Q1: How do I set the file permissions of my server and document roots?
To maximize security, you should adopt a strict "need to know" policy for both the document root (where HTML documents are stored) and the server root (where log and configuration files are kept). It's most important to get permissions right in the server root because it is here that CGI scripts and the sensitive contents of the log and configuration files are kept.
You need to protect the server from the prying eyes of both local and remote users. The simplest strategy is to create a "www" user for the Web administration/webmaster and a "www" group for all the users on your system who need to author HTML documents. On Unix systems edit the /etc/passwd file to make the server root the home directory for the www user. Edit /etc/group to add all authors to the www group.
Many servers allow you to restrict access to parts of the document tree to Internet browsers with certain IP addresses or to remote users who can provide a correct password (see below). However, some Web administrators may be worried about unauthorized _local_ users gaining access to restricted documents present in the document root. This is a problem when the document root is world readable.
One solution to this problem is to run the server as something other than "nobody", for example as another unprivileged user ID that belongs to the "www" group. You can now make the restricted documents group- but not world-readable (don't make them group-writable unless you want the server to be able to overwrite its documents!). The documents can now be protected for prying eyes both locally and globally. Remember set the read and execute permissions for any restricted server scripts as well.
The CERN server generalizes this solution by allowing the server to execute under different user and group privileges for each part of a restricted document tree. See the CERN documentation for details on how to set this up.
Q2: I'm running a server that provides a whole bunch of optional features. Are any of them security risks?
Yes. Many features that increase the convenience of using and running the server also increase the chances of a security breach. Here is a list of potentially dangerous features. If you don't absolutely need them turn them off.
Knowledge is power and the more the remote hacker can figure out about your system the more chance for him to find loopholes. The automatic directory listings that the CERN, NCSA, Netscape, Apache, and other servers offer are convenient, but have the potential to give the hacker access to sensitive information. This information can include: Emacs backup files containing the source code to CGI scripts, source-code control logs, symbolic links that you once created for your convenience and forgot to remove, directories containing temporary files, etc.
Of course, turning off automatic directory listings doesn't prevent people from fetching files whose names they guess at. It also doesn't avoid the pitfall of an automatic text keyword search program that inadvertently adds the "hidden" file to its index. To be safe, you should remove unwanted files from your document root entirely.
Some servers allow you to extend the document tree with symbolic links. This is convenient, but can lead to security breaches when someone accidentally creates a link to a sensitive area of the system, for example /etc. A safer way to extend the directory tree is to include an explicit entry in the server's configuration file (this involves a PathAlias directive in NCSA-style servers, and a Pass rule in the CERN server).
The NCSA and Apache servers allows you to turn symbolic link following off completely. Another option allows you to enable symbolic link following only if the owner of the link matches the owner of the link's target (i.e. you can compromise the security of a part of the document tree that you own, but not someone else's part).
Allowing any user on the host system to add documents to your Web site is a wonderfully democratic system. However, you do have to trust your users not to open up security holes. This can include their publishing files that contain sensitive system information, as well as creating CGI scripts, server side includes, or symbolic links that open up security holes. Unless you really need this feature, it's best to turn it off. When a user needs to create a home page, it's probably best to give him his own piece of the document root to work in, and to make sure that he understands what he's doing. Whether home pages are located in user's home directories or in a piece of the document root, it's best to disallow server-side includes and CGI scripts in this area.
Q3: I hear that running the server as "root" is a bad idea. Is this true?
This has been the source of some misunderstanding and disagreement on the Net. Most servers are launched as root so that they can open up the low numbered port 80 (the standard HTTP port) and write to the log files. They then wait for an incoming connection on port 80. As soon as they receive this connection, they fork a child process to handle the request and go back to listening. The child process, meanwhile, changes its effective user ID to the user "nobody" and then proceeds to process the remote request. All actions taken in response to the request, such as executing CGI scripts or parsing server-side includes, are done as the unprivileged "nobody" user.
This is not the scenario that people warn about when they talk about "running the server as root". This warning is about servers that have been configured to run their _child processes_ as root, (e.g. by specifying "User root" in the server configuration file). This is a whopping security hole because every CGI script that gets launched with root permissions will have access to every nook and cranny in your system.
You won't be able to open port 80 (at least not on Unix systems). You'll have to tell the server to listen to another port, such as 8000 or 8080.
You'll have to make the configuration files readable by the same user ID you run the server under. This opens up the possibility of an errant CGI script reading the server configuration files. Similarly, you'll have to make the log files both readable and writable by this user ID, making it possible for a subverted server or CGI script to alter the log. See the discussion of file permissions above.
Q4: I want to share the same document tree between my ftp and Web servers. Is there any problem with this idea?
Many sites like to share directories between the FTP daemon and the Web daemon. This is OK so long as there's no way that a remote user can upload files that can later be read or executed by the Web daemon.
Consider this scenario: the WWW server that has been configured to execute any file ending with the extension ".cgi". Using your ftp daemon, a remote hacker uploads a perl script to your ftp site and gives it the .cgi extension. He then uses his browser to request the newly-uploaded file from your Web server. Bingo! he's fooled your system into executing the commands of his choice.
You can overlap the ftp and Web server hierarchies, but be sure to limit ftp uploads to an "incoming" directory that can't be read by the "nobody" user.
Q5: Can I make my site completely safe by running the server in a "chroot" environment?
You can't make your server completely safe, but you can increase its security significantly in a Unix environment by running it in a chroot environment. The chroot system command places the server in a "silver bubble" in such a way that it can't see any part of the file system beyond a directory tree that you have set aside for it. The directory you designate becomes the server's new root "/" directory. Anything above this directory is inaccessible.
Setting up the new root directory can be tricky and is beyond the scope of this document. See the author's book (above), for details. You should be aware that a chroot environment is most effective when the new root directory is as barren as possible. There shouldn't be any interpreters, shells, or configuration files (including /etc/passwd!) in the new root directory. Unfortunately this means that CGI scripts that rely on Perl or shells won't run in the chroot environment. You can add these interpreters back in, but you lose some of the benefits of chroot.
Also be aware that chroot only protects files; it's not a panacea. It doesn't prevent hackers from breaking into your system in other ways, such as grabbing system maps from the NIS network information service, or playing games with NFS.
Q6: My local network runs behind a firewall. Can I use it to increase my Web site's security?
This is called a "sacrificial lamb" configuration. The server is at risk of being broken into, but at least when it's broken into it doesn't breach the security of the inner network.
It's _not_ a good idea to run the WWW server on the firewall machine. Now any bug in the server will compromise the security of the entire organization.
There are a number of variations on this basic setup, including architectures that use paired "inner" and "outer" servers to give the world access to public information while giving the internal network access to private documents. See the author's book for the gory details.
Q7: My local network runs behind a firewall. Can I break through the firewall to give the rest of the world access to the Web server?
If you are using a "screened host" type of firewall, you can selectively allow the firewall to pass requests for port 80 that are bound to or returning from the WWW server machine. This has the effect of poking a small hole in the dike through which the rest of the world can send and receive requests to the WWW server machine.
The CERN server can also be configured to act as a proxy. I feel much less comfortable recommending it, however, because it is a large and complex piece of software that may contain unknown security holes.
More information about firewalls is available in the books Firewalls and Internet Security by William Cheswick and Steven Bellovin, and Building Internet Firewalls by D. Brent Chapman and Elizabeth D. Zwicky.
Q8: How can I detect if my site's been broken into?
You should also check your access and error log files periodically for suspicious activity. Look for accesses involving system commands such as "rm", "login", "/bin/sh" and "perl", or extremely long lines in URL requests (the former indicate an attempt to trick a CGI script into invoking a system command; the latter an attempt to overrun a program's input buffer). Also look for repeated unsuccessful attempts to access a password protected document. These could be symptomatic of someone trying to guess a password.
Q9: Are there any known security problems with the Netscape Communications Server for NT?
Programmers at San Diego Source, the online news service of the San Diego Daily Transcript have discovered that by appending certain characters to the end of the URL that refers to a server-side include file, a remote user can recover the source code for the file, disclosing proprietary information, copyrighted source code, and even user names and passwords used to log into databases. In addition to affecting server-side includes, this bug affects such popular products as Allaire Cold Fusion, Microsoft Active Server Pages, and PHP.
Details of the exploit have not been published, but you can find a longer description in the original article at http://www.sddt.com/files/library/98/06/25/tbc.html.
Netscape is reportedly working on a fix. Please visit the Netscape site for possible patches. If you use server-side includes, you are urged to upgrade as soon as a patch becomes available.
O'Reilly's WebSite and WebSite Professional servers are also vulnerable to this bug. Microsoft IIS servers do not appear to be.
Netscape Enterprise Server 3.0 and FastTrack 3.01 both contain a bug that allows unauthorized remote users to fetch documents that are protected by IP address and password. This bug affects any file that does not use the standard DOS 8.3 naming convention. For example, if the document is named somelongfile.htm, then the unscrupulous user can ask for the file SOMEF~1.HTM, which is the mangled DOS equivalent of the file name. Even though the document may be password protected, this fetch will succeed.
This bug is fixed in Enterprise Server 3.5.1 or higher (see this technical note). It is unclear whether there is a patch available for the FastTrack server, however, which was still at version 3.01 as of June 30, 1998.
The Netscape server does not use the NT File Manager's associations between file extensions and applications. Thus, even though you may have associated the extension .pl with the perl interpreter, perl scripts aren't recognized as such when placed in the cgi-bin directory. Until very recently, a Netscape technical note recommended placing perl.exe into cgi-bin and referring to your scripts as /cgi-bin/perl.exe?&my_script.pl.
Unfortunately this technique allows anyone on the Internet to execute an arbitrary set of Perl commands on your server by invoking such scripts as /cgi-bin/perl.exe?&-e+unlink+%3C*%3E (when run, this URL removes every file in the server's current directory). This is not a good idea. A current Netscape technical note suggests encapsulating your Perl scripts in a .bat file. However, because of a related problem with batch scripts, this is no safer.
Because the EMWACS, Purveyor and WebSite NT servers all use the File Manager extension associations, you can execute perl scripts on these servers without placing perl.exe into cgi-bin. They are safe from this bug.
Older versions the Netscape servers (both the Netscape Communications Server version 1.12 and the Netscape Commerce Server version 1.0) have two problems involving the handling of CGI scripts. One of these problems is also shared by the WebSite Server.
of the CGI program, followed by a directory listing.
Q10: Are there any known security problems with the O'Reilly WebSite server for Windows NT/95?
Programmers at San Diego Source, the online news service of the San Diego Daily Transcript have discovered that by appending certain characters to the end of the URL that refers to a server-side include file, a remote user can recover the source code for the file, disclosing proprietary information, copyrighted source code, and even user names and passwords used to log into databases. In addition to affecting server-side includes, this bug affects such popular products as Allaire Cold Fusion, Microsoft Active Server Pages (using a 3d party ASP interpreter), and PHP.
O'Reilly has announced that a fix will be available in WebSite and WebSite Professional version 2.3. If you use server-side includes, you should strongly consider upgrading.
Windows-based Netscape servers are also vulnerable to this bug. Microsoft IIS servers do not appear to be.
WebSite versions 1.1b and earlier have the same problem with DOS .bat files that Netscape does. However because WebSite supports three different types of CGI scripting interfaces (native Windows, Standard CGI for Perl scripts, and the rarely used DOS .bat file interface), the recommended action is to turn off the server's support for DOS CGI scripts. This will not affect the server's ability to run Visual Basic, Perl, or C scripts.
This hole has been fixed in version 1.1c. You should upgrade to this version with the patch provided at the WebSite home page.
Detailed information on the actions necessary to close the WebSite .bat file security hole can be found at this page provided by WebSite's developer.
Q11: Are there any known security problems with the Purveyor Server for Windows NT?
The Purveyor Web server, all versions, is vulnerable to the same bug that allows the source code for server-side include files to be revealed. See the description of this bug in the section on Netscape Enterprise Server for more details. Support for Purveyor was discontinued in 1997, so no fix or upgrade is available. Your choices are to avoid using server-side includes, or to change server software completely.
Q12: Are there any known security problems with the Microsoft's IIS Web Server?
Microsoft Internet Information Server and Personal Web Server versions 4.0 and earlier contain a bug that allows unauthorized remote users to fetch documents that are restricted by IP address or SSL use. This bug affects any file that does not use the standard DOS 8.3 naming convention. For example, if the document is named somelongfile.htm, then the unscrupulous user can ask for the file SOMEF~1.HTM, which is the mangled DOS equivalent of the file name. Even though the document may be restricted, this fetch will succeed. Password protection, which is accomplished through file system access control lists, is not affected by this bug, although other file-specific settings, such as PICS rating, are.
A patch is available on Microsoft's security pages. Newer versions of IIS are free of the problem.
Versions of the Microsoft IIS server downloaded prior to 3/5/96 contain the same .BAT file bug that appears in other NT-based servers. In fact the problem is worse than on other servers because .BAT CGI scripts doesn't even have to be installed on the server for a malicious remote user to invoke any arbitrary set of DOS commands on your server!
Microsoft has released a patch for this bug, available at http://www.microsoft.com/infoserv/. In addition, all copies of the IIS server downloaded after 3/5/96 should be free of this bug. If you use this server, you should check the creation date of your server binary and upgrade it if necessary.
IIS version 3.0 is vulnerable to a simple denial of service attack. By sending a long URL of a particular length to an IIS server, anyone on the Internet can cause the Web server to crash. The server will need to be restarted manually in order to resume Web services. A variety of Perl and Java programs that exploit this bug are floating around the Internet, and actual attacks have been reported.
The exact length of the URL that is required to cause the crash varies from server to server, and depends on such issues as memory usage. The magic length is generally around 8192 characters in length, suggesting that the problem is a memory buffer overflow. In the past such problems have often been exploited by knowledgeable hackers to execute remote commands on the server, so this bug is potentially more than annoyance.
Q13: Are there any known security problems with Sun Microsystem's JavaWebServer for Windows NT?
The JavaWebServer is able to compile and execute Java class files in a manner similar to CGI scripts (but much more efficiently). These small Java programs are called "servlets."
The Windows NT version of JavaWebServer is vulnerable to a bug that allows the source code for Java servlets to be downloaded by remote users. This bug is similar to ones identified for Windows NT versions of O'Reilly WebSite Professional and Netscape Enterprise Server. By appending certain characters to the end of a servlet's URL, a remote user can fool the server into sending him the compiled servlet, which can then be decompiled by a product such as Mocha. Since servlets may contain proprietary code, trade secrets or even database access passwords, this is a significant problem.
Q14: Are there any known security problems with the MetaInfo MetaWeb Server?
MetaInfo (www.metainfo.com) produces a number of NT products, including a port of the Unix Sendmail program and a DHCP/DNS server. It provides a Web server, called MetaWeb, as a user-friendly front end to its administration tools for these products. At the time this was written, MetaWeb was at version 3.1.
According to Jeff Forristal, who discovered the bug, MetaWeb is vulnerable to the "double-dot" problem that plagued early versions of the Microsoft IIS server. By including ".." pairs in the URL path, the server can be tricked into giving access to directories outside the Web document root, including documents in the Windows system directory. This allows password files and other confidential information to be retrieved. Worse, a variant of this attack also gives remote users the ability to run any executable binary that happens to be installed on the server machine.
MetaWeb has not yet made an upgrade or patch available. You are urged to upgrade when a fix does become available. A good short-term solution is to disable remote administration via the Web interface.
More information about the MetaInfo bug may be posted Jeff Forristal's site.
Q15: Are there any known security problems with NCSA httpd?
Versions of NCSA httpd prior to 1.4 contain a serious security hole relating to a fixed-size string buffer. Remote users could break into systems running this server by requesting an extremely long URL. Although this bug has been well publicized for more than a year, many sites are still running unsafe versions of the server. The current version of the software, version 1.5, does not suffer from this bug and is available at the link given at the beginning of this paragraph.
Recently it has come to light that example C code (cgi_src/util.c) long distributed with the NCSA httpd as an example of how to write safe CGI scripts ommitted the newline character from the list of characters that are shouldn't be passed to shells. This ommission introduces a serious bug into any CGI scripts that were built on top of this example code: a remote user can exploit this bug to force the CGI script to execute any arbitrary Unix command. This is another example of the dangers of executing shell commands from CGI scripts.
In addition, the NCSA server source code tree itself contains the same bug (versions 1.5a and earlier). The faulty subroutine is identical, but in this case is found in the file src/util.c as opposed to cgi_src/util.c. After looking through the server source code, I haven't found a place where a user-provided string is passed to a shell after being processed by this subroutine, so I don't think this represents a actual security hole. However, it's best to apply the patch shown below to be safe.
The Apache server, versions 1.02 and earlier, also contains this hole in both its cgi_src and src/ subdirectories. It's not unlikely that the same problem is present in other derivatives of the NCSA source code.
Q16: Are there any known security problems with Apache httpd?
Versions prior to v1.3.20 contain server programming errors that present moderate to serious security risks. Under the right circumstances, authentication headers would not be provided to the client. The default configuration would lead two modules to present directory listings instead of presenting the default index.html file, if the URL retrieved was artificially long and contained many slashes.
The NetWare functions created a bug whereby directives for path settings were not interpreted correctly.
The mod_rewrite module, if the result of filename rewrites caused a file to include $0 or other such references, could result in server configuration information being presented to a browser.
Versions of Apache httpd prior to 1.2.5 contain several programming errors that present moderate security risks. Users who have local access to the server machine (e.g. Web authors), can carefully craft HTML files which, when fetched, will give the user the ability to execute Unix commands with Web server user permissions. Since local users usually already have as much, if not more, access to the system as the Web server, this does not present a major risk, but it may be of concern to ISP's who provide Web hosting services to untrusted authors. Apache version 1.2.5 is free of these bugs; upgrade at your earliest convenience. If you are using a 1.3 beta version of Apache, you may apply a patch located atthe Apache site, or await the release of 1.3b4.
Apache servers prior to 1.1.3 contain two security holes which are of far more concern. The first hole affects servers compiled with the "mod_cookies" module. Servers compiled with this module contain a vulnerability that allows remote users to send the server extremely long cookies and overrun the program stack, potentially allowing arbitrary commands to be executed. Because this gives remote users access to the server host, it is a far greater vulnerability than the holes discussed above, which only can be exploited by local users.
The second problem with 1.1.1 affects automatic directory listings. Ordinarily, a remote user cannot obtain a directory listing if the directory contains a "welcome page", such as "index.html". A bug causes this check to fail under certain circumstances, allowing the remote user to see the contents of the directory even if the welcome page is present. This hole is less serious than the first one, but is still a potential information leak.
Q17: Are there any known security problems with the Netscape Servers?
Netscape Enterprise server versions 3.6sp2 and earlier, as well as FastTrack server versions 3.01 and earlier contain a buffer overflow bug that can allow a remote user to gain shell access to the server machine. More information on this problem, as well as pointers to patches, can be found at http://www.ciac.org/ciac/bulletins/j-062.shtml.
There have also been two well-publicized recent episodes in which the system used by the Netscape Secure Commerce Server to encrypt sensitive communications was cracked. In the first episode, a single message encrypted with Netscape's less secure 40-bit encryption key was cracked by brute force using a network of workstations. The 128-bit key used for communications within the U.S. and Canada is considered immune from this type of attack.
In the second episode, it was found that the random number generator used within the server to generate encryption keys was relatively predictable, allowing a cracking program to quickly guess at the correct key. This hole has been closed in the recent releases of the software, and you should upgrade to the current version if you rely on encryption for secure communications. Both the server and the browser need to be upgraded in order to completely close this hole. See http://home.netscape.com/newsref/std/random_seed_security.html for details.
Q18: Are there any known security problems with the Lotus Domino Go Server?
Bill Jones <sneex@mac.com> reports that older versions of Lotus Domino Go, formerly known as IBM Internet Connection Server (ICS), contained a security hole in directory browsing. When directory browsing is set to "fancy", a potential hacker can browse backward through the directory tree all the way up to root ("/"). Thus, private system files and other documents are exposed to interception. This bug was present in versions 1.0 through 2.0 of ICS, and affected both the AIX and OS/2 Warp versions.
According to Richard L. Gray (rlgray@us.ibm.com>) of IBM, all known problems have been fixed in versions 4.2.1.3 and higher. Lotus Domino Go also now runs on Windows 95, Windows NT, OS/390, HPUX and Solaris systems.
Q19: Are there any known security problems with the WN Server?
The WN server is free of any known security holes. As explained in Q6 it contains several features that lessen the chance that security will be breached by improper server configuration.
Q20: Are there any known security problems with WebStar?
There is a gaping hole in WebSTAR's handling of log files. If you install WebSTAR using the default configuration, the server's log file will be located within the document tree. Anyone on the Internet can download the entire server log and review all remote accesses to the server simply by requesting the URL "http://your.site/WebSTAR%20LOG ". As discussed in Server Logs and Privacy, this is a violation of users' expectation to privacy. Use WebSTAR's administrative tool to change the location of the log file to some place outside the document tree.
As far as the security of the WebSTAR server itself goes, there is reason to think that WebSTAR is more secure than its Unix and Windows counterparts. Because the Macintosh does not have a command shell, and because it does not allow remote logins, it is reasonable to expect that the Mac is inherently more secure than the other platforms. In fact this expectation has been borne out so far: no specific security problems are known in either WebStar or its shareware ancestor MacHTTP.
In early 1996 a consortium of Macintosh Internet software development companies, including StarNine, the developer of WebStar, posted a $10,000 reward to anyone who could read a password-protected Web page on a Macintosh running WebStar software. As described in an article about the challenge in Tidbits#317/04-Mar-96, after 45 days no one had stepped forward to claim the prize.
Exploiting holes in the server to read files outside the official document tree.
Finding a way to crash the server.
Exploiting holes in CGI scripts to execute AppleScript commands. This particularly of concern for Perl scripts. All the caveats and warnings about safe scripting apply.
Q21: Are there any known security problems with MacHTTP?
MacHTTP shares WebSTAR's problem with log files. See the discussion above.
Q22: Are there any known security problems with Quid Pro Quo?
The Quid Pro Quo server saves its default log file inside the document root, at URL http://site.name/server%20logfile. A knowledgeable remote user can find out every access that anyone's made to your server!
(This information provided by Paul DuBois <dubois@primate.wisc.edu>).
Q23: Are there any known security problems with Novell WebServer?
If you are running Novell Webserver version 3.x and have the Web Server Examples Toolkit v.2 installed, you have a major security hole. Users can view any file on your system and download directory listings, possibly gaining information needed to break into your system. The hole is in the example CGI Perl script files.pl. Remove it from your /perl directory (typically located in SYS:INW_WEB\SHARED\DOCS\LCGI\PERL5. Better yet, remove all CGI scripts that are not essential for the operation of your site.
Q24: What information do readers reveal that they might want to keep private?
Most servers log every access. The log usually includes the IP address and/or host name, the time of the download, the user's name (if known by user authentication or obtained by the identd protocol), the URL requested (including the values of any variables from a form submitted using the GET method), the status of the request, and the size of the data transmitted. Some browsers also provide the client the reader is using, the URL that the client came from, and the user's e-mail address. Servers can log this information as well, or make it available to CGI scripts. Most WWW clients are probably run from single-user machines, thus a download can be attributed to an individual. Revealing any of those datums could be potentially damaging to a reader.
The pattern of accesses made by an individual can reveal how they intend to use the information. And the input to searches can be particularly revealing.
Another way Web usage can be revealed locally is via browser history, hotlists, and cache. If someone has access to the reader's machine, they can check the contents of those databases. An obvious example is shared machines in an open lab or public library.
Proxy servers used for access to Web services outside an organization's firewall are in a particularly sensitive position. A proxy server will log every access to the outside Web made by every member of the organization and track both the IP number of the host making the request and the requested URL. A carelessly managed proxy server can therefore represent a significant invasion of privacy.
Q25: Do I need to respect my readers' privacy?
Yes. One of the requirements of responsible net citizenship is respecting the privacy of others. Just as you don't forward or post private email without the author's consent, in general you shouldn't use or post Web usage statistics that can be attributed to an individual.
If you are a government site, you may be required by law to protect the privacy of your readers. For example, U.S. Federal agencies are not allowed to collect or publish many types of data about their clients.
In most U.S. states, it is illegal for libraries and video stores to sell or otherwise distribute records of the materials that patrons have checked out. While the courts have yet to apply the same legal standard to be applied to electronic information services, it is not unreasonable for users to have the same expectation of privacy on the Web. In other countries, for example Germany, the law explicitly forbids the disclosure of online access lists. If your site chooses to use the Web logs to populate your mailing lists or to resell to other businesses, make sure you clearly advertise that fact.
Q26: How do I avoid collecting too much information?
One of the requirements of your Web site may be to collect statistics on usage to provide data to the organization and to justify Web site resources. In general, collecting information about accesses by individuals is probably not warranted or even useful.
The easiest way to avoid collecting too much information is to use a server that allows you to tailor the output logs, so that you can throw away everything but the essentials. Another way is to regularly summarize and discard the raw logs. Since the logs of popular sites tend to grow quickly, you probably will need to do that anyway.
Q27: How do I protect my readers' privacy?
There are two classes of readers: outsiders reading your documents, and insiders reading your documents and outside documents.
having a clear site policy on Web usage.
educating them about the site policy and risks of Web usage.
using a site-wide proxy cache to hide the identity of individual hosts from outside servers.
If your site does not want to reveal certain Web accesses from your site's domain, you may need to get Web client accounts from another Internet provider that can provide anonymous access.


I was wondering how I could prove if a set of numbers along with some arbitrary operation is an abelian group.
Don't you have a list of axioms which says "G is an abelian group if and only if the following are satisfied: ..."?
The first step is proving that it is a group in the first place.
If it's not a group, than it certainly isn't an abelian group.
Then after that, look at the definition of what it means for a group to be abelian. Test it. Then you are done.
Sometimes it feels like people just repeat what I write.
That's assuming that it is a group, but he hasn't even shown that yet. I'd worry about proving that it is a group before even thinking about what properties the group might have.
No it isn't. I even used the plural of "axiom" to try to hint at the fact that several things, rather than just commutativity, needed to be checked.
"Group Theory" You must log in or register to reply here.
Group Theory and Social Groups.


Informant Bio: Informant is a friend and fellow business major. He is a junior at the University of Southern California Marshall School of Business. His family is from Mexico but he has lived in Southern California for nearly all of his life.
Context: I was talking to Fabian about Mexican stories and folklore. He originally learned this story at age 13 from his mother when he went hiking in mountains in which the specific cave is supposed to be located. His uncle had previously gone exploring and looking for the gold in this area. The tale is well known in the informant’s state of Michocoan.
Item: “So there’s this famous bandit, and, um, he like stole a lot of gold, but the thing is, he disappeared all of a sudden along with all his gold. They never found his body or his gold. People think that he buried it in some tunnels in the mountains. The legend around the gold is that you can only find it if you are looking for it by unselfish means. People who have been looking to get rich have never found the gold, but, people who have explored the cave for fun have randomly stumbled upon gold coins. And then at night, sometimes you will the bandit’s spirit running on his horse”.
Informant Analysis: Ghost riders are an extremely common phenomena in Mexican legends and tales. Unlike in the U.S. where ghosts and dead spirits are seen to be creepy, dead spirits are common in Mexican tales.
Analysis: Many Mexican tales seem to have an emphasis on intentions and values. The bit about only the unselfish/non-evil searchers being able to find the gold out of virtue seems to be a common thread in other cultures across the world. Mexicans are highly religious in general and also place great importance on familial duty, honest work, and honor. If you perform honest work then no one criticizes you while you can be ostracized for doing dis-honorable, illegal or morally question deeds. This tale seems to celebrate the fact that if you have good intentions and live purely, that you will indeed sew good luck and receive benefits in the end.
These two are similar in that they are about who you surround yourself with, in the second case, “wolves.” They’re about how you should be careful because we are easily influenced by others, and perceived in terms of people we choose to be with, even if you are good. Wolves are dangerous vicious animals that run in packs, so this is a warning not to get involved with bad people, who can turn you and make you “howl,” or be bad like them.
This refran is about being good to everyone, no matter who they are, how they may seem. Treating others well is very important to my informant and she believes strongly that you shouldn’t judge others.
Because my informant comes from very humble beginnings in León, Guanajuato, México, she can’t stand materialism and thinks that people who are obsessed with things and showing off are either fake, liars, or as the proverb suggests are lacking otherwise. This lack is likely a more metaphorical lack, like they have something perhaps emotionally or spiritually missing from their lives or are unhappy. This saying has probably become even more applicable since she moved to the United States, where image and things is a part of daily life and are even more in your face.
I found this refran to be the most interesting because the connotation or the reason why she says it seems somewhat contradictory at first. I’m not a gold coin is considered a positive thing. It’s good that you aren’t gold because then everyone doesn’t like you, everyone doesn’t want you, love you. This tells me that self-esteem in Mexican culture has a different slant in that it truly comes from the self as opposed to from affirmation from others, and also in the sense that not being perfect is a good thing. This saying emphasizes uniqueness and the imperfection of humanity as good and safe. It’s not as important that everyone love you because not everyone is good and you shouldn’t want everyone to love you. That she ends telling me this particular refran, which she explains to be the most popular and commonly used one she knows from Mexico, it really highlights the motif that you need to be cautious with people. You don’t want everyone to like you. It’s almost a giant Freudian defense mechanism, because again, the other motif is that not all people are good, or good for you to be around, though you should treat everyone well (even if you don’t like them).


The Rent in the Line is an article written by Arthur Conan Doyle first published in The Times on 3 october 1918.
A PICTURE OF THE GREAT BATTLE.
FROM THE ROOF OF A TANK.
The grand, sonorous, mystical lines of Julia Ward Howe rang in my head as I found myself by most unlooked-for chance an actual eye-witness of this, one of the historical episodes of the greatest of wars. Yes, with my own eyes I saw the rent while the men who made it were still pushing forward from the farther side of it.
Even now I can hardly realize that it was so. A kindly invitation from the Australian Government explains my presence on their front, and the energy and good will of a helpful soldier on the spot, a captain of Australian Artillery, brought about the rest. Let me try to transcribe what I saw.
It was about 11 o'clock when we reached the edge of the battlefield upon Sunday, September 29. "We" refers to Sir Joseph Cook, Colonial statesman, Commander Latham, the Naval Attaché, and myself, with Captain Plunket, a twice-wounded Australian officer, as our shepherd.
The programme of the day was already clear in our heads. American Divisions were to rush the front line. The Australian Divisions were to pass through them, and carry the battle front forward. Already as we arrived the glad news came back that the Americans bad done their part, and that the Australians had just been unleashed. Also that the Germans were standing to it like men.
As our car threaded the crowded street between the ruins of Templeux, we met the wounded coming back, covered cars with nothing visible save protruding boots, and a constant stream of pedestrians, some limping, some with bandaged arms and faces, some supported by Red Cross men, a few in pain, most of them smiling grimly behind their cigarettes. Amid them came the first clump of prisoners, 50 or more, pitiable enough, and yet I could not pity them, weary, shuffling, hangdog creatures, with no touch of nobility in their features or their bearing.
The village was full of Americans and Australians, extraordinarily like each other in type. One could well have lingered, for it was all of great interest, but there were even greater interests ahead, so we turned up a hill, left our ear, which had reached its limit, and proceeded on foot. The road took us through a farm, where a British anti-aircraft battery stood ready for action. There we found open plain, and went forward, amid old trenches and rusty, wire, in the direction of the battle.
We had now passed the heavy gun positions, and were among the field guns, so that the noise was deafening. A British howitzer battery was hard at work, and we stopped to chat with the major. His crews had been at it for six hours, but were in great good-humour, and chuckled mightily when the blast of one of their guns nearly drove in our ear-drums, we having got rather too far forward. The effect was, that of a ringing box on the exposed car — with which valediction we left our grinning British gunners and pushed on to the east, under a screaming canopy of our own shells. The wild, empty waste of moor was broken by a single shallow quarry or gravel-pit, in which we could see some movement. In it we found an advanced dressing station, with about a hundred American, and Australian gunners and orderlies. There were dug-outs in the sides of this flat excavation, and it had been an American battalion H.Q. up to a few hours before. We were now about a thousand yards from the Hindenburg Line, and I learned with emotion that this spot was the Egg Redoubt, one of those advanced outposts of General Gough's Army which suffered so tragic and glorious a fate in that great military epic of March 21 - one of the grandest in the whole war. The fact that we were now standing in the Egg Redoubt showed me, as nothing else could have done, how completely the ground had been recovered, and how the day of retribution was at hand.
We were standing near the eastward lip of the excavation, and looking over it, when it was first brought to our attention that it took two to make a battle. Up to now we had seen only one. Now two shells burst in quick succession 40 yards in front of us, and a spray of earth went into the air. "Whizz-bangs," remarked our soldier guide casually. Personally, I felt less keenly interested in their name than in the fact that they were there at all.
We thought we had done pretty well to get within 1,000 yards of the famous line, but now came a crowning big of good fortune, for an Australian gunner captain, a mere lad, but a soldier from his hawk's eyes to his active feet, volunteered to rush us forward to some enigm of vantage known to himself. So it was East-ward Ho ! once more, still over a dull, barren plain sloping upwards, with little sign of life. Here and there was the quick fluff of a bursting shell, but at a comforting distance. Suddenly ahead of us a definite object broke the skyline. It was a Tank, upon which the crew were working with spanners and levers, for its comrades were now far ahead, and it would fain follow. This, it seems, was the grand stand which our young gunner had selected. On to the top of it we clambered - and there, at our very feet and less than 500 yards away, was the rift which had been torn a few hour before in the Hindenburg line. On the dun slope beyond it, under our very eyes, was even now being fought a part of that great fight where at last the children of light are beating down into the earth the forces of darkness. It was there. We could see it. And yet how little there was to see !
The ground sloped down, as dark and heathy as Hindhead. In front of us lay a village. It was Bellicourt. The Hindenburg position ran through it. It lay quiet enough, and a with the glass, or even with the eye, one could see rusty red fields of wire in front of it. But the wire had availed nothing, nor had the trench that lurked behind it, for beyond it, beside the village of Nouroy, there was a long white line, clouds of pale vapour spouting up against a dark, rain-sodden sky. "The Boche smoke barrage." said our guide. "They are going to counter-attack." Only this, the long, white, swirling cloud upon the dark plain, told of the strife in front of us. With my glasses I saw what looked like Tanks, but whether wrecked or in hiding I could not say. There was the battle - the greatest of battles - but nowhere could I see a moving figure. It is true that all the noises of the Pit seemed to rise from that lonely landscape, but noise was always with us, go where we would.
The Australians were ahead where that line of smoke marked their progress. In the sloping fields, which at that point emerged out of the moor, the victorious Americans, who had done their part were crouching. It was an assured victory upon which we gazed, achieved so rapidly that we were ourselves standing far forward in ground which had been won that day. The wounded had been brought in, and I saw no corpses, though some friends who had reached the line to our left found 18 American lads lying dead by the roadside. On that side the fight was very severe, and the Germans, who had been hidden in their huge dug-outs, were doing their usual trick of emerging and cutting off the attack. So much we gathered afterwards, but for the moment it was the panorama before us which was engrossing all our thoughts.
Suddenly the German guns woke up. I can but pray that it was not our group which drew their fire upon the half-mended Tank. Shell after shell fell in its direction, all of them short, but creeping forward with each salvo. It was time for us to go. If any man says that without a call of duty he likes being under shell tire, he is not a man whose word I would trust.
We made our way back, with no indecent haste, but certainly without loitering, across the plain, the shells always getting rather nearer, until we came to the excavation. Here we had a welcome rest, for our good gunner took us into his cubby-hole of a dug-out, which would at least stop shrapnel, and we shared his tea and dried beef, a true Australian soldier's meal.
The German fire was now rather heavy, and our expert host examined that this meant that he had recovered from the shock of the attack, had reorganized his guns, and was generally his merry self once more. From where we sat we could see heavy shells bursting far to our rear, and there was a general atmosphere of explosion all round us, which might have seemed alarming had it not been for the general chatty afternoon-tea appearance of all these veteran soldiers with whom it was our privilege to find ourselves. As we started on our homeward track we came, first, upon the British battery which seemed to be limbering up with some idea of advancing. Farther still we met our friends of the air guns, and stopped again to exchange a few impressions. They had nothing to fire at, and seemed bored to tears, for the red, white, and blue machines were in full command of the sky of the sky. Soon we found our motor waiting in the lce of a ruined house, and began to thread our way back through the wonderfully picturesque streams of men. American, Australian, British, and German, who were strung along the road.
And then occured a very horrible incident. One knew, of course, that one could not wander about a battlefield and not find oneself sooner or later invoked in some tragedy, but we were now out of range of any but heavy guns, and their slots were spasmodic. We had halted the car for an instant to gather up two German helmets which Commander Latham had seen on the road-side, when there was a very heavy burst close ahead round a curve in the village street. A geyser of red brick-dust flew up into the air. An instant later our car rounded the corner. None of us will forget what we saw. There was a tangle of mutilated horse, their necks rising and sinking. Beside them a man with his hard blown off was staggering away, the blood gushing from his upturned sleeve. Beside the horses lay a shattered man, drenched crimson from head to foot, with two great glazed eyes looking upwards through a mask of blood. Two comrades were at hand to help and we could only go upon our way with the ghastly picture stamped for ever upon our memory. The image of that dead driver might well haunt one in one's dreams.
Once through Templeux and on the main road for Péronne things became less exciting and we drew up to see a column of 900 prisoners pass us. Each side of the causeway was lined by Australians, with their keen, clear-cut, falcon faces, and between lurched these heavy-jawed, beetle-browed, uncouth louts, new caught and staring round with bewildered eyes at their debonnaire captors. I saw none of that relief at getting out of it which I have read of ; nor did I see any signs of fear, but the prevailing impression was an ox-like stolidity and dullness. It was a herd of beasts, not a procession of men. It was indeed farcical to think that these uniformed bumpkins represented the great military nation, while the gallant figures who lined the road belonged to the race which they had despised as being unwarlike. Time and Fate between them have a pretty sense of humour.
They are great soldiers, these Australians. I think they would admit it themselves, but a spectator is bound to confirm it. There is a reckless daredevilry, combined with a spice of a cunning, which gives them a place of their own in the Imperial ranks. They have a great advantage, too, in having a permanent organization, the same five divisions always in the same corps, under the same chief. It doubles their military value - and the same applies equally, of course, to the Canadians. None the less, they must not undervalue their British comrades or lose their sense of proportion. I had a chance of addressing some 1,200 of them upon our return that evening, and while telling them all that I thought of their splendid deeds, I ventured to remind them that 72 per cent. of the men, and 76 per cent. of the casualties, were Englishmen. But this is a description of a day's adventure on the Hindenburg line, and my deep appreciation of the Commonwealth soldiers, of their officers, and of their Commander, must appear elsewhere.
This page was last edited on 3 October 2018, at 18:24.


When Police Officer Joseph Locurto held a news conference in his lawyer's office this month to apologize for appearing in blackface at a Queens parade and to plead for the right to continue serving on the force, there was a mole among the reporters: a police sergeant investigating his case who sat among the journalists and took notes.
But police officials defended their decision to dispatch an investigator to the news conference to hear what Officer Locurto had to say. Marilyn Mode, the department's Deputy Commissioner for Public Information, said she considered news conferences ''open to the public,'' and added that while the officer did not identify himself or wear a badge, he did not wear press credentials either.
Officer Locurto is scheduled to face an administrative trial at Police Headquarters on Oct. 5 at which he will fight to keep his job. He was suspended without pay for wearing blackface at the annual Labor Day parade in Broad Channel, Queens, while riding atop a float that parodied the racist killing of a black man in Jasper, Tex., last June.
Mr. Siegel, in his letter to police officials, asked for an investigation into whether the decision to send a police officer to the news conference violated the rules for using covert police surveillance of political activities. Under a 1985 Federal court order known as the Handschu agreement, the police are prohibited from investigating political gatherings except for the purposes of crowd control or when they have specific information that the group has committed or plans to commit a crime.
Ms. Mode said that after conferring with George A. Grasso, the department's Deputy Commissioner for Legal Affairs, she did not believe the investigation violated the Handschu agreement. But she added that the department would refer the case to its Handschu committee for a review. The committee is made up of Mr. Grasso; Patrick E. Kelleher, the department's First Deputy Commissioner, and John Doyle, a lawyer.
''Of course it was political,'' he said.
Ms. Mode said that while there was no written policy preventing officers from impersonating reporters, she believed it was against Police Department guidelines.


Is there a step-by-step guide to setup the SXFI AMP for use with macOS?
Can I use the SXFI AMP with macOS?
Yes you can use the SXFI AMP with PCs or laptops running macOS v10.13 High Sierra or newer.
After you have setup the AMP with your profile using an Android device, follow the steps below for the optimal Super X-Fi experience.
For the best experience with Super X-Fi, configure your audio settings in accordance with the number of audio channels in your content.
If you're playing content with 7.1 channel audio, do set your speakers configuration (in Step 5 below) to '7.1 RearSurround'.
If you are playing stereo content, correspondingly set this speakers configuration to 'Stereo'.
Go to Spotlight and type "Audio MIDI Setup"
Under "Audio Devices", select "Super X-Fi AMP"
You'll see the default configuration of speakers shown below.
You'll next need to reconfigure four of the speaker settings via the corresponding drop down lists shown in the next step.
For the "Left surround" speaker, set it to "Side Left"
For the "Left rear surround" speaker, set it to "Back Left"
For the "Right surround" speaker, set it to "Side Right"
For the "Right rear surround" speaker, set it to "Back Right"
You should end up with the settings shown below.
Go to "System Preferences", "Sound"
And you're good to go, enjoy your Super X-Fi experience!


Southern Adventist University is a liberal arts university located in Collegedale, Tennessee. It is affiliated with the Seventh-day Adventist Church. The university operates a radio station, WSMC-FM, which plays mainly classical music as well as news from the BBC, National Public Radio, and Public Radio International. The station also provides live broadcasts of services from the Collegedale Seventh-day Adventist Church.
Question and Answer about "Southern Adventist University"


I recently asked a question: What role does a user have to have to create a course with coursepress on their multisite?
I want each individual site to have access to create their own courses with coursepress on their multisite. I was told to give access to my site through the dashboard, which I did so they can see why a new user can't see the Coursepress dashboard.
If you are logged in as Admin you can see if on individual multisites, but if you create a new user and new multisite, and log in as them not admin, you do not have the option to create a course on your multisite.
I am under a bit of a time crunch in building this site and was wondering when someone could log onto my site and find out what the issue is.
You'll need to go to CoursePress>Instructors and add any members who you want to have instructor privileges.
The idea is to have users create a multisite and build their own online campus on it.


I have a map of vegetation in 1913 for a particular landscape (approx 35,000ha), of which I have data for just short of 60% of the landscape. The limited visibility is due to the coverage being derived from oblique photos, and large areas are obscured by ridges etc.I need to develop a prediction for what is in the invisible areas. The attached map shows the landscape as Forest (green) , Non-Forest (dark grey) and the missing areas are paler grey (a DEM coverage).
I have settled on using Indicator Kriging (using ArcGIS 10.3 Geostatistical Wizard) to fill in the missing areas. I have developed a model that predicts forest correctly in 83% of the landscape, and is 86% accurate for non forest (ie. if the real cover is forest, 83% of the time the kriging prediction says it is forest, and 17% of the time it says it is Non Forest).
In my model I have turned Anisotropy to "true", because there is a trend towards more non forest in the SSE corner, and more Forest in the NNW corner. However, I suspect that elevation and insolation are also factors in controlling vegetation.
How can I include Elevation and Insolation (I have the rasters for these) as predictors to see if they improve the model?
Having done this type of modeling for decades, I can say that, in how your problem is defined, Kriging is a very poor choice and, without understanding nonstationarity, you are probably violating the hell out of some important assumptions. You are likely getting your stated accuracy due to overfit and not actual prediction accuracy. If you were modeling something like spread of noninvasive species (that follows a spatial die-off) you may be able to justify a model such as Kriging but not here. I would dissuade you from exploring MaxEnt because of some intractable statistical reasons see: Renner & Warton (2013); Yackulic et al., (2013); Royle et al, (2012).
As the saying goes "what is your question"? I would think that you may have a model specification issue on hand. This is where the incorrect covariates are being defined, or an incorrect hypothesis, in describing the variation in your process. My reasoning is that you are getting poor model performance in multiclass Maximum Likelihood and RF model(s) which may indicate that you do not have variables that represent variation in these classes or have very poor training data. It also sounds like you are using covariates (elevation, insolation, ...) that are indicating "potential" rather than observed (BTW, I am consistently getting after my students that elevation is not a defensible process!). By representing forest as a binomial process the variation is being reduced and the covaritaes more representative of the modeled process. I would point out that nominal variabies (eg., Natural Subregions?) can artificially partition continuous variation to the point that it is meaningless.
Potential would effectively be modeling niche, using variables that indicate environmental variation, that the vegetation could "potentially" occupy where, modeling observed would use something like active or passive remote sensing to model where the process is actually observed in the field/data. The nature of "potential" occupancy adds a layer of uncertainty that needs to be accounted for in evaluating model performance.
If you settle on modeling the potential occupied niche, then you should carefully select variables that indicate ecological process of each desired class (eg., a variable important for trees may not matter for grass). It is also plausible that your classes interact in a way that changes to probability of occurrence. An example of this would be gaps in canopy influencing occurrence of grass and forest composition influencing other understory species.
Modeling is not, and should not, be a one-size-fits-all push button endeavor. At this juncture, I highly would recommend talking with a statistician or one experienced in vegetation modeling to get some guidance.
Kriging seems like a poor choice here.
First, what is the role of spatial autocorrelation in predicting whether an area is forested or not? Since, at its core, kriging is a method that predicts based on distance, you should only use it if you have a good reason to believe distance plays a large role in why there is forest at a given location, or if you have no other predictors available. It seems here that distance would be a distal predictor, or proxy variable, which is why you needed to include anisotrophy in your model - because really you need to be modeling the effect of elevation or whatever it is that changes as you move in that direction.
Second, you give an ~84% accuracy rate. How was that determined, and for how much of your study site? Is it only for the ~60% of the area you have coverage for?
If I were you I would use a different method altogether to predict forest occurrence, especially since you have so many other, and better predictors than distance. A method like Maxent has not only proven to be as accurate at predicting species/vegetation community occurrence as almost all other methods, but it's also very user friendly. You shouldn't use it uncritically, but you also don't need to be a statistician to get accurate, reliable, and defensible results.
Not the answer you're looking for? Browse other questions tagged arcgis-desktop arcgis-10.3 kriging geostatistical-analyst or ask your own question.


It has been said that the Bosnian Serb army commander Ratko Mladic led the 'ethnic cleansing' that saw thousands raped, tortured and killed in the early to mid 1990's.
With a hatred for a people that was so strong and so vile, the area of Srebrenica alone was purged of over 7,000 Muslim boys and men in 1995.
This is just one of the many charges brought against Mladic, who is himself, in ill health.
Captured and brought to justice under a year ago, he goes on trial in The Hague, 20 years after the start of the conflict in Bosnia. His focus at the time was to eradicate Bosnia of its Muslim influence, known as 'non-Serbs.'.
Gen Mladic faces 11 counts of war crimes and crimes against humanity, including genocide, in connection with the brutal four year period of 1992-95 Bosnian war.
He is also charged in connection with the 44-month siege of Sarajevo during which more than 10,000 people died.
Leading prosecuting counsel, Dermot Groome said they would prove Gen Mladic's hand in the crimes.
"Four days ago marked two decades since Ratko Mladic became the commander of the main staff of the army of Republika Srpska - the VRS," he said.
"On that day, Mladic began his full participation in a criminal endeavour that was already in progress. On that day, he assumed the mantle of realising through military might the criminal goals of ethnically cleansing much of Bosnia. On that day he commenced his direct involvement in serious international crimes."
Mr Groome continued by saying that by the time Gen Mladic and his troops had "murdered thousands in Srebrenica" they were "well-rehearsed in the craft of murder".
He emphasized his point with video footage taken of the aftermath of a notorious shelling of a market in the Bosnian capital Sarajevo, where dozens of people were slaughtered.
Gen Mladic spent the next 15 years on the run before being apprehended by Serb forces May 2011 where he was sent to The Hague. Mladic has called the accusations against him "monstrous" with the court entering a not guilty plea on his behalf.
Although the trial is forecasted to be a lengthy one, possibly even lasting in the vicinity of up to three years in duration, a number of crimes for which Mladic stands accused has been almost halved in order to speed up the procedure.
Some have even said that with Mladic's ill health weighing in the balance, he may not even last out the trial.
However, if the pre-trial hearings are anything to go by, with Mladic being characterised as ill-tempered and defensive while heckling the judge and interrupting proceedings with outbursts of; "The whole world knows who I am," he said "I am General Ratko Mladic. I defended my people, my country... now I am defending myself."
Undoubtedly, it is going to be a case which will stir up strong emotions on both sides, but in the case of the watching survivors, who witnessed loved ones being mewn down in their droves, the last thing they want to see is Gen Mladic taking control and getting the upper hand.
The departure of one and the swearing in of another. Francois Hollande, France's first Socialist president in 17 years takes the reins from former French president Nicolas Sarkozy to much public fanfare.
In the wake of a European debt crisis, which for many countries, and most notably Greece who is finding the roads ahead to be rather slippery indeed, one could imagine the French people hanging on to the idea that a newly elected president will quite literally mean, 'a new start.' What Sarkozy failed to do as president, this self proclaimed 'normal' man of 57 will turn the tables of wealth and prosperity around for all.
With public sentiment and support recoiling from Nicolas Sarkozy's flair for the dramatic, a man who never shied away from the limelight and to many, promoted capitalism over employment and growth. We now see a total reverse in action.
Hollande, seemingly, at first glance, an almost Clouseau-like character, seen waving to supporters from his vehicle's open sunroof as it made its way slowly and deliberately up the magnificent Champs-Elysees avenue. And, undeterred by the savage, pelting rain totally drenching the new leader's Marks and Spencer's basement quality suit, which appeared to soak up every last drop, one wondered whether they should laugh or possibly even cry.
Festivities over with and presidential business around the corner, a waterlogged Hollande took off for Germany, and a meeting with German Chancellor Angela Merkel.
Although Monsieur Hollande and the German Chancellor come from diametrically opposite spheres in dealing with their individual economies, it is unanimous that the goal in mind is to deal with and solve Europe's escalating debt crisis.
With Greece almost toppling the House of Economic Cards, the survival rate for the rest of the eurozone, is shaky at best. New figures in show that the eurozone avoided a double-dip recession, but that can be argued, as it was primarily due to the growth and stability of the German economy and therefore, down to their very own concerted work ethic and psyche to push along and forward.
When Hollande was first declared president he immediately acknowledged the challenges that lay ahead: "a massive debt, weak growth, high unemployment, degraded competitiveness, and a Europe that is struggling to come out of crisis."
Hollande also promised to fight financial speculation and "open a new path" in Europe. Unlike Sarkozy and Merkel, he intends to fight against harsh austerity measures with a thinking that spending your way out of a crisis is the road to survival. It seems he knows nothing of Gordon Brown's disasterous journey down that route. "To overcome the crisis that is hitting it, Europe needs plans. It needs solidarity. It needs growth. To our partners, I will propose a new pact that will tie the necessary reduction of public debt with the indispensable stimulus of the economy," he said. Hollande also pledged to bring "dignity and simplicity" to the presidential role. This was possibly viewed as a direct side swipe in the direction of France's former president, Nicolas Sarkozy who seemed to err on the side of elitism.
With France's economy at a merky standstill, most French people are looking towards this presidential change-over as a chance for a 'new start.' A fresh perspective is required. One also hopes, that the principle of, 'The Devil that you Know' versus, 'Out of the Frying Pan and into the Fire' will be far removed thoughts once the new guy settles in to his new role and the concept of a real 'Clouseau' in charge, will never be brought up again.
Ecuador has agreed to grant political asylum to WikiLeaks founder, Julian Assange and there's 'no law in the United Kingdom allowing it to carry out threats to attack Ecuador's embassy in London,' Foreign Minister Ricardo Patino claims. Is this really true? Well, the answer is not quite clear cut. Technically, if push came to shove, the Foreign Office could suspend Ecuadors Embassy's rights to function in the UK. But, would they take such dramatic steps? Most doubtful. International Lawyers could hold that up for years and it may harm the UK's international reputation.
The decision to grant diplomatic protection comes two months after Assange took refuge in Ecuador's London embassy to avoid extradition to Sweden to face questioning for alleged sexual misconduct. Patino says Ecuador found that Assange faces a real threat of political persecution including the threat of extradition to the United States, where Patino said the Australian would not get a fair trial and could face the death penalty.
Ecuador's decision certainly increases tensions between the UK and the South American country, which has been warned the situation could have "serious implications" for diplomatic relations. Ecuadorian Ministers accused the UK of threatening to enter the embassy to seize Assange, after it emerged that a 1987 law could allow the revocation of a building's diplomatic status if the foreign power occupying it "ceases to use land for the purposes of its mission or exclusively for the purposes of a consular post." That would be a technical manouevre in execution - and open to challenge in an International Court.
Escorted into the darkened skys was none other than trusty James Bond, (Daniel Craig) who saw Her Majesty safely to the Olympic Stadium where the latest Bond Girl officially announced the UK's Olympic Games open.
International Olympic Committee President Jacques Rogge praised London as a "diverse, vibrant, cosmopolitan" city and thanked it for hosting the games for a record third time.
The IOC leader made his remarks in a speech to 60,000 spectators and thousands of athletes at Friday's opening ceremony. Rogge continued "a major boost for gender equality" that all 204 participating countries included female competitors for the first time.
The opening ceremony to the Olympic Games was given a resounding thumbs up by the British press who are usually critical on all fronts. But the creative and inovative opening, directed by Britian's home grown Danny Boyle, did not seem to put a foot wrong.
Capturing the hearts and imagination of all children who loved to read, plus introducing all aspects of music across the years and with a historical core showing Britain through its industrial age and including the much loved and yet debated, National Health System.
With touches of good humour thrown in for good measure, Boyle managed to tie, what is intrinsically British about Britain, into a neat little bow.
Queen Elizabeth II did not hint at any suggestion she may return to reprise her role in the forth coming Bond film, 'Skyfall' but there's no doubting, as with Friday evening, if she did, we all would be amused.
Under international law, diplomatic posts are considered the territory of the foreign nation. Short of a war, or a much more serious incident, suspending such status is a risky business for the UK. The Foreign Office said the decision on Mr Assange's application for political asylum would not affect the UK's legal obligation to Sweden. Could the Police, or would the Police, search every diplomatic vehicle leaving the embassy for Assange? They could, but it is most doubtful they would. This will most likely be a drawn out matter and only solved by diplomatic negotiation.
By the share strength of those lungs, Isaac could well be laughing out very loudly, however, no-one else is laughing with him.
Harrowingly poignant as it seems, seven years to the day when his Mother Katrina ripped through the Louisiana city of New Orleans causing utter chaos and devastation, Isaac licks his lips and ploughs his way towards the American coast line with 80 mile an hour winds and heavy rain.
Thousands of people have already fled the rebuilt city not wanting to risk their lives that saw over 1,800 die to the awesome impact of Katrina in 2005 and which caused property damage of over $80billion.
With their new floodgates closed in the hope that this will stop any impact of high waters brought in by sustained winds people who are staying put are laying low.
Caitlin Campbell, a spokeswoman for Plaquemines Parish - where Isaac first touched down - said water was running over an 18-mile (29-km) stretch of the levee and some homes were flooded.
Officials say they are confident that improvements to water defences in New Orleans will prevent a repeat of the 2005 Katrina catastrophe.
However, about 75% of New Orleans residents were without power and there was some minor street flooding, according to emergency officials.
The storm's surge topped a levee in a sparsely populated community south of the city, closer to the mouth of the Mississippi River.
At 8 a.m. ET, the Category 1 hurricane was about 50 miles south-southwest of New Orleans, packing sustained winds of 80 miles an hour after making landfall in Louisiana Tuesday night, the National Weather Service said.
A hurricane warning remained in effect from east of Morgan City in Louisiana to the Mississippi-Alabama border.


What do I need to tell my doctor BEFORE I take Altabax?
If you have an allergy to retapamulin or any other part of Altabax (retapamulin).
Tell your doctor and pharmacist about all of your drugs (prescription or OTC, natural products, vitamins) and health problems. You must check to make sure that it is safe for you to take Altabax (retapamulin) with all of your drugs and health problems. Do not start, stop, or change the dose of any drug without checking with your doctor.
What are some things I need to know or do while I take Altabax?
Tell all of your health care providers that you take Altabax (retapamulin). This includes your doctors, nurses, pharmacists, and dentists.
Tell your doctor if you are pregnant or plan on getting pregnant. You will need to talk about the benefits and risks of using Altabax (retapamulin) while you are pregnant.
How is this medicine (Altabax) best taken?
Use Altabax (retapamulin) as ordered by your doctor. Read all information given to you. Follow all instructions closely.
Do not take Altabax (retapamulin) by mouth. Use on your skin only. Keep out of your mouth and eyes (may burn).
What are some other side effects of Altabax?
How do I store and/or throw out Altabax?
Some drugs may have another patient information leaflet. Check with your pharmacist. If you have any questions about Altabax (retapamulin), please talk with your doctor, nurse, pharmacist, or other health care provider.


Kavanaugh passes, with a condition: The Senate Judiciary Committee voted to send the Brett Kavanaugh nomination to the floor, but Sen. Jeff Flake said he will only support it after a brief FBI investigation.
What comes next? There will be a motion to proceed vote tomorrow, with an agreement for the supplemental background check for no longer than one week. President Trump has ordered the FBI investigation.
Earlier: Democrats, a few Republican governors and the American Bar Association urged the committee to halt the vote until an FBI investigation.
Our live coverage of today's dramatic committee vote has ended, but stick with CNN Politics for more updates on Brett Kavanaugh's confirmation process.
"A thorough FBI investigation is critical to developing all the relevant facts. Dr. Christine Blasey Ford welcomes this step in the process, and appreciates the efforts of Senators Flake, Murkowski, Manchin and Collins -- and all other senators who have supported an FBI investigation -- to ensure it is completed before the Senate votes on Judge Kavanaugh’s nomination. No artificial limits as to time or scope should be imposed on this investigation."
According to the statement, Trump has "ordered the FBI to conduct a supplemental investigation to update Judge Kavanaugh’s file."
"As the Senate has requested, this update must be limited in scope and completed in less than one week," the statement continued.
Key GOP senator: Today was "a good step"
While getting into her car, Sen. Lisa Murkowski of Alaska, a key vote, remarked that Friday had been "a good step."
She had earlier expressed support for Sen. Jeff Flake's proposal for a delay, saying, "I support the FBI having an opportunity to bring some closure to this."
When asked if she would agree to move forward with the final vote if the investigation had not finished, she wouldn't say.
“We’ve asked the FBI to reopen and we’ve put priority on this obviously. And they will move as quickly as they can - and we will move forward from there," Murkowski said.
He said the report will be given to the White House and the committee, but he hasn’t been given any assurances the FBI probe will be done in a week.
“Sure, you bet — that’s why we are doing an extended background investigation,” Flake said when asked if he may change his vote and oppose the nomination depending on what he learns.
Asked if he is prepared to vote to confirm Kavanaugh if probe is not done within a week, Flake replied: “All we can say it has to be done within a week or we move forward."
He said today’s protestors did not change his mind necessarily. He couldn’t “pinpoint” the reason, but he said he had sleepless nights.
Flake also said the FBI will determine what “credible” allegations to probe.
A White House official says President Donald Trump will authorize and order a supplemental FBI background investigation into Brett Kavanaugh.
It was 10 days ago when Trump first told us in the Oval Office that the FBI doesn’t do these types of investigations. Tonight, he will order them to do just that — after a handful of Senate Republicans insisted upon it.
Sen. Ted Cruz, emerging from the meeting in Majority Leader Mitch McConnell’s office, said they will leave it to the FBI to decide which are the “credible” allegations.
When asked directly what the Senate GOP would do if the FBI probe is not completed, Cruz said the conference has agreed to move forward next week.
Earlier we brought you a whip count based on the senators -- Republican and Democrat alike -- who held the keys on moving the Kavanaugh nomination forward.
The 🕵 indicates they support an FBI investigation.


What is the value of this limit?
A well-known physics problem asks whether the weight of an hourglass sitting on a scale would be the same whether all of the sand is at rest, or whether it is flowing. Usually, the answer given is yes, because of the exact balance between the "missing weight" of the sand in free fall, and the force of the sand hitting the bottom.
This well-known physics result is wrong.
The hourglass above has a total mass \(M\), constructed with a constant cross sectional area \(A\) on the top and bottom, and a very thin section connecting them which allows the sand with density \(\rho\) to flow through at a constant rate of mass flow \(q\). The total amount of sand fills the bottom of the hourglass once all the sand has fallen.
What is the weight of the hourglass at steady state when the sand is flowing?
Note: You may assume that the mass of the falling sand at any given time is negligible compared to the masses at rest above and below, and that once the sand lands, it rapidly spreads out onto a flat surface.
3 great circles cut the sphere into at most 8 regions.
What is the greatest number of regions that 30 great circles can cut the sphere into?
Note: A great circle on a sphere is the intersection of a sphere with a plane that contains the sphere's center.
There are 100 people on an island; some people always tell the truth, and the others always lie.
A visitor asks them, "How many of you tell the truth?"
How many of them always tell the truth?


Is BRCA ("Breast Cancer Gene") A Death Sentence?
What we think we know about the BRCA (Breast Cancer Susceptibility Associated) genes causing cancer is patently false, according to a new meta-analysis on the extant literature on the subject of these gene variations on breast cancer survival prognosis.
Angelina Jolie's story in a New York Times Op Ed revealed the celebrity underwent not only a bilateral prophylactic mastectomy about two years ago, but also more recently, a bilateral oophorectomy.


Could someone post an instructable on the proper way to use a bench grinder?
I'm looking to buy a bench grinder soon. I've seen them, touched them, read many an instructable requiring them, etc.
It would be great if someone could post an instructable on proper do's and don'ts as well as the different wheels you can get for them and their specific uses.
I should also explain that I might be getting one secondhand and currently am not certain if i'll the manual will come with it, which is why i'm asking.
A manual probably won't come even with a new one.
so I googled" how to use a bench grinder" for you. read what's there and come back here when you have some specific questions. I could do a couple of pages just on wheel choice alone.
My one tip tonight is to get at least a 3/4 hp motor. anything less won't be powerful for smaller jobs and you'll just end up buying another one later.
I think this is the "safest" way to start..... with goggles and NO GLOVES!
. In addition to Re-design's search, please look through some of the links at bench grinder safety, before using your grinder. I'm sure there is a lot of overlap with the two searches, so this is mainly a reminder to be safe. Grinders can eject objects with deadly force.


Here are a few of the questions that are often asked about the Ouidah Homeless Children's Project.
Is this a fair price for this property?
I wish I could say Yes, but because it's in a small African town where they do not have the same tools and processes for real estate sales, I just cannot tell if the price is fair. My hope, is to travel there with the money and do some research on the ground. Then if the price is too high, I will be in a position to negotiate a better price and use the money saved to buy things like toilets and beds and more. Martine says the price is fair and she owns and lives in the property next door, but I would hope to have more data points than that.
What is APEF and why should they own the property?
APEF is a registered NGO in Benin and has been helping women and children in villages since 2001. I went on a couple village visits personally and it is quite inspiring. APEF has a 6-member board of directors (Martine is the President) and the organization will own the new property. The project will be visited regularly by the Salesian Sisters (an international organization with offices and schools in Benin) who will report back to me to assure the project continues to operate as intended.
What if something goes wrong and the project ends?
This is an issue that has concerned me from the start. However, I think there is no other answer than APEF will sell or control the facility and be subject to the rules governing an NGO in Benin. Martine has been selflessly taking care of these kids for 5 years so I think she is a person who will do the right thing in that situation.
Martine da Souza is the founder and head of APEF, registered local NGO that helps women and children in the villages by teaching them how to avoid child trafficking and HIV, and to know their legal rights in domestic issues. She has also been a licensed guide for almost two decades and speaks five languages. She has translated for many dignitaries in Benin, the U.S., and other countries. She comes from a prominent Ouidah family but has made it on her own. I spent every day in Nov 2013 with Martine and she was honest, knowledgeable, and a pleasure to be around. I trust her completely or I would not be heading this project.
How many children can this project serve?
Martine would like to serve as many children as possible. She is currently serving 8 boys but other homeless children have asked her for help. With 4 large bedrooms, 24 is probably the maximum. She will start 12-16 and see how that goes. Having too many children in the facility is an invitation to problems and demands more supervision.
Martine, her mother, her children, and a local schoolmaster have been supervising the children. Mostly, it's Martine who supervises the kids, and her mother does most of the cooking. So far, cooking, eating, showers, washing clothes, and lessons have taken place at Martine's house, next door to the new property. That will shift to the new property if we can purchase it. With more children and a more complete facility, more supervision will be added.
The property is about 1740 sq ft with a huge fenced and gated yard. It's on a safe, middle class street. The yard will make a fantastic garden. The 4 bedrooms are large and will each have 2-3 bunk beds. There are 2 bathrooms, each with a toilet, sink, and shower. The kitchen and living room are large and open to each other. We'll get 4-5 tables and 20 chairs for eating and hanging out. The kitchen needs to be outfitted. Gas and water need to be hooked up too. Later, the option to add second level will be considered. (The house was prepped for future second level during construction.) Martine and I have detailed architectural drawings for the structure and property. The property is owned by a Frenchman living in Paris who has never occupied the property since purchasing it in 2007.
I met the children in Nov 2013 and they are a delight. They are very considerate and cooperative. It's hard to believe they all lived on the street. They started school this year for the first time. Antoine, the headmaster of a school about 30 minutes away, has been tutoring them for a few years (along with Martine). In their first year, they are at the top of their classes. There is too much to say about these children for this small document.
What happens to my donation if donations fall short of the goal?
If we don't raise enough money to buy the property, the donations will be deposited in Martine's NGO account to be used exclusively for school expenses, food, clothing, medical, and other essentials for the kids. Or possibly, another property or housing opportunity will be found. She is very frugal and resourceful and will use the money wisely. If the kids have to vacate the house, I predict Martine will find some place nearby for the kids to sleep (probably outdoors but better than the alleys) and she will continue to supervise them and take care of their daily needs for as long as she is able. I will also monitor things from afar and interact with the board of directors of her NGO.
For daily updates and a lot more, please "like" our Facebook page and share it with your friends. For more detailed information on the project, read our FAQ.
You can make a donation to the "Ouidah Homless Children Project " via the internet. Click here.


What did Jesus mean when He said that, to be His disciples, we must deny ourselves, take up our cross, and give our lives for Him (Matt. 16:24,25; Mark 8:34,35; Luke 9:23,24)?
In the context of these passages, Jesus had been predicting His death. Peter rebuked Him, and Jesus responded to Peter. Then Jesus made the statements we are discussing. They actually tie back to the points He was discussing before Peter interrupted Him. He had said He must die. Peter had shown a desire to follow his own will regarding this, instead of God's will. So Jesus showed how His death proves we must not follow our own desires, as Peter had just done.
Denying self requires us to give up anything that we would want or seek that would hinder our doing the will of God. This does not mean that, if we want something, it is necessarily wrong. It means we must take our wants and desires down from the throne and place Jesus and His will as the governing power in our lives.
There is room in each life for only one master (Matt. 6:19-24). If God is to rule in our lives, then our will must be made subservient to His. We must be willing to give up anything in life in order to please God. Rom. 12:1,2; Matt. 6:33; Luke 14:25-33; 2 Cor. 5:14,15.
Many think this means bearing burdens and suffering hardships for the Lord. Surely such hardships will at times be required, but there is a fuller meaning if we consider the context.
(1) What is a cross for? It was not just a burden to be borne. Far more than that, it was an instrument of death and total sacrifice. (2) Jesus said take up our cross and follow Him. He bore a cross and we must bear our cross and follow Him. But where was He going with His cross? He had just said He was going to die. (3) In the next verse Jesus said we must give our lives for Him. (4) Then He asked what good our lives would be to us, if we are unacceptable at the judgment.
So, "taking up your cross" refers to giving your whole life to God, as Jesus was about to give His life for us. This involves bearing burdens, but it is deeper than that. It is a total dedication of life. Our whole life is given to His service in anything He says. This will lead us to willingly deny self. Following Him then requires us to live as He lived His life (I Pet. 2:21; Matt. 10:34,35; I Cor. 11:1).
Luke adds "take up your cross daily" (Luke 9:23). There is a sense in which Christians must give their lives to God every day. This is not necessarily a physical death as Jesus died for us (though such might be required), but a daily total sacrifice of self to do the will of Jesus. Whatever He wants with my life is what must be done with it. What I want no longer matters, but I give myself for Him, just as He gave Himself for us despite the fact His human nature did not want to have to do it. Cf. Rom. 12:1,2; Gal. 2:20; I John 3:16-18; Matt. 6:19-33; Gal. 5:24; Rom. 6:6-23; 2 Tim. 2:11; 2 Cor. 4:11; Ecc. 12:13.
The determination to give our lives to God's service is called "repentance." In repenting we determine to turn away from our own will and live our lives to please God. We cannot be saved without this, and that is why repentance is so important in salvation. It also explains why so many people are not truly Jesus' disciples (whether or not they may claim to be His disciples): because they are not willing to make this total sacrifice.
The next verse then helps us understand Jesus' point and strengthens the application. If a person holds his life so dear to himself that he wants to use it to please himself, do his own will, and accomplish his own purposes, rather than denying self and serving God, that person will in the end lose his life eternally. But anyone who loses his life for Jesus' sake - gives it in service and sacrifice to God by denying himself, as described above - such a man will save his life by gaining eternal life.
There can be no greater or clearer teaching anywhere of the meaning of being a disciple. This is how our Master lived, so this is how His disciples must live. We must live lives of complete and total submission to the will of God.
For more information about serving God, please visit our Bible Instruction web site at /instruct/ and study our in-depth articles there about the importance of obedience, the meaning and purpose of life, and how to change yourself.