text:
Justia Patents US Patent Application for DHCP-COMMUNICATIONS MONITORING BY A NETWORK CONTROLLER IN SOFTWARE DEFINED NETWORK ENVIRONMENTS Patent Application (Application #20200366710)
DHCP-COMMUNICATIONS MONITORING BY A NETWORK CONTROLLER IN SOFTWARE DEFINED NETWORK ENVIRONMENTS
Jun 17, 2019 - VMware, Inc.
In an embodiment, a computer-implemented method for DHCP-communications monitoring by a network controller in software defined networks is disclosed. A method comprises detecting that a virtualized compute instance is instantiated on a host computer; generating, and transmitting to a port manager executing on the host computer, instructions to set a BLOCK-EXCEPT-DHCP status on a port assigned to the virtualized compute instance; determining whether an IP address has been assigned to the port by a DHCP service; and if it has: generating, and transmitting to the port manager, instructions to set a NORMAL status on the port; generating, and transmitting to the port manager, a SpoofGuard configured with the IP address assigned to the port; based on notifications received from the SpoofGuard, determining whether the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed; and if it has, transmitting instructions to set the BLOCK-EXCEPT-DHCP status on the port.
Latest VMware, Inc. Patents:
CROSS-CLOUD CONNECTIVITY CHECKS
ADDRESS RESOLUTION HANDLING AT LOGICAL DISTRIBUTED ROUTERS
EXCHANGING RUNTIME STATE INFORMATION BETWEEN DATACENTERS USING A CONTROLLER BRIDGE
DEPLOYMENT AND ISOLATION OF PLUGINS IN A VIRTUALIZED COMPUTING ENVIRONMENT
CLOUD ENVIRONMENT CONFIGURATION BASED ON TASK PARALLELIZATION
Benefit is claimed under 35 U.S.C. 119(a)-(d) to Foreign Application Serial No. PCT/CN2019/086764 filed in China entitled "DHCP-COMMUNICATIONS MONITORING BY A NETWORK CONTROLLER IN SOFTWARE DEFINED NETWORK ENVIRONMENTS", on May 14, 2019 by VMware Information Technology (China) Co., Ltd., which is herein incorporated in its entirety by reference for all purposes.
The Dynamic Host Configuration Protocol ("DHCP") provides an important service to traditional physical networks and virtualized networks. For example, it automatically provides configuration information to hosts implemented in the networks. It may, for example, automatically provide dynamic and reusable network addresses to entities instantiated in the network. Examples of such entities include virtual machines ("VMs").
VMs are virtualized computing instances and may be equipped with their own resources. The VMs may be assigned their own workloads and may be configured to perform the tasks assigned to the workloads. The VMs may be partially configured by users and tenants. For example, a user may assign a static IP address to an interface of a VM. However, if a user configures an IP address on the interface that should have been assigned a dynamic IP address provided by a DHCP service, then the two IP addresses may be in conflict, and subsequently, the VM may become unreachable or compromised.
Furthermore, if a user manually assigns to a VM a particular IP address that otherwise belongs to a pool of dynamic IP addresses maintained by a DHCP service, then the assignment may cause problems. For example, if the DHCP service attempts to assign the particular IP address to another VM, then the two VMs would try to use the same IP address.
Problems may also occur when a user maliciously assigns an illegal IP address (i.e., an address that is not assigned by a DHCP server and is configured by a user without a permission) to a VM and intends to use that address to compromise the VM and intercept, using another VM, the packets intended to the compromised VM. This may result in a security breach of the VMs and the entire network.
Therefore, controlling the assignments of IP addresses to network components needs to be meticulously managed to avoid assignments that are unauthorized and unsupervised.
In an embodiment, an approach for monitoring, by a network controller, DHCP communications exchanged in software defined network ("SDN") environments is presented. The approach allows the network controller, such as an SDN central controller, to snoop the DHCP communications that are transmitted to and from virtualized compute instances, such as VMs and containers, and protect the virtualized compute instances from being compromised.
In an embodiment, to initiate the monitoring of DHCP communications transmitted to and from a VM or a container, an SDN controller relies on notifications and messages received from datapath processes implemented in transport nodes and edge nodes.
Upon detecting that a new VM, or a new container, has been instantiated on a host and assigned a virtual network interface ("VNIC") and a port, an SDN controller may send instructions to a port manager managing the ports to set a BLOCK-EXCEPT-DHCP status on the port. The port manager may be a software-based module executing on a hypervisor of the host that supports the VM. The port manager may be executing in a virtual switch implemented in the hypervisor.
Setting the BLOCK-EXCEPT-DHCP status on the port allows the port to pass through only DHCP-related traffic and block any other traffic. The port manager may be configured to differentiate between the DHCP traffic and the non-DHCP traffic by inspecting, for example, a UDP header of the packets and determining that the packet belongs to the DHCP traffic if the packet includes "67" and "68" (where "67" is for a DHCP client, and "68" is for a DHCP server) as a port identifier in the UDP headers. Hence, even if a malicious user manually configures an unauthorized IP address on an interface of the VM, the traffic that uses that IP address, but that is not DHCP traffic, cannot go through the port and, thus, it will be dropped.
Once the BLOCK-EXCEPT-DHCP status is set on the port, a DHCP client application executing on the VM interacts with a DHCP service to obtain an IP address for the port of the VM.
In an embodiment, the datapath processes monitor all DHCP messages, and report them to the SDN controller. Upon receiving, from the datapath processes, a notification that an IP address has been assigned to the port of the VM, the SDN controller causes the port manager to overwrite the BLOCK-EXCEPT-DHCP status on the port assigned to the VNIC of the VM and set a NORMAL status on the port. This will allow the port to start accepting all traffic and configuration data, including both DHCP traffic and non-DHCP traffic.
Furthermore, the SDN controller may generate a SpoofGuard policy for the port of the VM and transmit the SpoofGuard policy and a SpoofGuard agent to the port manager. The SpoofGuard policy may be specific to the IP address that the DHCP server assigned to the VNIC of the VM.
In an embodiment, a SpoofGuard agent implements a SpoofGuard policy to determine whether the IP address that the VM is using is a legitimate IP address. The SpoofGuard agent may be implemented in a forwarding element of a hypervisor, or in a port manager implemented in a virtual switch of the hypervisor and may be configured to manage the ports of the VM. Examples of SpoofGuards are described in U.S. Pat. No. 9,582,308, entitled "Autodetecting Legitimate IP Addresses Using SpoofGuard Agents."
If the SpoofGuard agent detects that the VM started using an IP address that is different than the IP address that the particular DHCP server assigned to the port of the VM, then the SpoofGuard, or the port manager, may notify the SDN controller that the VM started using an unauthorized IP address. Subsequently, the controller may, for example, request setting the port to the initial BLOCK-EXCEPT-DHCP status and force the VM to request a new IP address from the DHCP server or drop the traffic. The SpoofGuard may also alter that IP address to the IP address that the DHCP server assigned to the VM. If the DHCP server triggers a lease expire event, then the controller, which monitors such events, causes the VM to receive a DHCP NACK message from a DHCP server. The controller may instruct the port manager to set a BLOCK-EXCEPT-DHCP status on the port and force the VM to request and obtain a new IP address, install a SpoofGuard again, and so forth.
In the drawings:
FIG. 1 is a block diagram depicting an example physical implementation view of an example logical network environment for DHCP-communications monitoring by a network controller in software defined networks.
FIG. 2 is a block diagram depicting an example process for DHCP-communications monitoring by a network controller in software defined networks.
FIG. 3 is a time chart depicting an example process for DHCP-communications monitoring by a network controller in software defined networks.
FIG. 4 is a flow chart depicting an example process for DHCP-communications monitoring by a network controller in software defined networks.
In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the method described herein. It will be apparent, however, that the present approach may be practiced without these specific details. In some instances, well-known structures and devices are shown in a block diagram form to avoid unnecessarily obscuring the present approach.
1. Example Physical Implementations
FIG. 1 is a block diagram depicting an example physical implementation view of an example logical network environment for DHCP-communications monitoring by a network controller in software defined networks. In the depicted example, environment 10 includes an SDN controller 20, one or more hosts 110 and 110A, and a physical network 190.
SDN controller 20 is a software application which, when executed, is used to receive configuration files and instructions from a management plane (not shown) and use the received data to control entities configured in the network. While SDN controller 20 is shown as a single application, it should be recognized that it may be implemented with a cluster of controller servers or VMs, or in a distributed fashion.
In an embodiment, SDN controller 20 enables an DHCP snooping mode. The snooping mode allows a datapath process to intercept packets and report the information about the intercepted packets to SDN controller 20. SDN controller 20 parses the information to determine the packets' attributes. The datapath process may intercept, for example, the DHCP discovery requests, offers, IP address requests, and acknowledgments, and monitor the usage of IP addresses assigned to VMs.
Host 110/110A may be any type of computing device configured to receive, process and transmit data. Host 110/110A may include a hypervisor 160/160A, hardware components and other components (not shown). Hardware components may include hardware processors, memory units, data storage units, and physical network interfaces.
Hypervisor 160/160A may be implemented as a software layer that supports execution of multiple virtualized computing instances of VMs. Hypervisor 160/160A may use uplinks (not shown) to provide connectivity to and from physical network 190. Hypervisor 160 may include a virtual switch 140 and may provide connectivity to and from one or more virtual machines, including VMs 120 and 121.
In an embodiment, hypervisor 160 executes a datapath process 150. Datapath process 150 is usually executed on a CPU to implement operations that support environment 10. It may be used to determine the instruction classes and formats, design datapath components and interconnections for the instruction classes or formats and determine the datapath segments.
In an embodiment, host 160A implements an edge node 155. Edge node 155 is a virtualized network component that may be configured to provide various services, such as edge security and gateway services to VMs and hosts. It may be implemented as a separate physical server, or as a virtual machine, as shown in FIG. 1, supported by hypervisor 160A. Edge node 155, in addition to providing logical router and/or service gateway services, and may provide dynamic routing services, firewall services, NAT services, DHCP services, site-to-site VPN services, L2 VPN services, load balancing services, and the like. In an embodiment, edge node 155 may provide a DHCP service 124 and may work in conjunction with datapath process 150A.
Virtual switch 140/140A may be configured to monitor and manage data traffic that is communicated to and from hypervisor 160/160A, respectively. Implementations of virtual switch 140/140A may vary and may depend on a type of product in which the switch is deployed as a virtualization medium. For example, virtual switch 140 may be implemented as part of hypervisor 160, while virtual switch 140A may be implemented as part of edge node 155.
In an embodiment, virtual switch 140 implements a port manger 136, which is described in detail later.
VMs 120 and 121 may be realized as complete computational environments. VMs 120 and 121 may operate as virtual equivalents of hardware and software components of the physical computing systems. Physical resources of host 110 are allocated to VMs 120 and 121 and may be mapped to virtual resources such as virtual CPUs, virtual memory, virtual disks, virtual network interface controllers and the like, which are available to guest operating systems and software applications executing within the VMs. VMs 120 and 121 may connect to virtual switch 140 via virtual network interfaces (VNICs) 130 and 131, respectively, and via virtual switch ports 132 and 133, respectively.
In an embodiment, VM 120/121 executes an DHCP client 122/123. DHCP client 122/123 may be a software implemented module configured to use the DHCP functionalities to obtain configuration parameters such as IP addresses for VM 120 and 121. According to standard DHCP protocol, a DHCP client generates and broadcasts to a DHCP discovery message. In response, the DHCP client receives a unicast DHCP offer. Then, the DHCP client generates and transmits an DHCP request to a selected DHCP service. In response, the DHCP client receives an DHCP acknowledgment with a dynamic IP address. It is also possible to provide a local DHCP proxy at the hypervisor, as described in U.S. Pat. No. 9,548,965 invented by Hua Wang, et al., which is incorporated herein by reference in its entirety.
Physical network 190 may include local area networks and/or wide area networks and may utilize various hardware and software configurations. For example, physical network 190 may include one or more routers (not shown), one or more switches (not shown), and one or more switch ports (not shown).
2. DHCP-Communications Snooping by a Network Controller
In an embodiment, DHCP-communications monitoring is performed by SDN controller 20. To monitor ("snoop") the DHCP-related communications, SDN controller 20 receives notifications from datapath 150 and/or datapath 150A. Datapath 150 is executed on transport host 110, while datapath 150A is executed on edge transport node 155. The datapaths intercept DHCP request, offers, and acknowledgments exchanged between DHCP client 122 and DHCP service 124, and report the intercepted messages to SDN controller 20.
2.1. Setting a Block-Except-DHCP Status on a Port
FIG. 2 is a block diagram depicting an example process for DHCP-communications monitoring by a network controller in software defined networks; FIG. 3 is a time chart depicting an example process for DHCP-communications monitoring by a network controller in software defined networks; and FIG. 4 is a flow chart depicting an example process for DHCP-communications monitoring by a network controller in software defined networks. The process pertains to assigning an IP address to VM 120, and is explained in reference to SDN controller 20, port manager 136, DHCP client 122, DHCP service 124 and datapath 150.
As shown in FIG. 4, in step 402, SDN controller 20 detects that VM 120 is instantiated on host computer 110 and assigned port 132.
In step 404, SDN controller 20 generates and sends instructions (step 1A in FIG. 2 and step 302 in FIG. 3) to port manager 136 executing in hypervisor 160 of host computer 110. The instructions may include a request to set a BLOCK-EXCEPT-DHCP status on port 132 assigned to VM 120. As shown in FIG. 3, SDN controller 20 sends (step 302 in FIG. 3) the instructions with the request to port manager 136.
Setting (step 1B in FIG. 2 and step 304 in FIG. 3) a BLOCK-EXCEPT-DHCP status on port 132 causes port manager 136 to filter the traffic received on port 132 and passing through only the DHCP-related traffic.
In step 406, SDN controller 20 awaits a notification that DHCP service 124 transmitted a DHCP acknowledgement and an IP address to VM 120. The notification may be sent to SDN controller 20 by datapath process 150.
The notification may be sent once DHCP client 122 and DHCP service 124 successfully exchange (step 2A of FIG. 2 and steps 306-312 in FIG. 3), a discovery request, an offer, a request, and an acknowledgment, and once datapath 150A intercepts (step 314 in FIG. 3) and notifies (step 2B in FIG. 2 and step 316 in FIG. 3) that the acknowledgment was sent to DHCP client 122.
SDN controller 20 may parse the notification received from DHCP service 124, determine whether the notification includes the DHCP acknowledgment, and if it does, parse the DHCP acknowledgment to identify an IP address that has been assigned to VM 120.
If, in step 408, SDN controller 20 determines that the notification has been received, then SDN controller 20 proceeds to step 410. Otherwise, SDN controller 20 continues awaiting the notification.
2.2. Setting a Normal Status on a Port
In step 410, SDN controller 20 generates and transmits (step 3A in FIG. 2 and step 318 in FIG. 3) instructions for port manager 136 to set a NORMAL status on port 132. By setting (step 3B in FIG. 2 and step 320 in FIG. 3) the NORMAL status on port 132, port manager 136 overwrites the previously set BLOCK-EXCEPT-DHCP status. Furthermore, by setting the NORMAL status on port 132, port manager 136 enables port 132 to accept all traffic, not just the DHCP-related traffic.
2.3. Installing a Spoofguard
In step 410, SDN controller 20 also generates, and transmits to port manager 136, a SpoofGuard with the IP address that has been assigned to VM 120. A SpoofGuard is a tool that is designed to prevent VMs from sending traffic with the source IP addresses that are not authorized to the VMs. The SpoofGuard can be configured at the port manager or the switch level and may help preventing malicious attacks such as web spoofing and phishing. For example, the SpoofGuard may be configured to detect whether an IP address that VM 120 is using matches the IP address that has been assigned to port 132. If it does not, then the SpoofGuard may prevent VM 120 from accessing any other VM or device in environment 10.
2.4. Snooping
In step 412, SDN controller 20 awaits a notification from datapath 150 (steps 322 and 324 in FIG. 3) that the IP address assigned to VM 120 has expired, or that the IP address assigned to VM 120 has been misused, or that the IP address assigned to VM 120 has been spoofed. An IP address lease expiration is usually triggered by DHCP service 124 internally. For example: if VM 120 is shutting down, then VM 120 does not need the IP address until VM 120 recovers. One way for DHCP service 124 to detect that VM 120 is shutting down is to monitor receiving an IP address RENEW request to renew the IP address assigned to VM 120. If DHCP service 124 does not receive such a request during a certain time period, then DHCP service 124 may assume that VM 120 does not need the IP address, and conclude that VM 120 is shutting down.
If any notification of the lease expiration, misuse or spoofing is received in step 414, then SDN controller 20 proceeds to step 404; otherwise, SDN controller 20 keeps awaiting such a notification. Meanwhile, SDN controller 20 may perform the above process for another VM or device.
The above process may be repeated for each newly instantiated VM and/or each time SDN controller 20 receives an indication that any of the IP addresses assigned to VMs has been spoofed or misused.
2.5. Preventing Spoofing on a Virtual Switch
In an embodiment, after synchronizing with an infrastructure management server (such as VMware vCenter®) (not shown) SDN controller 20 collects the IP addresses of all guest VMs that are provided by in-guest agents executing on the VMs. However, SDN controller 20 is configured not to trust the IP address provided by the VMs. Therefore, SDN controller 20 relies on the SpoofGuards executing on the hypervisor to determine whether any of the IP addresses provided by the VM-tools executing on the VMs has been compromised. If a VM has been compromised, then the IP address that the VM-tools executing on the VM provided to SDN controller 20 can be spoofed, and thus malicious transmissions can bypass the firewall policies.
In an embodiment, a SpoofGuard allows authorizing the IP addresses reported by VM-based tools and alter them if necessary to prevent spoofing. The SpoofGuard inherently trusts the MAC addresses of VMs as those are collected from primary configuration files and vSphere software development kit; however, it does snoop the usage of IP addresses by the VMs.
3. Improvements Provided by Certain Embodiments
In an embodiment, an approach for DHCP-communications snooping by a network controller in SDN environments provides mechanisms for automatic network access control. It allows detecting and preventing conflicts in IP address assignments that might be caused by misconfiguration of interfaces of virtualized compute instances, such as VMs and containers. Furthermore, the approach allows improving network security and detection of IP address misuse. Moreover, the approach allows detecting attempts to compromise the VMs and containers and traffic security virtual networks.
4. Implementation Mechanisms
The present approach may be implemented using a computing system comprising one or more processors and memory. The one or more processors and memory may be provided by one or more hardware machines. A hardware machine includes a communications bus or other communication mechanisms for addressing main memory and for transferring data between and among the various components of hardware machine. The hardware machine also includes one or more processors coupled with the bus for processing information. The processor may be a microprocessor, a system on a chip (SoC), or other type of hardware processor.
Main memory may be a random-access memory (RAM) or other dynamic storage device. It may be coupled to a communications bus and used for storing information and software instructions to be executed by a processor. Main memory may also be used for storing temporary variables or other intermediate information during execution of software instructions to be executed by one or more processors.
5. General Considerations
Although some of various drawings may illustrate a number of logical stages in a particular order, stages that are not order dependent may be reordered and other stages may be combined or broken out. While some reordering or other groupings may be specifically mentioned, others will be obvious to those of ordinary skill in the art, so the ordering and groupings presented herein are not an exhaustive list of alternatives. Moreover, it should be recognized that the stages could be implemented in hardware, firmware, software or any combination thereof.
The foregoing description, for purpose of explanation, has been described regarding specific embodiments. However, the illustrative embodiments above are not intended to be exhaustive or to limit the scope of the claims to the precise forms disclosed. Many modifications and variations are possible in view of the above teachings. The embodiments were chosen to best explain the principles underlying the claims and their practical applications, to thereby enable others skilled in the art to best use the embodiments with various modifications as are suited to the uses contemplated.
Any definitions set forth herein for terms contained in the claims may govern the meaning of such terms as used in the claims. No limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of the claim in any way. The specification and drawings are to be regarded in an illustrative rather than a restrictive sense.
1. A computer-implemented method for DHCP-communications monitoring by a network controller in software defined networks, the method comprising:
detecting, by a network controller, that a virtualized compute instance is instantiated on a host computer; wherein the virtualized compute instance is any one of: a virtual machine ("VM") or a container;
generating, by the network controller, and transmitting to a port manager executing on the host computer, instructions to set a BLOCK-EXCEPT-DHCP status on a port assigned to the virtualized compute instance;
determining, whether an IP address has been assigned to the port of the virtualized compute instance by a DHCP service;
in response to determining that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service: generating, and transmitting to the port manager, instructions to set a NORMAL status on the port assigned to the virtualized compute instance; generating, and transmitting to the port manager, a SpoofGuard configured with the IP address assigned to the port of the virtualized compute instance; based on notifications received from the SpoofGuard, determining, by the network controller, whether the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed; and in response to determining that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed, transmitting, to the port manager, instructions to set the BLOCK-EXCEPT-DHCP status on the port assigned to the virtualized compute instance.
2. The computer-implemented method of claim 1, wherein setting the BLOCK-EXCEPT-DHCP status on the port causes the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
3. The computer-implemented method of claim 1, wherein setting the NORMAL status on the port causes the port manager of the port to allow all traffic to and from the port.
4. The computer-implemented method of claim 1, wherein determining, whether the IP address has been assigned to the port of the virtualized compute instance by the DHCP service includes receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
5. The computer-implemented method of claim 1, wherein assigning the IP address to the port of the virtualized compute instance by the DHCP service comprises: transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
6. The computer-implemented method of claim 1, wherein determining, by the network controller, whether the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed comprises determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by the DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.
7. The computer-implemented method of claim 1, wherein transmitting, to the port manager, the SpoofGuard configured with the IP address assigned to the port of the virtualized compute instance causes the port manager to install and configure the SpoofGuard to monitor whether the IP address assigned to the virtualized compute instance is misused or spoofed.
8. One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to perform:
detecting, by a network controller, that a virtualized compute instance is instantiated on a host computer;
generating, by the network controller, and transmitting to a port manager executing on the host computer, instructions to set a BLOCK-EXCEPT-DHCP status on a port assigned to the virtualized compute instance; wherein the virtualized compute instance is any one of: a virtual machine ("VM") or a container;
9. The one or more non-transitory computer-readable storage media of claim 8, wherein setting the BLOCK-EXCEPT-DHCP status on the port causes the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
10. The one or more non-transitory computer-readable storage media of claim 8, wherein setting the NORMAL status on the port causes the port manager of the port to allow all traffic to and from the port.
11. The one or more non-transitory computer-readable storage media of claim 8, wherein determining, whether the IP address has been assigned to the port of the virtualized compute instance by the DHCP service includes receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
12. The one or more non-transitory computer-readable storage media of claim 8, wherein assigning the IP address to the port of the virtualized compute instance by the DHCP service comprises: transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
13. The one or more non-transitory computer-readable storage media of claim 8, wherein determining, by the network controller, whether the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed comprises determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by the DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.
14. The one or more non-transitory computer-readable storage media of claim 8, wherein transmitting, to the port manager, the SpoofGuard configured with the IP address assigned to the port of the virtualized compute instance causes the port manager to install and configure the SpoofGuard to monitor whether the IP address assigned to the virtualized compute instance is misused or spoofed.
15. A network controller configured to implement mechanisms for DHCP-communications monitoring in software defined networks, the network controller comprising:
one or more processors;
one or more memory units; and
one or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by the one or more processors, cause the one or more processors to perform:
16. The network controller of claim 15, storing additional instructions for setting the BLOCK-EXCEPT-DHCP status on the port by causing the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
17. The network controller of claim 15, storing additional instructions for setting the NORMAL status on the port by causing the port manager of the port to allow all traffic to and from the port.
18. The network controller of claim 15, storing additional instructions for determining, whether the IP address has been assigned to the port of the virtualized compute instance by the DHCP service by receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
19. The network controller of claim 15, storing additional instructions for assigning the IP address to the port of the virtualized compute instance by the DHCP service by: transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
20. The network controller of claim 15, storing additional instructions for determining, by the network controller, whether the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed by determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by the DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.
Applicant: VMware, Inc. (Palo Alto, CA)
Inventors: Ye Luo (Beijing), Qi Wu (Beijing), Donghai Han (Beijing)
International Classification: H04L 29/06 (20060101); H04L 29/12 (20060101); G06F 9/455 (20060101);


text:
TWO IN SAN FRANCISCO-DREAM OF THE RED CHAMBER AND ANDREA CHENIER
On September 13th and 14th, 2016, we attended two very different operas in San Francisco, one a word premiere, Bright Sheng's Dream of the Red Chamber, and the other Umberto Giordano's Andrea Chenier, first performed at La Scala in 1896, once a common repertory piece, but now staged less often. Here are my comments:
Dream of the Red Chamber. Dream of the Red Chamber is an operatic adaption of a classic, 2500 page Chinese novel, written in 1754, but not published until 1791. (I read parts of it in college in a History of China class). The task of boiling this novel, with 400 characters, down to a libretto for a two-and-one-half hour opera fell to librettist David Henry Hwang, assisted by the composer, best known for his play, M. Butterfly. He did so by concentrating on the central story of a love triangle involving Bao Yu, the scion of a distinguished, but heavily indebted family, his soul mate (literally, they were once a stone and flower in love in heaven), Dai Yu, and Bao Chai, a cultured and wealthy young woman, whom Bao Yu is tricked into marrying. Other characters of importance include a grandmother, an aunt, and a sister, whose relationship as concubine to the Emperor has kept the family from falling into disfavor. An actor portrays a monk, who in the prologue in heaven, futilely warns the stone and flower not to seek earthly love and serves as narrator, an awkward, if perhaps necessary device,
The good news about this opera is that it was beautifully staged and sung. The production, by designer Tim Yip was exquisite, everything you would want in an opera set in 18th Century China. The singing was superb. I was especially impressed by Chinese tenor Yijie Shi, who possesses a beautiful, plangent, high tenor voice. I hope I to see more of him. Additionally, Korean soprano Pureum Jo sang beautifully and sensitively as Dai Yu, and mezzo-soprano Irene Roberts was an excellent Bao Chai.
On the other hand, I was not impressed by the opera as whole, one, because the story was slow moving, especially in the First Act, and two, because the music, although orchestrally interesting as conducted by George Manahan, did not move me. Yes, as noted in the pre-opera lecture, Sheng provided a lot of high notes, but the music lacked passion and sounded like good background music to a film rather than an opera score. The San Francisco Symphony will be presenting Sheng's Dream of the Red Chamber Overture on September 28, 2016, and perhaps the music will work better in that format.
Andrea Chenier. Umberto Giordano's fictionalized tale of the unfortunate French poet, André Chenier, who was guillotined only three days before his nemesis Robespierre met the same fate, is a mixed bag of some relatively uninspired stretches, followed by really knock-out moments, particularly arias for the main characters. To be effective, it needs top notch singers, and especially a tenor who can pull off heavy dramatic, Italianate singing without strain This probably explains why it has come close to dropping out of the standard repertory. In fact, it was last staged in San Diego in September 1981 with the not-so-great Carlo Bini in the title role.
I would say the San Francisco production, directed by David McVicar, was a partial success. The sets and costumes were beautiful and traditional, which is fine with me. However given that it is a recent co-production with Royal Opera Covent Garden, one would think that with modern stage equipment they could have figured out a way to avoid two long curtain-down set changes between the First and Second Act and the Third and Fourth Act.
The other drawback was the conducting of Maestro Nicolà Luisotti, which tended to overwhelm the singers despite their large voices. I am informed that this may partially be result of where we sat, Orchestra, Row M, 109-111, slightly to the left of center, but I heard another person at intermission also complain about the seemingly overly loud conducting, although I do not know where he sat.
Korean tenor, Yonghoon Lee, who impressed in the Met HD broadcast of Il trovatore, possesses a huge voice, and even with its baritonal character, the voice had no trouble with ringing high notes. His "Improviso" and especially "Come un bel dì di maggio," were excellent. Occasionally, in fact, he seemed to have some problems with producing low notes, although that may partially be the result of the overly loud orchestra. One review I read severely criticized his acting on opening night, but he clearly had improved for this performance, although still a bit wooden. Italian soprano Anna Pirozzi sang well enough even though the start of the opera was delayed due to her falling ill that day. She did seem to be holding back prior to intermission, but got through "La mamma morta" in the Third Act without problems, but also without Callas-like emotion. (We all remember Tom Hank's reaction to the Callas recording in Philadelphia, and it is hard to put it out of one's mind.). Georgian baritone George Gagnidze sang an excellent Carlo Gerard, and his performance of "Nemico della patria" was one of the highlights of the evening. It brought back memories to me of a baritone singing this aria on Johnny Carson with Carson remarking that Andrea Chenier was his favorite opera.
Whatever the problems with this production, it was on the whole, satisfying and I was grateful to be able to attend. The program notes, by the way, were excellent, discussing the performance history of the opera, its highlights and its flaws, a good summary of the French Revolution, a short biography of André Chenier and defintions of the many revolutionary terms found in the opera.
Posted at 09:11 PM in Music | Permalink | Comments (0)

redpajama_set_name: RedPajamaCommonCrawl


text:
Il Colli del Trasimeno Grechetto è un vino DOC la cui produzione è consentita nella provincia di Perugia.

Caratteristiche organolettiche
colore: giallo paglierino più o meno intenso fino al dorato
odore: leggermente vinoso, delicato caratteristico
sapore: secco o leggermente abboccato, vellutato, retrogusto lievemente amarognolo, fruttato, caratteristico, armonico

Storia

Abbinamenti consigliati

Produzione
Provincia, stagione, volume in ettolitri
 nessun dato disponibile

Vini DOC della provincia di Perugia
Vini DOC e DOCG prodotti con uva Grechetto

redpajama_set_name: RedPajamaWikipedia


Chris Ikonomidis scored in the fifth minute of stoppage time to lift Perth Glory to a thrilling 3-2 win over Central Coast at nib Stadium on Sunday.
MARINERS boss Phil Moss insists the Central Coast's famed production line of young talent has left his squad stronger than a year ago.
HIS team side-stepped an FFA Cup banana skin, but Mariners boss Phil Moss has reminded them that anything below "the highest standards" won't be tolerated.
CENTRAL Coast Mariners have re-signed coach Phil Moss until 2017 and will play Brisbane Roar as preparation for the upcoming A-League season.
A-LEAGUE club the Mariners have stressed they have no intention to move their base from NSW's Central Coast to Wollongong or any other area.
RENEWED calls for a South Coast-based A-League team are likely to fall on deaf ears, with FFA saying no expansion will be considered until at least 2017.
MARINERS boss Phil Moss will make the latest possible decision on whether to deploy his two new imports in the FFA Cup against South Coast Wolves.
THE future of the Mariners remains shrouded in confusion, despite owner Mike Charlesworth claiming he does not want to sell his majority stake.
MARINERS owner Mike Charlesworth insists he has no intention of selling despite seeking fresh investment in the club and its centre of excellence.
WANT-away midfielder Michael McGlinchey's contract saga has exposed an ownership debacle at the Central Coast Mariners.
STAY up to date with all the player movement this off-season with our club-by-club rolling A-League Transfer Centre.
IT was off the pitch and into the kitchen for Mariners midfielder Glen Trifiro, who, along with teammates, left his comfort zone for the day.
MICHAEL McGlinchey's hopes of playing against EPL sides West Ham and Newcastle have suffered a blow after his contract dispute entered arbitration.
THE Professional Footballers Association has thrown its support behind in-limbo midfielder Michael McGlinchey involved in two-club tug of war.
AS we sit basking in the warm glow of the A-League grand final, it's important to remember Australian football still has some way to travel.
THE A-LEAGUE has been run and won, and it's time to hand out our season awards - from player of year to best young Aussie and Socceroos bolter.


text:
print "Hello World!"
print 1000

redpajama_set_name: RedPajamaGithub


A color based on the exceptional climatic and soil characteristics of the Champagne area: a calcareous soil with a cool climate, but protected against severe cold and humidity regulation by forests and the river Marne. The color Champagne was created by applying light colored oil on the wood floor. Our custom made light brown wood floors are produced according to a traditional recipe. The pictures show an oak floor, available as a solid wood floor or an engineered wood floor.
Floors in this color are available in widths from 8 to 38 cm. This beautiful wooden floor is produced in the Netherlands and are available in sizes of your choice. Floorboards can be shipped worldwide. Read more about the cost of wood flooring.


After the upgrade to HighSierra, my mac has been running very sluggish and stuttering at times. There is little CPU usage and randomly in any application I'm in, the mac will lock up for a few seconds. It comes in about 1-5 minute intervals and doesn't seem to be apparent to task switching. I've tried resetting the NVRAM and SMC as well as doing a normal cleanup. I can't seem to find out what the issue is which is left me through system logs to find fixes. Does anyone know what causes the authd process to have error -67050?
Browse other questions tagged high-sierra error .


text:
Show Related Q&As Veterinary Assistant Courses and Colleges Veterinary Pathologist Education and Career Facts Veterinary Technologist Jobs: Salary and Career Facts How to Become a Veterinary Technician in 5 Steps
Which Schools Offer...
Medical and Health...
Colleges By State and...
Which Schools Offer Veterinary Science Programs Near Portland, OR?
Find programs in Portland, Oregon, offering veterinary science classes. Learn about prerequisites, tuition rates, field of study options, and other school and program information. Schools offering Animal Care degrees can also be found in these popular choices.
Do you want to find out more about the undergraduate and graduate degree program in the field of veterinary science that can be found in the Portland, OR, area? Here you can read about the two schools and the programs that they offer.
There are two programs near Portland that lead to awards in veterinary medicine: an associate's degree in veterinary technology and an accredit doctorate in veterinary medicine. The first program is designed for individuals who want to work as vet techs. It takes two years to complete and includes a wide range of veterinary skills such as animal pharmacology, anesthesiology, diagnostic medicine, and nursing and restraint. The doctoral program will prepare you to become a veterinarian. Students must meet course prerequisites prior to admission in a variety of science subjects; although no pre-professional programs in vet medicine are offered in the immediate Portland area, such programs do exist and can serve to properly prepare students for their doctoral education. Classes includes in the DVM program range from courses on the general anatomy of animals to surgical techniques and include clinical practice opportunities in the final year.
Associate's Degree Programs in Veterinary Medicine Near Portland, Oregon
Portland Community College is the local community college for the metropolitan Portland region. It offers an associate's degree program that can prepare you to work as a veterinary technician or technologist. You will learn how to perform diagnostic examinations on animals with the help of equipment. The 7-term curriculum offers clinical insight on fields such as pharmacology, anesthesiology, and radiography. Courses in the program include animal nursing and restraint, comparative veterinary anatomy, veterinary microbiology, public health, and animal nutrition.
Program Name: Associate of Applied Science in Veterinary Technology
Tuition and Fees: $4,552 per year (in-state 2019-2020); $9,495 per year (out-of-state 2019-2020)
Admission Requirements: Preferred candidates with veterinary experience, a recommendation from a veterinarian, interview, completed prerequisite courses
School Type: 2-year, public; 27,046 students (all undergraduates)
Doctor of Veterinary Medicine Programs Near Portland, Oregon
Oregon State University in Corvallis
Oregon State University's College of Veterinary Medicine is the state's veterinarian college and is accredited by the American Veterinary Medical Association. The D.V.M. program is split between two concentrations: the biomedical sciences and the clinical sciences. The biomedical sciences program relates to veterinarian work that controls infectious diseases and studies the anatomy of animals. The clinical sciences concentration is focused on internal medicine practices, like cardiology and diagnostic imaging.
The 4-year curriculum at the College of Veterinary Medicine begins with a doctor orientation and courses on the general anatomy of animals. Courses in the first year stress gross and microscopic anatomy as well as neuroscience, physiology and immunology in animals. The second year of the curriculum stresses pathology, pharmacology, and the control of diseases and bacteria. You are also expected to take courses in public health related to animals and veterinary ethics. The third year of the curriculum reviews surgical techniques, and you can focus your care on large animals or small animals. The fourth year of the curriculum includes several clinical practice courses and how to provide primary or emergency care to an animal.
Program Name: Doctor of Veterinary Medicine
Field of Study Options: Biomedical Sciences, Clinical Sciences
Tuition and Fees: $14,331 per year (in-state 2018-2019); $25,563 per year (out-of-state 2018-2019)
Prerequisites: Completion of three general education requirements and nine science courses ranging from biology to genetics
School Type: 4-year, public; 30,986 students (25,699 undergraduates)
Students near Portland, OR, can receive their Associate of Applied Science in Veterinary Technology from Portland Community College, or their Doctor of Veterinary Medicine from Oregon State University.
To continue researching, browse degree options below for course curriculum, prerequisites and financial aid information. Or, learn more about the subject by reading the related articles below:
1. Degree Options:
View All Degree Options
2. More Articles
Veterinary Science Degree Programs
What Are Veterinary Studies?
Which Minneapolis Universities Have Veterinary Science Degree Programs?
Southern New Hampshire University responds quickly to information requests through this website.
Popular programs at Southern New Hampshire University:
Purdue University Global responds quickly to information requests through this website.
Popular programs at Purdue University Global:
Penn Foster
Penn Foster responds quickly to information requests through this website.
Popular programs at Penn Foster:
Career Diploma: Veterinary Assistant
Herzing University responds quickly to information requests through this website.
Popular programs at Herzing University:
Master - Business Administration Dual Concentration: Healthcare Mgmt & Public Safety Leadership
Master - Business Administration Dual Concentration: Healthcare Mgmt & Project Mgmt
Penn Foster High School responds quickly to information requests through this website.
Popular programs at Penn Foster High School:
Keiser University responds quickly to information requests through this website.
Popular programs at Keiser University:
Associate of Sciences - Medical Assistant
Campus Locations:
New York: Ithaca
Florida: Gainesville
Georgia: Athens
Select a Specific Subject Alternative Medical Treatments Bio and Medical Ethics Chiropractic Treatments Clinical Nutritional Services Dental Health and Fitness Education Health and Medical Services Preparatory Health Diagnostic and Treatment Services Medical and Health Administration Medical Assisting Services Medical Informatics Medical Laboratory Professions Medical Residency Training Mental Health Professions Nursing Services Ophthalmic and Optometric Support Professions Osteopathy - DO Pharmaceutical Administration Podiatric Medicine Public Safety and Health Rehabilitation Therapy Speech Pathology and Communication Disorders Therapeutic Bodywork Services Veterinary Sciences and Medicine
Select a Very Specific Subject Animal Laboratory Medicine Large Animal Medicine and Surgery Veterinary Anatomical Sciences Veterinary Biomedical Studies Veterinary Clinical Sciences Veterinary Diseases Veterinary Immunobiology and Microbiology Veterinary Medicine, DVM Veterinary Pathobiology and Pathology Veterinary Pharmacology and Toxicology Veterinary Physiology Veterinary Public Health
3. Penn Foster
Select One... Below 8th Grade 8th Grade 9th Grade 10th Grade 11th Grade High School Diploma/GED Associate's Degree Bachelor's Degree Master's Degree PhD
4. Herzing University
6. Keiser University
7. Cornell University
8. University of Florida
According to the BLS.gov
What Can I Do with an Associate's Degree in Veterinary Medicine? Veterinary technician is the most common job for people with an associate's degree in veterinary...
What are the Average Salaries for Veterinary Assistants? Are you looking to turn your love of animals into a career? As a veterinary assistant, you will...
What Training is Required for Veterinary Assistants? Training required to become a veterinary assistant varies by employer. Some employers require...
What's the Job Description of a Veterinary Technician? Veterinary technicians assist veterinarians in the care and treatment of animals. Learn about the...
How to Become a Veterinary Assistant: Education & Qualifications Veterinary assistants work with veterinarians to treat and care for animals of all different...
What is a Registered Veterinary Technician? A registered veterinary technician (RVT) is a state-credentialed animal healthcare professional,...
Veterinary Assistant Courses and Colleges
Veterinary Pathologist Education and Career Facts
Veterinary Technologist Jobs: Salary and Career Facts
How to Become a Veterinary Technician in 5 Steps
How to Become a Veterinary Oncology Technician in 5 Steps
Veterinary Technician: Job Duties, Career Outlook, and Educational Requirements
Veterinary Science Degree Options - Video
Bachelor's Degrees in Applied Science - Video
Specialized Degree Programs
Health Professions and Medical Services
Veterinary Sciences and Medicine
Animal Laboratory Medicine
Large Animal Medicine and Surgery
Veterinary Anatomical Sciences
Veterinary Biomedical Studies
Veterinary Diseases Training
Veterinary Immunobiology and Microbiology
Veterinary Medicine, DVM
Veterinary Pathobiology and Pathology
Veterinary Physiology Classes
Veterinary Public Health Degrees
What is a Business Education Instructor?
List of MBA Programs by GMAT Score Requirement
Schools with Pediatric Radiology Programs
Schools for Executive Assistants
Careers in Personal Training
Steps to Become a Music Teacher in California
Pastry Supervisor: Career and Salary Facts
Federal Agency Educational Resources: Department of Transportation
Romanian Language Course and Degree Programs
How Can I Become a School Administrator?
Where in Wyoming Can I Earn a Degree in Healthcare Administration?
Subscribe to RSS feed for Medical and Health Degrees in Oregon


text:
Home >> A News >> NYC Mayor Announces Deal with Teachers' Union
NYC Mayor Announces Deal with Teachers' Union
On May 1, 2014, New York City Mayor Bill de Blasio announced a deal with the city's largest teachers' union, raising wages by 18 percent over a nine-year period, according to an article in The New York Times. The deal would be in exchange for a $1.3 billion reduction in health care costs. The agreement includes $3.4 billion in back pay and must be ratified by the union's 100,000 members.
The deal ended a five-year stalemate, which was set by de Blasio's predecessor, Michael Bloomberg, who urged pay freezes and other measures.
The Times reported that Mayor de Blasio stood next to the union's president, Michael Mulgrew, while unveiling the plan.
"This is a mayor who actually respects the workforce," said Mulgrew in the article.
Article by Kassondra Granata, EducationWorld Contributor


The Bug Guy is Michael J. Raupp, Ph.D., Professor of Entomology and Extension Specialist at The University of Maryland.
The Bug Guy is Michael J. Raupp, Ph.D., Professor of Entomology and Extension Specialist at The University of Maryland. He has written Bug of the Week for over ten years, and is a frequent guest bug expert for Good Morning America, NPR, and other news outlets. He has appeared on BBC, CNN, National Geographic Ultimate Explorer, The Dr. Oz Show, Tyra Banks, and The Tonight Show with Jay Leno, among others.
All photographs and videos on Bug of the Week are copyright Michael J. Raupp unless otherwise noted.
Get Ready. The Invasive Species are Coming.
Take a lyrical journey through the alphabet with Mantie!
In this one-of-a-kind ABC, Mantie the Mantid introduces children to twenty-six of her colorful friends – who enjoy buzzing, crawling, flying, glowing, and eating creepy things for lunch! Distinguished entomologist Mike Raupp pairs charming verses with close-up color photographs of bugs from A to Z, and drawings by Jeff Kollins. For children five through eight.
Managing Insects and Mites on Woody Plants: An IPM Approach by John A. Davidson, Ph.D., and Michael J. Raupp, Ph.D.
Includes 240 color photos! Wire-bound, 198 pgs.


LONDON – September 3, 2015 – 4C, a data science company that is powering the future of advertising, today announced that its recently acquired Teletrax technology has been recognized as the best Video Advertising Platform by Streaming Media Europe readers.
Teletrax was acquired by 4C from Civolution in July 2015. Teletrax' technology complements the 4C offering by adding additional data sources and functionality for real-time TV analytics, including monitoring over 2,100 channels across 76 countries for both program content and advertisements. In addition, Teletrax offers TV synced ads, which identifies commercials within three seconds of broadcast and triggers digital campaigns for synchronization and/or competitive response. These ads can be delivered through social, video, display, and search channels across mobile, desktop, and television devices for truly integrated marketing.
By combining data from social media, set-top boxes, ad scheduling, and TV ad monitoring, 4C can now address millions of households globally and provide innovative solutions for TV and social media analytics and activation. 4C's products are used by leading advertisers, agencies, media companies, and content owners to deliver insights and improve sales and marketing efforts.
4C is powering the future of advertising with software that improves media planning, measurement, and buying. A data science company, 4C provides brands, agencies, networks, and operators with the world's most comprehensive platform for social and television advertising. 4C's products are built on more than 30 years of computational science research by Founder and Chief Scientist, Dr. Alok Choudhary, at prestigious institutions including Northwestern University. Its patented solutions also leverage hardware and intellectual property acquired through Civolution and Royal Philips Electronics. The value is increased marketing effectiveness and efficiency across channels and screens. 4C created the first platform to enable advertising across Facebook, Twitter, LinkedIn, Pinterest, and Instagram through certified API access. 4C also operates Teletrax, the largest global TV monitoring network covering more than 2,100 channels in 76 countries. The company has staff in Atlanta, Chicago, Eindhoven, Hong Kong, Geneva, Los Angeles, London, Munich, New York, Portland, Pune, San Francisco, Seattle, Singapore, and Tampa. Visit www.4Cinsights.com for more information.


Our installation is second to none.
Whether you wish to install a pre-finished hardwood floor, waterproof floor, or a unfinished hardwood floor, we are committed to providing you with only the highest quality craftsmanship & materials.
Our uniformed NWFA Certified Craftsmen not only provide you with unparalleled attention to detail but also use quality materials in the process.
Arrange a time if you would like to stop by our showroom to look at various samples and designs we offer. You'll receive personalized attention in a relaxed atmosphere with no high pressure sales to contend with, or call us today at 209.366.0664 to schedule your free in home estimate.
See why so many families have chosen Raphael Hardwood Flooring to install their hardwood flooring.
Wood floor sanding and refinishing is an art.
It takes time to develop the right touch to be able to perfectly restore a wooden floor. At Raphael Hardwood Flooring our professionally trained craftsmen will take your tired looking floor and bring it back to its original beauty and luster.
Using only the latest technology of equipment and protective finishes available your floors will once again become the focal point of your home.
Complimenting the process of refinishing your wood floors, Raphael Hardwood Flooring utilizes a patented Dust Containment System which dramatically reduces airborne dust from migrating throughout your home as is the case with conventional floor sanding machines.
The final steps in the refinishing process, is applying stain/color to your floors. You can choose from a traditional natural finish or add a color/stain to enhance your floor. In addition you can select the sheen level to be applied (Satin, Semi-Gloss, or Gloss) to further enhance your floor.
See why Raphael Hardwood Flooring is recognized by many as the valleys premier source for wood floor Sanding & Refinishing.
Raphael Hardwood Flooring, Inc offers professional installation, refinishing and repair of Gym Floors.
Originally founded in 2001 by Joshua Raphael, Raphael Hardwood Flooring Inc. has built a reputation for quality installations and superior service that is unrivaled in the Industry.
With our team of dedicated technicians and knowledgeable support staff, we deliver with pride, on time and on budget. We stand firmly behind our work and our track record proves it!
Our product line includes hardwood gymnasium, aerobic dance floors, banquet halls, stages, & athletic courts.
We perform services such as gymnasium floor refinishing, removal and disposal of old floors, and we offer free consultations.


The Kelowna Yacht Club Sailing School is looking to hire Instructors and Assistant Instructors for the 2019 Summer Cansail Courses. The Kelowna Yacht Club Sailing School is a friendly and professional place to work, whether you have years of experience or are new to the field. The Instructors will report to the Sailing School Manager and work in conjunction with others to create a safe and fun environment while providing quality instruction for the classes. The Instructors will be appropriately rated, licensed and insured to provide instruction and operate all boats required. They will follow all safety procedures and protocol and be willing to learn and adapt on the go. The Instructor will cooperate with the Manager and Head Instructor to facilitate all programs to the best of their abilities. Instructors need to be able to work independently or as a member of a team. Motivated, enthusiastic and ready to take initiative are characteristics we are looking for.
If this sounds like you, please contact us!
Staff training take place on June 30th, full programs run from July 2 – August 30th with minimal classes from August 6-9th.
Classes run between 9:00 am – 4:00 pm with a lunch break. Instructors are required to be at the Kelowna Yacht Club by 8:30 am and leave once all the students have been picked up and daily debrief has concluded. Usually by 4:15 pm.
Starting Wage for Assistant Instructors is $14.00, starting wage for Sailing Instructors is $16.00.


We are close to Christmas Day. And we are given an opportunity each year to review the greatest story ever told. Also, there are leadership lessons that are in this story that are present if you will look for them.
Consider today some leadership lessons from the Wise Men.
Wise leaders keep an eye to the future so don't partner with those who have no vision – They might have been called "wise men" but they sure made some silly mistakes. I could go back in time and speak to them I would ask them a few questions. For instance, I would ask, "If it is you who saw the star, then why did you ask anything from the ones who haven't seen what you have?" Leaders, if the vision is yours, then don't even try asking someone who does not share your vision for their suggestions, advice, opinion or any kinds of thoughts. They are likely to endanger your vision.
Wise leaders keep an eye to the future and have "Super Focus" – These wise men were on a mission to be sure. But they needed more than just a mission. They needed to be, and to stay, super-focused. They lost some of their focus to the more obvious reality, the palace of King Herod. Surely the new King must be living there, right? Nope! You have a star to focus on. Focus on that with singular intensity. They were not called to do the obvious. They were called to follow a star. Let's keep following that star!
So what is the leadership lesson from the Wise Men?
Leaders keep an eye to the future and are not distracted by those without vision. They keep their focus on what lies ahead of them. They also stay focused on something other than their surroundings and the here and now. Distractions abound. And we can be distracted, lose focus, or be fooled by the obvious.
The greatest story ever told can tell us more than just the story of the birth of Jesus Christ. And I guess if you have to focus on that or the leadership lessons, I hope you will focus on the birth of our Lord. But if you will look beyond that story, there are some leadership lessons from the Wise Men.


January 4, 2015 | By thelinuxevangelist | Filed in: Tutorial.
The Linux Tutorial Shows You Visually and Step-by-Step How to Install and Getting-Started with Netbeans 8.x IDE for C and C++ on Lubuntu Linux i386/amd64 Desktop.
The Netbeans 8 IDE C/C++ Require Java JRE/JDK 8+ Working Installation Lubuntu Linux System.
SetUp Oracle Jdk on Lubuntu Linux.
Then Possibly Browse for the JRE/JDK 7/8 Installation location.


text:
HomeResearchResearch ExplorerResearchersProf William Turley
Prof William Turley
A&F Accounting & Finance, Alliance Manchester Business School - Accounting and Finance division
stuart.turley@manchester.ac.uk
Stuart Turley has held a Chair in Accounting at the University of Manchester since 1994. He has held visiting appointments in Sweden, Denmark and Australia. Between 2002 and 2012 he was a member of the Auditing Practices Board (within the Financial reporting Council), which set practice and ethical standards for auditors in the UK and Ireland. He has been a member of the Scientific Committee of the European Auditing Research Network since its inception, serves on the editorial boards of several journals, and was formerly a member of the Research Committee of the Institute of Chartered Accountants in Scotland,
Professor Turley has held senior roles in university mamagement, as Head of the Manchester School of Accounting and Finance (now part of Alliance Manchester Business School), between 1997 and 2001, and Associate Dean for Postgraduate Taught Programmes in the Faculty of Humanities, between 2004 and 2008. He is a past editor of the British Accounting Review and the International Journal of Auditing.
HF5601 Accounting
Exploring Diversity in Sustainability Assurance Practice: Evidence from Assurance Providers in the UK
Big Data and Changes in Audit Technology: Contemplating a research agenda
Accountability in an Independent Regulatory Setting: The Use of Impact Assessment in the Regulation of Financial Reporting in the UK
BIG DATA ANALYTICS AND THE SOCIAL RELEVANCE OF AUDITING: AN EXPLORATORY STUDY
SUSTAINABILITY ASSURANCE IN PRACTICE: EVIDENCE FROM ASSURANCE PROVIDERS IN THE UNITED KINGDOM
Audit Quality in Practice: A Study of Perceptions of Auditors, Audit Committee Members and Quality Inspectors


Lynn Ratcliffe was diagnosed with epilepsy in 1998 following a head injury. Her first seizure alert dog, Dougal retired in late 2014 and two years ago Lynn graduated with a Golden Retriever cross, Simba, as her new seizure alert dog. Lynn explains the impact that Support Dogs has had on her life.
"When my GP suggested it might be epilepsy, I went into denial, it very difficult to accept. The impact of seizures on my everyday life was huge. It affected me and my family quite dramatically, including my two teenage children. I lost my driving licence and the medication I was taking had nasty side effects and never gave me complete control of my seizures. Ultimately I lost my job as an assistant at a nursery, because of my epilepsy, which I found devastating.
What were your expectations when you started the Support Dogs seizure alert programme with Dougal?
I learnt about Support Dogs through a man who had his own seizure alert dog and so I was quite hopeful as I knew the impact it had made to his life. It had been about 10 years since my diagnosis and so I was willing to give anything a try.
The training process is quite intensive and I probably found it harder than I expected. As well as the actual training of how to handle and work with a support dog, there is the writing of regular diaries and reports to complete. I was exhausted after the end of the intensive residential training period.
I learnt to trust Dougie very quickly and one of the most important things to me was regaining my privacy. When I have a seizure in public people are kind and want to help, but often when I woke up from it I'd be very confused. I would have strangers staring at me or talking to me. I may have been taken to A&E or somewhere else to recover so I'd be really disorientated and frustrated.
Dougie gave me a warning that prevented all of this and gave me complete control of my epilepsy.
However it took my family longer to get used to Dougie and feel confident that his alerts were 100% reliable. It took them a while before they knew that I was safe cooking, having a bath or crossing the road on my own.
As Dougal reached retirement, did you have any worries?
Dougie sadly had to retire at quite short notice. As he grew older he had become less confident around other dogs, especially after a couple of incidents of being attacked by dogs in a local park. This sadly meant that if I were to have another support dog, for his own quality of life Dougie would need to be rehomed.
As Dougie reached retirement, I felt very anxious about the future. Firstly I was worried about Dougie, who I loved enormously. I was also then worried about the impact on my family and of course my own safety; what if after Dougie retired and another suitable seizure alert dog could not be found? Support Dogs were wonderfully supportive through this whole process. They found a great home with a lovely couple who I am in regular contact with. However during the transition period, with Dougie retiring a fairly short notice, I was effectively without a seizure alert dog for 5 months until Simba began training with me in spring 2015.
I found this five month period even harder than the 10 years I had living with epilepsy before having a support dog. Through having Dougie for seven years I had been able to enjoy a safe, independent life, where I had 100% reliable advance warning of all my seizures and was able to take control and have them in private.
Suddenly I was back to having to rely on the support and help of others, not knowing when or where a seizure may happen. I relied on family and friends, without a seizure alert dog I couldn't cook and my family became very anxious if I suggested leaving the house on my own, because of the risks involved. My mood deteriorated during this period as my privacy and quality of life became more restricted. This resulted in me becoming more stressed and in turn lead to me having even more frequent seizures.
I have four grandchildren and, thanks to Support Dogs, they have never seen me have a seizure. During the five months without a support dog, I couldn't really be left alone with them, especially the younger ones, in case I had a seizure.
How has your partnership with Simba progressed? What has been the impact?
Simba was alerting very early on in the training which was great. He gives me 100 % reliable 24 minute warning in advanced of all my seizures.
He has a different personality to Dougie and needs handling differently to Dougie in different situations. When I first had Dougie it took a few months for me to fully get to know him, bond with him and truly love him. It was exactly the same with Simba.
I now adore Simba as equally as much as I love Dougie. He is amazing at his job and has truly given me my life back. Having a seizure alert dog doesn't just mean independence, privacy and assurance for me, it has an life changing impact on all my family.


I don't think my son likes cheese. Which really begs the question: is he even my child? I'm almost five months in to a dairy-free diet because I'm breastfeeding my daughter and I'm not going to lie… I live a little dangerously and have cheese from time to time because cheese is amazing. (Before you judge please know that I am dairy free due to an abundance of caution because my son had the allergy and outgrew it. My daughter has never had any of the definitive signs of a dairy allergy, she just poops a lot when I have a lot of dairy).
I have tried everything to get him to like cheese. I've offered it in all forms, on all things, all of the times. Sometimes he nibbles on the cheese squares that come in the Lunchable package. So he sorta likes bad, cheap cheese. Sometimes he will poke his mac and cheese with his fork like a woodpecker pecks at a tree. But not even a pretend airplane will make it go in his mouth.
Friday he had pizza for lunch. He cried and said he wanted bread. I told him pizza is bread with cheese and tomato sauce. I offered to take the cheese off of it. He surprised me by trying it cheeseless. He looked at the remaining sauce and said, "That's peanut butter!" I explained to him that it's not, that it's tomato sauce but he would't hear it. I make a point to be honest with him about what he is eating… but I tried and he insisted that it was peanut butter. He was eating it so if that's the lie he needed to tell himself to eat then cool!
Today, however, he refused to even be at the same table with the pizza. "I don't like pizza! It's yucky! I wanna throw it in the trash!" Pretty weird coming from a kid who ate pizza two days prior thinking it had peanut butter on it, but okay.
Kids do what they want. They hear what they want. They believe what they want. They eat what they want (kinda). And loving cheese is not a genetic trait, apparently.
Making dinner a fun experience is a tried and true way of making any kid relax and hopefully eat at meal time. Recently we tried the Dinner Winner Plate to try to make eating dinner a literal game.
Overall, the concept is really cute. The plate is designed to look like a board game. Each square has encouraging phrases to get your kid to try whatever food is in that square. Once your child eats his way to the last square they get a treat! They come in a few different designs, the one we got was the dinosaur print.
My son is three, so he was very into the design. I make sure he had some things on the plate that he would like. He didn't really follow the order of the squares, he just went right to the things he knew he liked. I had talked up him getting a treat if he ate everything, so when he ate what he wanted he said, "all done!" and then wanted the treat. I'm not sure if I should have not mentioned the treat or not. When I explained that he only gets the treat if he eats everything he got pretttttty mad. I got him to eat all but 2 of the squares, though he did nibble on some of the cheese. I did withhold the intended treat since he didn't eat everything, but since he did do pretty well I gave him a veggie pouch and told him it was his treat. It was actually just in the last square before the actual treat and he had no idea.
I'm hoping that if we keep using Dinner Winner Plate that my son will start to see how fun eating can be and eat more of what is on the plate. I highly recommend it to parents who are dealing with a picky eater. Making eating a game is a great way to get them interested.
Yesterday was my son's third birthday! Planning a birthday party is stressful and, as we are now juggling two kids this year since our new addition in December, my budget and energy for this party were pretty limited.
This year his language developed enough where he was able to understand what his birthday meant enough to know he wanted a Paw Patrol birthday party. "I eat the Paw Patrols!" he said, and I can only assume and hope he meant cake.
Planning a birthday party for a picky eater is extra stressful. You want them to be a kid and enjoy themselves but also, you know not one of the fifty turkey pinwheels you bought is going to end up even close to his mouth. So you plan it early enough where you can squeeze in something he'll eat before he (hopefully) naps. All while knowing that if all goes according to plan he is likely not going to care much for dino nuggets. And that is exactly what happened.
The day of the party we obviously talked up all things birthday related to him. He knew exactly what a birthday party was because of daycare. As soon as he heard the word birthday party he screamed, "I WANT CAKE!" I was able to reason with him by showing him his colorful Paw Patrol cake and reassuring him that we will eat it at the party.
His friends started showing up and he really didn't care about anything else after that. Until it was time for his long awaited Paw Patrol cake. I want to really emphasize how picky of an eater my son is. It's often impossible to get him to eat anything. So when I saw him tear into his cake I was thrilled. Last year on his birthday I tried to get him to eat a cupcake that was specially purchased for him and he cried. Progress has been made.
Giving a toddler a present is always an adventure. Seeing their excitement and hearing their giggles as they rip apart the wrapping is such a magical experience. And all of his presents were on point this year. I tried to choose the present to be opened based on who wasn't distracted, a difficult task at a three year old's party. My son saw the toy push lawn mower in the giant dino bag and excitedly started pushing it all around the house. When we asked if he wanted to open his others he decidedly said, "Nope!" and started another lap. He eventually opened the rest with the same amount of enthusiasm.
Overall it was a huge success. My extra picky toddler was able to tell me what he wanted with the only fail being the turkey pinwheels. At least he liked the cake. And the presents.
When my son started eating solid meals and snacks at one year old we didn't think anything of the fact that he mostly ate chicken nuggets. And we should not have, children that are new to solids are going to be limited in what they eat. But as time went on, his friends starting becoming obsessed with the foods kids typically are obsessed with (mac and cheese, pizza, and pasta for example). My son is three and still refuses to eat any of these foods.
When we began to realize he was a picky eater we tried all of the methods. We offered him the food we wanted him to eat and if he didn't eat it he would be offered it at the next meal. We catered to what he wanted. We didn't cater to what he wanted. Ultimately, we ended up putting him in daycare when I went back to work in hopes that being around other kids would help him eat better. Not even that worked. Eventually, he ended up in food therapy.
Upon research, we learned that our son isn't just a picky eater, but an extremely picky eater. He was so much anxiety about trying new foods that he would seriously rather go hungry then eat it. His eating was so bad that when pictures pop up from my memories, I can see that he used to be chubby and is now skinny and it makes me sad and worried.
When I was working it was impossible to do family meals. He would get whatever was quick and filling. When his sister was born I became a Stay at Home Mom again and being the one that gave him at least three meals and two snacks a day showed me just how much his eating had not improved. I made it my project to make it better. I don't know if what I'm doing is the right way, but it seems to be working for us.
The first thing I did was make a schedule that made it so my son was eating every two hours that he was awake. Each offering, whether it was a snack or a meal, was high in protein and calories (snacks being less than meals as they are, well, snacks).
I make sure he drinks water except for at meals, which is when he got whole milk after he ate. I made sure he was not filling up on snacks and milk so that he's actually hungry at meals.
I make sure he gets ample running around time, preferably outside. I try to get him to work up an appetite.
The one thing that I have done that has made the biggest difference is I started having family meals again where we all sit at the same table and eat the same thing. Phones and devices are not allowed. I make sure there is at least one thing on my son's plate that he will eat. But he is offered what we eat. Sometimes on days when he hasn't eaten much I panic and make him a smoothie because I'd rather him have something than go to bed hungry.
My son is still an extremely picky eater. I'm learning that this is a process and that he isn't going to get better if I don't show him healthy eating habits. We still have sensory snacks where we just play around with food to get him used to it and hopefully try it. I've also learned that a good portion of his poor eating habits is about control for him. I can offer him something that I "know" he will eat and he won't just because he knows I can't or won't force him to. It is a very taxing battle.
I am not an expert in anything parenting related. But I can say that from my experience, everything that you want your child to learn needs to start at home. Lead by example. It's one thing to tell your child to eat a well balanced meal, but it's another to offer it to them and eat it along with them. Let them be little, but know they can't be little forever.


text:
Q: Github authentication extension VSCode I was trying to commit something to github repo using VSCode and I was told that
"extension github wants to sign in using github", when I allowed it I was redirected to a page with some link which I could copy in VScode to login.

But when I did so it gives me this error:

Sign in failed: FetchError: request to
https://vscode-auth.github.com/token?code=e23e730e3d1c5dc&state=717aca03-28e1-486f-bbb2-57680a149638
failed, reason: self signed certificate in certificate chain

It has become impossible to work with GitHub due to its security restrictions.
Can someone help?

A: If somehow the certificate from GitHub is not trusted by your Ubuntu OS, you can get it with (as suggested here):
mkdir ~/git-certs

openssl s_client -showcerts github.com:443 2>/dev/null </dev/null | \
sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/git-certs/cert.pem

git config --global http.sslCAInfo "${HOME}/git-certs/cert.pem"

Then relaunch your VSCode and try again.

A: I had a similar problem, and my final resolution was reinstalling it. However, that didn't solve the problem, as there were remnants left on my windows computer.
In the end, I got the problem removed by completely removing vs-code (or insider) from my computer as suggested here, meaning:

*

*Uninstall by running unins.exe file found in > C: Users\your_user_name\AppData\Local\Programs\Microsoft\ VS Code (or insider)

*delete the .vscode or .vscode-insiders folder found in  C: Users\your_user_name

*Now delete code or code-insider found in >C:\Users\your_user_name\AppData\Roaming
I installed vs-code again and also the github pull requests. I authenticized it using my git account, and things are back to normal. I have had already synced my setting to my account, therefore my previous working setup was back.

redpajama_set_name: RedPajamaStackExchange


Deciduous forests of all kinds except the wettest, especially on sandy soils, in disturbed areas, along roads, and in clearings; in thin, rocky mixed forests in the northern part of the state, toward Lake Superior; sometimes under hemlock or red pine, but mostly not associated with conifers.
MICHIGAN FLORA ONLINE. A. A. Reznicek, E. G. Voss, & B. S. Walters. February 2011. University of Michigan. Web. April 19, 2019. https://michiganflora.net/species.aspx?id=932.


text:
Nichols trial costs closing in on $5 million
Monday, September 15th 2003, 12:00 am
OKLAHOMA CITY (AP) _ Terry Nichols' state murder case has not even gone to trial yet, but it has already cost the state nearly $4 million, and another million could be spent before it is over next year or in 2005, records show.
The trial is to start March 1st in McAlester.
Nichols, 48, was convicted of federal involuntary manslaughter and conspiracy charges and sentenced to life in prison for the deaths of the eight law enforcement officers in the bombing of the Alfred P. Murrah Federal Building. The state murder trial is for the 160 other people who died in the April 19, 1995, bombing, and there is an additional charge for the death of a fetus whose mother was killed in the blast.
Most of the money spent to date has been for his defense.
``I continue to be concerned with the overall cost of this case and the (Oklahoma County) court fund's ability to cover it,'' state Supreme Court Chief Justice Joseph M. Watt said last week. ``However, I am confident that all parties involved in this case will work to keep that cost at a minimum.''
Almost all the defense expenses and much of the actual trial costs will come out of an Oklahoma County court fund that is a collection of fines, fees and forfeitures in civil, traffic and criminal cases. If that fund is exhausted, funding for Nichols' trial will come from the taxpayer-supported Supreme Court Revolving Fund.
Prosecutors expect the trial, including jury selection, to last four to five months. Defense attorneys estimate it could take a year or longer.
The total cost of the case so far is about $3.8 million.
Defense expenses -- including salaries and overhead -- already exceed $2.72 million, and another $65,000 in defense bills is being processed.
Prosecutors are using their existing budget to meet expenses, but they did spend $488,786 from a special appropriation to the case before the Legislature cut off such funding in 1999.
Oklahoma County Sheriff John Whetsel said the special security for Nichols so far has cost close to $500,000 extra.
The defense expense was projected to be $78,846 a month for salaries and overhead. Nichols now has five court-appointed attorneys and at least two investigators.
The estimate did not include payments to defense experts and defense witness fees. It also did not include the cost of defense housing and office space in McAlester. The defense team is now based in Ponca City.
``Considerable expense will be incurred moving the massive quantity of files and documents from Ponca City to the trial site,'' lead attorney Brian Hermanson wrote in one filing. ``In addition, it will be extremely expensive to bring witnesses all over the United States to the trial site and to house and feed them.''
News On 6 OKLAHOMA CITY (AP) _ Terry Nichols' state murder case has not even gone to trial yet, but it has already cost the state nearly $4 million, and another million could be spent before it is over next


Attorneys at the firm regularly appear before the High Court of Telangana and Andhra Pradesh and in Civil Courts in matters relating to commercial disputes, constitutional rights, Company law matters, winding up of companies; amalgamations and merger applications; reduction of capital, shareholder litigation; Arbitrations, First and Second Appeals, Customs, Central Excise and Service Tax matters, Environmental matters, among others.
The firm provides comprehensive advisory and litigation services in dishonor of negotiable instruments, matters arising from Lease Deeds relating to enforcement of terms of lease, rights of lessees, refund of security deposit, specific performance and enforcement of terms of lease or sale agreements, among others.
Our team appears before the various Tribunals like Debt Recovery Tribunal, Company Law Tribunal, Commissioner of Land Revenue, Revenue authorities and others for matters arising under the SARFAESI Act, Company matters, revenue and municipal Laws.
We handle matters at various Civil, Magistrate and Sessions courts and quasi-judicial authorities in matters relating to recovery of money, specific performance, seeking compensation for damages consequent to breaches of contract, employee related matters for breach of Employment Agreements, violation of confidentiality and Non-Disclosure Agreements, employees indulging in malpractices against the interests of the employer among others.
Partners of the firm regularly handle matters for filing application for appointment of Arbitrators before the High Court; appear before the Arbitrators in commercial disputes and matters pertaining to breaches of contract, among others. Partners of the firm regularly advice companies in litigation matters relating to corporate and commercial matters.


text:
PDT to +03
PDT to +03 Converter
PST/PDT
PDT automatically adjusted to PST time zone, that is in use
Pacific Standard Time is 11 hours behind
12:30 am00:30 in PST is 11:30 am11:30 in +03
PDT to +03 call time
Best time for a conference call or a meeting is between 8am-10am in PDT which corresponds to 6pm-8pm in +03
12:30 am00:30 Pacific Standard Time (PST). Offset UTC -8:00 hours
11:30 am11:30 (+03). Offset UTC +3:00 hours
12:30 am00:30 PST / 11:30 am11:30 +03
12am (midnight) 11am
1am 12pm (noon)
10am 9pm
11am 10pm
12pm (noon) 11pm
1pm 12am (midnight)
10pm 9am
11pm 10am
Daylight Saving: Pacific Daylight Time (PDT) is a daylight saving/summer time zone, however during winter some places adjust time for one hour back and observe Pacific Standard Time (PST).
End: Pacific Daylight Time (PDT) has ended on Sunday, November 7, 2021 at 2:00 am local time and clocks were set one hour back to Sunday, November 7, 2021, 1:00 am local standard time instead. Daylight saving ends annually the on first Sunday of November
Start: Pacific Daylight Time (PDT) starts on Sunday, March 13, 2022 at 2:00 am local time and clocks are set one hour forward to Sunday, March 13, 2022, 3:00 am. Daylight saving starts annually the on second Sunday of March
Offset: +03 is 3 hours ahead Greenwich Mean Time (GMT) and is used in Asia
Countries: It is used in following countries: Antarctica, Bahrain, Belarus, Iraq, Kuwait, Qatar, Russia, Saudi Arabia, Turkey, Yemen
Principal Cities: The largest city in the +03 timezone is Istanbul from Turkey with population about 11.174 million people. Other major cities in the area are Baghdad, Riyadh, Ankara, Jeddah
Daylight Saving: (+03) is not adjusted for daylight saving therefore +03 remains the same through out the year. This means, unlike some time zones where the clock is set forward by one hour every summer and backward by one hour during winter to adjust for daylight saving, remains the same
+03 representations, usage and related time zones
+0300 - sign character (+) followed by a four digit time providing hours (03) and minutes (00) of the offset. Indicates three hour and zero minutes time differences to the east of the zero meridian.
Charlie - Military abbreviation for +03
C - short form of 'Charlie'
IANA/Olson: Reflects +03 time zone boundaries defined by political bodies, primarily intended for use with computer programs and operating systems
Asia/Istanbul
Etc/GMT-3
EEST - Eastern European Summer Time
MSK - Moscow Standard Time
AST - Arabia Standard Time
C - Charlie Time Zone
EAT - Eastern Africa Time
FET - Further Eastern European Time
IDT - Israel Daylight Time
TRT - Turkey Time
KUYT to +03
IST to +03
+03 to CST
IRST to +03
MDT to PDT
EET to +03
EAST to PDT
GMT to +03
GMT to PST
EST to UTC
BST to EST
GMT to CET
CET to PST
PDT to EDT
BST to UTC


text:
South Africa: Latest tax developments regarding employer-provided scholarships and bursaries
By Michael Rudnicki,Aneria Bouwer,Barry Garven,Mogola Makola Tuesday, August 18, 2020
In February 2020, the Minister of Finance's Budget Speech contained some announcements regarding the income tax treatment of employer-provided scholarships and bursaries (S&Bs) for relatives of employees.
The exemption in respect of employer-provided S&Bs, both to employees and to relatives of employees, are dealt with in section 10(1)(q) of the Income Tax Act 58 of 1962 (ITA). Section 10(1)(qA) contains similar type provisions in respect of persons with disabilities.
The provision of S&Bs to relatives of employees will only qualify for an exemption where provided to employees earning less than ZAR 600 000 per year. In addition, the exemption applies only to as much of a scholarship or bursary as does not exceed ZAR 20 000 for Grades R to 12, and ZAR 60 000 for tertiary education.
As a result, the employees benefiting from the S&Bs are not high-income earners but fall into the 18% - 39% tax brackets. The effective tax rate of the highest earners in the group is a maximum rate of 27.5%. In addition, relatives benefiting from the exemption mainly attend public educational institutions, not private institutions.
The intention as set out in the Budget Speech appeared to provide that employer-provided S&Bs to relatives of employees would not qualify for an income tax exemption if the benefit was provided as part of a cost-to-company (CTC) package (also referred to as a 'salary sacrifice').
Although there was no clarity as to what the proposed changes would entail, the proposal was for the changes to apply with effect from 1 March 2020. Click here to see our newsflash dated 3 March 2020 for further information in this regard.
The recently released 2020 Draft Taxation Laws Amendment Bill (Draft TLAB) now contains the proposed changes to sections 10(1)(q) and (qA), due to take effect on 1 March 2021. In terms of the proposed changes:
the exemption in respect of bona fide S&Bs granted by the employer to the relatives of the employee as contemplated in paragraph (ii) of the provisos to section 10(1)(q) and section 10(1)(qA), will only apply to bona fide S&Bs granted not only to relatives of employees, but in terms of an open S&B scheme available and provided to members of the general public;
the exemption in respect of S&Bs provided to any employee or relative of an employee, will not apply if there is an element of salary sacrifice; and
the employer will not qualify for a deduction in relation to S&Bs provided to relatives of employees, if they are provided on a salary sacrifice basis.
Similar proposals are included in respect of S&Bs provided to persons with disabilities. The proposals are problematic for a number of reasons. While the Budget Speech indicated changes in respect of S&Bs provided to relatives of employees, some of the proposed changes as contained in the Draft TLAB apply to S&Bs provided both to employees and to relatives of employees.
Salary sacrifice prohibition
In terms of these proposals, S&Bs would not qualify for the exemption if they are provided as part of a CTC package. This applies not only to S&Bs provided to relatives of employees but also to S&Bs provided to employees.
Until 2006, the exemption in respect of S&Bs to employees stipulated that they may not be provided on a salary sacrifice basis. However, this requirement was deleted in 2006 and the reason for change was reflected as follows:
'Salary sacrifice as a component of the exemption creates unnecessary difficulties in application. While justifiable as a matter of legal theory, this distinction makes little economic sense in light of the skills shortage within South Africa.'
The Explanatory Memorandum to the Draft TLAB does not refer to the ongoing skills shortage or challenges experienced by the so called 'missing middle' in accessing affordable quality education.
Instead, the proposal seems to be premised on the perception that the exemption is being used as a tax planning opportunity by employers and employees, which results in a loss to the fiscus. It is not clear what the actual loss to the fiscus is, and how the 'loss' is split between S&Bs provided to employees and to relatives of employees respectively.
In addition, it is proposed that the employer will not be able to claim a deduction where S&Bs granted to relatives of employees are provided as part of a CTC package. It is unclear why it is thought necessary to deny the deduction if the employee is already being taxed on the benefit.
As pointed out in our previous newsflash, South Africa desperately needs to focus on affordable quality education for all youngsters. The implementation of this benefit on a salary sacrifice basis has provided some breathing space for many middle- and low-income households that struggle to afford quality education for their relatives. The reality is that this was, in most instances, only possible if provided on a salary sacrifice basis.
The implementation of the proposal as currently worded would hamper the efforts being made to foster access to affordable education, at a time when the country should increase its investment in education.
Children who currently benefit from access to a better education would be hard done by if the exemption is (effectively) withdrawn. In addition, the benefit currently facilitates the payment of school fees to (mainly) public educational institutions, thus relieving the demand on public funds by these institutions.
Surely the desired outcome should be to balance the need to protect the fiscus whilst investing in taxpayers of the future. National Treasury and SARS have in the past spoken about the need to broaden the South African tax base. Upliftment by way of access to quality education clearly assists in that endeavour.
Open S&B schemes
The proposal with regard to S&Bs provided to relatives of employees (i.e. that in addition to the CTC prohibition, such S&Bs must be granted as part of an open S&B scheme available to and provided to members of the general public in order to qualify for the exemption) is, in our view, unrealistic especially in relation to S&Bs that fund primary and secondary education.
It is highly unlikely that an employer would, especially in the current economic climate, have the funds available to provide an open S&B scheme to learners attending primary or secondary schools.
It is further to be anticipated that an employer would not be able to claim a deduction for expenses incurred in this regard, unless the S&B is undertaken as a marketing exercise.
The argument that an open S&B scheme on tertiary level is a business expense, as the employer is incurring the expense to ensure that it will have a pick of the cream of the graduate 'crop' in a specific field of expertise, generally does not apply to S&Bs offered to primary and secondary school learners.
In our view, there are compelling arguments for not implementing the proposals as currently drafted in the TLAB. To the extent that there are specific anti-avoidance concerns, those concerns could and should be addressed without effectively abolishing the exemption and losing the momentum gained to date in respect of access to quality education.
As stated previously, efforts should be expended into striking a balance between the need to protect the fiscus and the very legitimate need to invest in education.