we look past the day’s agenda, we’ll see more than we ever thought we had in common.


text:
HD iPhone Wallpaper Girly is the best HD iPhone wallpaper image in 2019. This wallpaper was upload at November 12, 2017 upload by Jennifer H. King in Pink.
HD iPhone Wallpaper Girly is the perfect high-resolution iPhone wallpaper and file resolution this wallpaper is 736x1306 with file Size 67.57 KB. You can use HD iPhone Wallpaper Girly for your iPhone 5, 6, 7, 8, X, XS, XR backgrounds, Mobile Screensaver, or iPad Lock Screen and another Smartphones device for free. To get file this wallpaper HD and obtain the HD iPhone Wallpaper Girly images by click the download button to get multiple high-resversions.

lowercased:
hd iphone wallpaper girly is the best hd iphone wallpaper image in 2019. this wallpaper was upload at november 12, 2017 upload by jennifer h. king in pink.
hd iphone wallpaper girly is the perfect high-resolution iphone wallpaper and file resolution this wallpaper is 736x1306 with file size 67.57 kb. you can use hd iphone wallpaper girly for your iphone 5, 6, 7, 8, x, xs, xr backgrounds, mobile screensaver, or ipad lock screen and another smartphones device for free. to get file this wallpaper hd and obtain the hd iphone wallpaper girly images by click the download button to get multiple high-resversions.


text:
To help show your appreciation to all your coworkers, customers and friends, we’re happy to offer a very competitive corporate discount rate for our business customers.
Discounts calculated on total merchandise (excluding tax & shipping & handling charges), on a per order basis, some exclusions apply.
Sale & Special Values items are not eligible for Volume Discounts.
Volume Discounts cannot be combined with Free Shipping promotion.

lowercased:
to help show your appreciation to all your coworkers, customers and friends, we’re happy to offer a very competitive corporate discount rate for our business customers.
discounts calculated on total merchandise (excluding tax & shipping & handling charges), on a per order basis, some exclusions apply.
sale & special values items are not eligible for volume discounts.
volume discounts cannot be combined with free shipping promotion.


text:
Match ends, Hertha Berlin 0, Hannover 96 0.
Second Half ends, Hertha Berlin 0, Hannover 96 0.
Substitution, Hertha Berlin. Fabian Lustenberger replaces Niklas Stark because of an injury.
Delay in match Niklas Stark (Hertha Berlin) because of an injury.
Attempt missed. Salomon Kalou (Hertha Berlin) right footed shot from outside the box is close, but misses to the right. Assisted by Ondrej Duda following a fast break.
Attempt missed. Marko Grujic (Hertha Berlin) header from the centre of the box is too high. Assisted by Ondrej Duda with a cross following a corner.
Corner, Hertha Berlin. Conceded by Michael Esser.
Attempt saved. Salomon Kalou (Hertha Berlin) left footed shot from the right side of the box is saved in the top right corner.
Corner, Hannover 96. Conceded by Davie Selke.
Corner, Hannover 96. Conceded by Karim Rekik.
Attempt blocked. Hendrik Weydandt (Hannover 96) header from the centre of the box is blocked. Assisted by Genki Haraguchi with a cross.
Foul by Sebastian Soto (Hannover 96).
Substitution, Hannover 96. Sebastian Soto replaces Linton Maina.
Delay in match Hendrik Weydandt (Hannover 96) because of an injury.
Attempt blocked. Davie Selke (Hertha Berlin) right footed shot from the centre of the box is blocked. Assisted by Ondrej Duda.
Attempt blocked. Ondrej Duda (Hertha Berlin) right footed shot from the centre of the box is blocked. Assisted by Davie Selke.
Attempt saved. Oliver Sorg (Hannover 96) right footed shot from outside the box is saved in the centre of the goal. Assisted by Genki Haraguchi.
Substitution, Hertha Berlin. Javairo Dilrosun replaces Mathew Leckie.
Felipe (Hannover 96) wins a free kick in the defensive half.
Attempt saved. Salomon Kalou (Hertha Berlin) left footed shot from the centre of the box is saved in the top centre of the goal. Assisted by Vedad Ibisevic.
Substitution, Hannover 96. Nicolai Müller replaces Florent Muslija.
Corner, Hannover 96. Conceded by Lukas Klünter.
Attempt missed. Genki Haraguchi (Hannover 96) left footed shot from the centre of the box misses to the right following a set piece situation.
Linton Maina (Hannover 96) wins a free kick on the right wing.
Attempt blocked. Matthias Ostrzolek (Hannover 96) left footed shot from the left side of the box is blocked.
Offside, Hannover 96. Pirmin Schwegler tries a through ball, but Florent Muslija is caught offside.
Substitution, Hertha Berlin. Davie Selke replaces Per Skjelbred.
Foul by Florent Muslija (Hannover 96).
Attempt missed. Ondrej Duda (Hertha Berlin) right footed shot from the right side of the box is high and wide to the left. Assisted by Vedad Ibisevic.
Attempt saved. Florent Muslija (Hannover 96) right footed shot from outside the box is saved in the bottom left corner.
Mathew Leckie (Hertha Berlin) is shown the yellow card for a bad foul.
Florent Muslija (Hannover 96) wins a free kick in the attacking half.
Attempt missed. Linton Maina (Hannover 96) left footed shot from outside the box is too high following a corner.
Corner, Hannover 96. Conceded by Rune Jarstein.
Attempt saved. Florent Muslija (Hannover 96) right footed shot from outside the box is saved in the bottom right corner. Assisted by Linton Maina.
Attempt missed. Lukas Klünter (Hertha Berlin) left footed shot from outside the box misses to the left. Assisted by Mathew Leckie.
Offside, Hannover 96. Waldemar Anton tries a through ball, but Hendrik Weydandt is caught offside.
Second Half begins Hertha Berlin 0, Hannover 96 0.
First Half ends, Hertha Berlin 0, Hannover 96 0.
Attempt saved. Waldemar Anton (Hannover 96) right footed shot from the left side of the box is saved in the bottom left corner. Assisted by Matthias Ostrzolek.
Corner, Hertha Berlin. Conceded by Waldemar Anton.
Attempt blocked. Marko Grujic (Hertha Berlin) right footed shot from outside the box is blocked. Assisted by Mathew Leckie.
Attempt missed. Salomon Kalou (Hertha Berlin) header from the centre of the box is too high. Assisted by Marvin Plattenhardt with a cross.
Attempt missed. Genki Haraguchi (Hannover 96) right footed shot from outside the box is high and wide to the right. Assisted by Florent Muslija.
Attempt missed. Salomon Kalou (Hertha Berlin) right footed shot from outside the box is too high. Assisted by Per Skjelbred.
Attempt blocked. Mathew Leckie (Hertha Berlin) right footed shot from the centre of the box is blocked.
Offside, Hertha Berlin. Marko Grujic tries a through ball, but Marvin Plattenhardt is caught offside.
Niklas Stark (Hertha Berlin) wins a free kick on the right wing.
Attempt missed. Marko Grujic (Hertha Berlin) header from the centre of the box is just a bit too high. Assisted by Marvin Plattenhardt with a cross following a corner.
Attempt blocked. Genki Haraguchi (Hannover 96) left footed shot from outside the box is blocked. Assisted by Hendrik Weydandt.
Attempt saved. Mathew Leckie (Hertha Berlin) right footed shot from a difficult angle on the right is saved in the bottom right corner. Assisted by Karim Rekik.
Offside, Hannover 96. Oliver Sorg tries a through ball, but Hendrik Weydandt is caught offside.
Per Skjelbred (Hertha Berlin) is shown the yellow card for a bad foul.
Marvin Bakalorz (Hannover 96) wins a free kick in the attacking half.
Attempt blocked. Marko Grujic (Hertha Berlin) right footed shot from the centre of the box is blocked. Assisted by Vedad Ibisevic.
Attempt saved. Linton Maina (Hannover 96) left footed shot from outside the box is saved in the centre of the goal. Assisted by Genki Haraguchi.
Attempt missed. Lukas Klünter (Hertha Berlin) left footed shot from the right side of the box is close, but misses to the right. Assisted by Marko Grujic.

lowercased:
match ends, hertha berlin 0, hannover 96 0.
second half ends, hertha berlin 0, hannover 96 0.
substitution, hertha berlin. fabian lustenberger replaces niklas stark because of an injury.
delay in match niklas stark (hertha berlin) because of an injury.
attempt missed. salomon kalou (hertha berlin) right footed shot from outside the box is close, but misses to the right. assisted by ondrej duda following a fast break.
attempt missed. marko grujic (hertha berlin) header from the centre of the box is too high. assisted by ondrej duda with a cross following a corner.
corner, hertha berlin. conceded by michael esser.
attempt saved. salomon kalou (hertha berlin) left footed shot from the right side of the box is saved in the top right corner.
corner, hannover 96. conceded by davie selke.
corner, hannover 96. conceded by karim rekik.
attempt blocked. hendrik weydandt (hannover 96) header from the centre of the box is blocked. assisted by genki haraguchi with a cross.
foul by sebastian soto (hannover 96).
substitution, hannover 96. sebastian soto replaces linton maina.
delay in match hendrik weydandt (hannover 96) because of an injury.
attempt blocked. davie selke (hertha berlin) right footed shot from the centre of the box is blocked. assisted by ondrej duda.
attempt blocked. ondrej duda (hertha berlin) right footed shot from the centre of the box is blocked. assisted by davie selke.
attempt saved. oliver sorg (hannover 96) right footed shot from outside the box is saved in the centre of the goal. assisted by genki haraguchi.
substitution, hertha berlin. javairo dilrosun replaces mathew leckie.
felipe (hannover 96) wins a free kick in the defensive half.
attempt saved. salomon kalou (hertha berlin) left footed shot from the centre of the box is saved in the top centre of the goal. assisted by vedad ibisevic.
substitution, hannover 96. nicolai müller replaces florent muslija.
corner, hannover 96. conceded by lukas klünter.
attempt missed. genki haraguchi (hannover 96) left footed shot from the centre of the box misses to the right following a set piece situation.
linton maina (hannover 96) wins a free kick on the right wing.
attempt blocked. matthias ostrzolek (hannover 96) left footed shot from the left side of the box is blocked.
offside, hannover 96. pirmin schwegler tries a through ball, but florent muslija is caught offside.
substitution, hertha berlin. davie selke replaces per skjelbred.
foul by florent muslija (hannover 96).
attempt missed. ondrej duda (hertha berlin) right footed shot from the right side of the box is high and wide to the left. assisted by vedad ibisevic.
attempt saved. florent muslija (hannover 96) right footed shot from outside the box is saved in the bottom left corner.
mathew leckie (hertha berlin) is shown the yellow card for a bad foul.
florent muslija (hannover 96) wins a free kick in the attacking half.
attempt missed. linton maina (hannover 96) left footed shot from outside the box is too high following a corner.
corner, hannover 96. conceded by rune jarstein.
attempt saved. florent muslija (hannover 96) right footed shot from outside the box is saved in the bottom right corner. assisted by linton maina.
attempt missed. lukas klünter (hertha berlin) left footed shot from outside the box misses to the left. assisted by mathew leckie.
offside, hannover 96. waldemar anton tries a through ball, but hendrik weydandt is caught offside.
second half begins hertha berlin 0, hannover 96 0.
first half ends, hertha berlin 0, hannover 96 0.
attempt saved. waldemar anton (hannover 96) right footed shot from the left side of the box is saved in the bottom left corner. assisted by matthias ostrzolek.
corner, hertha berlin. conceded by waldemar anton.
attempt blocked. marko grujic (hertha berlin) right footed shot from outside the box is blocked. assisted by mathew leckie.
attempt missed. salomon kalou (hertha berlin) header from the centre of the box is too high. assisted by marvin plattenhardt with a cross.
attempt missed. genki haraguchi (hannover 96) right footed shot from outside the box is high and wide to the right. assisted by florent muslija.
attempt missed. salomon kalou (hertha berlin) right footed shot from outside the box is too high. assisted by per skjelbred.
attempt blocked. mathew leckie (hertha berlin) right footed shot from the centre of the box is blocked.
offside, hertha berlin. marko grujic tries a through ball, but marvin plattenhardt is caught offside.
niklas stark (hertha berlin) wins a free kick on the right wing.
attempt missed. marko grujic (hertha berlin) header from the centre of the box is just a bit too high. assisted by marvin plattenhardt with a cross following a corner.
attempt blocked. genki haraguchi (hannover 96) left footed shot from outside the box is blocked. assisted by hendrik weydandt.
attempt saved. mathew leckie (hertha berlin) right footed shot from a difficult angle on the right is saved in the bottom right corner. assisted by karim rekik.
offside, hannover 96. oliver sorg tries a through ball, but hendrik weydandt is caught offside.
per skjelbred (hertha berlin) is shown the yellow card for a bad foul.
marvin bakalorz (hannover 96) wins a free kick in the attacking half.
attempt blocked. marko grujic (hertha berlin) right footed shot from the centre of the box is blocked. assisted by vedad ibisevic.
attempt saved. linton maina (hannover 96) left footed shot from outside the box is saved in the centre of the goal. assisted by genki haraguchi.
attempt missed. lukas klünter (hertha berlin) left footed shot from the right side of the box is close, but misses to the right. assisted by marko grujic.


text:
Recharge yourself with pure delight.
The big steps in life are full of compromises. But there’s plenty of time for indulgence in between. Like a ready to go size rich milk chocolate combined with a thin waffle layer and whole caramelized almonds.
Ingredients: sugar, cocoa butter, whole milk powder, whole caramelized almonds 11% (almonds 83%, sugar, cocoa butter, emulsifier: lecithin (soy)), vegetable fats (palm, shea), cocoa mass, wafer 2% (wheat flour (gluten), vegetable fats (palm), sugar, soy flour, emulsifier: lecithin (soy), raising agent: sodium bicarbonate), hazelnuts 1,5%, skimmed milk powder, cocoa powder, almonds 0,8%, emulsifier: lecithin (soy), milk fats, flavors (vanilla and hazelnuts).

lowercased:
recharge yourself with pure delight.
the big steps in life are full of compromises. but there’s plenty of time for indulgence in between. like a ready to go size rich milk chocolate combined with a thin waffle layer and whole caramelized almonds.
ingredients: sugar, cocoa butter, whole milk powder, whole caramelized almonds 11% (almonds 83%, sugar, cocoa butter, emulsifier: lecithin (soy)), vegetable fats (palm, shea), cocoa mass, wafer 2% (wheat flour (gluten), vegetable fats (palm), sugar, soy flour, emulsifier: lecithin (soy), raising agent: sodium bicarbonate), hazelnuts 1,5%, skimmed milk powder, cocoa powder, almonds 0,8%, emulsifier: lecithin (soy), milk fats, flavors (vanilla and hazelnuts).


text:
ParaSport® Ontario is a not-for-profit provincial sport organization that provides leadership, resources, and opportunities to ensure a strong community for persons with a disability in the Ontario sport and recreation community.
The ParaSport® Ontario Web Site is comprised of various Web pages operated by ParaSport® Ontario.
The ParaSport® Ontario Web Site is offered to you conditioned on your acceptance without modification of the terms, conditions, and notices contained herein. Your use of the ParaSport® Ontario Web Site constitutes your agreement to all such terms, conditions, and notices.
ParaSport® Ontario is committed to protecting your privacy and developing technology that gives you the most powerful and safe online experience. This Statement of Privacy applies to the ParaSport® Ontario Web site and governs data collection and usage. By using the ParaSport® Ontario website, you consent to the data practices described in this statement.

lowercased:
parasport® ontario is a not-for-profit provincial sport organization that provides leadership, resources, and opportunities to ensure a strong community for persons with a disability in the ontario sport and recreation community.
the parasport® ontario web site is comprised of various web pages operated by parasport® ontario.
the parasport® ontario web site is offered to you conditioned on your acceptance without modification of the terms, conditions, and notices contained herein. your use of the parasport® ontario web site constitutes your agreement to all such terms, conditions, and notices.
parasport® ontario is committed to protecting your privacy and developing technology that gives you the most powerful and safe online experience. this statement of privacy applies to the parasport® ontario web site and governs data collection and usage. by using the parasport® ontario website, you consent to the data practices described in this statement.


text:
Total War: Rome 2’s latest freebie DLC update has been released today, adding the Getae faction to the game. The 250mb-ish patch should automatically download through Steam (try a restart of the client if it doesn’t) and add the Getae as a starting option in the grand campaign.
In this period, the Getae are not a single tribe but “a loose confederation settled around the Lower Danube.” Their starting position is quite perilous, as they’re surrounded by other powerful factions. However, they can call upon a few new units to help them. The Getae were apparently quite famous for their archery, so it’s good to see that they can recruit elite heavy archers to their cause. A pair of other units have been added to the game for the Getae too: heavy skirmishers (more archery) and noble swords.
This Rome 2 update also adds the historic Battle of Pydna, in which Rome was triumphant over Macedon. It doesn’t have to go that way though, and the outcome of your own battle may well be different. Especially if you get distracted in the middle of it.
Added missing subtitles for Hannibal at the Gates intro in German, Spanish and Russian.
Increased the length of the falx weapon handle, so units hold it correctly in two hands.
Political promotions in Campaign modes are now dependant on all of their prerequisites (e.g. age or experience level of the general), rather than just whether or not they can be afforded.
Fix for Campaign AI sometimes overestimating strength of transport ships.

lowercased:
total war: rome 2’s latest freebie dlc update has been released today, adding the getae faction to the game. the 250mb-ish patch should automatically download through steam (try a restart of the client if it doesn’t) and add the getae as a starting option in the grand campaign.
in this period, the getae are not a single tribe but “a loose confederation settled around the lower danube.” their starting position is quite perilous, as they’re surrounded by other powerful factions. however, they can call upon a few new units to help them. the getae were apparently quite famous for their archery, so it’s good to see that they can recruit elite heavy archers to their cause. a pair of other units have been added to the game for the getae too: heavy skirmishers (more archery) and noble swords.
this rome 2 update also adds the historic battle of pydna, in which rome was triumphant over macedon. it doesn’t have to go that way though, and the outcome of your own battle may well be different. especially if you get distracted in the middle of it.
added missing subtitles for hannibal at the gates intro in german, spanish and russian.
increased the length of the falx weapon handle, so units hold it correctly in two hands.
political promotions in campaign modes are now dependant on all of their prerequisites (e.g. age or experience level of the general), rather than just whether or not they can be afforded.
fix for campaign ai sometimes overestimating strength of transport ships.


text:
Black is a less common wedding color than most, but it shouldn't be underestimated. The color black often inspires dark and mysterious elements of classic romance. Just take a look below and you too will be swooning over the unexpected beauty that black can bring to a wedding day.
To see more dark and romantic wedding ideas from this hauntingly beautiful shoot, captured by Kristen Booth, view the full gallery here.
One detail, which can't go unnoticed, is this crown constructed by Ashley of Patterns on Walls out of antique skeleton keys.

lowercased:
black is a less common wedding color than most, but it shouldn't be underestimated. the color black often inspires dark and mysterious elements of classic romance. just take a look below and you too will be swooning over the unexpected beauty that black can bring to a wedding day.
to see more dark and romantic wedding ideas from this hauntingly beautiful shoot, captured by kristen booth, view the full gallery here.
one detail, which can't go unnoticed, is this crown constructed by ashley of patterns on walls out of antique skeleton keys.


text:
Briefly describe transition plan Replace transmitter and transmission line and retune existing antenna. Acquire interim antenna system to stay on the air during construction. Map and analyze tower to ensure safety before working on the tower.
Justification for New Antenna Temporary antenna to continue operation while main transmission line and elbow complex are replaced.
Justification for New Transmission Line The existing primary transmission line is rigid with section lengths that cannot accommodate the assigned channel.
Justification for New Transmission Line An interim transmission line is necessary for the existing antenna to keep station on the air during primary line replacement. Station will attempt to rent if renting is available at time of acquisition.
Explanation It will be necessary to schedule and coordinate multiple vendors and complete progress reports. Station does not have available personnel or personnel trained in project management for such complex projects.
Justification It will be necessary to plan the installation, develop specifications for purchasing, and perform final inspections of this RF project. Station does not have available personnel or personnel trained in such services.

lowercased:
briefly describe transition plan replace transmitter and transmission line and retune existing antenna. acquire interim antenna system to stay on the air during construction. map and analyze tower to ensure safety before working on the tower.
justification for new antenna temporary antenna to continue operation while main transmission line and elbow complex are replaced.
justification for new transmission line the existing primary transmission line is rigid with section lengths that cannot accommodate the assigned channel.
justification for new transmission line an interim transmission line is necessary for the existing antenna to keep station on the air during primary line replacement. station will attempt to rent if renting is available at time of acquisition.
explanation it will be necessary to schedule and coordinate multiple vendors and complete progress reports. station does not have available personnel or personnel trained in project management for such complex projects.
justification it will be necessary to plan the installation, develop specifications for purchasing, and perform final inspections of this rf project. station does not have available personnel or personnel trained in such services.


text:
It’s always special to see a show at the historic Hollywood Bowl and the Heart show on Friday was almost magical. The Hollywood Bowl Orchestra, led by conductor, Thomas Wilkins, joined the Rock and Roll Hall of Famers in a magical night. The band and orchestra opened with the first of two Led Zeppelin covers of the evening. The first was Kashmir and I think it was a great way to kick off the show. The mix of the band with the orchestra on this particular song was pure sonic nirvana. The way horns and strings accented and accentuated particular parts really brought a lot of definition to the music. They later closed their set with Stairway to Heaven.
Ann Wilson is a fantastic singer, and on this song she could’ve given Robert Plant a run for his money on any given day. Throughout their 90 minute set, Heart played a great mixture of chart topping hits and fan favorites. Some of the highlights, aside from the Zeppelin covers, were Kick It Out, Even It Up, and (obviously) Crazy On You. Another notable cover was Elton John’s, Mona Lisa’s and Mad Hatters sang by Nancy Wilson. During this song, she used her signature Martin HD-35. Nancy played a couple of Martins, Fenders, and a great Duesenberg Starplayer throughout the set. I can easily say that her Duesenberg was my favorite; it’s such a cool looking guitar. To close the set, the band also played a fantastic version of Stairway to Heaven, which featured Nancy handling the rhythm parts and lead guitarist, Craig Bartock handling those identifiable lead lines on this iconic song.
Heart is a high energy, high output, high caliber rock and roll band that simply puts on a great show. To see this band with the Hollywood Bowl Orchestra was a real treat. The Wilson sisters feed off of each other’s energy and it really comes through with their performance. If you haven’t seen them live, you really should. And if you have, then you know what I’m talking about.

lowercased:
it’s always special to see a show at the historic hollywood bowl and the heart show on friday was almost magical. the hollywood bowl orchestra, led by conductor, thomas wilkins, joined the rock and roll hall of famers in a magical night. the band and orchestra opened with the first of two led zeppelin covers of the evening. the first was kashmir and i think it was a great way to kick off the show. the mix of the band with the orchestra on this particular song was pure sonic nirvana. the way horns and strings accented and accentuated particular parts really brought a lot of definition to the music. they later closed their set with stairway to heaven.
ann wilson is a fantastic singer, and on this song she could’ve given robert plant a run for his money on any given day. throughout their 90 minute set, heart played a great mixture of chart topping hits and fan favorites. some of the highlights, aside from the zeppelin covers, were kick it out, even it up, and (obviously) crazy on you. another notable cover was elton john’s, mona lisa’s and mad hatters sang by nancy wilson. during this song, she used her signature martin hd-35. nancy played a couple of martins, fenders, and a great duesenberg starplayer throughout the set. i can easily say that her duesenberg was my favorite; it’s such a cool looking guitar. to close the set, the band also played a fantastic version of stairway to heaven, which featured nancy handling the rhythm parts and lead guitarist, craig bartock handling those identifiable lead lines on this iconic song.
heart is a high energy, high output, high caliber rock and roll band that simply puts on a great show. to see this band with the hollywood bowl orchestra was a real treat. the wilson sisters feed off of each other’s energy and it really comes through with their performance. if you haven’t seen them live, you really should. and if you have, then you know what i’m talking about.


text:
No town is safe from pest insects and rodents – not even Long Valley. Though it’s situated far enough from New York City to escape many of the urban pests, it still has to deal with the most common pests around, like ants, rodents and bees. Whether it’s summer or winter in Long Valley, PermaKill Exterminating deals with pest infestations quickly and efficiently.
Pests come in all shapes and sizes, from small bed bugs to large rats and other rodents. They invade homes and businesses in Long Valley each year, contaminating food and compromising the health of residents across the area. PermaKill Exterminating specializes in pest control services and provides numerous services to combat these pests and to prevent future infestations.
Carpenter ants attack homes on a daily basis, chewing holes in wood fascia and building tunnels in which to expand their colonies for raising their young. These ants may not be as destructive as termites are, but they still cause cosmetic damage to decks, siding, wood patio furniture and more.
Our experienced technicians know what signs to look for when inspecting for carpenter ant damage. Once we’ve located the nests, we evaluate the damage and create a custom plan of action to eliminate the ants and to prevent another infestation later.
Rodents, such as mice and rats, create numerous problems for residents and business owners in Long Valley. These critters chew through walls, wires, boxed goods and furniture, leaving behind feces, urine and danger that cause sickness in children and adults. Even rodents such as squirrels cause problems in homes as they invade attic spaces and build nests in unused furniture and clutter.
Our trained technicians can perform a thorough inspection of your property and flush out rodents where they live, eat and breed. We can also set up a preventative maintenance plan to keep rodents outside and away from your property for the foreseeable future.
Not all bees are helpful with pollination around the house. Carpenter bees, wasps and other stinging insects make life miserable for residents who want to enjoy their patios and backyards. Carpenter bees burrow holes in wood and pester children, adults and pets as they pass by. Wasps build nests near doors and cause painful stings that could trigger allergic reactions.
Our certified technicians understand which bees pose a threat and which ones are more beneficial to the environment. We’ll inspect your home for bee, hornet, wasp and other stinging insect nests and use the appropriate treatments to eliminate them completely.
Our services also include home protection plans, which consist of three regularly scheduled pest control visits each year. These services provide year-round protection for your home and give you peace of mind that your home and property are free of invasive pest insects and rodents.
Our one-time services are also popular and provide an effective method for clearing out an existing infestation, such as a wasp nest on the patio or mice in the attic. We believe in providing quality services to our customers no matter if they need a quick home treatment or an ongoing pest control program.
Whether you’re planning a backyard barbecue or want to lounge on your deck for an afternoon, you don’t want ants, bees and other insects to ruin your fun. If a pest infestation goes untreated, it can expand into a much larger problem down the road. Pests breed quickly and can take over a home, a business or an entire property in a matter of weeks or months depending on the species. Once you spot the signs of an infestation, it’s time to turn to the professionals.
Contact PermaKill Exterminating for a free quote and more information about our pest control services. We serve Long Valley and the surrounding areas and provide effective, quality services to remove pest infestations from homes and businesses. If you’re dealing with ants around the house, mice in the kitchen or other pests in and around your property, we’re here with services to eliminate the problem and to keep the pests from returning.

lowercased:
no town is safe from pest insects and rodents – not even long valley. though it’s situated far enough from new york city to escape many of the urban pests, it still has to deal with the most common pests around, like ants, rodents and bees. whether it’s summer or winter in long valley, permakill exterminating deals with pest infestations quickly and efficiently.
pests come in all shapes and sizes, from small bed bugs to large rats and other rodents. they invade homes and businesses in long valley each year, contaminating food and compromising the health of residents across the area. permakill exterminating specializes in pest control services and provides numerous services to combat these pests and to prevent future infestations.
carpenter ants attack homes on a daily basis, chewing holes in wood fascia and building tunnels in which to expand their colonies for raising their young. these ants may not be as destructive as termites are, but they still cause cosmetic damage to decks, siding, wood patio furniture and more.
our experienced technicians know what signs to look for when inspecting for carpenter ant damage. once we’ve located the nests, we evaluate the damage and create a custom plan of action to eliminate the ants and to prevent another infestation later.
rodents, such as mice and rats, create numerous problems for residents and business owners in long valley. these critters chew through walls, wires, boxed goods and furniture, leaving behind feces, urine and danger that cause sickness in children and adults. even rodents such as squirrels cause problems in homes as they invade attic spaces and build nests in unused furniture and clutter.
our trained technicians can perform a thorough inspection of your property and flush out rodents where they live, eat and breed. we can also set up a preventative maintenance plan to keep rodents outside and away from your property for the foreseeable future.
not all bees are helpful with pollination around the house. carpenter bees, wasps and other stinging insects make life miserable for residents who want to enjoy their patios and backyards. carpenter bees burrow holes in wood and pester children, adults and pets as they pass by. wasps build nests near doors and cause painful stings that could trigger allergic reactions.
our certified technicians understand which bees pose a threat and which ones are more beneficial to the environment. we’ll inspect your home for bee, hornet, wasp and other stinging insect nests and use the appropriate treatments to eliminate them completely.
our services also include home protection plans, which consist of three regularly scheduled pest control visits each year. these services provide year-round protection for your home and give you peace of mind that your home and property are free of invasive pest insects and rodents.
our one-time services are also popular and provide an effective method for clearing out an existing infestation, such as a wasp nest on the patio or mice in the attic. we believe in providing quality services to our customers no matter if they need a quick home treatment or an ongoing pest control program.
whether you’re planning a backyard barbecue or want to lounge on your deck for an afternoon, you don’t want ants, bees and other insects to ruin your fun. if a pest infestation goes untreated, it can expand into a much larger problem down the road. pests breed quickly and can take over a home, a business or an entire property in a matter of weeks or months depending on the species. once you spot the signs of an infestation, it’s time to turn to the professionals.
contact permakill exterminating for a free quote and more information about our pest control services. we serve long valley and the surrounding areas and provide effective, quality services to remove pest infestations from homes and businesses. if you’re dealing with ants around the house, mice in the kitchen or other pests in and around your property, we’re here with services to eliminate the problem and to keep the pests from returning.


text: Love is in the air and on your door this Valentine's Day! This wooden, hand cut and hand-painted Valentine's Day heart is fun and cute. Whether you decide to buy one for yourself or give it to a friend, you can also add a monogram of your choice!

lowercased: love is in the air and on your door this valentine's day! this wooden, hand cut and hand-painted valentine's day heart is fun and cute. whether you decide to buy one for yourself or give it to a friend, you can also add a monogram of your choice!


text:
My British passport expires in a year and I figure it would be easier/cheaper to renew it before heading to Oz. Is it best to renew it now (while my visa application is still in the queue) or wait until I’ve received my visa? My concern with waiting until after the visa is granted is that I assume my visa will be attached to my current passport??
Your visa is electronic these days, so once you have updated your immi account with your new passport details it should switch to being linked to your new passport.
Ok, I guessed it possibly would be so it’s good to have confirmation of that, thanks. How would I update my passport number if I don’t renew until after being granted my visa - do I still use my Immi account or would there be some other way to update it?
Yes - in your immi account.

lowercased:
my british passport expires in a year and i figure it would be easier/cheaper to renew it before heading to oz. is it best to renew it now (while my visa application is still in the queue) or wait until i’ve received my visa? my concern with waiting until after the visa is granted is that i assume my visa will be attached to my current passport??
your visa is electronic these days, so once you have updated your immi account with your new passport details it should switch to being linked to your new passport.
ok, i guessed it possibly would be so it’s good to have confirmation of that, thanks. how would i update my passport number if i don’t renew until after being granted my visa - do i still use my immi account or would there be some other way to update it?
yes - in your immi account.


text:
The Cumberland Police Department Summer Camp is a cooperative effort between the Cumberland Police Department and the Salvation Army to mentor middle school aged boys and girls and to provide them with the knowledge to make smart, healthy and safe decisions in order for them to lead a productive life. The hope is to spark an interest or continue the interest in law enforcement by receiving knowledge of police work and having an opportunity to participate in Police Training.
This fee includes the week long camp, 1 t-shirt for each camper, breakfast and lunch each day and transportation while at the camp. Transportation to and from the camp is not provided.

lowercased:
the cumberland police department summer camp is a cooperative effort between the cumberland police department and the salvation army to mentor middle school aged boys and girls and to provide them with the knowledge to make smart, healthy and safe decisions in order for them to lead a productive life. the hope is to spark an interest or continue the interest in law enforcement by receiving knowledge of police work and having an opportunity to participate in police training.
this fee includes the week long camp, 1 t-shirt for each camper, breakfast and lunch each day and transportation while at the camp. transportation to and from the camp is not provided.