text:
Max Nettlau, The Struggle against the State (1908)
Written by anarchisms_xnlmj6	 August 12, 2015 July 18, 2021
The Struggle against the State
[Les Temps Nouveaux, 13 no. 51 (April 18, 1908) : 3-4.]
What follows is not a translation, but a free and somewhat expanded summary of an article ["Are there New Fields for Anarchist Activity?"] that I wrote for the revue Mother Earth of New-York (December 1907, pp. 433-444), and as I have been led to make some new digressions, the comrades who publish that revue are completely absolved of any literary responsibility for the present writing.
I have often asked myself why anarchist ideas, which appears so clear to us and add so much to the joy of living in those who embrace them, are accepted in the end by so few people, even where long years of propaganda has encountered the fewest of obstacles. As long as I had faith in the mechanical (so to speak) possibility of an unlimited propagation of ideas though the pedagogical means of education and agitation, such limited success seemed mysterious and disgusting to me. Since then, I have arrived at the following explanation:
What is, in fact, the essence of anarchism? We observe three tendencies in every organism: that of appropriating and assimilating as much as possible of the surrounding matter most useful for its material well-being; that of extending its own sphere of action by an expansion that overcomes, as much as possible, all obstacles; and that of differentiating itself, of creating for itself an individuality it relation with heredity, the environment, etc. In humanity, these are the desire for material well-being, the love of liberty and the development of individuals, who little by little separate themselves from the more homogenous, more gregarious mass of times past. The end of this evolution is obviously a state of things in which the greatest liberty and well-being are accessible to each individual, in the form that best corresponds to their individuality and allows them to approach the greatest possible perfection—and that state of things of Anarchy.
Anarchy is this the state of the greatest happiness of which each individual is capable. It is obvious that this true Anarchy will not be established on the basis of a single economic and social system, but that there would be as many ways of managing things as there are individuals. We must also consider that, during the long period of time demanded for the conversion to anarchy of the most recalcitrant, the first anarchists will not stand still, but will march forward on their own part. So there will never be a future state of development (economic, moral, etc.) that is equal for all, any more than that equality exists in our time or has ever existed.
It cannot exist, for the simple reason that individuals differ from one another, and they are—with the exception of those whose development is still almost entirely crushed by the cruel oppression of the past and present—on the path to further differentiation. All desire well-being and liberty, but each desires it in a different degree and proportion. If certain causes—the common social position, persuasion, propaganda, suggestion, the enthusiasm of these great moments—diminish these differences, others—like heredity, environment, age and some many accidents of everyday life—have the opposite effect, and it is a deadly illusion to believe that it is enough to sway the masses in the manner of our rulers, which only occurs because they have played on the strings of all the prejudices, all the malice accumulated for so many centuries; too often only a feeble echo responds to us, who only count on what is noble and generous.
Each of us contributes to the success of our ideas in a different way, according to the proportion of the desire for liberty and for material well-being that is in them. One is driven by the love of liberty to the greatest sacrifice; the other lives peacefully and will be capable of an extraordinary effort for liberty only some moments of general enthusiasm. Propaganda and the struggle against authority demand a combative temperament that is not given to all, and many people, who are only disposed to put themselves forward through acts that cause the least stir, do nothing, since no occasion in this way seems to present itself for them. We must create a field of action accessible to them as well.
As for the working masses in general, they think above all of improving their material position and relegate liberty to the second rank. That is the effect of the commercial age and of the longstanding statist oppression. I fear that the desire of the working masses is above all revenge against capitalist society and that they only want to be masters in their turn, in order to perpetuate the domination of one class and the authority of a new worker state, just as the bourgeois of the Revolution, after defeating feudalism, no longer wanted liberty, but only the exclusive domination of their class. Those tendencies will perhaps prevail over those of the old good-faith socialists who still survive; and what could the anarchists do against that action of enormous masses that slip from the control of those who which neither to direct nor to dominate them, but to see them go by themselves down the road of liberty? The anarchists could only continue the task of our times, that of awakening the latent forces that tend towards liberty and to struggle, then and always, against authority.
These real tendencies of the masses have already led to the breakdown of socialism, which has realized that it is impossible to bring them together for anything but peaceful electoral struggles or syndical organizations that only pull away from all real socialism. From the other side the State, discredited though it is, tends to regain the confidence of the masses through all sorts of labor laws, retirement retreats, protection foreign workers, etc. I am far from forgetting the deeds in various countries accomplished by a revolutionary syndicalism, that general strikes of trade associations or localities, or even more extended strikes, can break out at any moment; but in this case as well, it always happens that this simple, logical step, the decisive step that leads from general strike to revolution, is not taken; it was not even taken in Russia, in October 1905, and that led to all the defeats and all the disasters of the Russian movement that we now see. Why do the most enthusiastic strikes always end with a lull and the peaceful return to work? It is because the masses do not really want to go any farther, and the few who do want it are powerless.
The initiative of the minorities and the action of the militants have their limits. A new idea, a new experiment sees the light of day first where favorable circumstances permit it; in this sense all progress is naturally due at first to minorities, to the isolated. But to impose that new idea on the majority, by force, is an act of authority, identical to the oppression exercised by the majority over minorities. This is a point that interests the anarchist above all; for if a tyrannical minority has a thousand means to impose its will on a majority, who could we who desire liberty give it to those who are not concerned enough about it to take it for themselves?
Look at science and ignorance: science does not reason with ignorance; it marches in advance, shows its results and little by little makes the less ignorant follow it. Now look at free though and religion: if some liberate themselves from religious absurdities, enormous masses still remain attached to them. In these two cases we end by finding a modus vivendi through a sort of mutual tolerance. Let us compare the infamous brutality of the ignorant bigotry of past centuries, directed against free thought, to the state of relative indifferent in our own time. I know well that what is there is only an armed peace and that the reaction only watches for a suitable moment to regain the lost ground, but the position is still infinitely different from that of the past; science and free thought, previously outlawed, today have a position, still small, but solid and unconquerable. Let us do the same for anarchy!
What has led to the relative cessation of these persecutions? Ignorance and bigotry, wishing to perpetuate their domination, thought that they could exterminate science and free thought by fire and blood: they have not succeed, for you cannot destroy an idea. Science and free thought, on their side, have equally seen that they run up against the firm prejudices of the large masses and have had to advance from their side, limiting themselves to welcoming with open arms those who feel closest to them and come to them. Free thought wishes to destroy all the religions as much as anarchy would love to destroy all authority, but that would be immediately possible only by the material destruction of ninety-nine percent of humanity; and even were that done, the persecutors would, by that work of persecution, have become authoritarians infinitely worse than their victims. So we have seen from both sides of bringing an end to a war of pure attack, of at least softening the forms of the struggle, and those who really wish to leave the field of prejudices and ignorance know how to find, and more easily every day, the path towards science and free thought. Tomorrow they will find, and with an equal ease, the road to anarchy.
We are not, I think very used to this sort of reasoning. Out of habit, we only contemplate the revolutionary path. So let us suppose the present capitalist regime destroyed. Some energetic minorities are extremely important at the moment of action; let us suppose then that the anarchists had contributed their best to that victory, that the prestige of anarchy was enormously increased, that in many places the old prejudices were forgotten and people had begun to live in anarchy. For that to occur, obviously, there would be no leaders, nor any single set of rules; so things would be very different in different places. Some would reject all organization; others would accept it in differing degrees. There would be groups and communes that would each attempt to practice liberty in their fashion, in or more less different ways. That is all excellent, and it is precisely what must occur; for only experiment will gradually show what is most appropriate and we will proceed in that way from the imperfect to the most perfect. But in the meantime, all these organisms would exist side by side in peace, and the attempts to impose this or that system other than by example would evoke only general scorn and sad memories of the persecutions of past times. If, consequently, in a new society, everyone wanted to practice anarchy, we would see a thousand shades of it, from the most moderate anarchy to the most advanced, without anyone finding fault.
But you will admit that this is to suppose the most favorable outcome. It very well could be that capitalism should be defeated under conditions where the organized workers, which is to say their leaders, would come to power; that would perhaps be the abolition of the salariat, but it would not necessarily be liberty or socialism; they would form a new bureaucracy that would go from an administrative role to a directing, governing role. The anarchists would be viewed as unfavorably by those people as the worker politicians of all labels are today. It would be necessary to make a new struggle against that society, without obvious exploitation but also without liberty, and no one can say if that struggle would be easier (and everyone, rid of economic worries, would make their way towards liberty), or more difficult (due to the indifference of the satisfied), than present struggles. It is likely that certain localities would be more advanced than the others and that at first anarchy would be established more easily in some places since the land and the instruments would be more accessible, while elsewhere difficulties would loom up as a result of the existence of an authoritarian organization that has always monopolized everything and denied the right of secession.
The conditions in which anarchy will perhaps be realized some day, will thus be more or less different in many places and it may be necessary, even then, to live alongside people who do not understand our ideal or who still only approach it gropingly. I ask myself consequently if it is not best to consider that situation future in the present and to act in such a way as to give anarchy the greatest possible chances of being practiced, tested, and respected in that future society?
What we must do, it seems to me, is to accustom ourselves to the idea of a future co-existence, temporary and steadily less noticeable, but a co-existence all the same of anarchist and non-anarchist institutions; in other words, we must accustom ourselves to the idea of a mutual tolerance. This is how it is, inevitably, every day for each of us, with the exception of those who feel themselves pushed toward direct revolt. What I mean is not at all submission to the present order, whether political or social. I think, on the contrary, that the anarchists should completely disregard the laws that hinder their personal liberty and obtain the recognition of the right to act in this way by those who, for reasons that are their own affair for the moment, believe or pretend to believe in the necessity of these laws for themselves and those who will follow them.
I know that these words demand some explanation; I regret that I must defer them until the next article.
(To be continued.)
M. Nettlau.
(Conclusion.)
[Les Temps Nouveaux, 13 no. 52 (25 avril 1908) : 2-4.]
The idea expressed in my first article—that the anarchists, recognizing the necessity of a temporary co-existence with less advanced persons and their institutions, and, consequently, of mutual tolerance, can put it into practice by refusing to submit to the laws on their own account, while leaving others complete liberty to prostrate themselves before them—that idea would appear utopian and unrealizable at first, but, sooner or later, whether to day or in a worker regime without capitalism, it must happen if we finally want to realize anarchy in the only manner possible, by beginning at the beginning. Economic independence, so desirable above all for that struggle, can be obtained, either through cooperation or after the fall of capitalism, taking the earth and tools as they find them. Tolerance, although it is the simplest of things, will not appear all by itself; we must know how to achieve it. There are some struggle that lead only to an increase of mortal hatred, to an absolute intolerance; there are others that, if they do not lead to mutual respect, which is a higher degree, end at least in mutual tolerance; so we must struggle in such a manner that it is tolerance and not intolerance that we find in the end—that is the heart of the matter for me.
What I would propose on the anti-statist terrain is already practiced by the anarchists on the economic terrain. There, not just since the emergence of syndicalism, but at all times they are united in solidarity with all the workers who feel that they are exploited, even without having any conscious desire for a complete economic change. An analogous solidarity must be established between all those who are in some way enemies of the State, without having clearly come to desire anarchy, nor to having the same economic ideas as us—just as we do not ask the workers unionized against capital to have the same political ideas as us. There is a vast field of labor there almost entirely unexplored and uncleared. The hatred for the State, scorn for the law and for the personnel who live under the laws, the unquenched thirst for liberty; that immense indignation that accumulates in almost everyone at each step, when we see that, despite all the so-called advanced institutions, we do not enjoy the least bit of real liberty, that we encounter the thousand obstacles and nuisances of Statism at each step—from all that, it would be necessary to create, in the manner of the syndicates, but on the freer and broader basis of groups that gather all those who, without being anarchists, begin to move closer to us, through their opposition to some particularly odious form of State influence. All the present methods of syndicalist struggle, and new ones too, which we will doubtless find, would be applied to that struggle against the State, the laws ad authority. There would result from this an anti-statist current that would, on the day of the economic victory, prevent a fall back into the errors of authority and all anarchy, if not a full or partial realization, which could still be impossible, at least a freer experimentation.
If this was an entirely new method, I would not speak of it; for it is impossible to create something of which the seeds do not already exist. But we see that at every moment, in real life, the majority of the laws remain completely ignored; and life would be impossible otherwise. The most brutal laws are one day trampled under foot, made impossible by a whole nation—the history of Ireland, of the abolitionist enemies of slavery in America, at base, the history of all political movements shows it to be so. If statistics were kept of the laws that were obeyed and those that were disobeyed, the absurdity of all legislation would be palpable; for society can only develop by trampling them underfoot, by sweeping away, at each step, the obstacles called rules and regulations.
There even exist some feeble attempts to recognize this state of affairs and to manage things accordingly. In England, it has been enough, for several years, to declare that one has a conscientious objection against vaccination, in order to be exempted from that law making vaccination mandatory for all; quite recently the formalities that exist in that regard have been reduced to a simple declaration. It is the result of long struggles directed against that special law; the adversaries of the law have not convinced its defenders to the point of revoking it for all, but they have managed to be left alone and all have been given the possibility of imitating them by a simple declaration. That would appear without great importance, but if, on other points, efforts had been made, we would already have won exemption from other laws, or at least that work would be well on its way; but in the past it has always been all or nothing—and with the principle of exemption, based on the natural right of secession, that each goes their own way and acts after their own fashion has never been a question. The Englishman Auberon Herbert advocates voluntarism with regard to taxes—tax paid by those who are interested in the object for which the money would be used and not payable for other. That has the air of a utopia, but the tax-strike is something rather serious and would be more popular than the act of outdoing one another to invent a new tax, as the statists do, the socialists included. The various projects for proportional representation show that the anarchists are not alone in not being indifferent to the crushing of minorities by traditional democracy. We also see the little nationalities that rise up against the large States, which must renounce forever the hope of leveling them and making them disappear in the vast mass of the cattle of the taxpayers and cannon-fodder. I do not speak of those whom religious fanaticism has always won a situation outside the law, of soldiers who refuse to touch a rifle from religious conviction, etc., but all that seems to me to demonstrate that true, determined efforts have always led to some solution, insufficient perhaps, but which all the same counters the principle of the equal crushing of all by the law. I recognize that these are still only feeble beginnings; so many other movements, in fact, tend to reinforce statism, that tendency that is so accommodating to the indolent and indifferent who are unconcerned about their liberty. There is also a living proof of it, these millions of socialist electors of all countries, and we would be badly fooled believing that syndicalism could ever do that anti-statist work that we demand, even if it calls itself anti-political or anti-parliamentary.
For, finally, let us cease to be hypnotized by syndicalism. The collective resistance of the workers against capital is an absolute struggle for them; that struggle must be made according to the demands of the hour and thus has nothing to do with the struggle against existing society of socialism and anarchy. With the disappearance of capitalism, syndicalism will necessarily come to an end and if some syndicalist theories appear according to which the raw materials and instruments of labor should enter afterwards into the possession of the corporations of the individual trades, that would be a new appropriation, a new monopoly that would contradict the first principle of socialism, which says that everything will belong to everyone. So syndicalism, which is excellent for the moment, has no future; it is a military dictatorship that the war against an equally concentrated enemy can justify for the moment, from a strictly technical point of view, but the continuation of which would be desired by no one after the battle. Now we know that it is in the nature of all authority to wish to perpetuate itself; an authoritarian syndicalist regime is thus as possible as the dictatorships of the two Napoleons have been. Plebiscites, direct government of the people by the people (the chimera of 1851 and of Considérant, Ledru-Rollin and Rittinghausen) and direct action (not the ideal, but the reality), are displacements of authority, which passes from parliament into the hands of a larger mass, so-called improvements of democracy, an incorrigible thing. I feel more than I can express in words that there between all that and our beloved "do what you will" there is an abyss. Besides, syndicalism is powerful enough and makes its way, asking nothing better than to be left alone by the anarchists and socialists who do not interest it; it gets along on its own. It is young in France and has still not yet entirely swallowed up and assimilated the libertarians who were so useful to it when it was still weak. You must go see it in England and America where it dates from the last century, devoid of all the idealism that some socialists also added to it there in its beginning; it is collective selfishness succeeding individual selfishness, the "labor trust," as it has been called in America. The young become old and the old do not grow young again—as long as we do not demolish this natural fact no one will convince me that the trades-unions will become revolutionary syndicalists and that French revolutionary syndicalism will always remain young.
It appears to me that a great breath of authority still issues from every collective movement and more than ever I see the necessity of a broad anti-statist propaganda, alongside a deeper propaganda of the ideas of anarchy in their entirety. Here, what we must deeply regret is that the anarchist idea has been, from its debut, so to speak, yoked to economic hypotheses (1) that have gradually passed to the state of doctrines and theories. In order to prove the practical possibility of anarchy, we erect economic utopias and anarchy is divided into schools: communist, collectivist, individualist, etc. It is very sad; for on the one hand we raise the veil of the future and we show the pleasure of the enjoyment of the greatest liberty and on the other we chain ourselves to some economic doctrine, the merit of which I do not contest, but which can only be an unverified hypothesis. We lack experience and it is absurd to believe that we can surmise what will be appropriate in a society that is still unknown or even that we could have a single doctrine instead of experimentation, on the largest scale, with all the economic possibilities compatible with the needs of liberty. When a newcomer comes to anarchy, they truly find no group, no book, no newspaper that has not long since rallied to one of the other of the economic schools and their doubts meet with little sympathy among the believers in found systems and solutions. So let us leave that all aside; the work of anti-statist and anarchist action and propaganda is so immense that it will require assembling all those who love liberty without immediately wishing to indoctrinate them and unify them of the economic terrain. Each will make their own utopia and group together, if it suits them, which those who come closest to it.
I know well that the altruistic sentiment is so well developed in the majority of anarchists that for some time they will still give all their support to syndicalism; others will act as rebels or as propagandists of the ideas in their ensemble. But those who do not find a complete satisfaction in all that, who want to escape the relative isolation of pure propaganda and at the same time not be swallowed up by syndicalism, those will perhaps find a new terrain for action in the anti-statist agitation, which will put them in contact as many people as syndicalism and allowed them more pronounced libertarian actions. Anti-militarism is an excellent precedent; it remains to carry similar sentiments into still larger milieus and, by attacking the State, the laws and authority in all its forms, to create a current of anti-statist opinion and anarchist sympathy that will one day facilitate the creation of a true anarchist milieu. Besides, everywhere, on the terrain of the struggle against the prejudices of the old morality, for liberty of thought and art,—there are vague aspirations that, through the propaganda and action of libertarians, can become more conscious, directed against the source of the evil: authority.
I believe that you will understand my point of view more easily if you consider once more what I have said about the inevitability of the co-existence of institutions of various characters. For example, it appeared impossible in the past that there could be two religions in the same State, and from that followed centuries of religious wars; today, free thought and all the religions exist side by side. It will be the same for social systems. The new and the old always live side by side. The old wants to stifle the new with persecutions, and the new wants to crush the old with proud attacks. A great deal of evil is done, but no party triumphs because there always remain men attached by all their inclinations, either to the old or to the new and because, moreover, the two camps are connected by countless intermediate shades. One day, the anarchists will be left to go their own way and lose interest in the State to such a degree that the State will lose interest in them, in the same way that today free thought and the churches are clearly separated. It remains to establish the economic basis of that independence—it will be cooperation or an expropriated portion of social capital. It will always be the case that anarchy will exist at first only for anarchists and the others will come around as at the speed and in the numbers that they wish—just as there will be fewer serious obstacles for anyone to accept free thought or free union—we will leave the State as today we leave the church or the moral systems of our grandfathers. That evolution—which is, in my opinion desirable—will be assisted, accelerated, and perhaps only made possible by the existence of widespread anti-statist sympathies, which will be equally indispensable for preventing any new authoritarian socialist or syndicalist regime. So it is a question of creating these sympathies and I have striven to demonstrate how, by supporting with all our strength, with an extreme patience and tolerance, all the anti-statist and anti-authoritarian tendencies that appear—and they will be more numerous than we believe. They we will give some serious basis to a true political libertarian and create the true support necessary for a final economic emancipation.
(1) Which, moreover, have never been given except as hypotheses and are not at all the shackles that comrade Nettlau sees them as.—Editor's note.
[Working translation by Shawn P. Wilbur]
Posted in 1908, Max Nettlau, Uncategorized
Fernando Tarrida del Mármal, "Questions of Tactics" (1890)
Max Nettlau, "Does Socialism Truly Want to Be International?" (1920s)


Almond bark (also known as vanilla flavored candy coating) is a chocolate-like confection made with vegetable fats instead of cocoa butter and with coloring and flavors added. It can be bought in packages, blocks, or round discs where candy and baking supplies are sold. The confection is commonly used to cover or dip fruits, caramel, oats, granola, nuts, cookies, or crackers, in place of real chocolate.
The term is also applied to a type of candy consisting of sheets or chunks of semisweet or milk chocolate to which almonds or almond pieces, and/or cherry almond flavoring have been added.
^ Jarvie, Valerie (June 14, 2010). "Bite-size cake balls are popular new treat with home cooks, bakeries". The Dallas Morning News.
^ Holiday Favorites Fall Sweets. Leisure Arts. 2009. p. 12. ISBN 978-1-57486-308-6.
^ Weinstein, Bruce (2000). The Ultimate Candy Book. New York: W. Morrow. ISBN 978-0-688-17510-8.


Lifestyle discovery	From 3 days & 3 nights. Opt for a shorter discovery programme with personalised and adapted objectives according to your lifestyle.
Choose this shorter discovery programme and set up your own goals according to your lifestyle. Understand the benefits of the recognised Vichy Method based on 5 essential principles.
If you need more informations about this programme of 3 days, you can directly go on our contact form.
The purpose of this weight loss programme is to help you fight extra pounds and gain a more tonic silhouette by making the body firm, and balanced.
At the beginning of your stay, you will be invited to a lifestyle consultation in order to understand the causes of your weight issue.
As part of your weight loss programme, you will be offered a daily Trilogy of "Signature" hydrotherapy treatments. These treatments are inspired by medical techniques developed in the famous water town of Vichy (France) and they are meant to provide deep relaxation. This trilogy is composed of following care treatments : a Hydro massage bath + a Phyto-mineral Mud wrap + a Vichy shower with 2 hand massage.
Your slimming cure in Salwa will also be the opportunity for you to discover high-tech treatments aimed at toning your body. In this context, you will be offered one Expert care treatment every day.
Since adopting an adapted physical activity seems to be a key element to sustainable weight loss, you will be invited to an individual Coaching session. Your coach will help you set realistic goals as far as exercising is concerned, in order for you to improve your habits after your slimming cure.
Regarding your meal plan, you will be able to taste various healthy gourmet dishes at our Dietetic restaurant, the Vichy Slim.
It can be difficult to find a satisfying balance between work and personal life, which leads to more and more burnouts. In order to avoid that, our detox programme offers you to relax in a peaceful atmosphere and enjoy the soothing effects of hydrotherapy combined with wellness care treatments and adapted sport sessions.
At the beginning of your detox cure, you shall have a lifestyle consultation as well as a personalised session with a dietitian. Then, you will be offered a daily Trilogy of "Signature" hydrotherapy treatments. This ritual, inherited from Vichy thermal medicine is composed of a deeply soothing Hydro massage bath with essential oils and mineral salts from France, then a relaxing Phyto-mineral Mud Wrap and finally a Vichy shower with 2 hand massage.
On a daily basis, you will be invited to discover one of our Expert care treatments focusing on stress management.
During your detox & anti-stress programme, you will be offered a session with a personal trainer, and a vast choice of sport options.
We based our type 2 diabetes cure on the renowned Vichy programme, which has shown great success in France. It is a self-management and educational programme designed to support people living with type 2 diabetes.
Our programme begins by a lifestyle consultation with a specialist. He will determine with you the current stage of your disease and discuss your particular symptoms. Potential side effects of the illness will also be mentioned (e.g.: heart diseases, vascular disorders, eyes conditions, etc.).
During the type 2 diabetes cure, you will have the opportunity to meet a dietitian as well. During these consultations, a specific dietetic meal plan will be decided upon.
Stress plays a major role on weight gain. Cortisol (the "stress hormone") seems to have a direct influence, causing the body to store fat. Therefore, we do our best to organise relaxing stays, so that you can completely let go, make the best out of your care treatments and improve your diabetic diet's efficiency. In order for you to relax, we offer you a daily Trilogy of "Signature" hydrotherapy treatments, featuring a Hydro massage bath, a Phyto-mineral Mud wrap and a Vichy shower with 2 hand massage.
During your stay you will also discover one of our state of the art devices.
As far as your meal plan is concerned, you will enjoy delicious and healthy meals according to your diabetic diet: less sugar, less fat, but a lot of flavour !


text:
package org.apache.ignite.internal.processors.cache;

import java.util.Arrays;
import java.util.Collection;
import java.util.Map;
import java.util.concurrent.CountDownLatch;
import org.apache.ignite.Ignite;
import org.apache.ignite.Ignition;
import org.apache.ignite.configuration.IgniteConfiguration;
import org.apache.ignite.internal.util.GridJavaProcess;
import org.apache.ignite.internal.util.lang.GridAbsPredicate;
import org.apache.ignite.internal.util.typedef.CI1;
import org.apache.ignite.internal.util.typedef.internal.U;
import org.apache.ignite.spi.discovery.DiscoverySpi;
import org.apache.ignite.spi.discovery.tcp.TcpDiscoverySpi;
import org.apache.ignite.spi.discovery.tcp.ipfinder.vm.TcpDiscoveryVmIpFinder;
import org.apache.ignite.testframework.GridTestUtils;
import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest;

import static java.util.concurrent.TimeUnit.SECONDS;

/**
 *
 */
public class CacheConfigurationP2PTest extends GridCommonAbstractTest {
    /** */
    public static final String NODE_START_MSG = "Test external node started";

    /** */
    private static final String CLIENT_CLS_NAME =
        "org.apache.ignite.tests.p2p.startcache.CacheConfigurationP2PTestClient";

    /**
     * @return Configuration.
     */
    static IgniteConfiguration createConfiguration() {
        IgniteConfiguration cfg = new IgniteConfiguration();

        cfg.setPeerClassLoadingEnabled(true);

        cfg.setLocalHost("127.0.0.1");

        TcpDiscoverySpi disco = new TcpDiscoverySpi();

        disco.setIpFinderCleanFrequency(1000);

        TcpDiscoveryVmIpFinder ipFinder = new TcpDiscoveryVmIpFinder();

        ipFinder.setAddresses(Arrays.asList("127.0.0.1:47500..47509"));

        disco.setIpFinder(ipFinder);

        cfg.setDiscoverySpi(disco);

        return cfg;
    }

    /**
     * @throws Exception If failed.
     */
    public void testCacheConfigurationP2P() throws Exception {
        fail("Enable when IGNITE-537 is fixed.");

        try (Ignite ignite = Ignition.start(createConfiguration())) {
            final CountDownLatch srvsReadyLatch = new CountDownLatch(2);

            final CountDownLatch clientReadyLatch = new CountDownLatch(1);

            GridJavaProcess node1 = null;
            GridJavaProcess node2 = null;
            GridJavaProcess clientNode = null;

            Collection<String> jvmArgs = Arrays.asList("-ea", "-DIGNITE_QUIET=false");

            try {
                node1 = GridJavaProcess.exec(
                    CacheConfigurationP2PTestServer.class.getName(),
                    null,
                    log,
                    new CI1<String>() {
                        @Override public void apply(String s) {
                            info("Server node1: " + s);

                            if (s.contains(NODE_START_MSG))
                                srvsReadyLatch.countDown();
                        }
                    },
                    null,
                    jvmArgs,
                    null
                );

                node2 = GridJavaProcess.exec(
                    CacheConfigurationP2PTestServer.class.getName(), null,
                    log,
                    new CI1<String>() {
                        @Override public void apply(String s) {
                            info("Server node2: " + s);

                            if (s.contains(NODE_START_MSG))
                                srvsReadyLatch.countDown();
                        }
                    },
                    null,
                    jvmArgs,
                    null
                );

                assertTrue(srvsReadyLatch.await(60, SECONDS));

                String cp = U.getIgniteHome() + "/modules/extdata/p2p/target/classes/";

                clientNode = GridJavaProcess.exec(
                    CLIENT_CLS_NAME, null,
                    log,
                    new CI1<String>() {
                        @Override public void apply(String s) {
                            info("Client node: " + s);

                            if (s.contains(NODE_START_MSG))
                                clientReadyLatch.countDown();
                        }
                    },
                    null,
                    jvmArgs,
                    cp
                );

                assertTrue(clientReadyLatch.await(60, SECONDS));

                int exitCode = clientNode.getProcess().waitFor();

                assertEquals("Unexpected exit code", 0, exitCode);

                node1.killProcess();
                node2.killProcess();

                final DiscoverySpi spi = ignite.configuration().getDiscoverySpi();

                boolean wait = GridTestUtils.waitForCondition(new GridAbsPredicate() {
                    @Override public boolean apply() {
                        Map p2pLdrs = GridTestUtils.getFieldValue(spi, "p2pLdrs");

                        log.info("p2pLdrs: " + p2pLdrs.size());

                        return p2pLdrs.isEmpty();
                    }
                }, 10_000);

                assertTrue(wait);
            }
            finally {
                if (node1 != null)
                    node1.killProcess();

                if (node2 != null)
                    node2.killProcess();

                if (clientNode != null)
                    clientNode.killProcess();
            }
        }
    }
}

redpajama_set_name: RedPajamaGithub


text:
Australophiloscia är ett släkte av kräftdjur. Australophiloscia ingår i familjen Philosciidae.

Kladogram enligt Catalogue of Life:

Källor

Gråsuggor och tånglöss
Australophiloscia

redpajama_set_name: RedPajamaWikipedia


text:
Home Karachi Digital census good step to bring harmony: Saeed
Digital census good step to bring harmony: Saeed
Minister of Labor and Manpower Sindh Saeed Ghani has said that the digital census conducted by Pakistan Statistical Office is a good step and we understand its importance. The apprehensions of all the political parties, including PPP, in the 2017 census will no longer exist and this will bring harmony between the provinces. On the basis of census, the country and the provinces can be put on the path of development.He expressed these views while speaking as the chief guest at the opening ceremony of the upcoming census 2022 digital census enumerator training at Adamji Science College under the Pakistan Statistical Institute and later interacting with the media.
Saeed Ghani said that digital census is a good step, we understand its importance.In 2017, the concerns of the political parties, including the PPP, will no longer be there. Accurate census will bring harmony between provinces and if the country has accurate population data, we will be able to plan better. Saeed Ghani said that the Sindh government will fully cooperate with the Statistics Institute. The digital census will improve the count of people living in Sindh including Karachi.
Talking to the media on the occasion, the Minister said that census is the basis for the development of any country, objections were raised on the census conducted in the past. In any case, an atmosphere of trust should be established between the provinces.
To a question, he said that this time the previous objections in the census must be removed. In the past, many objections were raised regarding the census in Sindh.
Addressing the training teachers, he asked them to consider the census as a national duty, because only on the basis of the census, the country and the province can be taken on the path of development and only on the basis of the census, resources and representation in the National Assemblycan be allocated.
He said that no other political party had the highest reservations on the 2017 census, but the People's Party and it is good to have a digital census for the first time and this time the census will be acceptable to all. In response to a question, he said that he tried and hoped that no one would have objections to the upcoming census. On a question, Saeed Ghani said that according to the constitution, the census should be conducted after ten years.Unfortunately, after serious concerns over the 2017 census, the Election Commission announced elections in the country after the 2018 elections and assured that the next census would be conducted as soon as possible.
In response to a question, he said that on the basis of the census, the National Assembly seats are allocated to the province and the distribution of resources is also subject to it.
To a question, Saeed Ghani said that after 2017, an atmosphere of mistrust arose between the provinces. In response to a question regarding the impact of the census on the current local government
Previous articleECP reserves verdict on MQM-P plea on fresh delimitations
Next articleSearch underway for lady doctor who committed suicide at Sea View
PTI's Fawad Chaudhry released from jail following court orders
'First-ever' women-only Pink Bus Service Launched
Citizens protest against 'non-supply of gas'

redpajama_set_name: RedPajamaCommonCrawl


Generic Security Services API (GSS-API)  provides a framework for security services. It allows source level portability. It allows applications to run independently of the underlying security mechanisms and technologies.
To provide security mechanism independence in ONC RPC [1, 2, 3], this paper proposes a new security flavor, RPCSEC_GSS. RPCSEC_GSS incorporates services offered by the GSS-API into ONC RPC. Using the programming interface for the RPCSEC_GSS flavor, ONC RPC applications can specify a GSS-API security mechanism to be used with an RPC session, and also request security services, such as integrity and privacy.
This document describes the proposed security architecture for ONC RPC. The reader of this document should understand the GSS-API and be familiar with ONC RPC.
The framework must support multiple underlying security mechanisms, and provide access to their services through a common API. Applications using this API should not be required to be aware of the underlying security mechanism.
The API should be flexible enough to enable different applications to meet their security requirements, while still being easy to use.
The framework should accommodate existing applications by providing for binary and source compatibility. That is, existing binaries and source code should continue to work as before.
Components used to implement this framework should not be specific to ONC RPC. As far as possible, components, such as the GSS-API, should be available for use by applications that don't require ONC RPC services.
The Solaris 2.x Network Interfaces Programming Guide describes how security flavors work in ONC RPC.
To date, security flavors have provided only authentication services of varying strengths. The AUTH_DES and AUTH_KERB (version 4) security flavors use cryptography to provide stronger authentication than the AUTH_SYS security flavor, which does not use cryptography and therefore can be more easily spoofed.
Historically, security flavors have been called authentication flavors. This is probably because integrity and privacy were not considered requirements. Also, the computational overhead of integrity and privacy was considered prohibitive for an application like the NFS environment (which drove RPC architecture for the main part). Today, no fundamental reason exists for restricting new security flavors in the services they perform.
Examples of security mechanisms are Kerberos V5, RSA public key, Diffie-Hellman public key, PGP, etc. A security mechanism specifies cryptographic techniques to achieve data authentication or confidentiality. Usually, a security mechanism does not specify transport protocols or conventions; security mechanisms can be used in conjunction with different data transport protocols. For example, the Kerberos V5 [6, 9] mechanism specifies certain conventions and formats that allow it to be used with ONC RPC, FTP, TELNET, or DCE RPC.
Security flavors are specific to ONC RPC and are administered by iana@isi.edu. Each security flavor is represented by a unique integer and is carried in the RPC protocol header. A security flavor indicates how to interpret RPC security headers (the credential and verifier fields) and client data. Until now, since integrity and privacy have not been used, client data formats have been the same for all security flavors. Also, existing security flavors embody different security mechanisms, and each security flavor has its own API. Currently, ONC RPC applications that require security services use security flavors that embody specific security mechanisms. These applications have to be modified to make use of other security mechanisms.
The GSS-API framework defines a generic security service standard and an API that offers the same security services to applications, while using multiple underlying security mechanisms. The GSS-API framework is described in  and its C language bindings are described in . This API framework has some similarities to TLI. It ``normalizes'' accesses to different security mechanisms, so that applications using the GSS-API need not be aware of underlying security mechanisms.
The basic services offered by the GSS-API are integrity and privacy. In the integrity service, the GSS-API uses the underlying mechanism to authenticate messages exchanged between applications. Cryptographic checksums establish the identity of the data originator to the receiver, the identity of the receiver to the originator (if mutual authentication is requested), and the authenticity of the transmitted data. The privacy service includes the integrity service. In addition, the transmitted data is encrypted to protect it from any eavesdroppers.
The GSS-API does not specify any transport mechanisms. Calls to the GSS-API primitives return tokens, which the application must convey to its peer. For example, if the application is ONC RPC, clients will convey the tokens created by the GSS-API to servers and vice-versa, in RPC messages. These tokens may represent entities such as cryptographic checksums or encrypted data.
Before an application begins to exchange data with a peer, it must first establish a context for the exchange. The GSS-API primitive that creates the context requires a parameter that specifies the security mechanism to be used for that context. Applications that wish to be independent of the security mechanism must provide this parameter transparently, by obtaining it either from a configuration file, or the name service.
Once a context is established, applications can begin to exchange data units. For each data unit, the application can specify whether the integrity service or the privacy service or neither applies. The GSS-API defines these services. They are independent of the security mechanism. The services may be determined dynamically or hard-coded by the application without compromising security mechanism independence.
For each data unit, the application can also specify the Quality of Protection (QOP) to be used. The QOP parameter determines the cryptographic algorithms to be used in conjunction with the integrity or privacy service. This parameter is security mechanism dependent. Therefore, to be independent of the underlying security mechanism, an application has to either obtain the QOP parameter from a configuration file or name service, or use the default QOP for the security mechanism.
Using the programming interface for the RPCSEC_GSS security flavor, ONC RPC applications can specify a security mechanism to be used on an RPC session, and request desired security services (integrity, privacy, or none) for each RPC exchange. Applications can also specify the desired QOP for each RPC exchange. As noted before, if the application needs to be independent of the security mechanism, it should not hard code security mechanism names or QOP values. These parameters will be passed through the RPCSEC_GSS layer to the GSS-API layer.
Since the RPCSEC_GSS security flavor uses the GSS-API interface, any security mechanism supported by the GSS-API will be available to ONC RPC applications via the RPCSEC_GSS security flavor interface. Thus, in some sense, this will be the ``last security flavor'' that ONC RPC needs to support to use multiple underlying security mechanisms. Moreover, adding a new security mechanism to the existing set supported by the GSS-API will not require an ONC RPC application to be modified for use with the new security mechanism. Of course, if a security mechanism is created that offers different services than those provided by the GSS-API, and that cannot be supported under the GSS-API, it also will not be available with the RPCSEC_GSS flavor. The new security mechanism will require a different API to capture the sense of the different services it offers.
The programming paradigm for the RPCSEC_GSS security flavor is similar to that for the existing security flavors. The additional complexity is due to the extra services and options available.
The following section describes the programming interface for the RPCSEC_GSS security flavor, followed by some usage examples.
This programming interface is the same for kernel and user-level RPC implementations, unless indicated otherwise.
The rpc_gss_seccreate function shown below is used to create a security context.
clnt - Client handle. Context creation may involve an exchange with the server. This is why a client handle incorporating a transport connection to the server is passed as a parameter.
principal - Identity of the server principal. The name has the form <service>@<host>, where <service> is the name of the service that the client wishes to access; <host> is the fully qualified name of the host where the service resides, for example, nfs@jurassic.eng.sun.com.
mechanism - An ASCII string, for example, ``kerberos_v5,'' that results in the use of the appropriate GSS-API backend. This mapping is done via a configuration file. The mechanism may be obtained either from the client program's configuration, or as a result of a name service lookup. This ASCII mechanism name space will be managed in ONC RPC. Note that due to export control restrictions, available mechanisms may be limited to those statically linked in with the GSS-API library.
service_type - Specifies the type of service requested on the session. The service_type sets the initial service option. This can be changed in the course of a session. For example, when NIS+ replicates, most of the information needs to be only integrity protected, but some tables such as the password table, or other tables which are not world readable, may be privacy protected; to do so, the initiator may change the service for the session.
qop: Determines the initial quality of protection for messages exchanged in this session. qop is specified as an ASCII string. If no QOP is specified, the default QOP for the mechanism will be used. An example of a QOP string is ``GSS_KRB5_CONF_C_QOP_DES'' .
options_req - Options passed through directly to the GSS-API. These are described in the GSS-API specification. Note that the kernel version of these options uses cred_t (UNIX credentials) rather than gss_cred_id_t for delegated credentials. This is because cred_t is a more natural formulation for the kernel. For example, NFS will act on behalf of users whose UNIX credentials it already has. If options_req is NULL, defaults will be used.
options_ret - Options returned to the caller. These are described in the GSS-API specification. The caller may specify NULL if it is not required to see these options.
is used to destroy a context.
principal -The server's principal name, specified in the <service>@<host> form.
mechanism - Mechanism for which the name is registered.
req_time - Time during which the credential should be valid.
program - RPC program number for the service.
version - Version number for the service.
If a server wishes to act as multiple principals, it may invoke rpc_gss_set_svc_name as many times as necessary.
The rpc_gss_getcred function is used to obtain the client's credentials.
req - Received request, input to rpc_gss_getcred().
rcred - Pointer to an rpc_gss_rawcred_t structure pointer. The calling and called principal names are returned. The GSS mechanism is also returned, because an application may wish to determine how ``strong'' the security mechanism over which the request was received is, and refuse service if the mechanism is not strong enough. The QOP used for the message is returned for the same reason. The service parameter indicates whether the request was integrity protected or privacy protected. The server may choose to refuse service for a request, for example, if the message does not have privacy protection. If an application is not interested in these details, it may pass NULL for the rcred parameter.
ucred - Caller's UNIX credentials. The application may pass NULL if it does not require these. If a client does not have UNIX credentials, a NULL pointer will be returned in this field.
cookie - Pointer to a (void *). If not NULL, the value returned will be that specified by the server when the context was created. Cookies are specified through the server callback mechanism described below.
Note that the credentials returned need not be destroyed or deallocated because they are pointers to entities within the security context. The application should not modify them.
The server can receive any delegated credentials at this point. The server also gets a pointer to the GSS context in case it wants to do GSS operations on the context to test for acceptance criteria. The per-message information in the raw_cred structure (qop, service) will be set to the values specified by the initiator for these parameters in the rpc_gss_seccreate() call.
The server also gets a pointer to the RPC request associated with the context initiation request. This will enable the server to determine the network address of the initiator, for example, by using existing calls.
The server can also specify a cookie that will be returned along with the caller's credentials for each request (in the rpc_gss_getcred() call). This cookie can be used in anyway appropriate for the application - RPC will not interpret this quantity. For example, the cookie may be a pointer or index to a structure that represents the context initiator. Instead of computing this for every request, the server does this at context creation time, and saves on request processing time.
If the server does not specify a callback, all incoming contexts will be accepted.
The rpc_gss_set_defaults function changes certain default parameters for a session.
This call applies to the client side only. The application may choose to switch from integrity protection to privacy protection. The application may also wish to change the QOP. The new values set by the application will apply to the rest of the session (unless changed again).
When a server needs to operate on a client's principal name (for example, to check access control lists).
A server's principal name is always specified as a NULL-terminated ASCII string in the form <service>@<host>. Here, <service> is the name of a service, for example, nfs, and <host> is the fully qualified DNS name of a host, for example, jurassic.eng.sun.com. The GSS-API Version 2 specification allows such names to be used with any underlying security mechanism.
The principal name of a client as received by a server has the structure corresponding to the rpc_gss_principal_t defined in Receiving Credentials at the Server on page 4. This is a counted, opaque byte string. In general, the format of this string will be mechanism specific. These strings can be used either as database indices for looking up a UNIX credential (if one exists), or directly in access control lists. Now a server may wish to compare a principal name it has received with the principal name of a known entity. To do so, the server needs to generate these principal names for known entities.
The rpc_gss_get_principal_name() call takes as input a mechanism type, and parameters that uniquely identify an individual in a network. It returns a principal name in mechanism-specific format, which may be byte-compared with received principal names (for example, as part of a client's network credentials).
It is hard to pin down the criteria for all security mechanisms that will uniquely identify an individual in a network. For now, the following parameters seem to be sufficient: an individual or service name, a node name, and a security domain. An individual name could be a UNIX login identifier. An example of a service name is ``nfs.'' An example node name is a UNIX machine name, such as jurassic. A security domain could be a DNS, NIS, or NIS+ domain name.
The principal name constructor will accept NULLs for one or more of the three parameters (name, node, security domain) that identify an individual in a network. For each security mechanism, the parameters necessary to construct principal names will be specified. For example, Kerberos V5 will require: a user name; optionally, a fully qualified host name; and optionally, a realm name. The construction of the principal name is mechanism dependent. Some mechanisms may do this algorithmically, and some may look up the principal name in a name service or database.
The type rpc_gss_principal_t has been defined earlier.
Principal names are freed using the free() library call. A principal name need only be freed in those instances where it was constructed by the application. Values returned by other routines point to structures already existing in a context, and need not be freed.
If the error is RPC_GSS_ER_SYSTEMERROR, the error encountered was a system error. The field system_error is then set to one of the possible values for errno. Note that unless the invoked function indicates a failure, rpc_gss_get_error() will not return a meaningful value.
The following functions are used to obtain information about installed mechanisms and the version of RPCSEC_GSS supported.
This function fetches the list of supported security mechanisms as a NULL terminated list of character strings.
This function fetches the relevant mechanism information. Supported QOPs are returned as a NULL terminated list of character strings. The returned value for service is one of the values of the rpc_gss_service_t type.
This returns the highest and lowest RPCSEC_GSS versions supported.
This function returns TRUE if the mechanism is installed, and FALSE otherwise.
This section provides an indication of how clients and servers will use the interfaces described in this document.
The following is a very simple client program that makes one secure call to a server. Details such as error checking are not shown.
The server should set the name of the principal it is acting as in the main program. Error checking details are not shown.
The following is a simple server side dispatch procedure. Details such as error checking are not shown.
An RPC session based on the RPCSEC_GSS security flavor consists of three phases: context creation, RPC data exchange, and context destruction. The following section discusses protocol elements for these three phases.
For convenience, APPENDIX B of this document reproduces the XDR language description of the RPC protocol. The following description of the protocol uses some of these definitions.
Context creation and destruction use control messages that are not dispatched to service procedures registered by an RPC server. The program and version numbers used in these control messages are the same as the service program and version numbers. The procedure number used is NULLPROC. A field in the credential information (the gss_proc field) specifies whether a message is to be interpreted as a control message or a regular RPC message. If this field is set to RPCSEC_GSS_NULL, no control action is implied; in this case, it is a regular data message. If this field is set to any other value, a control action is implied. This behavior is described in the following sections.
Before RPC data is exchanged on a session using the RPCSEC_GSS flavor, a context must be set up between the client and the server. Context creation may involve zero or more RPC exchanges. The number of exchanges depends on the security mechanism. For KerberosV5, context creation involves one RPC exchange.
The first RPC request from the client to the server initiates context creation for those mechanisms that require context creation messages. The program and version used in the RPC message are always those for the service being accessed. The procedure is set to NULLPROC.
The credential uses the RPCSEC_GSS flavor. The credential body is created by XDR encoding the rpc_gss_cred_t structure listed earlier into a byte stream, and then opaquely encoding this byte stream as the body field.
The values of the fields contained in the rpc_gss_cred_t structure are set as follows: The version field is set to the current RPCSEC_GSS version (1). The gss_proc field must be set to RPCSEC_GSS_INIT for the first creation request. In subsequent creation requests, the gss_proc field must be set to RPCSEC_GSS_CONTINUE_INIT. The server must ignore the seq_num field in all creation requests. The server must also ignore the service field in all creation requests. In the first creation request, the handle field is NULL (opaque data of zero length). In subsequent creation requests, handle must be equal to the value returned by the server. handle serves as the identifier for the context, and will not change for the duration of the context.
The opaque_auth structure also describes the verifier field in the RPC message header. All creation requests have the NULL verifier (AUTH_NONE flavor with zero length opaque data).
Here, gss_token is the token returned by the call to gss_init_sec_context(), opaquely encoded. The value of this field will probably differ in each creation request, if there is more than one creation request. If the call to gss_init_sec_context() does not return a token, the context should have been created (assuming no errors). No more creation requests will occur.
One reason for ``overloading'' the call data in this way, rather than packing the GSS token into the RPC header, is that RPC Version 2 restricts the amount of data that can be sent in the header. The opaque body of the credential and verifier fields can be each at most 400 bytes long, and GSS tokens can be longer.
The qop and service fields must be set to the quality-of-protection (QOP)  and service the client wishes to use for the session. Some services will need this information before they will allow the context to be set up. Although the client can change the QOP and service used on a per request basis, this may not be acceptable to all RPC-based services. These services may choose to enforce the QOP and service specified during context creation for the rest of the session. If there is more than one creation request, all of them should use the same values for qop and service. The GSS-API interprets a value of 0 (zero) for QOP as a request to use the default QOP level. Since QOP values are mechanism-specific, 0 should be used whenever possible, to be mechanism-independent.
Here, handle is non-NULL opaque data that serves as the context identifier. The client must use this value in all subsequent requests, whether control messages or otherwise. The gss_major and gss_minor fields contain the results of the call to gss_accept_sec_context() executed by the server. If gss_major is not one of GSS_S_COMPLETE or GSS_S_CONTINUE_NEEDED, the context setup has failed. In this case, the server must set handle and gss_token to NULL. The value of gss_minor depends on the value of gss_major and the security mechanism used. The gss_token field contains any token returned by the gss_accept_sec_context() call executed by the server. A token may be returned for both successful values of gss_major. If the value is GSS_S_COMPLETE, it indicates that the server does not expect any more tokens. If the value is GSS_S_CONTINUE_NEEDED, the server expects another token, and, therefore, at least one more creation request carrying the required token is needed.
In a successful response, the seq_window field is set to the sequence window length supported by the server for this context. This window specifies the maximum number of client requests that may be outstanding for this context. The server will accept seq_window requests at a time. These may be out of order. The client may use this number to determine the number of threads that can simultaneously send requests on this context.
The verifier used for a context creation response is the NULL verifier (AUTH_NONE flavor with zero-length opaque data).
An ACCEPTED reply to a creation request whose status is other than SUCCESS also has a NULL verifier, and is formulated as usual for different status values.
A DENIED reply to a creation request is also formulated as usual. Two new values, RPCSEC_GSS_NOCRED and RPCSEC_GSS_FAILED, have been defined for the auth_stat type. When the reason for denial of the request is AUTH_ERROR, one of the two new values could be returned in addition to the existing values. These values don't have any special significance for responses to creation requests, but they do for responses to normal (data) requests, as described later.
The data exchange phase is entered after a context has been successfully set up. The format of the data exchanged depends on the security service used for the request. Although clients can change the security service and QOP used on a per-request basis, this may not be acceptable to all RPC services. For all three modes of service (no data integrity, data integrity, data privacy), the RPC request header has the same format.
For the RPC request header, the credential has the opaque_auth structure described earlier. The flavor field is set to RPCSEC_GSS. The credential body is created by XDR encoding the rpc_gss_cred_t structure listed earlier into a byte stream, and then opaquely encoding this byte stream as the body field.
The version field is set to the current RPCSEC_GSS version (1).
The gss_proc field is set to RPCSEC_GSS_NULL.
The handle field is set to the context handle value received from the RPC server during context creation.
The seq_num field can start at any value below MAXSEQ, and should be incremented (by one or more) for successive requests.
Use of sequence numbers is described in detail later in this paper.
The verifier has the opaque_auth structure described earlier. The flavor field is set to RPCSEC_GSS. The body field is set as follows: The checksum of the RPC header (up to and including the credential) is computed using the gss_sign() call with the desired QOP. gss_sign returns the checksum as an opaque byte stream and its length. This is encoded into the body field. Note that the QOP is not explicitly specified anywhere in the request. It is implicit in the checksum or encrypted data. The same QOP value used for the header checksum must also be used for the data (for checksumming or encrypting), unless the service used for the request is rpc_gss_svc_none.
If the service specified is rpc_gss_svc_none, the data (procedure arguments) are not integrity or privacy protected. They are sent in exactly the same way as they would be if the AUTH_NONE flavor were used (following the verifier). Note, however, that because the RPC header is integrity protected, the sender will still be authenticated in this case.
Here, seq_num must have the same value as the credential. The type proc_req_arg_t is the procedure- specific XDR type describing the procedure arguments, thus is not specified here. The byte stream corresponding to the rpc_gss_data_t structure and its length is encoded as the databody_integ field.
The checksum field represents the checksum of the byte stream corresponding to the rpc_gss_data_t structure. (Note that this is not the checksum of the databody_integ field.) This checksum is obtained using the gss_sign() call, with the same QOP as was used to compute the header checksum (in the verifier). The gss_sign() call returns the checksum as an opaque byte stream and its length. The checksum and its length are opaquely encoded as the checksum field.
The databody_priv field is created as follows: the rpc_gss_data_t structure is reconstructed in the same way as for data integrity. Next, the gss_seal() call is invoked to encrypt the byte stream corresponding to the rpc_gss_data_t structure, using the same value for QOP as was used for the header checksum (in the verifier). The gss_seal() call returns an opaque byte stream (representing the encrypted rpc_gss_data_t structure) and its length. These values are used to opaquely encode the RPC request data as the databody_priv field.
Version number in the credential.
Service specified in the credential.
Context handle specified in the credential.
Sequence number specified in the credential (as explained in this section).
Header checksum in the verifier.
The gss_proc field in the credential must be set to RPCSEC_GSS_NULL for data requests. Otherwise, the message will be interpreted as a control message, as discussed later.
The server maintains a window of seq_window sequence numbers, starting with the last sequence number seen and extending backwards. If the server receives a sequence number higher than the last number seen, the window moves forward to the new sequence number. If the last sequence number seen is n, the server can receive requests with sequence numbers in the range n through (n - seq_window + 1), both inclusive. If the sequence number received falls below this range, the server silently discards it. If the sequence number is within this range, and the server has not seen it, the request is accepted. Then, the server turns on a bit to ``remember'' that it has seen this sequence number. If the server determines that it has already seen a sequence number within the window, it silently discards the request.
The reason for discarding requests silently is because the server cannot determine why the duplicate or out of range request occurred. It could be due to a sequencing problem in the client, network, or operating system; to some quirk in routing; or to a replay attack by an intruder. Discarding the request allows the client to recover after timing out, if indeed the duplication was unintentional or well intended.
The data is decoded according to the service specified in the credential. In the case of integrity or privacy, the server ensures that the QOP value is acceptable, and that it is the same as that used for the header checksum in the verifier. For the same reason, the server will reject the message if the sequence number embedded in the request body is different from the sequence number in the credential. This prevents splicing attacks. If the sequence numbers were not compared, an attacker could capture previous RPC requests, and splice in the header of one with the body of another.
An ACCEPTED reply to a request in the data exchange phase will have the verifier set to the checksum of the sequence number (in network order) of the corresponding request. The QOP used is the same as the QOP for the corresponding request.
If the status of the reply is not SUCCESS, the rest of the message is formatted as usual, as for the AUTH_NULL security flavor.
If the status of the message is SUCCESS, the format of the rest of the message depends on the service specified in the corresponding request message. Basically, what follows the verifier in this case are the procedure results, formatted in different ways depending on the requested service.
If no data integrity was requested, the procedure results are formatted as for the AUTH_NULL security flavor.
If data integrity was requested, the results are encoded exactly as the procedure arguments were in the corresponding request. (Discussed previously in the section under the heading RPC Request Data - With Data Integrity.) The only difference is that the structure representing the procedure's result - proc_res_arg_t - must be substituted in place of the request argument structure proc_req_arg_t. The QOP used for the checksum must be the same as that used for constructing the reply verifier.
If data privacy was requested, the results are encoded in exactly the same way as the procedure arguments were in the corresponding request. See the section RPC Request Data - With Data Privacy. The QOP used for encryption must be the same as that used for constructing the reply verifier.
A DENIED reply to a data request is formulated as usual. Two new values, RPCSEC_GSS_NOCRED and RPCSEC_GSS_FAILED, have been defined for the auth_stat type. When AUTH_ERROR is the reason for denial of the request, one of the two new values could be returned in addition to the existing values. These two new values have special significance, differing from the existing reasons for denial of a request.
When the client's sequence number exceeds the maximum the server will allow, the server will reject the request with the reason RPCSEC_GSS_FAILED. Also, if security credentials become stale while in use (for example, ticket expiration in the case of the Kerberos V5 mechanism), the resulting failures cause the RPCSEC_GSS_FAILED reason to be returned. In these cases, the client must refresh the context, and retry the request.
For other errors, retrying will not rectify the problem. The client should not refresh the context until the problem causing request denial is rectified.
When the client is done using the session, it should send a control message informing the server that it no longer requires the context. This message is formulated just like a data request packet, with the following differences: the credential has gss_proc set to RPCSEC_GSS_DESTROY, the procedure specified in the header is NULLPROC, and there are no procedure arguments. For the server to accept the message, the sequence number in the request should be valid, and the header checksum in the verifier should be valid.
The server sends a response as it would for a data request. The client and server should then destroy the context for the session.
If the request to destroy the context fails for some reason, the client need not take any special action. The server should handle situations where clients never inform when they no longer are in session and no longer need the server to maintain a context. The server should use an LRU mechanism or an aging mechanism to clean up in such cases.
Sun used OpenVision's AUTH_GSSAPI as a prototype for RPCSEC_GSS. In the paper ``GSS-API Security for ONC RPC,''  the goal was to implement a no-frills RPC authentication system with minimal effort.
It did not protect the RPC call message header from modification.
The AUTH_GSSAPI implementation was not thread-safe.
RPCSEC_GSS solved the first limitation by using the gss_sign() primitive to sign the RPC call header (up to and including the credential) and placing the result in the RPC message's verifier.
RPCSEC_GSS solved the second limitation by using the sliding sequence window. This allows a client to have multiple threads making requests on the same client handle. The use of the sequence window also simplified replay detection on the server side. Note that in the current implementation, only the kernel level client and server code is thread-safe. In the user level version, only the server side is safe because the current user level, client side of ONC RPC is not multithreaded.
The AUTH_GSSAPI implementation did not allow selective use of integrity or encryption on call data; all call data was encrypted. Since RPCSEC_GSS was envisioned for a wide variety of applications (such as NFS and NIS+), always encrypting the call data was considered too restrictive. Also, United States export control laws provided sufficient motivation for an exportable implementation that does not encrypt call data.
This limitation was solved by adding the service field to the RPCSEC_GSS credential. This allows the client to change the service requested on each request. Therefore, servers can require that a particular service to be used, and enforce that policy by ``locking'' the service for a session.
An RPC client executing in a run time environment without support for RPCSEC_GSS can continue to interoperate with an RPC server that has RPCSEC_GSS support, provided of course the RPC server is not implemented or configured to insist on requests using RPCSEC_GSS. An RPC client that uses RPCSEC_GSS to attempt procedure calls with a server in a non-RPCSEC_GSS environment will not be able to interoperate. An NFS () implementation is an example of an application that has to cope with these interoperability issues. Version 3 of the NFS protocol () provides a way to handle this via the security flavor negotiation feature of the corresponding version of the MOUNT protocol.
Extensive performance testing has not been done at this point. Some preliminary tests on a prototype have been run. The results are graphed in Figure 3, with raw data in Table 1. These results were obtained by sending messages of varying length of opaque data (the horizontal axis) from an SS5 to an SS20 over UDP, and taking the average time (the vertical axis, in milliseconds) over 1000 calls. The GSS-API mechanism used with RPCSEC_GSS was Kerberos V5 with mutual authentication and replay detection enabled.
The results match expectations. Using rpc_gss_svc_none (call header integrity), as opposed to AUTH_NONE, adds overhead to each message. The overhead is a constant. It is not dependent on the size of the data being sent (because the header size doesn't change). The overhead imposed by rpc_gss_svc_integrity and rpc_gss_svc_privacy does increase with the size of the data, also as expected. Some profiling work is planned to see if the overhead can been lessened.
Adding data integrity and privacy to ONC RPC is not cheap. There is a trade-off between security and performance. RPCSEC_GSS gives one the ability to enable integrity and privacy of data when needed. Sites that do not need integrity and privacy can still benefit from the strong authentication gained by using RPCSEC_GSS.
A working prototype of the user-level and kernel-level versions of RPCSEC_GSS is available. Plans are well underway for adding RPCSEC_GSS support to NFS, to provide a version of NFS with strong authentication, as well as data integrity and privacy.
Much of this work was based on an earlier prototype by OpenVision Technologies. Without their efforts, RPCSEC_GSS may never have happened. In particular, thanks are extended to Barry Jaspan, Mark Horowitz, John Linn, Ellen McDermott, and the rest of the OpenVision crew at the time the prototype was developed.
On the Sun side, Raj Srinivasan evolved OpenVision's prototype into RPCSEC_GSS, along with help from Mike Eisler. Roland Schemers took Raj Srinivasan's prototype and put the finishing touches on it, along with modifying snoop to understand about RPCSEC_GSS.
Dan Nessett and Derek Atkins developed an in-kernel GSS-API library. Lin Ling ported user level RPCSEC_GSS into the kernel and thus achieved the milestone of encrypted NFS traffic on the network.
The authors appreciate the efforts by Rosalind HaLevi, Lin Ling, and Kathy Slattery in reviewing this paper on short notice.
7. Jaspan, B. (1995). ``GSS-API Security for ONC RPC,'' `95 Proceedings of The Internet Society Symposium on Network and Distributed System Security, pp. 144-151.
8. Neuman, C and Ts'o, T. (1994). ``Kerberos: An Authentication System for Computer Networks, IEEE Communications, 32.
9. Linn, J. (1996). ``The Kerberos Version 5 GSS-API Mechanism,'' IETF Internet-Draft.
The following RPC Language specification defines an address list server. The server maintains a database of name to address mappings. The following three procedure calls are defined: addrlist_set, addrlist_get, and addrlist_del.
When the client program calls rpc_gss_seccreate, a RPCSEC_GSS_INIT control message is sent to the server, and the server sends a reply.
Note the value of the handle returned by the server. This value will be used with all future communications with the server.
Once the context is established, the normal call/reply exchange occurs. The next example shows three exchanges between the client and server. The first uses the integrity service (rpc_gss_svc_integrity), the second uses the privacy service (rpc_gss_svc_privacy), and the third uses no service (rpc_gss_svc_none).
Note that since integrity (and not privacy) was used, call arguments are visible to snoop. However, since they are integrity protected, an attacker is unable to modify them. Also note that the sequence number (2 in this case) is the same in both the call header and body. As mentioned earlier, this prevents a splicing attack.
Note that the reply arguments are also integrity protected.
Since the call and reply arguments are encrypted, snoop can't display them. It could display the encrypted data as hexadecimal. But, without knowing the encryption key display, the hexadecimal data is not very useful.
When rpc_gss_svc_none is used, the call/reply arguments are not integrity protected or encrypted. The call/reply header is still integrity protected though, providing strong authentication.
The context will be destroyed when the client calls the standard ONC RPC auth_destroy function.


text:
Graphic detail | Daily chart
King-in-waiting
How long will Prince William's son have to wait to become king?
By R.L.W. and G.D.
ON JULY 22nd Prince William, the grandson of Queen Elizabeth II, had a son. The new baby is third in line to the British throne, but it could be decades before his reign starts. Prince Charles, 64 and first in line, will soon become the longest king-in-waiting, passing William IV, who became king—at 64 years and 10 months—after his brother George IV died in 1830. (Only this year was primogeniture abolished, allowing a first-born daughter to become the queen.) Since the first William (the Conqueror), the average age of accession has been 31, Prince William's current age. The reason future kings and queens have to wait longer to rule is largely because life expectancy has increased, and there are fewer or no challenges to their power. The youngest king was Henry VI, who came to the throne in 1422, aged nine months, when his father Henry V died suddenly, probably of dysentery.
More from Graphic detail
Habitat loss and climate change increase the risk of new diseases
Bats account for 90% of predicted viral transmission between mammal species
Europe's next inflation victim? Sugary treats
Having a sweet tooth is now a lot more expensive
Where have all America's workers gone?
The supply of workers is at pre-pandemic levels, but demand is far greater


text:
About the Children at Risk Unit
Annual Reports
Contact us
About the Expert Group
Mandate and priorities of the Expert Group
Members of the Expert Group on Children at Risk
Extranet login (for Expert Group members)
Links and resources in the Baltic Sea states
International links and resources
Wikipedia Portal on Transnational Child Protection
EUSBSR Flagship
Non-violent childhoods
AudTrain
PROTECT children on the move
Children trafficked for exploitation in begging and criminality
Baltic Sea Region Information Management to Prevent Trafficking
Baltic Sea Region Comprehensive Assistance to Children Victims of Trafficking
Historical high-level events
Expert Group on Children at Risk
Early Childhood Intervention – Invent Prevention, Berlin, September 12-13
by admin | May 11, 2011 | News |
The conference is organized by the Federation of Child Protection Centers in cooperation with the Federal Ministry for Families (BMFSFJ) and the Expert Group for Cooperation on Children at Risk (EGCC). It is a prelude to the German presidency of the EGCC, which is held by the BMFSFJ for one year starting from July 2011.
The birth of a child – a happy moment. Usually, a young parent's wish come true. But at the same time, many things change. A child needs attention, nearness, and care. The family develops new structures which challenge everyone involved. If parents are not able to deal with this new situation, the well-being of infants and small children is at risk.
In Germany Early Childhood Interventions start with pregnancy and generally continue until the child is three years old. Their goal is to strengthen parental competences in order to prevent disruptions in the early parent-child relationship and to ensure the best development opportunities for infants and small children.
The congress welcomes internationally acknowledged speakers to introduce the essential fields of Early Childhood Intervention. The insights gained in Germany are going to be presented and will be connected with experiences and findings of other CBSS member countries. The following questions will be of major interest:
How to make contact with families with infants and small children?
How to evaluate risks of infants and small children?
What kind of support do troubled parents need?
What should support structures for troubled parents look like?
What do quality standards look like? How far is the development of quality standards?
The congress wants to enhance the professional exchange between international experts and practitioners working in the field of Early Childhood Intervention. Different concepts and strategies will be worked out in panels and workshops, which can help to qualify and develop early childhood intervention in each respective member country.
The target groups of the conference are decision makers, NGOs, health care employees, child and youth service providers, and researchers.
See the programme on www.childprotection-congress.org/index.php
Bullying Child-friendly justice Child participation Child poverty and social marginalization Child protection systems Children in residential care Child safeguarding measures Child sexual abuse and exploitation Early prevention and intervention Education Health Internet and online risks Majority/Minority issues Migration and child trafficking
EGCC Extranet login


text:
Andromeda (constellation) facts for kids
Andromedae
Andromeda,
the Woman Chained
Right ascension
722 sq. deg. (19th)
Main stars
Stars with planets
Stars brighter than 3.00m
Stars within 10.00 pc (32.62 ly)
α And (Alpheratz) (2.07m)
Nearest star
Ross 248
(10.30 ly, 3.16 pc)
Messier objects
Andromedids (Bielids)
Bordering
Perseus
Triangulum
Visible at latitudes between +90° and −40°.
Best visible at 21:00 (9 p.m.) during the month of November.
Andromeda Constellation chart
Andromeda is a constellation in the northern sky. It is named after the princess Andromeda in Greek mythology. It is sometimes called "Princess of Ethiopia" or "the Chained Woman" in English. It has also been called Persea ("Perseus's wife") or Cepheis ("Cepheus's daughter"). The astronomer named Ptolemy listed Andromeda when he made a list of 48 constellations. It is also one of the 88 constellations made by the International Astronomical Union.
The Andromeda Galaxy is inside Andromeda. It is the closest spiral galaxy to Earth, at about 2.2 million light-years from Earth (estimates range up to 2.5 million light-years). The brightest star in Andromeda is called Alpha Andromedae, which is a binary star.
Johannes Hevelius's depiction of Andromeda, from the 1690 edition of his Uranographia. As was conventional for celestial atlases of the time, the constellation is a mirror image of modern maps as it was drawn from a perspective outside the celestial sphere.
Andromeda depicted in an early scientific manuscript, c.1000
Andromeda as it appears in the night sky, with the superimposed figure.
A Hertzsprung-Russel diagram for stars brighter than 4th magnitude in the constellation Andromeda (axes not labelled).
M31, the Great Galaxy of Andromeda.
Sharp view of the Andromeda Galaxy
The Blue Snowball Nebula as seen through the Hubble Space Telescope.
Andromeda (constellation) Facts for Kids. Kiddle Encyclopedia.


This week there were 82 runners, of whom 15 were first timers and 13 recorded new Personal Bests. Representatives of 10 different athletics clubs took part.
Corey LAWSON (VM35-39) of South Melbourne AC, was first over the line in 18:14 - third time in 3 appearances.
Sani BADIC (VM55-59) (Unattached) was second over the line in 19:45.
Rohan DURRANT (VM35-39) of Westerfoldians, was third over the line in 20:06.
Matthew BATTY (Unattached) 3953 pts.
George KOUNTOUROGIANNIS (Unattached) 3305 pts.
Gary HOLLAND (Unattached) 3178 pts.
Karin KING (VW50-54) of Dandenongs Trail Runners, was first (9th overall) over the line in 23:01 - 6th time in 15 appearances.
Jessica BUTTIGIEG (SW25-29) (Unattached) was second (14th overall) over the line in 25:08.
Lisa BANFIELD (VW40-44) (Unattached) was third (19th overall) over the line in 26:01.
Melissa MACEOIN (TXR Runners) 3461 pts.
Sandra BROADBENT (Unattached) 3303 pts.
Lisa BANFIELD (Unattached) 3108 pts.
Sani BADIC (VM55-59) was graded 77.81% for the time 19:45 (second overall).
Corey LAWSON (VM35-39) was graded 73.77% for the time 18:14 (first overall).
Karin KING (VW50-54) was graded 73.71% for the time 23:01 (9th overall).
Frog Hollow parkrun started on 14th June 2014, and since then 1,078 different runners, including participants from 75 athletics clubs, have completed 5,840 runs covering a total distance of 29,200 km, and there have been 1,177 new Personal Bests.


LAHORE – Twitter on Saturday suspended the account of Punjab Chief Minister Spokesperson Dr Shahbaz Gill over 'violation of rules' and regulations of the social media plate farm.
Dr Gill had nearly 48,000 followers on his account.
However, the spokesperson said that his account was suspended after being hacked by an unknown individual/group, adding that the hacker(s) changed the account's password.
Micro-blogging administration had also been suspended the account of Tehreek-e-Labbaik Pakistan leader Khadim Hussain Rizvi a few months ago on the request of the government of Pakistan.


text:
Steph Wood is focused on a third Super Netball title.
Wood says hook did her good
by GREG DAVIS
LIGHTNING sharpshooter Steph Wood says getting benched by Sunshine Coast mastercoach Noeline Taurua snapped her out of a post-World Cup funk and reignited her competitive fire heading into the Suncorp Super Netball finals.
The Australian Diamonds goal attack will be playing in her fifth consecutive national league decider on Sunday when the Lightning take on the NSW Swifts at Boondall in the 2019 Super Netball grand final.
Wood has been a central figure in the Lightning dynasty which is pushing for a hat-trick of championships on Sunday, but being a foundation player, two-time title winner and established international did not spare her from the hook in the round 13 clash with the Melbourne Vixens.
After hitting just one goal in the opening quarter, Taurua dragged Wood for the second term and let her stew on the bench before injecting her back into the match after halftime.
The next two matches, Wood had 22-goal outings at a high clip.
"Coming back from the World Cup, I had a bit of a down period and the motivation to play netball wasn't quite at 100 per cent,'' Wood said.
"It was against the Vixens when Noels (Taurua) benched me. I was sitting there on the sideline and I was just itching to get back out there.
Steph Wood hugs coach Noeline Taurua after the Lightning won the major semi-final against the NSW Swifts to win hosting rights for the Super Netball grand final.
"There was a real fire that came back and I have been enjoying the challenge of how hard the netball has been rather than getting frustrated.
"Noels is a mastermind. She didn't say much, she didn't necessarily give me a reason why I was benched, but after three years working together, I knew why.
"In previous years, it would have been easy to sulk if you got benched but we all understand there's a reason for it and you have to use that time watching the game and working out what you weren't doing correctly.''
Wood, a Pine Rivers junior, said Taurua "smashed" the Sunshine Coast squad during the week off while the Swifts and Vixens did battle in the preliminary final for the right to meet the Lightning in the season showpiece.
The Sunshine Coast's ability to mix up their attacking end with Cara Koenen and Peace Proscovia sharing the goalshooter duties alongside Wood at goal attack has been a reliable weapon all season, with the Lightning on a nine-game winning streak heading into the grand final.
"We can go to a moving circle with Cara while Peace is more of a traditional holding shooter, so there's a lot we can throw out there,'' Wood said.
"And it's not a risk. It gives us an attacking advantage because we can exploit different match-ups.''
netball nsw swifts steph wood sunshine coast lightning super netball
Premium Content NAMED AND SHAMED: Everyone who appeared in court
News Here is everyone who fronted court in the Charleville Magistrates Court on Monday...
Premium Content St George pushed back to level one water restrictions
News Welcome rain in the Balonne River catchment has prompted the easing of water...
Premium Content Roma teen accused of stabbing man in chest heard in court
News A Roma student accused of stabbing a 19-year-old in the chest multiple times after...
Premium Content Teen allegedly punches hole in pub door before resisting...
News A teenager will front the Roma courthouse after he allegedly punched a hole in the...
Premium Content Extra police called to Roma as home break-ins reach new...
News After almost a dozen homes were targeted, thieves have broken into a home and car...
Premium Content CRIME WAVE: Heat map reveals where thieves are striking in...
News A Queensland Police crime map reveals exactly which Roma streets thieves are targeting, after 11 incidents were reported to police in just a week.
From Monday 29 June 2020, Roma Western Star will become entirely digital and as a result, the digital print edition will no longer be available.


Northern Indiana Public Service Company, ComEd and other corporate and private fleet owners offer surplus vehicles and equipment to the general public through JJ Kane Auctioneers in Gary, Indiana on Saturday, September 24th 2016. More than 250 used bucket trucks, dump trucks, pickups, service trucks, cars and construction equipment will sell with no reserve!
The auction is at 2800 East 15th Avenue, Gary, IN, 46403. Bidders can participate in person or online. Items are available for public inspection on Friday September 23rd, 8a.m.-4 p.m. and also beginning at 7:00 a.m. on auction day. Several times each year retiring autos and equipment are offered for sale to the general public at this auction.
JJ Kane auctions are unreserved. That means that everything sells to the highest bidder, regardless of price. Owners are not allowed to bid on equipment they have consigned to the auction.


I feel like crap. I'm tired. I have a ton of work to do and I don't have enough help from my husband and kids. Example, when we got home from visiting family yesterday as soon as I got home everyone started to complain about being hungry and tired. ( we were gone all day and spent a lot of time outside). They all expected me, 34 1/2 weeks pregnant to jump up and make dinner right away. In addition to making, eating and cleaning up after dinner I also needed to get the girls in bed. I did not get a moment to rest until almost 10:00 at night! I'm too tired and too pregnant for this. Also, within the next five weeks I need to get the baby's room ready, help my oldest daughter get her room organized, potty train my younger daughter, keep the house clean, catch up on laundry and clean & organize the downstairs den. GOD HELP ME!!!!!!!