text:
CTLN Opinion+
LNN
Shop CTLN
CTLN
How to Sign Up for ACA Health Insurance in Connecticut
Most residents of Connecticut are eligible to buy health insurance through Access Health CT, the state's Affordable Care Act (ACA) marketplace. And you might be able to save money on premiums, thanks to expanded federal tax credits in the March coronavirus relief bill. Because of the pandemic, Access Health CT's enrollment window is open through Aug. 15.
Most people already enrolled in ACA marketplace plans will also see their premiums go down this year because the recently enacted American Rescue Plan increases tax credits for insurance premiums and expands the number of households who qualify for them. Every household that pays more than 8.5 percent of their household income now qualifies for federal tax credits to help them afford health insurance. Prior to the new law, such tax credits were only available to people making up to 400 percent of the federal poverty level (around $51,000 for one person).
The average American with a marketplace plan can save $50 per month with the new assistance, the federal government says. As of now, this additional federal financial assistance will only be available in 2021 and 2022.
Connecticut residents, including non-U.S. citizens with worker or student visas, are eligible to buy health insurance through Access Health CT, regardless of whether they are currently insured. The incarcerated are not eligible.
You may also qualify for the state's Medicaid programs, called HUSKY Health plans, which offer free or low-cost coverage to low-income singles and families, adults 65 and older, individuals 18 to 64 with a disability, children, and others.
When can I enroll?
Anytime through Aug. 15, 2021
Those who've lost or will be losing their health coverage and those who've experienced a qualifying life change — such as the birth of a child, a divorce or a marriage, or a move to Connecticut — can still enroll after Aug. 15.
Those who qualify for HUSKY Health can enroll anytime, as can American Indians and Alaska Natives.
You apply for coverage and choose your plan at the same time. Once you're approved for a plan, you'll need to pay your first monthly premium for coverage to begin. You can pay online or ask to receive a bill in the mail. To apply and enroll:
Online: Go to AccessHealthCT.com and click "Enroll Now."
By phone: Call the Access Health CT call center at 855-805-4325 between 8 a.m. and 5 p.m. Monday to Friday. Assistance is available in more than 100 languages. If you are deaf or hearing impaired, use the TTY at 855-789-2428 or contact them with a relay operator.
In person: Visit one of the Access Health CT's in-person enrollment locations.
By mail: Call the Access Health CT call center at 855-805-4325 to have the correct application form mailed to you.
What is covered, and how much will it cost?
Coverage and cost depend on where you live, the type of plan you choose, your estimated household income and the age and disability status of you and your family.
If you qualify for HUSKY Health, you can get free or low-cost coverage and may not need to worry about premiums or copays, depending on your level of income.
All Access Health CT plans cover 10 "essential" benefits, including:
Emergency services and hospitalization
Pregnancy, maternity and newborn care
Mental health services (including counseling)
Chronic disease management and pediatric care
Insurance companies cannot deny coverage because of preexisting conditions. When you apply, you can identify your medical needs and choose a plan that makes financial sense for you and your family.
All Access Health CT plans cover basic dental services for those 18 and younger, including cleanings and exams. HUSKY plans offer dental coverage for adults as well. But adults who want dental coverage must add it to their Access Health CT plan. Deductibles and out-of-pocket costs vary between plans; enrolling in a family plan can cut costs.
What about new federal assistance for premiums?
Every eligible household that pays insurance premiums that exceed 8.5 percent of annual income now qualifies for federal tax credits for insurance premiums. For example, a single 64-year-old filer earning $51,000 per year could potentially save more than $8,000 with the new tax credits, according to the Kaiser Family Foundation.
Is there any other financial assistance available?
Yes. If you qualify for a premium tax credit, you may also qualify for a cost-sharing reduction (CSR) that would help you pay for such out-of-pocket expenses as deductibles and copays. You must enroll in a Silver-level plan to get this assistance.
If you've collected unemployment benefits this year, even for just one week, you may qualify for an almost $0/month premium health coverage option, thanks to the American Rescue Plan. This subsidy will become available in July. If you've already received unemployment benefits this year while enrolled in a marketplace plan, you'll be able to claim the additional subsidies for the months prior to July when you file your 2021 tax returns. This extra financial help will expire at the end of 2021.
What plans are available?
Access Health CT's plans areorganized into categories:
Bronze plans have the lowest monthly premiums and the highest deductibles and copays, and cover roughly 60 percent of care costs. They're designed to help you in case of serious illness or injury.
Silver plans have moderate monthly premiums, deductibles and copays. They cover between 70 and 94 percent of care costs, depending on which cost-sharing reductions you qualify for.
Gold plans have higher monthly premiums and lower deductibles and copays, and cover roughly 80 percent of care costs.
Platinum plans have the highest monthly premiums and the lowest deductibles and copays and cover roughly 90 percent of care costs. These are for people who have significant health care needs and are willing to pay the highest premiums. Currently, there are no platinum plans offered in the Access Health CT marketplace.
Catastrophic plans are available to Connecticut residents under 30 or to those who have been granted a hardship or affordability exemption from Access Health CT. They offer low premiums and cover three primary care visits per year. You are not eligible for financial help for these plans.
Access Health CT's Compare Plans tool helps you estimate costs and benefits of various plans and check whether you might qualify for financial assistance.
Access Health CT also offers the Certified Independent Broker program, which helps customers find a local broker to help with plan selection or questions. You can also call 855-805-4325 to speak with a broker.
What if I already have health insurance?
If you already have coverage through your employer, you can switch to an Access Health CT plan through Aug. 15. But you may not qualify for tax credits if you opt out of your employer's plan — unless those premiums exceed a certain portion of your household income. The premiums would need to be more than 9.83 percent of your household income for individual coverage or more than 8.27 percent for family coverage in order for you to qualify for the tax credits.
If you have coverage through a plan that's outside the exchange you can also enroll in an Access Health CT plan through Aug. 15. If you decide to swap plans but stick with the same insurance provider, any cost-sharing amounts you've incurred, such as deductibles and covered out-of-pocket costs, should carry over. Contact your insurance company to confirm and to ask about changes to provider networks and prescription drug benefits for Access Health CT plans.
If you get coverage through the Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA) because you were terminated from a job or were put on reduced hours, you should be receiving a temporary COBRA premium subsidy that covers 100 percent of your monthly premium cost. This premium assistance, made possible through the American Rescue Plan, runs through the end of September or the end of your last month of COBRA eligibility, whichever comes first.
If you're on COBRA, you may want to sign up for a marketplace plan that starts as soon as your COBRA coverage ends. If you're not sure about whether making this switch makes sense for you, you can ask for free advice from a certified insurance broker.
Will I need to get a new doctor?
Maybe. Not all doctors accept marketplace plans. You can talk to your primary care physician or use the Compare Plans tool to see whether a doctor or practice is in the plan's network. You can also check the websites of Access Health CT insurers Anthem and ConnectiCare to search for covered providers.
Will my family members qualify for the same health plan that I do?
It depends. You can enroll as a family. But in some cases, some family members may also be eligible for subsidies or other programs, depending on age, income and disability, or caregiver status.
HUSKY Health plans have their own provider networks, but there is a lot of overlap between their providers and those in the Access Health CT plans. This often allows family members on different plans to visit the same doctor or medical provider.
This guide, originally published June 16, was updated June 25 with new information on financial help for those who've collected unemployment benefits in 2021 and those on COBRA.
Your ACA checklist
COVID-19 coverage under the ACA
Test your knowledge of health care rules
ACA Out-of-Pocket Max Costs Will Drop in 2022
Publisher's Note: The ACA has narrowed racial gaps in access to health care but Hispanics-Latinos are still nearly three times more likely to be uninsured.
CTLN partners with AARP Connecticut in best serving the Hispanic-Latino community.
In this article:AARP CT, Affordable Health Care Act, Health Insurance, Hispanics and Health
C-HIT
The Pandemic Changed Their Lives – And Brought Them Closer Together
Student Advocates for Domestic Worker Rights
After Stillbirth, Undocumented Woman Organizes Partnership To Help Others Find Better Care
Community Program Brings Diverse Children and Elderly Together
New Loan Program Looks to Support Latino Small Businesses & Nonprofits
Race, Economics, Environment Continue To Drive State's Asthma Disparities
The other language barrier: What it means for Latinos to lose Spanish fluency
CTLN Partners
Democracy in CTLN: Voter Access Across New England
Hipster Yoga at the End of the World
Video Post with Built-in Video Player
Post with Vimeo Video Example
AARP Connecticut Livable Communities Grant Program Accepting 2021 Applications
AARP Connecticut invites community organizations and governments across the state to apply for the 2021 Livable Communities Grant Program, a local extension of the national AARP...
Hugo BaltaSeptember 1, 2021
OPINION: Connecticut's Family Caregivers Need Financial Support. And They Can't Wait Any Longer
Every year, more than 460,000 Connecticut residents provide 390 million hours of unpaid care to their loved ones, valued at a staggering $5.9 billion...
Anna DoroghaziAugust 3, 2021
3 Questions With...
Nora Duncan of AARP – "has your back"
"For over a year, nursing home residents, staff, family members, the Long-Term Care Ombudsman, and AARP Connecticut have advocated for many of the important...
News EditorJuly 29, 2021
Meet the CTLN Team
NHLN
MALN
RILN
ILLN
Copyright © 2022 Latino News Network. All Rights Reserved.


text:
Preston risked becoming an 'island' in tier-three negotiations claims city leader
Posted on - 16th October, 2020 - 2:41pm | Author - Rachel Smith | Posted in - Health, Politics, Preston News
The Sessions House in Preston city centre, part of the Town Hall complex Pic: Tony Worrall
As Lancashire's move to tier-three was confirmed the gloves came off on the political infighting over the government's handling of the negotiations.
Preston City Council's leader, councillor Matthew Brown, had already made vocal his feelings the deal wasn't good enough.
It's understood the Labour leader at the Town Hall didn't attend the final meeting to sign-off on the deal – in an apparent boycott of the measures.
He has joined a number of Labour leaders across Lancashire in criticising the way the tier-three negotiations were done.
Councillor Brown has become increasingly out-spoke as the week's negotiations have progressed
Cllr Brown appeared on Sky News to say: "The way they've treated us is pretty dreadful.
"We were put into a position where many of us were bullied and were told if we didn't accept the restrictions.
"We would basically be an island and the rest of Lancashire would be given slightly better benefits, and we basically living in Preston wouldn't be able to travel outside.
"The number of businesses which can remain open wouldn't be able to remain open and we'd get less money. There's been lots of pressure put on us and I'm pretty disgusted with the way they've treated us."
You can watch Cllr Brown's appearance here.
Bullied into tier 3 @MatthewBrownLab pic.twitter.com/KZ9zng4fb5
— Preston Labour (@prestonlabour) October 16, 2020
Read more: These are the tier-three restrictions for Preston and Lancashire
A lengthy statement from Cllr Brown and Mohammad Iqbal, the Pendle council leader, has further criticised the handling of Preston and Lancashire going into tier-three restrictions.
Strong statement from some Lancashire Labour leaders who say they were 'bullied' into Tier 3 and not sure it will work.@MatthewBrownLab @IqbalMohamned say they were told Preston and Pendle would get less funding if they didn't agree.@SRLabourLeader says 'a complete shambles' pic.twitter.com/88eeugbiWA
— Hannah Miller (@hannahITV) October 16, 2020
And South Ribble Borough Council's Labour leader, councillor Paul Foster, has attacked the decision in a video statement.
Publishing the video update via the borough council's social media channels he makes clear he did not support the tier-three measures or the terms of the deal.
Read more: Longridge micro pub decides to temporarily shut due to restrictions
Preston MP Mark Hendrick has also criticised the tier-three measured and backed Cllr Brown's call, earlier this week on Blog Preston, for a national 'circuit breaker' lockdown.
We need a proper #Covid19 circuit-break – Tier 3 measures in #Preston won't stop this virus. Two-thirds of wages are simply not enough to live on when you earn the national minimum wage, livelihoods need to be protected and Universal Credit will just not cut it.
— Mark Hendrick (@MpHendrick) October 16, 2020
Lancashire County Council's leader county councillor Geoff Driver, a Conservative, has defended the tier-three deal, understood to be worth £42m to the county.
He said: "Across Lancashire, the coronavirus situation is serious and getting worse. Lancashire's leaders all agree that, as we approach winter, urgent action has to be taken now to ensure the county is not overwhelmed by the virus.
"After major negotiations with government, we have agreed a bespoke deal for Lancashire that means our businesses and residents will receive extra support that will not be available elsewhere in the country.
"I want to thank all of the Lancashire leaders for the constructive and meaningful discussions we have had over the past week. The deal has presented real challenges for some and they have only been able to sign up with reluctance, but we have been willing to work across party lines so that we can hammer this out with government.
"These new restrictions will affect us all, but we know they will be particularly harsh on those who make their living in our hospitality sector. It is a vital and valued part of our economy and we are all committed to maximising the support we can give as a result of this deal."
A spokesperson for the Prime Minister is 'very grateful' to council leaders in Lancashire, according to LancsLive.
See the latest coronavirus cases and info near you
Preston, and Lancashire, will enter tier-three restrictions from 00.01 on Saturday 17 October.
Read more: See the latest Preston news and headlines
What do you make of councillor Brown's comments? Do you agree with tier-three restrictions? What do you make of Cllr Driver's comments? Let us know your views in the comments below

redpajama_set_name: RedPajamaCommonCrawl


The Consortium for Policy Research in Education (CPRE) is a community of researchers from renowned research institutions and organizations committed to advancing educational policy and practice through evidence-based research.
Research conducted by CPRE is peer-reviewed and open access—allowing for the spread of new knowledge and allowing that knowledge to be built upon. You can access CPRE research via our Scholarly Commons repository.
CPRE's mission is to contribute to the output of new, scholarly, evidence-based research.
Our goal is to make education policy research openly accessible to policymakers, practitioners, researchers, and other interested readers.
CPRE's vision is to disseminate research that can be the catalyst for informed decision-making and action in educational policy and practice.
The Consortium for Policy Research (CPRE) was founded in 1985 by Susan Fuhrman at Rutgers University before moving to its current headquarters at University of Pennsylvania Graduate School of Education (Penn GSE). Since its inception, CPRE has conducted meaningful research that delves into the relationship between educational policy and the effects it has on classroom practice, student learning, school reform, teacher workforce, and school governance.
CPRE is chiefly comprised of researchers from seven leading schools of education—often referred to as the "CPRE 7." However, CPRE researchers often establish formal research collaborations with many education agencies, higher education institutions, schools of education, organizations, and associations at the local, regional, national, and international level. Working with this diverse community has afforded CPRE the opportunity to conduct some of the most influential educational analyses in the areas of: reading literacy, early childhood data systems, higher education, and mathematics assessment. CPRE is headquartered with University of Pennsylvania's Graduate School of Education.
Executive Director Jonathan Supovitz (University of Pennsylvania) leads the Consortium for Policy Research in Education. Learn more about the researchers, faculty, and staff who make up the Consortium for Policy Research in Education in our Expert Directory.
The Consortium for Policy Research in Education (CPRE) conducts rigorous program evaluation and research studies using qualitative and quantitative methods, advanced survey techniques, and data analysis. CPRE consists of a broad network of leading experts. This network of premier researchers features experts in a diverse array of education topics.
For questions on CPRE research and services, please use our Contact Form or email: cpre@gse.upenn.edu.
The Consortium for Policy Research in Education (CPRE) is headquartered with the University of Pennsylvania's Graduate School of Education. CPRE fosters an innovative, collaborative research environment where dedicated staff members can apply their skills and talents to support the advancement of educational policy and practice research.
If you are interested in joining CPRE's diverse community of experts, please use University of Pennsylvania's job portal.


If God told you to kill children would you do it?
Quite a question, isn't it? The answer should be an obvious "No", right?
We're studying the biblical book of Deuteronomy on Sunday mornings at Faith Church, and we've come to some troubling passages where God commands the armies of Israel to kill children. In chapters 2 and 3, Moses is reviewing with the people of Israel the story of how they made it to where they are encamped on the east side of the Jordan River. Their journey took them through lands inhabited by Canaanites, and both times they proclaimed holy war on the Canaanites, utterly wiping them out.
What in the world is going on? They actually killed children! It was holy war.
Holy war will come up again in Deuteronomy chapters 7 and 20, so I decided this week that we're going to talk about Holy war this one time and be done with it. Why? Well, quite frankly, it is difficult material. I wonder how you are feeling as you read these passages?
I think behind these comments is desire for relief from tension. We feel very uncomfortable with tension, right? Tension is when you are the middle and you are being pulled in two directions, and generally-speaking we hate it.
Do you feel that pull, the tension, when you read passages about God commanding the people to kill all the men, women and children of a nation? I think you should feel tension. I do.
Where is the tension coming from?
I think it is coming from the fact that we want to believe in a loving, good, merciful God on one hand, and on the other, we want to believe the Bible is true. And when our true Bible teaches us about a violent, destructive, genocidal God, we're stuck.
We want peace, not tension. We want our impressions and beliefs about God to make us feel good, comforted and safe.
So what do we do to relieve the tension? I do not believe there is a satisfying answer to relieve the tension about the amount of violence in the Old Testament.
Here are some ways that people have tried to resolve the tension of the violence in the OT. I got these from pastor and author Brian Zahnd. Check out a great interview with him here.
Question the morality of God? Maybe he is actually monstrous. But we know that isn't true. God is good, right?
Question the immutability of God? Maybe he is changing. But we're hesitant about this too, because God doesn't change, right?
Question our reading of Scripture? Maybe we shouldn't take it so literally. But how do we know which parts of the Bible should be literal or not?
None of these options resolve the tension for me. What does resolve the tension for me? Nothing. Instead, I have two thoughts on holy war in the Bible.
Thought #1 – Be humble about difficult passages.
I think it is vital that I view my interpretation of difficult biblical passages as unfinished interpretations. A work in progress. My seminary Old Testament prof Dave Dorsey taught us this, and I think it is incredibly wise. He said that whenever he comes to a part of the Bible that does not line up with what he knows to be true of God, he does not allow himself to come to a final conclusion on the interpretation of that passage. He waits. He studies. Often, he said, there is more going on that he has not yet encountered or does not understand. It could be cultural or language or translation issues. I encourage you to follow Dr. Dorsey's advice.
Thought #2 – Maybe the holy war passages are a justice issue.
Here's where I'm at with all the times God commands Israel to commit holy war against people. It seems to me that the people of Canaan, including the Amorites (like King Sihon in Deuteronomy 2), were incredibly evil, and also very powerful. Think Nazi Germany with the atom bomb. For any of you that have watched the Amazon series The Man in the High Castle, this is exactly what happens. That TV show presents an alternate history, imagining that the Nazis win World War 2 because they create and use the atom bomb before we do. They bomb Washington DC and win the war, together with Japan controlling the USA.
It is possible that Israel was up against similar powerful, wicked nations. Archaeologists have done work on the Canaanites, finding them to practice child sacrifice and female temple prostitution, both practices treating vulnerable people terribly. It was evil that needed to be stopped. Also, take a much weaker nation with a slave mentality like Israel*, and the chances are incredibly high that Israel could have been quickly enslaved again by the Canaanites.
God knows this. And so when you have Nazis versus your Jewish people, what happens? Nazis exterminate Jews. Nazis are powerful and evil. But God has a plan, a hope for the redemption and recreation of the world, and it is a plan that is to come through the line of the Jews. Thus God empowers the Jews to eradicate the Nazis, judging evil in the land, and creating this new just society which is to be a blessing to the whole world.
Am I satisfied with this interpretation? Nope. Not in the least. Do I like it? Not really. I pray, "God, could there not have been any other way?" It seems like there should have been. So I follow Dr. Dorsey's advice, and I keep studying. I'm leaning toward the interpretation that it was a justice issue, to eradicate evil and pave the way for a new just society, in much the same way as World War 2.
Today, in our world, if I had a vision or dream or heard the voice of God asking me to kill children, I would assume that I had not heard or interpreted God correctly, and I would not kill children. I'd be looking for any other way. And you know what I find?
I find Jesus on the cross. I find God dying for us. I find him weeping for us, weeping at sin, and then I find him giving his own life, so that they world could be radically changed. And I focus on that. That is powerful. That is what we need, that is what we know to be true. God the forgiver, God the merciful, God of second chances, God who loves you so much he would die for you. God who wants to remove violence from this world. I find a God of justice who wants wickedness and evil to stop, who has hopes and dreams, and empowers his people to recreate the world as it should be.
*Consider that Israel had been enslaved in Egypt for 400+ years, and only 40 prior to the events we read about in Deuteronomy 2 and 3. Compare that to slavery in our own nation's history. Our American slavery was a shorter length, about 250 years, and 150 years we are still very much feeling the pain of slavery's wickedness.
A few years ago my two small children were involved in a singing performance at their Christian school. The performance was scheduled as part of the Sunday worship service of the church which sponsors the school. Approximately one hundred little, cute, smiling children sang their hearts out. It was beautiful. You could feel the joy and happiness of all the proud parents in the room.
Then the pastor started his sermon. The subject: The Slaughter of the Amalekites.
"Jesus would NEVER do that to little children," I thought.
I reviewed all the justifications that you have listed above, even the one about killing the children so that their parents wouldn't kill them in a human sacrifice. Uh…Really?? It is moral to kill children so that someone else can't kill them??? It is moral to kill children so that their more numerous offspring will not be killed in future generations???
I don't buy it. I cannot look my little children in the eyes and EVER consider any justification for the targeted killing of children. Nope, Jesus would NEVER have commanded such a thing. And if I no longer believe that Jesus would EVER order the targeted killing of little children regardless of the wicked sins of their parents and culture, how do I resolve the tension between this new perspective and Trinitarian Christianity which teaches that the God of the Old Testament was none other than JESUS!??
Then and there I decided I could NOT believe that Jesus was the God of the Old Testament. I could no longer be a Trinitarian Christian. The God of the Old Testament was EVIL INCARNATE. Yet Jesus called this monster his "Father" and never once condemned his "Father" for his wicked acts in the Old Testament. In a hypothetical scenario, if Hitler had had a son, and that son was the most wonderful, kind, generous, giving person on the planet…yet…he refused to ever condemn the horrific moral crimes of his father, would I still respect the son?
Something's wrong here, folks. Something is really wrong. Jesus can't be perfect if he refuses to condemn the evil actions of his father and asks other people to "love" and "obey" this evil father.
The more I dug, the more problems I found with the Christian belief system. The evidence for the accuracy of the prophecies in the OT are poor. Multiple blatant historical (and scientific) errors exist in the Bible. The evidence for the bodily resurrection of Jesus is much weaker than our pastors tell us, and on, and on.
Nope. There is never any justification for the targeted slaughter of children, folks. Don't ever let ANYONE attempt to justify such a horrific act.
Thanks for your comments. I hope my consternation with this passage, and the many others like it, came across. I feel as though you didn't give me credit for the internal doubt and struggle I presented. I clearly stated that I don't like any interpretation of this passage. I'm saddened to hear that you have abandoned Trinitarian faith, as I don't believe that is the only possible conclusion. Instead I would encourage you to follow Dr. Dave Dorsey's advice. Did you get a chance to listen to the podcast interview of Brian Zahnd? See what you think of his perspective.
I very much sensed your discomfort with these passages, Joel. I was not in any way criticizing you. What I am trying to do is get you to open your eyes to the truth, my friend. Please hear me out. I have been where you are and understand your thinking.
No, I have not listened to the podcast. However, continuing my hypothetical with Hitler and his hypothetical son: Would you listen to a podcast in which Hitler's very compassionate, kind, generous son explains why his father's genocidal slaughter of millions of Jews and other people was somehow justified??
I doubt it. What possible justification could he give to justify the killing of so many fathers, mothers, teenagers, grandparents, and, yes, little children and babies, in the Holocaust?
Since there is no justification, I would bet you would not waste your time listening to Hitler's son's podcast. And that is why I have no interest in listening to a podcast in which a Christian attempts to justify a similar immoral act of human slaughter. The targeted killing of children is EVIL AND IMMORAL, Joel. There is NEVER a justification for it.
It makes me sad that so many good people such as yourself have been brainwashed to believe that something that is so evil and so immoral is somehow just, moral, and even "good".
I didn't just leave Trinitarian Christianity, I left Christianity and ALL forms of supernatural belief. I believe that the belief in supernatural powers and the existence of supernatural invisible beings is probably one of the greatest sources of suffering in our world. I believe it is time for modern, educated people to see our supernatural beliefs for what they really are: superstitions.
Thanks for this. I appreciate the dialogue. I would ask you to consider the possibility that you are assuming too much. On one hand, I agree with you that I would not listen to Hitler's son's podcast, if the message of the podcast was clearly known ahead of time as you described, which is a continuation of justification for genocide. But what if the message of the podcast was different? What if the message of the podcast was saying "Genocide is wrong"? Then I might listen. Did you assume that the message of the Brian Zahnd podcast was "genocide is okay" or somehow justified? It is not that at all. I think you might appreciate what Zahnd has to say. Am I brainwashed? I have to consider that it is possible. I strive to remain teachable. I know I am far from perfect in that regard. Thus I hope that my comments about wrestling and struggling with difficult biblical passages show that I am questioning a lot more that you seem to insinuate about me. Your approach leaves me feeling like I don't want what you have found.
I will consider listening to the podcast if you can assure me that at the end of the podcast the speaker condemns the stories of child slaughter in the Bible. Some Christians say that the stories are fictional, but if that is true, why is there no mention of condemnation of such behavior?
I am not promoting any "-ism", Joel. I only seek the truth. However, sometime the truth is not pretty. That is why people create make-believe.
Good question…does the speaker condemn the stories? I can't remember. I think his take on interpreting the stories is that God is good and loving, and thus we need to read the passages differently. I think he would say, if he doesn't explicitly condemn child slaughter, that a different interpretation implicitly does so. And that is how I would respond to your question about the lack of condemnation of such behavior from those who call the stories fictional. But that is my take. In discussions like these, I find it quite hard for any side to pull themselves away from their precommitments. It is so hard to remove, because we are so strongly colored by our disagreement. Driving to lunch today, I was listening to an NPR interview with professsional fact-checkers. It was really interesting. One person talked about people in Florida hearing a conservative talk radio host suggest that the media hyped up hurricanes because they want to promote their agenda supporting global warming. So the Florida resident did not evacuate. They chose to ignore the scientific reports from the National Weather Service, in favor of believing a talk show host. It happens all the time. Our precommitments color us. I am afraid that mine color my way of seeing the world too much. I think you will appreciate Zahnd. But obviously that is because of the position of biblical theism that I come from. I think Zahnd is being honest, humble and genuinely seeking to understand a terribly difficult issue. You might think otherwise. I'd be interested in your perspective. I believe that you are seeking truth. Me too.
Ok, I will listen to the podcast.
I have discussed this issue with many Christians of various persuasions. Fundamentalist Christians typically excuse the barbaric actions described in these passages with the excuses you mention above, such as that the Canaanites practiced child sacrifice and that killing a few children now was better than the killing of many children later (in human sacrifice rituals) over a period of hundreds of years.
Like me, it sounds like you have a hard time with that justification, and understandably so.
Another explanation I have heard from fundamentalist Christians is that if the heathen children were killed prior to the Age of Accountability, they would die and go to heaven. An eternity in heaven is surely worth being chopped to pieces in this life (and avoiding Hell in the next). However, if you ask the same Christians if they would support abortion for all fetuses of non-Christian parents today, they then are not so eager to support this "act of mercy" even though the same issues apply.
Moderate and liberal Christians have come up with the best justification for these passages that I have seen. They believe that these stories are fictional. They never happened. They are simply folk-tales. The stories describe the attitudes and behaviors of ancient, primitive peoples. The Christian God had nothing to do with these alleged acts.
Ok. That seems reasonable and, in fact, I agree with the claim that these stories are fictional. Most archeologists and historians believe these stories are fictional. But this creates an even bigger problem for moderate Christians. The overwhelming majority of archeologists and Near East historians also believe that the entire Exodus Story, Forty Years in the Sinai, and the Conquest of Canaan are fictional folktales. That does not bode well for the claim that Jesus was an all-knowing God: Jesus believed these events were real. And if these stories are fiction, what about the story of the Garden of Eden? If that story is fiction, then there was no Fall, and if there was no Fall, mankind does NOT need a Savior.
And this points out a very important issue, Joel. Once you find one "crack" in the Christian belief system…it leads to SO many more.
This is what I found when I started investigating the claims of Christianity with an open mind. I was NOT looking to deconvert. I was not looking for an excuse to abandon my faith. I was VERY happy and content as a Christian. I, my wife, and kids were actively involved in our conservative Christian church. My kids attended Christian school. I was an online Christian blogger. Leaving Christianity was the LAST thought on my mind.
But one day I was challenged on some of my beliefs by a former conservative Christian pastor turned atheist. It was my goal to convert HIM. Yet after four months of intense study, one "crack" after another appeared in my precious faith until one day I realized I was an unbeliever.
If your faith is more important to you than the truth, don't dig any further, Joel. Accept one of the justifications for the murder of heathen children in the Bible, and move on. Focus on the many pleasant, more palatable aspects of modern Christianity.
But if knowing the truth, the real truth, and nothing but the truth is of utmost importance to you…keep digging. Keep asking questions. Just be prepared: your entire "world" may collapse. Could you handle that? If not. Stop.
Thank you for taking the time to write so much. It seems to me that your motivation is good. I'll give your comments consideration. Though I will say that I have studied many times previously numerous atheist positions, biblical contradictions, and the cracks you refer to. I don't ever want to be in a place of concreted faith that is unwilling to keep examining, studying and learning, even if it means taking that hard look at the possibility that my faith could be false. Thus far, my personal study into these matters has continued to lead me to be a biblical theist. Again, thank you so much for your time.
Best wishes to you, Joel.
Thanks! And the same to you.
I left a comment but do not see it. Is there moderation?
Yes, there is moderation. Comment just approved.
I listened to the podcast. Rev. Zahnd states that in the past he was the typical conservative Christian who supported "just" wars. In fact, he and some friends sat down with a pizza to watch the opening salvos of the First Gulf War on CNN with great enthusiasm (as if it were entertainment). One day, years later, as he was praying, he states that he felt the presence of Jesus and Jesus said to him, "That moment where you enjoyed the commencement of a war was your biggest error".
After that point in time he took up the position that war is wrong. He believes that fighting in a war is against the will of Jesus.
So, how does he reconcile his new-found non-violent view of Jesus (God) with the violence in both the Old and New Testaments? Zahnd chooses to see the Bible as having the same relationship with Jesus (God) as did John the Baptist with Jesus. John the Baptist was the forebearer, the messenger of Jesus, but was not Jesus. What Zahnd is really saying here is that the Bible is not perfect just as John the Baptist was not perfect— but he doesn't come out and say that in the podcast.
That is an earth-shattering statement for any evangelical.
If the Bible is imperfect, what if any passage in the Bible can the lay Christian trust as true? Answer: You can't. What is Zahnd's answer to this problem: "Look to Jesus. JESUS is the focus of your faith, not the Bible. Jesus is perfect. Jesus is good. Jesus loves children. Jesus would never kill children." Therefore, the statements of violence in the Bible do not prove that God (Jesus) is evil. They only prove that humans are evil. Jesus can do no evil nor command evil to be done.
It is hopefully obvious to anyone reading this comment that Rev. Zahnd is making two very big assumptions: That Jesus is God. And, that Jesus (God) is perfect and can do no evil.
However, he has just destroyed the credibility of the only source of evidence for these two claims: the Bible! If we can't trust the Bible to tell us the truth in the stories of Genesis, Exodus, Leviticus, and Numbers, why should we trust the Bible to tell us the truth in Matthew, Mark, Luke, and John about Jesus???
All one can really say, in response to Zahnd's emotional-psychological passage through various… "impressions" and his interpretation of them is, they are what they are. They reflect something going on inside of him, something unlikely to be either highly self-critical or logically coherent. He certainly hasn't destroyed "the credibility of the Bible" (you have phrased that quite illogically, for your own part); he has merely obliterated any logical coherence in his OWN position on the Bible. There is a critical difference. After all, we don't want to accept Zahnd's pronouncements on "where he's at" now vis-a-vis the Bible as some sort of…divine pronouncement, do we? Particularly if we are inclined to dismiss the existence of anything divine to begin with?
You are correct, Zahnd has only condemned his OWN explanation. He is not speaking for Christianity as a whole. But Joel is suggesting that Zahnd's explanation for the violence in the Old Testament is a good one. I don't agree.
I think Joel needs to continue looking for a rational explanation for why a "good" God committed so many EVIL deeds.


text:
Jared Bybee (Emile de Becque) and Maris McCulley (Nellie Forbush) in South Pacific. Photo by Felix Rodriguez.
The Broadway classic South Pacific hits the Hult Center
Theater by Henry HoustonPosted on 03/17/2022
After months of a gloomy winter, it might be time for the sunny island of Bali Ha'i, the fictional setting of South Pacific. But watch for some of the overcast that comes with the World War II musical by Broadway giants Richard Rodgers and Oscar Hammerstein II.
A traveling Broadway cast brings the "gray area" of the production, Woody Minshew (Lt. Joseph Cable) tells Eugene Weekly, which includes racism, love and environmental degradation.
South Pacific tells the story of quirky American soldiers occupying the island, an entrepreneurial Tonkinese woman named "Bloody Mary" and, of course, romance. There's Cable who falls in love with Bloody Mary's daughter, and the American nurse Nellie Forbush, who has a romance with the French expat Emile de Becque — but she has to wrestle with her prejudices of potentially being a mother to his mixed-race children.
As with all of Rodgers and Hammerstein's productions, South Pacific has several songs that are a part of the Great American Songbook, including "I'm Gonna Wash that Man Right Outta My Hair," "Some Enchanted Evening," "There Is Nothing Like a Dame" and "Bali Ha'i."
But one song from the musical almost ended the show when Rodgers and Hammerstein were developing it back in the '50s. Producers wanted to pull "You've Got to Be Carefully Taught" because of its lyrics, Minshew says, leading the duo to issue an ultimatum: Either the song runs or the show dies.
It's a song that's around one minute in length, but its lyrics say racism is what people are taught, not born with. "You've got to be taught to be afraid/ of people whose eyes are oddly made/ and people whose skin is a different shade," the character Cable sings in the musical.
"To keep that in the show in the early '50s is a beautiful thing," Minshew says. He says the song may have led to future generations taking bigger leaps with addressing major themes in shows, from Jesus Christ Superstar to Hamilton. "It's really one of the early seeds."
South Pacific is based on a Pulitzer Prize-winning anthology of short stories called Tales of the South Pacific, and the musical itself won a Pulitzer Prize for drama in 1950. The production's most popular film adaptation was in 1958. The traveling Broadway production that features Minshew is presented by the American Theatre Guild, a touring presenter.
Minshew says that what sets the traveling Broadway production apart from other stagings is that it explores more of the grittiness of wartime in the Pacific. He says director Jeff Moss didn't want to depart too much from the playbook, but audiences should notice the degradation that occurs on the American GI-occupied island.
"The beautiful island exists in the beginning. Then throughout the show you see how the U.S. military has taken the palm trees, and you see them all cut out, and it's made into a big shower and stumps," Minshew says. "You see the ravaging of the island for the war effort."
Previous major productions of South Pacific don't pull at that thread, he adds, instead focusing on Bali Ha'i being a tropical paradise.
The central theme of South Pacific, Minshew says, is love, as with most of the musicals by Rodgers and Hammerstein. "It's about these two couples who have to wrestle with their prejudices and their own outward influences and sources on what they should do and how they should act," he says. "Choosing love over greed and ambition, because that's what we're put on this planet for."
Despite South Pacific's seemingly simple central theme, he adds, there are layers to what the message of love is, and it surpasses the World War II setting. At first, the musical sounds simple, he says, but when you leave the theater, the power of South Pacific hits you. "There are a lot of layers and complexities," he adds, "and it lives with you."
South Pacific is 8 pm Friday, March 18, 2 and 8 pm Saturday, March 19, and 1 pm Sunday, March 20. Tickets start at $20.50. Visit HultCenter.org for more information.
To Die Like a Man
A powerful production at VLT explores the art of facing an unjust death
Theater 1 week ago
Terrell Dickerson, Dawaun Lawler, Michael Hoekstra
A Lesson Before Dying, Romulus Linney's drama based on the acclaimed 1993 novel by Ernest J. Gaines, is now playing in a heart-wrenching production at The … Continue reading →
Pegasus Playhouse Takes Flight
Theater company opens new location, continues to expand limits of the youth musical
ArtsBlogTheater 2 weeks ago
Amelia Stinson, Lola Stinson, Julie Roelof, Abigail Frazee, Story Frazier-Maskiell, Brooklyn Nessin and Adeline Daggett will be in 'Winnie the Pooh' opening Jan. 21. / photo courtesy Pegasus Playhouse
Amelia Stinson, Lola Stinson, Julie Roelof, Abigail Frazee, Story Frazier-Maskiell, Brooklyn Nessin and Adeline Daggett will be in 'Winnie the Pooh' opening Jan. 21. / … Continue reading →
Tags: EW Extra / Very Little Theatre
'Finding Each Other'
Eugene theater set to host original play about breast cancer, space and discovering friendship under the unlikeliest of circumstances
Theater 2 weeks ago
Dmitri Rose and Nina Kuhl.
"You can find connection with any person if you're able and open to listen," says Siena Marilyn Ledger, the playwright of Man and Moon. Eric … Continue reading →


dreams in Petersfield is the mission of the experts we have selected for you!
Personalised service is at the foundation of Twirl Bridal and we like to think our ethos parallels that of visiting any London or Parisian boutique. The Twirl team are extremely knowledgeable with... bridal fabrics, styling, and accessorising the bride as well as her maids.


22 March 2019 LGPS Funds: Valuation anyone?
One of Lord Hutton's key recommendations was that retaining defined benefit schemes in the public sector should come with the condition that there is a "cost cap" mechanism. This seemed like a good idea at the time but like many things in life is easier to say than actually do.


text:
Q: Issues in calculating tf-idf in gensim I am using Gensim to calculate tf-idf scores for my corpus mentioned below.
corpus=['human interface computer',
 'survey user computer system response time',
 'eps user interface system',
 'system human system eps',
 'user response time']

My current code is as follows.
dictionary = corpora.Dictionary(line.lower().split() for line in corpus)

class MyCorpus(object):
    def __iter__(self):
        for line in corpus:
            yield dictionary.doc2bow(line.lower().split())

corpus = MyCorpus()

tfidf = models.TfidfModel(corpus)

corpus_tfidf = tfidf[corpus]

However, I get the error RecursionError: maximum recursion depth exceeded while calling a Python object (PS: if my code is wrong I am happy to have a different code). Please help me to calculate tf-idf values for my current corpus. Moreover, I want to get the 3 terms that has the highest tf-idf score in my corpus.
Please help me!

A: Well you are redefining your original corpus list as a MyCorpus object, so of course this is going into an infinite recursion when trying to iterate over it (since you iterate over corpus in the __iter__ method). Maybe you want to define my_corpus = MyCorpus()? Otherwise explain what you are trying to do...

redpajama_set_name: RedPajamaStackExchange


text:
Q: How can I access nested JSON object in Django Template properly? I'm trying to access some info with dot notation but I'm getting a weird error. I'll try to explain as well as I can with my code.
My relevant code from views.py file:
def index(request):
    // removed "x" assignment as it is long an irrelevant
    month = (datetime.datetime.now()).strftime("%B")
    year = str(datetime.datetime.now().year)
    customers = table(x, month, year)
    return render(request, 'index.html', {'customers': customers, "month" : month, "year": year})

Here, I call my tablequery file with table function to return a JSON object of files I have from MONGODB(I am not using MONGODB as the default DB so I do it manually). My table function is as follows:
def table(user, month, year):
    ///// Code to access DB removed
    curs = col.find()
    list_curs = list(curs)
    liststring = json.dumps(list_curs)
    liststring = re.sub("_", "", liststring) // have to remove _ from "_id" because template doesnt allow "_id" type of variable to be used with dot notation
    jt = json.loads(liststring)
    return jt

Type of "jt" appears to be "list" in python when I print it.
My relevant html code:

    {% for customer in customers %}

            {{ customer.id }}
            {{ customer.isim }}

                {% for ekran in customer.ekranlar %}

                        {{ ekran }} DENEME
                        {{ customer.ekranlar.1.hesapbakiyeTL}} TL
                        {{ customer.ekranlar.1.yurtdisibakiyedolar}} USD
                        {{ customer.ekranlar.1.yurtdisibakiyeeuro }} Euro

                {% endfor %}

            {{ customer.temsilci }}

{{ customer.toplambakiyeTL }} TL

{{ customer.toplambakiyeUSD }} USD

{{ customer.toplambakiyeEURO }} EURO

    {% endfor %}

Problem lies within the second for-in loop. When I write "ekran" in customer.ekranlar, I only get the "1", "2", "3" etc as output, but not the values for those. There are more variables within those nested objects(? maybe not objects) but I can only access them if I do "customer.ekranlar.1.hesapbakiyeTL" but when I do "ekran.hesapbakiyeTL"(because I need them looped an printed in table cell) I dont get anything because "ekran" is only "1" or "2" or whatever else the name of the "ekran" is but not the values inside.(I have 4 different accesses as tests to see what is visible how, so it's not the final form)
What I think it should be is like I said, "ekran.hesapbakiyeTL" should be able to access that value, but "ekran" only gets the key, not the nested keys/values inside it. I tried so many different things, tried to change the tablequery output type but I get different problems that way, tried to us "forloop.counter" to use as index to access directly as "customer.ekranlar.forloop.counter" but it appears variables cannot be used in dot notation and many others I've forgotten in the last week. Please, I've been stuck trying to access those values within the for-in loop which stops me from going forward with my project and add other functions.
An example document directly from MongoDB Compass app:
Image for data example
Blues: float numbers
Blacks: strings
There can be more in "ekranlar" as in 1, 2, 3...
All help is appreciated.
Thank you all and have a good day
edit1: I tried to get nested values seperately from python. Same things happens. As soon as I use a second for loop to access like "{{ for ekranlar in customer.ekranlar }}, I only get the key values, not the other variables or their content inside
edit2: How I got around it is that I created a custom tag and sent the customer info to a python file in templatetags with forloop.counter and returned needed info that way. Feels a little clunky but works so meh... If anyone gets around to why this happens inside template html, I'd still love to hear it.


text:
Trace: • vulnerability_discovery_models
vulnerability_discovery_models
How to Find and Assess Dangerous Vulnerabilities?
Bringing order to the dependency hell: which vulnerable dependencies really matter
A Screening Test for Disclosed Vulnerabilities in FOSS Components
Effort of security maintenance of FOSS components
Which static analyzer performs best on a particular FOSS project?
Which vulnerabilities are actually exploited in the Wild?
Research goals and outputs
Data collection and (a quick) analysis
Empirical Validation of Vulnerability Discovery Models
The proposed solution
Talks and Tutorials
Among the research topics of the Security Group we focus on here on the following activities:
Which vulnerable dependencies really matter?
How to (automatically) find vulnerabilities in the deployed versions of FOSS?
How to automatically test them (when you get a report)
Which vulnerability scanning tool performs best on your particular project?
Empirical Validation of Vulnerability Discovery Models?
See also our sections on Security Economics and Malware Analysis.
Most importantly, Do you want data? We know that building datasets is difficult, error prone and time consuming so we have decided to share our efforts of the past 4 years. Check our Security Datasets in Trento.
Vulnerable dependencies are a known problem in today's open-source software ecosystems because FOSS libraries are highly interconnected and developers do not always update their dependencies.
In our recent paper we show how to avoid the over-inflation problem of academic and industrial approaches for reporting vulnerable dependencies in FOSS software, and therefore, satisfy the needs of industrial practice for correct allocation of development and audit resources.
To achieve this, we carefully analysed the deployed dependencies, aggregated dependencies by their projects, and distinguished halted dependencies. All this allowed us to obtain a counting method that avoids over-inflation.
To understand the industrial impact, we considered the 200 most popular FOSS Java libraries used by SAP in its own software. Our analysis included 10905 distinct GAVs (group, artifact, version) in Maven when considering all the library versions.
We found that about 20% of the dependencies affected by a known vulnerability are not deployed, and therefore, they do not represent a danger to the analyzed library because they cannot be exploited in practice. Developers of the analyzed libraries are able to fix (and actually responsible for) 82% of the deployed vulnerable dependencies. The vast majority (81%) of vulnerable dependencies may be fixed by simply updating to a new version, while 1% of the vulnerable dependencies in our sample are halted, and therefore, potentially require a costly mitigation strategy.
Our methodology allows software development companies to receive actionable information about their library dependencies, and therefore, correctly allocate costly development and audit resources, which is spent inefficiently in case of distorted measurements.
Do you want to check if your project actually uses some vulnerable dependencies? Let us know.
Our new paper in the IEEE Transactions on Software Engineering proposes an automated method to determine the code evidence for the presence of vulnerabilities in retro software versions.
Why is should you worry about a disclosed vulnerabilities? Each time a vulnerability is disclosed in a FOSS component, a software vendor using this component in an application must decide whether to update the FOSS component, patch the application itself, or just do nothing as the vulnerability is not applicable to the older version of the FOSS component used.
To address this challenge, we propose a screening test: a novel, automatic method based on thin slicing, for estimating quickly whether a given vulnerability is present in a consumed FOSS component by looking across its entire repository. We have applied it our test suit to large open source projects (e.g., Apache Tomcat, Spring Framework, Jenkins) that are routinely used by large software vendors, scanning thousands of commits and hundred thousands lines of code in a matter of minutes.
Further, we provide insights on the empirical probability that, on the above mentioned projects, a potentially vulnerable component might not actually be vulnerable after all (e.g. entries to a vulnerability database such as NVD, which says that a version is vulnerable when the code is not even there),
A previous paper in the Empirical Software Engineering Journal focussed on Chrome and Firefox (spanning 7,236 vulnerable files and approximately 9,800 vulnerabilities) on the National Vulnerability Database (NVD). We found out that the elimination of spurious vulnerability claims found by our method may change the conclusions of studies on the prevalence of foundational vulnerabilities.
If you are interested in getting the code for the analysis please let us know.
In our paper we investigated publicly available factors (from number of active users to commits, from code size to usage of popular programming languages, etc.) to identify which ones impact three potential effort models: Centralized (the company checks each component and propagates changes to the product groups), Distributed (each product group is in charge of evaluating and fixing its consumed FOSS components), and Hybrid (seldom used components are checked individually by each development team, the rest is centralized).
We use Grounded Theory to extract the factors from a six months study at the vendor and report the results on a sample of 152 FOSS components used by the vendor.
Our paper in proceedings of International Symposium on Empirical Software Engineering and Measurement addresses the limitations of the existing static analysis security testing (SAST) tool benchmarks: lack of vulnerability realism, uncertain ground truth, and large amount of findings not related to analyzed vulnerability.
We propose Delta-Bench – a novel approach for the automatic construction of benchmarks for SAST tools based on differencing vulnerable and fixed versions in Free and Open Source (FOSS) repositories. I.e., Delta-Bench allows SAST tools to be automatically evaluated on the real-world historical vulnerabilities using only the findings that a tool produced for the analyzed vulnerability.
We applied our approach to test 7 state of the art SAST tools against 70 revisions of four major versions of Apache Tomcat spanning 62 distinct Common Vulnerabilities and Exposures (CVE) fixes and vulnerable files totalling over 100K lines of code as the source of ground truth vulnerabilities.
The most interesting finding we have - tools perform differently due to the selected benchmark.
The Delta-Bench was awarded silver medal in the ESEC/FSE 2017 Graduate Student Research Competition: Author's PDF or Publisher's Version
Let us know if you want us to select a SAST tool that suits to your needs.
Vulnerability exploitation is, reportedly, a major threat to system and software security. Assessing the risk represented by a vulnerability has therefore been at the center of a long debate. Eventually, the security community widely adopted the Common Vulnerability Scoring System (or CVSS in short) as the reference methodology for vulnerability risk assessment. The CVSS is used in reference vulnerability databases such as CERT and NIST's NVD, and is referenced as the standard-de-facto methodology by national and international standards and best-practices for system security (e.g. U.S. Government SCAP Protocol).
Today's baseline is that if you have a vulnerability and its CVSS score is high, you are in trouble and must fix it. But this may not be so realistic…
We are trying to assess to what degree this "baseline" can be reasonable to follow: after all, any CIO of any company big enough to care about security, will tell you "if this was a perfect world, maybe: but you are crazy if you think I'll fix every vulnerability out there, high CVSS or not". Surely, CIOs and CEOs care about business continuity on top of business security, and to this extent updates can sometimes be more risky to apply than vulnerabilities not to patch.
We are going to present a detailed analysis of how CVSS influences (positively and negatively) your patching policy at the beginning of August at BlackHat USA 2013 in Las Vegas, USA. Want to come? PDF of the BlackHat presentation or the talk video on YouTube . You can also check out the Full paper on ACM TISSEC (Now ACM TOPS) .
Our research gravitates around the question "are really all (high CVSS score) vulnerabilities interesting for the attacker?" With this question we renounce in giving a general answer that would identify every possible attack vector, ending with really not identifying anything in particular (see our CCS BADGERS work): on the contrary, we are seeking for a general law of macro-security that can cover the greatest majority of the risk.
We developed a methodology that allows the organisation to:
Identify vulnerabilities that are more likely to be exploited by attackers, and therefore represent higher risk
Quantitatively (as opposed to current qualitative approaches) evaluate the risk of successful attacks on a per-system basis.
Calculate the risk reduction entailed by a patching action, hence enabling the organisation to deploy meaningful vulnerability management strategies.
For example, our methodology enables CIOs and decision makers to make assessments such as "System K has a Z% likelihood of being successfully attacked. If I fix these V vulnerabilities on the system, my risk of being attacked will decrease by X%".
Additional information on the methodology can be found in our ACM TISSEC article.
To perform our study we collected five databases of vulnerabilities and exploits.
NVD is the reference database for the population of vulnerabilities (link)
EDB is the reference database for public (proof-of-concept) exploits (link)
EKITS is our database of vulnerabilities and exploits traded in the black markets. We have built an update infrastructure that allow us to keep our database well ahead of any public source on such vulnerabilities publicly available (e.g. Contagio's Exploit Pack Table). For more information on the black markets and our work in this area see Malware Analysis.
SYM is our ground-truth database of vulnerabilities actually exploited in the wild as reported by Symantec's sensors world wide. This dataset is publicly available through Symantec's website.
WINE reports volumes of attacks per month from 2009 and 2012. Its collection was possible thank to our collaboration with Symantec's WINE Program
The Picture on the right is a Venn-Diagram representation of vulnerabilities and CVSS scores in our database. Colours are representative of High, Medium and Low CVSS scores (Red, Orange and Cyan respectively). Areas are proportional to volumes of vulnerabilities. As one can immediately see, NVD is disproportionally big with respect to any other database. Remember that NVD is the database into which, according to the SCAP protocol, are contained all the vulnerabilities you should fix, and SYM is the dataset of actually exploited vulnerabilities. Adjusting by software type and year of the vulnerability does not change the overall figure: NVD is full of un-interesting (or at least not-high risk) vulnerabilities, despite what the CVSS score says.
EDB (or the equivalent OSVDB) is often used as the reference dataset for "actually exploited" vulnerabilities. Many researchers already observed that a vulnerability should represent higher risk if a public exploit for it exist. Still, EDB intersect SYM for only ~4% of its surface: most publicly available exploits aren't used by attackers! And, most interestingly, more than 75% of SYM is not covered by EDB, which decreases the credibility of the latter, as a risk marker for vulnerabilities, by a fair amount.
EKITS is the small square at the intersection between SYM and EDB. It features only about 100 vulnerabilities and still, according to Google, it may drive as much as 60% of the overall attacks against the final users ( see Trends in circumventing web-malware detection (PDF)). EKITS is covered by SYM for 80% of its surface, meaning that if a vulnerability is in the black markets it is, most likely, going to be attacked.
Focusing on the CVSS score distributions, a few facts are worth being underlined:
Even by controlling by CVSS score in NVD, one ends up fixing way more vulnerabilities than those really used by the bad guys. Look at the all the red in the picture with respect to SYM (the vulnerabilities you should care the most about).
EDB features mostly low and medium score vulnerabilities (and fairly easy ones too: see our technical report on vulnerabilities).
Only 50% of SYM is composed by high risk vulnerabilities.
Overall, these results show, in our opinion, that much room for improvement in vulnerability metrics and risk assessment is possible. Our contribution is rooted in:
Identifying technically interesting vulnerabilities for the attacker;
Developing an expected-utility model for exploitation to plug into the assessment methodology
Building a macro-law of security that addresses the big chunk of risk represented by only a few vulnerabilities (as it looks like from these figures and as reported by Google).
For further insights we refer the interested reader to the Malware Analysis and Security Economics sections of this Wiki.
Vulnerability Discovery Model (VDM) operates on known vulnerability data (or observed data) to estimate the cumulative number of vulnerabilities found and reported in released software. A VDM is a function family with some parameters, for example, the linear model (LN) is: LN(t) = At + B where t is the time, A, B are two parameters. These parameters are valued by fitting the model to observed data.
A successful model should not only well fit the observed data, but also be able to predict the future trend of vulnerabilities.
The figure on the right exhibits the taxonomy of recent VDMs. VDMs are categorized into two major categories: time-based models and effort-based models. Most of state-of-the-art models fall into the first category. Only one model is classified into the second category. The time-based models divide into three other subcategories:
Linear models:
Simple Linear (LN): this is the simplest model, the straight line.
Rescorla's Quadratic (RQ): proposed by Eric Rescorla
Software Reliability Growth models (SRGM): models in this subcategory are fist introduced for modeling the software reliability. Now they are reused to capture the vulnerability trend.
Anderson's Thermodynamic (AT): proposed by Ross Anderson
Logarithmic Poisson (LP)
Rescorla Exponential (RE): proposed by Eric Rescorla
S-shape models: models in the category are inspired by logistic distributions. The shape of these model s is similar to letter S (s-shape).
Alhami-Malaiya Logistic (AML): proposed by Omar Alhazmi and Yashwant Malaiya
Weibull (JW): proposed by HyunChul Joh et al.
AML for Multi-version software: proposed by Jinyoo Kim et al.
Folded VDM (YF): proposed by Awad Younis et al.
The above models were supported with one or more empirical evidences by the proponents, except the Aderson's one. However, there are some concerns in their experiments:
Vulnerability is not clearly defined while a lot of vulnerability definitions exists (from technical level to high abstract level). This would impact the way vulnerabilities were counted. This concern is referred to as vulnerability definition
All versions of software were often considered as a single entity. Even though there is a large amount of shared code among different versions of a software, still they are different from a non-negligible amount of code. Their vulnerability trajectories therefore are also different. This concern is referred to as multi-version software
The goodness-of-fit (i.e. how well a model fits the observed data) was often evaluated at a single point of time. This is an internal validity to the conclusion of previous experiments. This concern is referred to as brittle goodness-of-fit.
We propose an experimental methodology to systematically assess the performance of a model based on two quantitative metrics: quality and predictability. The methodology includes following steps:
Step 1 Acquire the data sets: collect different data sets of vulnerabilities with respect to different definitions of vulnerability and different versions of software. The assessment of VDM will be established based on these data sets, so it will cover different definitions of vulnerability. By doing this, we address the vulnerability definition and multi-version software concerns.
Step 2 Fit the VDM on collected data: estimate the parameters of VDM so that it could fit the collected data as much as possible. The goodness-of-fit of the fitted model can be evaluated by using the chi-square test for goodness-of-fit.
Step 3 Perform goodness-of-fit quality analysis: perform an analysis on the quality of VDM in software lifetime. This addresses the brittle goodness-of-fit concern.
Step 4 Perform predictability analysis: perform an analysis on the predictability of VDM.
Step 5 Compare VDM: compare a VDM with others to determine which one is better.
We apply the proposed methodology to evaluate state-of-the-art models. They are evaluated in different usage scenarios such as:
Plan for lifetime support: we have the history data for a year (or more). We are looking for what will happen in the next quarter to plan the support activities.
Upgrade or keep: we have the history data for a year. We want to know the trend in next 6 months so that we can decide whether to keep current system or to go over the hassle of updating.
Long-term deployment in the field: we have the history data for a year (or more). We would like to decide whether to deploy the system in the field. Hence we want to see the situation in the next one or two years. For example, an operating system and a browser used in a ticketing machine at a station. Such system might be there for years.
Our analysis has revealed that the most appropriate model is the simplest one (LN) when software is young (12 months). In other cases, s-shape models perform better where AML model is significantly better for middle-age software (36 months), but there is no statistically significant difference among s-shape models when software is old (72 months).
The details of our methodology as well as the validation of existing models are published in TSE. Preliminary analysis on VDM could be found in our ESSoS'12, and ASIACCS'12 papers
The following is a list of people that have been involved in the project at some point in time.
Ivan Pashchenko
Luca Allodi
Viet Hung Nguyen
Fabio Massacci
Stephan Neuhaus
This activity was supported by a number of project
SECONOMICS
VAMOSS
I. Pashchenko, S. Dashevskyi, F. Massacci. Delta-Bench: Differential Benchmark for Static Analysis Security Testing Tools. To appear in International Symposium on Empirical Software Engineering and Measurement (ESEM2017), 2017. Prepub version
I. Pashchenko. FOSS Version Differentiation as a Benchmark for Static Analysis Security Testing Tools. In Proceedings of 2017 11th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'17), 2017. Author's PDF or Publisher's Version
V.H. Nguyen, S. Dashevskyi, and F. Massacci. An Automatic Method for Assessing the Versions Affected by a Vulnerability, Empirical Software Engineering Journal. 21(6):2268-2297, 2016. Publisher's copy
L. Allodi. The Heavy Tails of Vulnerability Exploitation In the Proceedings of ESSoS 2015 PDF.
L. Allodi, F. Massacci. The Work-Averse Attacker Model. In the Proceedings of the 23rd European Conference on Information Systems (2015). PDF.
L. Allodi, F. Massacci. Comparing vulnerability severity and exploits using case-control studies. In ACM Transactions on Information and System Security (TISSEC).PDF (Draft)
S. Dashevskyi, D.R. dos Santos, F. Massacci, and A. Sabetta. TestREx: a Testbed for Repeatable Exploits, In Proceedings of the 7th USENIX conference on Cyber Security Experimentation and Test (CSET), 2014. PDF
F. Massacci, V.H. Nguyen. An Empirical Methodology to Evaluate Vulnerability Discovery Models. In IEEE Transactions on Software Engineering (TSE), 40(12):1147-1162, 2014.PDF
L. Allodi. Internet-scale vulnerability risk assessment (Extended Abstract). In Proceedings of Usenix Security LEET 2013, Washington D.C., USA. PDF
Luca Allodi, Fabio Massacci How CVSS is DOSsing your patching policy (and wasting your money). Presentation at BlackHat USA 2013. Las Vegas, Nevada, Jul 2013. Slides White Paper
L. Allodi, W. Shim, F.Massacci. Quantitative assessment of risk reduction with cybercrime black market monitoring. In: Proceedings of the 2013 IEEE S&P International Workshop on Cyber Crime (IWCC'13), May 19-24, 2013, San Francisco, USA. PDF
V.H.Nguyen and F.Massacci. The (Un)Reliability of Vulnerable Version Data of NVD: an Empirical Experiment on Chrome Vulnerabilities. In: Proceeding of the 8th ACM Symposium on Information, Computer and Communications Security (ASIACCS)'13, May 7-10, 2013, Hangzhou, China PDF.
Luca Allodi, Fabio Massacci. A Preliminary Analysis of Vulnerability Scores for Attacks in Wild. ACM Proceedings of BADGERS 2012 CCS Workshop. ACM,PDF
V.H.Nguyen and F.Massacci. An Independent Validation of Vulnerability Discovery Models. In: Proceeding of the 7th ACM Symposium on Information, Computer and Communications Security (ASIACCS)'12, May 2-4, 2012, Seoul, Korean. PDF
V.H.Nguyen and F.Massacci. An Idea of an Independent Validation of Vulnerability Discovery Models. In: Proceeding of the International Symposium on Engineering Secure Software and Systems (ESSoS)'12, February 16-17, 2012, Eindhoven, The Netherlands. PDF (Short paper).
F. Massacci, S. Neuhaus, V. H. Nguyen. After-Life Vulnerabilities: A Study on Firefox Evolution, its Vulnerabilities, and Fixes. Proc. of ESSOS-2010. PDF
Ivan Pashchenko, Stanislav Dashevskyi, Fabio Massacci Delta–Bench: Differential Benchmark for Security Testing. Poster at ESSoS 2017. Bonn, Germany, July 2017. Poster
Ivan Pashchenko, Stanislav Dashevskyi, Fabio Massacci Design of a benchmark for static analysis security testing tools. Presentation at ESSoS Doctoral Symposium 2016. London, UK, Apr 2016. Slides
Luca Allodi Internet-scale vulnerability risk assessment (Extended Abstract). Presentation at Usenix Security LEET 2013. Washington D.C., USA, Aug 2013. Slides
Luca Allodi. Quantitative assessment of risk reduction with cybercrime black market monitoring. Talk at IEEE SS&P IWCC 2013, San Francisco, CA, USA. Slides
Luca Allodi Risk metrics for vulnerabilities exploited in the wild Lecture at University of Milan, April 2013. AbstractSlides
Luca Allodi Exploitation in the wild: what do attackers do, and what should(n't) we care about. UniRoma Tor Vergata. February 2013. Slides
Luca Allodi. A Preliminary Analysis of Vulnerability Scores for Attacks in Wild. Presentation at 2012 CCS BADGERS Workshop, Raleigh North Carolina (U.S), 15 Oct 2012 Slides
Fabio Massacci. My software has a vulnerability, should I worry? Siemens Research Center, Munich. 18th December 2012. slides. See also Security Economics and Vulnerability Discover Models
Viet Hung Nguyen. The (Un)Reliability of NVD Vulnerable Version DataAn Empirical Experiment on Google Chrome Vulnerabilities Presentation at ASIACCS'13, May 203, Hangzhou, China. Slides
Viet Hung Nguyen. Vulnerability Discovery Models: Which workds, which doesn't? Presentation at ASIACCS'12, 3rd May 2012, Seoul, Korea Slides (Revised and updated version of the ESSoS'12 slides)
Viet Hung Nguyen. Vulnerability Discovery Models: Which workds, which doesn't? Presentation at ESSoS'12, 17th February 2012, Eindhoven, The Netherlands Slides
vulnerability_discovery_models.txt · Last modified: 2018/08/31 11:29 by ivan.pashchenko@unitn.it


Home Prints Lithographer: Prang's aids for object teaching. Trades & occupations. Plate 5.
Lithographer: Prang's aids for object teaching. Trades & occupations. Plate 5.
Title Lithographer: Prang's aids for object teaching. Trades & occupations. Plate 5.
Publishing details Boston : Published by L. Prang & Co.
Physical Description 1 print : chromolithograph ; image 30.4 x 50.8 cm., sheet 36 x 55.4 cm.
Summary Interior of a lithography shop. One of twelve lithographs depicting trades and occupations from the educational series called "Aids for Object Teaching." Gift of Charles E.Mason, Jr.
Genre terms Genre prints--United States--1870-1880.


In our role as the Building Research Establishment and a leading BIM Accreditation agency, we see many examples of projects that claim to be delivering BIM Level 2 which are little more than 3D models with attached documents. A fundamental requirement of BIM Level 2 is the delivery of structured data that satisfies the asset information required by the client and their operational team, and too little attention has been paid to this vitally important aspect of BIM.
My concern is that many of the BIM proposals don't manage the data element of interoperability effectively because they don't address the "devil in the detail". Too often, there are untested concepts pushed onto an already struggling industry without reference to that detail. Most people rely on applications to export data but few are checking a recipient will get something useable and coherent. When such problems crop up, these become blockers to the adoption of BIM and, unless they are recognised and addressed effectively, it affects the wider mission.
To facilitate change you not only need a driver for change, but you also need to remove the blockers or problems to facilitate that change. Any solutions taken forward need to address the problems and must be implementable by the whole industry and not simply by a privileged few with the specialist expertise to create workarounds.
The key to the resolution of any problem, blocker or barrier is to recognise that it exists. The success of the Building Information Management process identified as Level 2 is down to those standards and documents that have been developed to remove the blockers to adoption. But to remove the blocker, they first recognised that a blocker might exist. Unfortunately, hindsight is generally the accepted solution, and even with this, often other excuses are developed to hide the true problem.
The article "£185,000,000: Is this the cost of delivering COBie UK?" highlighted the issues with the delivery of structured data. The reality is that delivering structured data to meet the Asset Information Requirements identified in the Employers Information Requirements is just one of the problems identified.
There has been a huge expectation placed upon the three letter acronym especially when it finally matures to Level 3. Here the talk is of big data; the internet of things; as well as delivering faster, cheaper buildings. But key to success is the delivery of information that will aid the decision-making process for all those involved. Again the devil is in the detail, and this is where understanding those problems and finding appropriate solutions is paramount. Various research projects have identified similar problems and solutions to these have already been tried and tested.
Structured data is key to interoperability, and the issues that presently exist are best resolved by the standardisation of the data formats. The perception that IFC is the only solution has held back the industry for many years, due to the speed of development and lack of supporting funding. While there is a need for IFC to expand, the creation of a standard data dictionary can alleviate the development problems through using product experts and input into IFC; plugging those gaps.
To this end, the Construction Product Association are launching the LEXiCON tool in April. This will be a 'free to use' process to allow products to be defined and their data formatted in a unified approach. The CPA appointed BRE in cooperation with Active Plan given their extensive experience in developing the Templater Tool, this being its latest incarnation. At its heart is the provision of a standard data dictionary using Web Service API's to enable the delivery of the standardised structured data, and remove the construction product data problems that exist.
Identifying and implementing the best solution doesn't just happen. Implementation involves change, and then the people, process and technology blockers come into play. The best solution needs to evaluate the problems and provide implementable solutions. The development of the Templater Tool has followed such a path, and it now provides solutions to problems that many presently do not know exist because they don't try and read and validate the data they deliver.
To facilitate change, we need to make it easier for people to change than to continue doing what they have previously been doing. This involves standardising process and technology and providing solutions to alleviate those blockers that will be created.
The creation of LEXiCON as a data dictionary holding a data standard does not resolve the problem on its own. However, it does provide a foundation upon which other tools and solutions can be built which can start to resolve the problem. But what problems is it solving and what does change look like?
Amongst the LEXiCON launch events, it will feature at the BRE BIM Prospects conference in April, where various companies will be discussing the problems they have identified and how this new system will improve delivery.
We have now reached a point where the data problem has at least been identified, and solutions are being developed. What is key over the coming years is the ability for further tools and technology to be developed that can impact on the people and process to ensure that positive and sustainable change can be implemented.


"We write today to express our concerns regarding proposals contained in the Federal Motor Carrier Safety Administration (FMCSA) notice of public comment on: "Regulatory Guidance: Applicability of the Federal Motor Carrier Safety Regulations to Operators of Certain Farm Vehicles and Off-Road Agricultural Equipment" [Docket No. FMCSA-2011-0146]. We appreciate the extension of the public comment period from June 30, 2011 to August 1, 2011, which allows additional time for those potentially negatively impacted by the proposed rule changes to voice their opinions.
"Farming can certainly be a dangerous occupation and we strongly agree that safe transportation of agricultural equipment on roads and highways is of utmost concern. However, it is our collective opinion that the FMCSA proposed rule changes would provide no quantifiable benefit; but only serve to excessively and unnecessarily overburden U.S. agriculture producers who are already strained by cumbersome federal regulations.
"How does one distinguish between intra- and interstate commerce when a commercial motor vehicle (CMV) is operated within the boundaries of a single state?
"The 1975 U.S. Department of Transportation Federal Highway Safety Administration guidance for enforcement agencies provides that agricultural products should be considered interstate commerce because farmers intend for their crops to be sold out of state.
"When marketing grain or livestock at local facilities or livestock barns, farmers do not necessarily intend for their crops or livestock to be sold out of state. Farmers and ranchers generally market their products at the closest market that offers the best prices. Often this is the local elevator or livestock auction barn, where the farmer or rancher relinquishes ownership and control of their crops and livestock. The incorrect assumption that these crops or animals will eventually be sold or processed in another state does not mean anyone could reasonably assume that farmers and ranchers are therefore engaged in interstate commerce. For example, most livestock operations purchase large amounts of locally grown feed grain and other agricultural products from local grain handling facilities. We suggest the FMCSA should rescind current guidelines which lead enforcement officials and motor carriers to broadly define movement of agricultural products as interstate commerce.
"Should the Agency distinguish between indirect and direct compensation (crop-share vs. cash rent leases) in deciding whether a farm vehicle driver is eligible for the exception to the commercial drivers license in 49 CFR 383.3(d)(1)?
"FMCSA is not interpreting crop share agreements correctly. Crop-share is simply another means of paying rent on agricultural land. Rather than paying cash for the rent, the landlord, under a share-lease agreement is entitled to a portion of the crop. Under these lease agreements, the tenant generally delivers the landlord's share of the grain to wherever the landlord wants it. Delivery of the crop-share is considered as part of the tenant's labor and machine work that is required to grow, harvest, and market crops, and does not define the farmer as a 'for-hire' commercial carrier.
"Should implements of husbandry and other farm equipment be considered CMVs?
"The Commercial Motor Vehicle Safety Act of 1986 established minimum national standards for commercial driver's licenses, in an attempt to improve highway and transportation safety. The act provides states the authority to waive the Commercial Driver's License (CDL) requirements for agriculture producers who operate farm equipment on public roads for short-distance trips. Agriculture is a critically important and economically significant industry for our states and this nation, and this exemption is extremely crucial for those involved in agriculture production.
"Implements of husbandry and other farm equipment should not be considered CMVs as they are not operated in interstate commerce and do not carry passengers. Farm machinery, under a blanket rule, should not be classified as CMVs and farm machinery owners and operators should not be required to acquire CDLs. A single federal standard for classifying farm machinery as CMVs is unworkable. If technical differences exist between federal and state laws and regulations, state laws should be the governing authority.
"While we agree road safety should be a top priority, we believe new regulations would amount to yet another government overreach and would have negative consequences on the food production industry. If this proposal were to become effective all farmers, ranchers, and producers would be determined commercial drivers, requiring them to acquire additional documentation, maintain health records, logs of their travel, and restrict the age of those permitted to drive farm equipment.
"At a time when many individuals and small business are facing economic uncertainty and unemployment remains high, we cannot afford to place additional burdens on our nation's producers of high quality, safe, and nutritious food. We have heard from many farmers and ranchers across the country who have already been encumbered with an abundance of new federal regulations. We are concerned that these new proposed requirements are simply additional attempts to further burden one of our nation's most essential industries.
The letter was signed by the following: John Thune, Pat Roberts, Richard Lugar, Mark Kirk, Olympia Snowe, John Boozman, Roy Blunt, James Inhofe, Jerry Moran, Chuck Grassley, John Hoeven, Claire McCaskill, Saxby Chambliss, Amy Klobuchar, Ben Nelson, Johnny Isakson, Mike Enzi, Thad Cochran, Mike Johanns, Tim Johnson, Susan Collins, and Kent Conrad.


text:
Tunisia 'queer film festival' seeks to make a difference
Wednesday, 17 Jan 2018 10:39 AM MYT
The first-ever film festival celebrating the LGBT community is underway in Tunisia, a Muslim country where homosexuals can face up to three years in prison. — Reuters pic
TUNIS, Jan 17 — The first-ever film festival celebrating the LGBT community is underway in Tunisia, a Muslim country where homosexuals can face up to three years in prison.
Twelve short and medium-length films produced in Tunisia and across the Middle East and North Africa are being shown at the "Mawjoudin Queer Film Festival" that opened Monday.
The four-day event is organised by Mawjoudin, Arabic for "We Exist", a Tunisian non-governmental association which defends the rights of lesbian, gay, bisexual and transgender people.
It is the first event of its kind in Tunisia and the organisers say the "festival conceives of itself as audacious".
The films "speak of sexuality, identity and gender affiliation," said Senda Ben Jebara, a member of Mawjoudin, a group founded in 2014.
"Through this festival we would like to give a space to queer people in general in order to escape a bit from social pressure, and also to identify with something, find a means to express ourselves," she said.
"We are trying to fight not only in the courts but through art."
Ben Jebara said the messages which the festival would like to get across are that "we are different but we exist and differences are welcome".
Mourad, a 21-year-old festival-goer, said the film fest "helps to strengthen the LGBT community and brings together people who are considered different".
Gay rights activists have emerged from the shadows in Tunisia since the revolution in 2011, but their position remains precarious in the North African country's conservative Muslim society.
Article 230 of the penal code includes a punishment of up to three years in prison for homosexuality and young men are regularly detained and prosecuted.
An online radio station catering for the LGBT community, believed to be the first of its kind in the Arab world, started broadcasting in Tunisia on December 18.
But Shams Rad, which was set up by LGBT rights group Shams and promotes "dignity, equality", is now facing legal procedures aimed at shutting it down. — AFP
Asia's first LGBT-focused streaming service tackles taboos
Turtles and tourists share the same beach on a Tunisian island
Electronic music festival rocks Tunisian desert


Sew Little Time: Update :: Sew Much Done!
Yes! A BTRT Silk Sale!
It seems foxes are hot. At the risk of being trendy, I thought I would feature some sweet foxes for my Waldorf Thursday post~ the colour for Thursday being orange.
Adorable foxes. We have a family of them living up the road from us.
I love them! Foxes are one of my fave animals. :) I especially love the Nikoart Arctic Fox Pendant, it looks almost just like my tattoo..in silver. ;) Thanks so much for sharing these great lil foxies!
so cool!!! my other dog looked like a fox so these photos are so awesome to me. foxes are soo cool.