text:
The Art Of Asking
Fear -
Manifesto -
Amanda F'ing Palmer's brain on the page in The Art Of Asking
Debbie Holloway
I first really took notice of Amanda Palmer (of The Dresden Dolls and Amanda Palmer and the Grand Theft Orchestra) when I found an old blog post of hers about her wedding. I vaguely knew she was a musician, but I was immediately intrigued that she was married to Neil Gaiman (one of my favorite authors) and that Daniel Handler (aka Lemony Snicket!) played accordion at their nuptials. Whoever this woman is, I thought, she obviously has excellent taste.
At the time, I had no idea what an endless vortex of music, magic, and madness she truly is. The Art of Asking is her first book, a memoir and manifesto. Curiously, a book is, in many ways, a strange way of intersecting with Amanda. (Yes, I like to think we'd be on a first name basis.) Because books are static, and everything about Amanda flows and moves and shouts back. On the other hand, isn't a book a brilliant way to paint a picture of where an author finds herself at one specific moment in time?
That's what The Art of Asking is. It's Amanda opening her arms and saying, This is how I learned to stop being so afraid, start trusting humanity, and ask for what I need. It seems so simple. But if you're human, each of those things is pretty much a never-ending journey that many of us never even start.
It's all about The Bride, really.
To earn money in college and as a young musician, Amanda dressed up as a living statue, The Eight Foot Bride, and stood in Harvard Square to busk. As she describes in her phenomenal Ted Talk, she would remain perfectly still, holding her bridal bouquet, until a passerby stopped to put money in her hat. Then she would unfreeze, hand them a single flower, and share a brief, lovely moment of eye contact with her patron. Some would become incredibly emotional at this transaction; others would become flustered and refuse to take her proffered flower. Cue unexpected life lessons about how humans deal with asking and giving.
The book was born out of the aforementioned Ted Talk. In it, we get not only Amanda's reflections on how she learned to ask and receive, but many other sagas. She tells us of her life as an angsty teen, secretly writing songs and hopping from boyfriend to boyfriend. She tells us the story of how she came to be a part of punk-cabaret duo The Dresden Dolls, and how that began her journey as a professional musician and performer. We are privy to the fears and insecurities which spring from that lifestyle, but also to the joys and surprises.
Human connection, the art of give-and-take, is the thread connecting every story. What must an artist invest in her community, in order to elicit enough support to survive? Can a marriage survive if you're afraid to ask your partner for help? Is humanity essentially bad, or are we more willing to open our homes, hearts, and pockets to each other than we realize?
Honestly, The Art of Asking is just a drop of Amanda Palmer's many waters. I started with the Dresden Dolls, and then adventured my way through her solo albums and her fascinating music videos. I sat on a folding chair in a concert hall for "An Evening with Amanda Palmer" as she (bathrobed and pregnant) talked and laughed with us, and played her piano keys so hard we thought the keyboard might tip over. I get her hyper email blasts in my inbox and scroll through her Instagram for snapshots of baby Ash.
Someday soon I plan to become one of her Patreon patrons so that I can keep being a tiny part of the great and mysterious machine of Art that makes the world so much better. And if all this talk of art and humanness and mutual giving and learning to receive makes you curious too, perhaps it's time you learned The Art of Asking.
Debbie reviews films & books for Narrative Muse as part of her freelance hustle in Brooklyn, New York. She loves film critique, creativity, advocating for kindness, Mexican food, yoga, GIFs, getting rush tickets for Broadway shows, and reading on the Subway.
Sign up for great
Want to be matchmade
with just-for-you
books and movies?
Movie Producers & Distributors
Copyright NARRATIVE MUSE 2018


Posted on May 3, 2017 by It's my circus they're my monkeys.
I love books. I love to read. I believe that most things that you need to know to succeed in this world can be learned from books.
Unfortunately life in the circus does not generally lend itself to long periods of quiet, so I don't get the chance the chance to read as much as I might like.
That's not to say I don't read at all; I have at least 15 of the 'Free Kindle Bestsellers' list on the go at any one time, though admittedly I generally read one page and get distracted mentally writing an email to the author outlining the various spelling, grammar and punctuation issues followed by a rundown of what I believe are the major character flaws and helpfully point out any holes in the plot. You know what they say; those who can do – those who can't………..criticise.
Odin king of Asgard – I'm sure he meant well, but I'm really not sure that banishing one of the children to another realm until he can lift a hammer is really going to help.
Big Nutbrown Hare – Sure, trying to outdo everything your child attempts sounds like fun on the surface. But, do you really want to get into a competition with a three year old with boundary issues, no embarrassment filter and questionable morals?!
Dilys Price – All my children so far have gone through a Fireman Sam stage, so I have been forced to watch and read about this woman's delinquent son more times than I care to remember. I think he is the one exception from my 'no banishing children from realms' rule.
But finally I have seen the light and I have found a couple of books that really helped me with a few things and I admire their sheer cunning and genius. Let me share with you some of my new found parenting advice.
You've had one of those days. You haven't cleaned the house, you haven't been grocery shopping and you can't be bothered to make supper.
You will need a small child; preferably one who loves to play pretend and will go along with things willingly. Firstly you will need to prepare a very simple tea (small sandwiches, a few biscuits and a pot of tea will suffice). Whilst the tea is brewing, you will need to locate the water stopcock. Once found, turn to the OFF position. Next, explain to small child that you're going to play 'who can mess the kitchen cupboards up first?' don't worry, small child will like this part so no effort needed from you.
Next thing is to ensure that anything that could potentially be turned into supper should be removed (call it 'reorganising' if you like), outbuildings and airing cupboards are useful here.
Now, to be able to carry this through is going to require complete dedication (I would suggest sampling any beer that may be cooling in the fridge).
You might need to leave this to sink in for a moment, children can be annoyingly cynical.
The next part is crucial. Small child needs to be wearing nightwear (perhaps the tiger might like a sleepover?). Unfortunately the OFF position of the stopcock means a bath just aint happening.
Right as soon as you hear Daddy's key in the door, prompt small child to relay the hilarious tiger story to Daddy. Small children can be incredibly convincing, especially when they mention that the tiger drunk all the beer too.
Poor hungry, unbathed child. Poor (slightly tipsy…shhh!) wife traumatised by the mess left behind by the feline visitor.
Daddy steps up and suggests a nice dinner out.
I'm sure you'll agree this is the perfect (if somewhat convoluted) get out clause of a 'can't be bothered day'. Thank you Judith Kerr.
My second go-to for parenting advice is slightly different. I have a 1 year old and a 3 year old so we watch quite a lot of a programme called Bing, and repeatedly read the associated books.
The excitable bunny on the left is 'Bing'. The slightly bizarre looking, knitted thing on the right is Flop. For reasons unknown, Flop is Bing's guardian (despite being half his size). But what Flop is lacking in size he makes up for in patience. Seriously, his patience would make Mother Theresa quake in her boots. His favourite phrase is "it's no big thing". He says it for everything from too many bubbles in the bath, to a broken and hidden mobile, to a shoplifting incident.
He never raises his voice. He never rolls his eyes. He never threatens to summon a policeman (god knows why I thought that threat or that phrasing would be effective). He never evens counts to ten while frantically figuring out what suitable punishment will be enforced by number ten.
I do hope that me sharing what I've learnt from books has been helpful to you.
Previous Post Great Expectations and Little Rewards.


text:
Gaming Companies, Browse, Wisconsin
Out of the Box Publishing
Games Portal
Out of the Box Publishing is a Dodgeville, Wisconsin based Publishing Company specializing in family, card and party games. As of December 2008, they have published over 45 titles.
Out of the Box Publishing is best known for games that are innovative, easy to learn and quick to play. The company has received numerous awards including Mensa Select, Toy of the Year and National Parenting Center.
Out of the Box Publishing was established in 1998 in Madison, Wisconsin by Mark Osterhaus, Alan Waller, Cathleen Quinn-Kinney and John Kovalic. The first game published by the company was Bosworth, a four-player chess variant which has since been retired. In the summer of 1998, Out of the Box Publishing acquired the license for their most well-known game, Apples to Apples, from inventor Matthew Kirby. Over the next ten years, Out of the Box grew into a leading American game company, supplying games to thousands of specialty toy stores, Target, Wal-mart and Toys R Us. In 2007, the company sold the licenses to Apples to Apples, Blink, Snorta and Qwitch to the Mattel Corporation, several owners retired and several new owners (including children of the previous owners) were invited to join. Since the sale Out of the Box has new growing games, such as Backseat Drawing, Ninja versus Ninja and Word on the Street.
Games Edit
Out of the Box Publishing is best known for games that are innovative, take less than 5 minutes to learn and less than a half an hour to play. All Out of the Box games are family-oriented and appropriate for kids and adults. Out of the Box accepts game submissions from new inventors as well as established inventors. The company receives over 600 submissions a year and publishes about 5 games per year. Instructions for submitting a game are located on the company's website.
Notable Games Edit
The artistic director and one of the founders of Out of the Box Publishing, John Kovalic, was also the illustrator for Munchkin.
Out of the Box Homepage
Out of the Box Twitter Page
Out of the Box Blog
Out of the Box Facebook Page
Out of the Box YouTube Channel
Back To: Ogres Wiki -> RPG Portal -> List of Game Companies
Retrieved from "https://ogres.fandom.com/wiki/Out_of_the_Box_Publishing?oldid=9945"
Gaming Companies

redpajama_set_name: RedPajamaCommonCrawl


text:
All posts tagged "Wonder Boy: The Dragon's Trap"
Wonder Boy: The Dragon's Trap is coming to mobile
Lizardcube's fabulous remake of Sega Master System classic, Wonder Boy: The Dragon's Trap, is coming to iOS and Android.
News1 year ago
Wonder Boy: The Dragon's Trap gets EU/AUS/NZ physical release
Lizardcube's loving remaster of Wonder Boy gets a physical release on PS4 and Nintendo Switch.
GDC 18: Wonder Boy: The Dragon's Trap – Redesigning a classic
Lizardcube's Ben Fiquet reveals how he updated the graphics of a childhood classic in Wonder Boy: The Dragon's Trap.
News2 years ago
The Dragon's Trap sold more Switch copies than the other platforms combined
Here's an interesting snippet about just how well Wonder Boy The Dragon's Trap has sold on Nintendo Switch.
Wonder Boy: The Dragon's Trap is coming to Mac, Linux
Get ready, Mac and Linux gamers – Wonder Boy: The Dragon's Trap is on its way to a system near you.
Wonder Boy: The Dragon's Trap PC release date confirmed
Ready to head to Monster Land on Windows? It's The Dragon's Trap PC version, folks.
The Week in Video Games – May 14, 2017
Welcome to our weekly video games news roundup, featuring stories from Thumbsticks and elsewhere on the internets.
The Dragon's Trap physical release announced by Limited Run Games
Get ready to head back to Monster Land (again) with this impending The Dragon's Trap physical release.
Reviews2 years ago
Wonder Boy: The Dragon's Trap review
Is Wonder Boy: The Dragon's Trap the remake this classic game deserves, or yet another cheap, shoddy cash-in on video game nostalgia?


text:
Q: Tell if remote computers are online/offline I have a bunch of computers(running windows 7) at different locations around the city  and I need to know which of the computers is online in real time. Since none of the computers have a static IP address, i am unable to use the usual mechanisms of pinging the computers.
My initial idea was to create a windows service and install it at each client, then have the respective services ping a central server (I have an amazon EC2 account, running windows OS) which can keep track of when the last ping from each respective computer was received. A website based dashboard would then read the DB from the server and tell if the respective computers are online/offline based on the last recorded ping.
Now all of this seems to be a lot of work for something which must be quite common an issue. Can anyone suggest a out of box solutions or a similar mechanism to achieve my goal of monitoring online/offline status of remote computers which have no static IP address. Thanks

A: A friend of mine used www.no-ip.org.
What he did was running the program on his computer that connected to no-ip.org and keeping a certain address (for example: my_computer_1.no-ip.org) up to date so it linked to his PC even when the IP has changed. Like that, you can set up a pseudo-static address for all of your PCs and try to connect to those to see whether the PCs are online or not.
I hope that helps.

A: PRTG monitor?
http://www.paessler.com/prtg
It's mostly used for servers, but would work great for your scenario.

redpajama_set_name: RedPajamaStackExchange


Classifications of diseases become extremely important in the compilation of statistics on causes of illness (morbidity) and causes of death (mortality). It is obviously important to know what kinds of illness and disease are prevalent in an area and how these prevalence rates vary with time. Classifying diseases made it apparent, for example, that the frequency of lung cancer was entering a period of alarming increase in the mid-20th century. Once a rare form of cancer, it had become the single most important form of cancer in males. With this knowledge a search was instituted for possible causes of this increased prevalence. It was concluded that the occurrence of lung cancer was closely associated with cigarette smoking. Classification of disease had helped to ferret out an important, frequently causal, relationship.
The most widely used classifications of disease are (1) topographic, by bodily region or system, (2) anatomic, by organ or tissue, (3) physiological, by function or effect, (4) pathological, by the nature of the disease process, (5) etiologic (causal), (6) juristic, by speed of advent of death, (7) epidemiological, and (8) statistical. Any single disease may fall within several of these classifications.
In the topographic classification, diseases are subdivided into such categories as gastrointestinal disease, vascular disease, abdominal disease, and chest disease. Various specializations within medicine follow such topographic or systemic divisions, so that there are physicians who are essentially vascular surgeons, for example, or clinicians who are specialized in gastrointestinal disease. Similarly, some physicians have become specialized in chest disease and concentrate principally on diseases of the heart and lungs.
In the anatomic classification, disease is categorized by the specific organ or tissue affected; hence, heart disease, liver disease, and lung disease. Medical specialties such as cardiology are restricted to diseases of a single organ, in this case the heart. Such a classification has its greatest use in identifying the various kinds of disease that affect a particular organ. The heart is a good example to consider. By the segregation of cardiac disease it has been made apparent that heart disease is now the most important cause of death in the United States and in most other industrialized nations. Moreover, it has become apparent that disease caused by atherosclerosis of the coronary arteries is by far the most important form of heart disease. In making a diagnosis of cardiac disease in an elderly patient, the cardiologist must first determine whether this disease of the coronary arteries is responsible for the heart's failure to function normally.
The physiological classification of disease is based on the underlying functional derangement produced by a specific disorder. Included in this classification are such designations as respiratory and metabolic disease. Respiratory diseases are those that interfere with the intake and expulsion of air and the exchange of oxygen for carbon dioxide in the lungs. Metabolic diseases are those in which disturbances of the body's chemical processes are a basic feature. Diabetes and gout are examples.
The pathological classification of disease considers the nature of the disease process. Neoplastic and inflammatory disease are examples. Neoplastic disease includes the whole range of tumours, particularly cancers, and their effect on human beings.
The etiologic classification of disease is based on the cause, when known. This classification is particularly important and useful in the consideration of biotic disease. On this basis disease might be classified as staphylococcal or rickettsial or fungal, to cite only a few instances. It is important to know, for example, what kinds of disease staphylococci produce in human beings. It is well known that they cause skin infections and pneumonia, but it is also important to note how often they cause meningitis, abscesses in the liver, and kidney infections. The sexually transmitted diseases syphilis and gonorrhea are further examples of diseases classified by etiology.
The juristic basis of the classification of disease is concerned with the legal circumstances in which death occurs. It is principally involved with sudden death, the cause of which is not clearly evident. Thus, on a juristic basis some deaths and diseases are classified as medical-legal and fall within the jurisdiction of coroners and medical examiners. A person living alone is found dead in bed—dead of natural causes or killed? Had the person who dropped dead on the street been given some poison that took a short time to act? Much less dramatic, but perhaps more common, are disease and death caused by exposure of the individual to some unrecognized danger to health in working or living conditions. Could the illness or disease be attributable to fumes or dusts in a factory? These are examples of the many types of disease and death that fall properly in this classification.
The epidemiological classification of disease deals with the incidence, distribution, and control of disorders in a population. To use the example of typhoid, a disease spread through contaminated food and water, it first becomes important to establish that the disease observed is truly caused by Salmonella typhi, the typhoid organism. Once the diagnosis is established, it is obviously important to know the number of cases, whether the cases were scattered over the course of a year or occurred within a short period, and what the geographic distribution is. It is critically important that the precise address and activities of the patients be established. Two widely separated locations within the same city might be found to have clusters of cases of typhoid all arising virtually simultaneously. It might be found that each of these clusters revolved about a family unit including cousins, grandparents, aunts and uncles, and friends, suggesting that in some way personal relationships might be important. Further investigation might disclose that all the infected persons had dined at one time or at short intervals in a specific home. It might further be found that the person who had prepared the meal had recently visited some rural area and had suffered a mild attack of the disease and was now spreading it to family and friends by unknowing contamination of food. This hypothetical case suggests the importance of the etiologic, as well as the epidemiological, classification of disease.
Epidemiology is one of the important sciences in the study of nutritional and biotic diseases around the world. The United Nations supports, in part, the World Health Organization, whose chief function is the worldwide investigation of the distribution of disease. In the course of this investigation, many observations have been made that help to explain the cause and provide approaches to the control of many diseases.
The statistical basis of classification of disease employs analysis of the incidence (the numbers of new cases of a specific disease that occur during a certain period) and the prevalence rate (number of cases of a disease in existence at a certain time) of diseases. If, for example, a disease has an incidence rate of 100 cases per year in a given locale and, on the average, the affected persons live three years with the disease, it is obvious that the prevalence of the disease is 300. Statistical classification is an additional important tool in the study of possible causes of disease. These studies, as well as epidemiological, nutritional, and pathological analyses, have made it clear, for example, that diet is an important consideration in the possible causation of atherosclerosis. The statistical analyses drew attention to the role of high levels of fats and carbohydrates in the diet in the possible causation of atherosclerosis. The analyses further drew attention to the fact that certain populations that do not eat large quantities of animal fats and subsist largely on vegetable oils and fish have a much lower incidence of atherosclerosis. Thus, statistical surveys are of great importance in the study of human disease.


The T-024SK Carbon Fiber Tripod with B-00 Ball Head from Sirui has 10x carbon fiber legs with a magnesium spider, making it a convenient travel-friendly 2.2 lb support. The legs can fold in the reverse to create a compact 15.8" in length, and twist locks on the four-section tripod open with a simple turn to extend the legs along with the rapid center column to maximum height of 58.7". A second, short center column is included, which allows you to drop the tripod to a minimum height of 8.3" without having to lift the column up.
The black Arca-type B-00 ball head makes a good match to tripod and retains the theme of being compact. The ball head supports mirrorless, compact, and small DSLR cameras weighing up to 11 lb. The separate pan lock disengages and allows the head to rotate the 360�. The ball also moves freely after unlocking the head's lever lock, and at the same time, the cut notch on the side of the head permits you to position a camera at a 907� angle. The TY-C10 quick release plate, which has a 1/4"-20 threaded mount, is included with this kit.


text:
[Docs] [txt|pdf] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]
Versions: 00 01 02 03 04 05 06 RFC 4953
IETF TCPM WG                                                   J. Touch
Internet Draft                                                  USC/ISI
Expires: April 2006                                     October 8, 2005
Defending TCP Against Spoofing Attacks
draft-ietf-tcpm-tcp-antispoof-02.txt
By submitting this Internet-Draft, each author represents that
any applicable patent or other IPR claims of which he or she is
aware have been or will be disclosed, and any of which he or she
becomes aware will be disclosed, in accordance with Section 6 of
BCP 79.
Task Force (IETF), its areas, and its working groups.  Note that
other groups may also distribute working documents as Internet-
Drafts.
http://www.ietf.org/ietf/1id-abstracts.txt
http://www.ietf.org/shadow.html
This Internet-Draft will expire on April 8, 2006.
Copyright (C) The Internet Society (2005).  All Rights Reserved.
Recent analysis of potential attacks on core Internet infrastructure
indicates an increased vulnerability of TCP connections to spurious
resets (RSTs), sent with forged IP source addresses (spoofing).  TCP
has always been susceptible to such RST spoofing attacks, which were
indirectly protected by checking that the RST sequence number was
inside the current receive window, as well as via the obfuscation of
Touch                   Expires April 8, 2006                  [Page 1]
Internet-Draft  Defending TCP Against Spoofing Attacks     October 2005
TCP endpoint and port numbers.  For pairs of well-known endpoints
often over predictable port pairs, such as BGP or between web servers
and well-known large-scale caches, increases in the path bandwidth-
delay product of a connection have sufficiently increased the receive
window space that off-path third parties can guess a viable RST
sequence number. The susceptibility to attack increases as the square
of the bandwidth, thus presents a significant vulnerability for
recent high-speed networks. This document addresses this
vulnerability, discussing proposed solutions at the transport level
and their inherent challenges, as well as existing network level
solutions and the feasibility of their deployment. This document
focuses on vulnerabilities due to spoofed TCP segments, and includes
a discussion of related ICMP spoofing attacks on TCP connections.
1. Introduction...................................................3
2. Background.....................................................4
2.1. Review of TCP Windows.....................................5
2.2. Recent BGP Attacks Using TCP RSTs.........................5
2.3. TCP RST Vulnerability.....................................6
2.4. What Changed - the Ever Opening Advertised Receive Window.7
3. Proposed Solutions and Mitigations.............................9
3.1. Transport Layer Solutions................................10
3.1.1. TCP MD5 Authentication..............................10
3.1.2. TCP RST Window Attenuation..........................10
3.1.3. TCP Timestamp Authentication........................11
3.1.4. Other TCP Cookies...................................12
3.1.5. Other TCP Considerations............................12
3.1.6. Other Transport Protocol Solutions..................13
3.2. Network Layer (IP) Solutions.............................13
3.2.1. Address filtering...................................13
3.2.2. IPsec...............................................14
4. ICMP..........................................................15
5. Issues........................................................16
5.1. Transport Layer (e.g., TCP)..............................16
5.2. Network Layer (IP).......................................17
5.3. Application Layer........................................18
5.4. Shim Transport/Application Layer.........................19
5.5. Link Layer...............................................19
5.6. Issues Discussion........................................19
6. Security Considerations.......................................20
7. IANA Considerations...........................................20
8. Conclusions...................................................20
9. Acknowledgments...............................................21
10. References...................................................21
10.1. Normative References....................................21
10.2. Informative References..................................21
Author's Addresses...............................................24
Intellectual Property Statement..................................24
Disclaimer of Validity...........................................25
Copyright Statement..............................................25
Acknowledgment...................................................25
Analysis of the Internet infrastructure has been recently
demonstrated new version of a vulnerability in BGP connections
between core routers using an attack known for nearly six years
[8][9][18][40].  These connections, typically using TCP, can be
susceptible to off-path third-party reset (RST) segments with forged
source addresses (spoofed), which terminate the TCP connection.  BGP
routers react to a terminated TCP connection in various ways which
can amplify the impact of an attack, ranging from restarting the
connection to deciding that the other router is unreachable and thus
flushing the BGP routes [32].  This sort of attack affects other
protocols besides BGP, involving any long-lived connection between
well-known endpoints.  The impact on Internet infrastructure can be
substantial (esp. for the BGP case), and warrants immediate
TCP, like many other protocols, can be susceptible to these off-path
third-party spoofing attacks.  Such attacks rely on the increase of
commodity platforms supporting public access to previously privileged
resources, such as root-level access.  Given such access, it is
trivial for anyone to generate a packet with any header desired.
This, coupled with the lack of sufficient address filtering to drop
such spoofed traffic, can increase the potential for off-path third-
party spoofing attacks.  Proposed solutions include the deployment of
existing Internet network and transport security as well as
modifications to transport protocols that reduce its vulnerability to
generated attacks.
One way to defeat spoofing is to validate the segments of a
connection, either at the transport level or the network level.  TCP
with MD5 extensions provides this authentication at the transport
level, and IPsec provides authentication at the network level. In
both cases their deployment overhead may be prohibitive, e.g., it may
not feasible for public services, such as web servers, to be
configured with the appropriate certificate authorities of large
numbers of peers (for IPsec using IKE), or shared secrets (for IPsec
in shared-secret mode, or TCP/MD5), because many clients may need to
be configured rapidly without external assistance.  Services from
public web servers connecting to large-scale caches to BGP with
larger numbers of peers can experience this challenge.
The remainder of this document outlines the recent attack scenario in
detail and describes and compares a variety of solutions, including
existing solutions based on TCP/MD5 and IPsec, as well as recently
proposed solutions, including modifications to TCP's RST processing
[10], modifications to TCP's timestamp processing [30], and
modifications to IPsec and TCP/MD5 keying [38]. This document focuses
on spoofing of TCP segments, although a discussion of related
spoofing of ICMP packets based on spoofed TCP contents is also
discussed.
Note that the description of these attacks is not new; attacks using
RSTs on BGP have been known since 1998, and were the reason for the
development of TCP/MD5 [18]. The recent attack scenario was first
documented by Convery at a NANOG meeting in 2003, but that analysis
assumed the entire sequence space (2^32 packets) needed to be covered
for an attack to succeed [9]. Watson's more detailed analysis
discovered that a single packet anywhere in the current window could
succeed at an attack [40]. This document adds the observation that
susceptibility to attack goes as the square of bandwidth, due to the
coupling between the linear increase in receive window size and
linear increase in rate an attacker, as well as comparing the variety
of more recent proposals, including modifications to TCP, use of
IPsec, and use of TCP/MD5 to resist such attacks.
The recent analysis of potential attacks on BGP has again raised the
issue of TCP's vulnerability to off-path third-party spoofing attacks
[8][9][40].  A variety of such attacks have been known for several
years, including sending RSTs, SYNs, and even ACKs in an attempt to
affect an existing connection or to load down servers.  Overall, such
attacks are countered by the use of some form of authentication at
the network (e.g., IPsec), transport (e.g., SYN cookies, TCP/MD5), or
other layers.  TCP already includes a weak form of such
authentication in its check of segment sequence numbers against the
current receiver window.  Increases in the bandwidth-delay product
for certain long connections have sufficiently weakened this type of
weak authentication in recent weeks, rendering it moot.
2.1. Review of TCP Windows
Before proceeding, it is useful to review the terminology and
components of TCP's windowing algorithm. TCP connections have three
kinds of windows [1][31]:
o  Send window (SND.WND): the latest advertised send window size.
o  Receive window (RCV.WND): the latest advertised receive window
o  Congestion window (CWND): the window determined by congestion
feedback that limits how much of RCV.WND can be in-flight in a
round trip time.
For most modern TCP connections, SND.WND and RCV.WND are the size of
the corresponding send and receive socket buffers, and are
configurable using socket buffer resizing commands.
CWND determines how much data can be in transit in a round trip time,
SND.WND determines how much data the sender is willing to store on
its side for possible retransmission due to loss, and RCV.WND
determines the ability of the receiver to accommodate that loss and
reorder received packets. CWND never grows beyond RCV.WND.
High bandwidth-delay product networks need CWND to be sufficiently
large to accommodate as much data would be in transit in a round trip
time, otherwise their performance will suffer. As a result, it is
recommended that users and various automatic programs increase
RCV.WND to at least the size of bandwidth*delay (the bandwidth-delay
product) [19][33].
As the bandwidth-delay product of the network increases, however,
such increases in the advertised receive window can cause increased
susceptibility to spoofing attacks, as the remainder of this document
shows. This assumes, however, that the receive window size (e.g., via
increased receive socket buffer configuration) is increased with the
increased bandwidth-delay product; if not, then connection
performance will degrade, but susceptibility to spoofing attacks will
increase only linearly (with the rate of the attacker to send spoofed
packets), not as the square of the bandwidth.
2.2. Recent BGP Attacks Using TCP RSTs
BGP represents a particular vulnerability to spoofing attacks because
it uses TCP connectivity to infer routability, so losing a TCP
connection with a BGP peer can result in the flushing of routes to
that peer [32].
Until six years ago, such connections were assumed difficult to
attack because they were described by a few comparatively obscure
parameters [18]. Most TCP connections are protected by multiple
levels of obfuscation except at the endpoints of the connection:
o Both endpoint addresses are usually not well-known; although server
addresses are advertised, clients are somewhat anonymous.
o Both port numbers are usually not well-known; the server's usually
is advertised (representing the service), but the client's is
typically sufficiently unpredictable to an off-path third-party.
o Valid sequence number space is not well-known.
o Connections are relatively short-lived and valid sequence space
changes, so any guess of the above information is unlikely to be
BGP represents an exception to the above criteria (though not the
only case).  Both endpoints can be well-known, using hints from part
of an AS path.  The destination port is typically fixed to indicate
the BGP service.  The source port used by a BGP router is sometimes
fixed and advertised to enable firewall configuration; even when not
fixed, there are only 65,384 valid source ports which may be
exhaustively attacked.  Connections are long-lived, and as noted
before some BGP implementations interpret successive TCP connection
failures as routing failures, discarding the corresponding routing
information. As importantly and as will be shown below, the valid
sequence number space once thought to provide some protection has
been rendered useless by increasing advertised receive window sizes.
2.3. TCP RST Vulnerability
TCP has a known vulnerability to third-party spoofed segments.  SYN
flooding consumes server resources in half-open connections,
affecting the server's ability to open new connections.  ACK spoofing
can cause connections to transmit too much data too quickly, creating
network congestion and segment loss, causing connections to slow to a
crawl.  In the most recent attacks on BGP, RSTs cause connections to
be dropped.  As noted earlier, some BGP implementations interpret TCP
connection termination, or a series of such failures, as a network
failure [32].  This causes routers to drop the BGP routing
information already exchanged, in addition to inhibiting their
ongoing exchanges, thus amplifying the impact of the attack.  The
result can affect routing paths throughout the Internet.
The dangerous effects of RSTs on TCP have been known for many years,
even when used by the legitimate endpoints of a connection.  TCP RSTs
cause the receiver to drop all connection state; because the source
is not required to maintain a TIME_WAIT state, such a RST can cause
premature reuse of address/port pairs, potentially allowing segments
from a previous connection to contaminate the data of a new
connection, known as TIME_WAIT assassination [7].  In this case,
assassination occurs inadvertently as the result of duplicate
segments from a legitimate source, and can be avoided by blocking RST
processing while in TIME_WAIT.  However, assassination can be useful
to deliberately reduce the state held at servers; this requires that
the source of the RSTs go into TIME_WAIT state to avoid such hazards,
and that RSTs are not blocked in the TIME_WAIT state [11].
Firewalls and load balancers, so-called 'middleboxes', sometimes emit
RSTs on behalf of transited connections to optimize server
performance [13].  This is effectively an on-path RST attack in which
the RSTs are sent for benign or beneficial intent.  There are
numerous hazards with such use of RSTs, outlined in that RFC.
2.4. What Changed - the Ever Opening Advertised Receive Window
RSTs represent a hazard to TCP, especially when completely unchecked.
Fortunately, there are a number of obfuscation mechanisms that make
it difficult for off-path third parties to forge (spoof) valid RSTs,
as noted earlier.  We have already shown it is easy to learn both
endpoint addresses and ports for some protocols, notably BGP.  The
final obfuscation is the segment sequence number.
TCP segments include a sequence number which enables out-of-order
receiver processing as well as duplicate detection.  The sequence
number space is also used to manage congestion, and indicates the
index of the next byte to be transmitted or received.  For RSTs, this
is relevant because legitimate RSTs use the next sequence number in
the transmitter window, and the receiver checks that incoming RSTs
have a sequence number in the expected receive window.  Such
processing is intended to eliminate duplicate segments (somewhat moot
for RSTs, though), and to drop RSTs which were part of previous
TCP uses two window mechanisms, a primary mechanism which uses a
space of 32 bits, and a secondary mechanism which scales this window
[19][31].  The valid advertised receive window is a fraction, not to
exceed approximately half, of this space, or ~2 billion (2E9, i.e.,
U.S. billion).  Under typical configurations, the majority of TCP
connections open to a very small fraction of this space, e.g.,
10,000-60,000(approximately 5-100 segments).  This is because the
advertised receive window typically matches the receive socket buffer
size. It is recommended that this buffer be tuned to match the needs
of the connection, either manually or by automatic external means
On a low-loss path, the advertised receive window should be
configured to match the path bandwidth-delay product, including
buffering delays (assume 1 packet/hop) [33].  Many paths in the
Internet have end-to-end bandwidths of under 1 Mbps, latencies under
100ms, and are under 15 hops, resulting in fairly small advertised
receive windows as above (under 35,000 bytes).  Under these
conditions, and further assuming that the initial sequence number is
suitably (pseudo-randomly) chosen, a valid guessed sequence number
would have odds of 1 in 57,000 of falling within the advertised
receive window.  Put differently, a blind (i.e., off-path) attacker
would need to send 57,000 RSTs with suitably spaced sequence number
guesses to successfully reset a connection.  At 1 Mbps, 57,000 (40
byte) RSTs would take over 50 minutes to transmit, and, as noted
earlier, most current connections are fairly brief by comparison.
Recent use of high bandwidth paths of 10 Gbps and higher result in
bandwidth-delay products over 125 MB - approximately 1/10 of TCP's
overall maximum advertised receive window size (i.e., assuming the
receive socket buffers are increased as much as possible) excluding
scale, assuming the receiver allocates sufficient buffering (as
discussed in Sec. 2. ).  Even under networks that are ten times
slower (1 Gbps), the active advertised receive window covers 1/100th
of the overall window size.  At these speeds, it takes only 10-100
packets, or less than 32 microseconds, to correctly guess a valid
sequence number and kill a connection.  A table of corresponding
exposure to various amounts of RSTs is shown below, for various line
rates, assuming the more conventional 100ms latencies (though even
100ms is large for BGP cases):
BW       BW*delay   RSTs needed     Time needed
10 Gbps   125       MB          35     1 us (microsecond)
1 Gbps    12.5     MB         344   110 us
100 Mbps     1.25    MB       3,436    10 ms (millisecond)
10 Mbps     0.125   MB      34,360     1 second
1 Mbps     0.0125  MB     343,598     2 minutes
100 Kbps     0.00125 MB   3,435,974     3 hours
Figure 1 Time needed to kill a connection
This table demonstrates that the effect of bandwidth on the
vulnerability is squared; for every increase in bandwidth, there is a
linear decrease in the number of sequence number guesses needed, as
well as a linear decrease in the time needed to send a set of
guesses.  Notably, as inter-router link bandwidths approach 1 Mbps,
an 'exhaustive' attack becomes practical.  Checking that the RST
sequence number is somewhere in the advertised receive window out of
the overall maximum receive window (2^32) is an insufficient
obfuscation.
Note that this table makes a number of assumptions:
1. the overall bandwidth-delay product is relatively fixed
2. traffic losses are negligible (insufficient to affect the
congestion window over the duration of most of the connection)
3. the advertised receive window is a large fraction of the overall
maximum receive window size, e.g., because the receive socket
buffers are set to match a large bandwidth-delay product
4. the attack bandwidth is similar to the end-to-end path bandwidth
Of these assumptions, the last two are more notable.  The issue of
receive socket buffers was discussed in Sec. 2.  The issue of the
attack bandwidth is considered reasonable as follows:
1. RSTs are substantially easier to send than data; they can be
precomputed and they are smaller than data packets (40 bytes).
2. although susceptible connections use somewhat less ubiquitous
high-bandwidth paths, the attack may be distributed, at which
point only the ingress link of the attack is the primary
3. for the purposes of the above table, we assume that the ingress at
the attack has the same bandwidth as the path, as an approximation
The previous sections discussed the nature of the recent attacks on
BGP due to the vulnerability of TCP to RST spoofing attacks, due
largely to recent increases in the fraction of the TCP advertised
receive window space in use for a single, long-lived connection.
3. Proposed Solutions and Mitigations
TCP currently authenticates received RSTs using the address and port
pair numbers, and checks that the sequence number is inside the valid
receiver window.  The previous section demonstrated how TCP has
become more vulnerable to RST spoofing attacks due to the increases
in the receive window size.  There are a number of current and
proposed solutions to this vulnerability, all attempting to provide
evidence that a received RST is legitimate.
3.1. Transport Layer Solutions
The transport layer represents the last place that segments can be
authenticated before they affect connection management.  TCP has a
variety of current and proposed mechanisms to increase the
authentication of segments, protecting against both off-path and on-
path third-party spoofing attacks.  SCTP also has mechanisms to
authenticate segments.
3.1.1. TCP MD5 Authentication
An extension to TCP supporting MD5 authentication was developed in
1998 specifically to authenticate BGP connections (although it can be
used for any TCP connection) [18].  The extension relies on a pre-
shared secret key to authenticate the entire TCP segment, including
the data, TCP header, and TCP pseudo-header (certain fields of the IP
header).  All segments are protected, including RSTs, to be accepted
only when their signature matches.  This option, although widely
deployed in Internet routers, is considered undeployable for
widespread use because the need for pre-shared keys [3][27].  It
further is considered computationally expensive for either hosts or
routers due to the overhead of MD5 [36][37].
3.1.2. TCP RST Window Attenuation
A recent proposal extends TCP to further constrain received RST to
match the expected next sequence number [10].  This restores TCP's
resistance to spurious RSTs, effectively limiting the receive window
for RSTs to a single number.  As a result, an attacker would need to
send 2^32 different packets to correctly guess the sequence number.
The extension further modifies the RST receiver to react to
incorrectly-numbered RSTs, by sending a zero-length ACK.  If the RST
source is legitimate, upon receipt of an ACK the closed source would
presumably emit a RST with the sequence number matching the ACK,
correctly resetting the intended recipient.  This modification
changes TCP's control processing, adding to its complexity and thus
potentially affecting its correctness (in contrast to adding MD5
signatures, which is orthogonal to TCP control processing
altogether).  For example, there may be complications between RSTs of
different connections between the same pair of endpoints because RSTs
flush the TIME-WAIT (as mentioned earlier).  Further, this proposal
Touch                   Expires April 8, 2006                 [Page 10]
modifies TCP so that under some circumstances a RST causes a reply
(an ACK), in violation of generally accepted practice, if not gentle
recommendation - although this can be omitted, allowing timeouts to
suffice.  The advantage to this proposal is that it can be deployed
incrementally and has benefit to the endpoint on which it is
deployed.
A variant of this proposal uses a different value to attenuate the
window of viable RSTs.  It requires RSTs to carry the initial
sequence number rather than the next expected sequence number, i.e.,
the value negotiated on connection establishment [35][41].  This
proposal has the advantage of using an explicitly negotiated value,
but at the cost of changing the behavior of an unmodified endpoint to
a currently valid RST.  It would thus be more difficult, without
additional mechanism, to deploy incrementally.
Another variant of this proposal involves increasing TCP's window
space, rather than decreasing the valid range for RSTs, i.e.,
increasing the sequence space from 32 bits to 64 bits.  This has the
equivalent effect - the ratio of the valid sequence numbers for any
segment to the overall sequence number space is significantly
reduced.  The use of the larger space, as with current schemes to
establish weak authentication using initial sequence numbers (ISNs),
is contingent on using suitably random values for the ISN.  Such
randomness adds additional complexity to TCP both in specification
and implementation, and provides only very weak authentication.  Such
a modification is not obviously backward compatible, and would be
thus difficult to deploy.
A converse variant of increasing TCP's window space is to decrease
the receive window, which would further reduce the effectiveness of
spoofed RSTs with random sequence numbers. This alternative may
reduce the throughput of the connection, if the advertised receive
window is smaller than the bandwidth-delay product of the connection.
3.1.3. TCP Timestamp Authentication
Another way to authenticate TCP segments is to utilize its timestamp
option, using the value as a sort of authentication [30].  This
requires that the receiver TCP discard values whose timestamp is
outside the accepted window, which is derived from the timestamps of
other packets from the same connection.  This technique uses an
existing TCP option, but also requires modified TCP control
processing (with the same caveats) and may be difficult to deploy
incrementally without further modifications.  Additionally, the
timestamp value may be easier to guess because it is derived from a
predictable value.
3.1.4. Other TCP Cookies
All of the above techniques are variants of cookies, otherwise
meaningless data whose value is used to validate the packet.  In the
case of MD5 checksums, the cookie is computed based on a shared
secret.  Note that even a signature can be guessed, and presents a 1
in 2^(signature length) probability of attack.  The primary
difference is that MD5 signatures are effectively one-time cookies,
not predictable based on on-path snooping, because they are dependent
on packet data and thus do not repeat.  Window attenuation sequence
numbers can be guessed by snooping the sequence number of current
packets, and timestamps can be guessed even more remotely.  These
variants of cookies are similar in spirit to TCP SYN cookies, again
patching a vulnerability to off-path third-party spoofing attacks
based on a (fairly weak, excepting MD5) form of authentication.
Another form of cookie is the source port itself, which can be
randomized but provides only 16 bits of protection (65,000
combinations), which may be exhaustively attacked. This can be
combined with destination port randomization as well, but that would
require a separate coordination mechanism (so both parties know which
ports to use), which is equivalent to (and as infeasible for large-
scale deployments as) exchanging a shared secret.
3.1.5. Other TCP Considerations
The analysis of the potential for RST spoofing above assumes that the
advertised receive window is opened to the maximum extent suggested
by the bandwidth-delay product of the end-to-end path, and that the
window is opened to an appreciable fraction of the overall sequence
number space.  As noted earlier, for most common cases, connections
are too brief or over bandwidths too low for such a large window to
be useful. Expanding TCP's sequence number space is a direct way to
further avoid such vulnerability, even for long connections over
emerging bandwidths. If either manual tuning or automatic tuning of
the advertised receive window (via receive buffer tuning) is not
provided, this is not an issue (although connection performance will
suffer) [33].
It is may be sufficient for the endpoint to limit the advertised
receive window by deliberately leaving it small.  If the receive
socket buffer is limited, e.g., to the ubiquitous default of 64KB,
the advertised receive window will not be as vulnerable even for very
long connections over very high bandwidths. The vulnerability will
grow linearly with the increased network speed, but not as the
square.  The consequence is lower sustained throughput, where only
one window's worth of data per round trip time (RTT) is exchanged.
This will keep the connection open longer; for long-lived connections
with continuous sourced data, this may continue to present an attack
opportunity, albeit a sparse and slow-moving target. For the most
recent case where BGP data is being exchanged between Internet
routers, the data is bursty and the aggregate traffic may be small
(i.e., unlikely to cover a substantial portion of the sequence space,
even if long-lived), so is smaller advertised receive windows (via
small receiver buffers) may, in some cases, sufficiently address the
immediate problem. This assumes that the routing tables can be
exchanged quickly enough with bandwidth reduced due to the smaller
buffers, or perhaps that the advertised receive window is opened only
during a large burst exchange (e.g., via some other signal between
the two routers).
3.1.6. Other Transport Protocol Solutions
Segment authentication has been addressed at the transport layer in
other protocols.  Both SCTP and DCCP include cookies for connection
establishment and use them to authenticate a variety of other control
messages [26][34].  The inclusion of such mechanism at the transport
protocol, although emerging as standard practice, unnecessarily
complicates the design and implementation of new protocols [28]  As
new attacks are discovered (SYN floods, RSTs, etc.), each protocol
must be modified individually to compensate.  A network solution may
be more appropriate and efficient.
3.2. Network Layer (IP) Solutions
There are two primary variants of network layer solutions to
spoofing: address filtering and IPsec. Address filtering is an
indirect system which relies on other parties to filter packets sent
upstream of an attack, but does not necessarily require participation
of the packet source. IPsec requires cooperation between the
endpoints wanting to avoid attack on their connection, which
currently involves pre-existing shared knowledge of either a shared
key or shared certificate authority.
3.2.1. Address filtering
Address filtering is often proposed as an alternative to protocol
mechanisms to defeat IP source address spoofing [2][12]. Address
filtering restricts traffic from downstream sources across transit
networks based on the IP source address. It cannot restrict traffic
from the core to edges, i.e., from upstream sources. As a result,
each border router must perform the appropriate filtering for overall
protection to result; failure of any border router to filter defeats
the protection of all participants inside the border, ultimately.
Address filtering at the border can protect those inside the border
from some kinds of spoofing, because only interior addresses should
originate inside the border. It cannot, however, protect connections
originating outside the border except to restrict where the traffic
enters from, e.g., if it expected from one AS and not another.
As a result, address filtering is not a local solution that can be
deployed to protect communicating pairs, but rather relies on a
distributed infrastructure of trusted gateways filtering forged
traffic where it enters the network. It is not feasible for local,
incremental deployment, and relies too heavily on distributed
cooperation. Although useful to reduce the load of spoofed traffic,
it is insufficient to protect particular connections from attack.
A more recent variant of address filtering checks the IP TTL field,
relying on the TTL set by the other end of the connection [14]. This
technique has been used to provide filtering for BGP. It assumes the
connection source TTL is set to 255; packets at the receiver are
checked for TTL=255, and others are dropped. This restricts traffic
to one hop upstream of the receiver (i.e., a BGP router), but those
hops could include other user programs at those nodes (e.g., the BGP
router's peer) or any traffic those nodes accept via tunnels -
because tunnels need not decrement TTLs [29] (see Sec. 5.1 of [14]).
This method of filtering works best where traffic originates one hop
away, so that the address filtering is based on the trust of only
directly-connected (tunneled or otherwise) nodes. Like conventional
address filtering, this reduces spoofing traffic in general, but is
not considered a reliable security mechanism because it relies on
distributed filtering (e.g., the fact that upstream nodes do not
terminate tunnels arbitrarily).
3.2.2. IPsec
TCP is susceptible to RSTs, but also to other off-path and on-path
spoofing attacks, including SYN attacks.  Other transport protocols,
such as UDP and RTP are equally susceptible.  Although emerging
transport protocols attempt to defeat such attacks at the transport
layer, such attacks take advantage of network layer identity
spoofing.  The packet is coming from an endpoint who is spoofing
another endpoint, either upstream or somewhere else in the Internet.
IPsec was designed specifically to establish and enforce
authentication of a packet's source and contents, to most directly
and explicitly addresses this security vulnerability.
The larger problem with IPsec is that of key distribution and use.
IPsec is often cumbersome, and has only recently been supported in
many end-system operating systems.  More importantly, it relies on
preshared keys, signed X.509 certificates, or a third-party (e.g.,
Kerberos) public key infrastructure to establish and exchange keying
information (e.g., via IKE).  These present challenges when using
IPsec to secure traffic to a well-known server, whose clients may not
support IPsec or may not have registered with a previously-known
certificate authority (CA).
These keying challenges are being addressed in the IETF in ways that
will enable servers secure associations with other parties without
advance coordination [38][39]. This can be especially useful for
publicly-available servers, or for protecting connections to servers
that - for whatever reason - have not, or will not deploy
conventional IPsec certificates (i.e., core Internet BGP routers).
4. ICMP
Just as spoofed TCP packets can kill a connection, so too can spoofed
ICMP packets. TCP headers can occur inside certain ICMP messages [6].
There have been recent suggestions to validate the sequence number of
TCP headers when they occur inside ICMP messages [16]. This sequence
checking is similar to checks that would occur for conventional data
packets in TCP, but is being proposed in the spirit of the RST window
attenuation described in Section 3.1.2.
Some such checks may be reasonable, especially where they parallel
the validations already performed by TCP processing, notably where
they emulate the semantics of such processing. For example, the TCP
checksum should be validated (if the entire TCP segment is contained
in the ICMP message) before any fields of the TCP header are
examined, to avoid reacting to corrupted packets. Similarly, if the
TCP MD5 option is present, its signature should probably be validated
before considering the contents of the message.
Such validation can ensure that the packet was not corrupted prior to
the ICMP generation (checksum), that the packet was one sent by the
source (IPsec or TCP/MD5 authenticated), or that the packet was not
in the network for an excess of 2*MSL (valid sequence number).
ICMP presents a particular challenge because some messages can reset
a connection more easily - with less validation - than even some
spoofed TCP segments. However, fixing such messages to be 'in window'
is insufficient protection, as this document shows for spoofed data.
In addition, many networks filter all ICMP packets because validation
may not be possible, especially because they can be injected from any
point on a path, and so cannot be selectively address filtered. As a
result, they are not addressed separately in the issues or security
considerations of this document further.
5. Issues
There are a number of existing and proposed solutions addressing the
vulnerability of transport protocols in general, and TCP in specific,
to off-path third-party spoofing attacks.  As shown, these operate at
the transport or network layer.  Transport solutions require separate
modification of each transport protocol, addressing network identity
spoofing separately in the context of each transport association.
Network solutions are computationally intensive and require pervasive
registration of certificate authorities with every possible endpoint.
This section explains these observations further.
5.1. Transport Layer (e.g., TCP)
Transport solutions rely on shared cookies to authenticate segments,
including data, transport header, and even pseudo-header (e.g., fixed
portions of the outer IP header in TCP).  Because the Internet relies
on stateless network protocols, it makes sense to rely on state
establishment and maintenance available in some transport layers not
only for the connection but for authentication state.  Three-way
handshakes and heartbeats can be used to negotiate authentication
state in conjunction with connection parameters, which can be stored
with connection state easily.
As noted earlier, transport layer solutions require separate
modification of all transport protocols to include authentication.
Not all transport layers support negotiated endpoint state (e.g.,
UDP), and legacy protocols have been notoriously difficult to safely
augment.  Not all authentication solutions are created equal either,
and relying on a variety of transport solutions exposes end-systems
to increased potential for incorrectly specified or implemented
solutions.  Transport authentication has often been developed piece-
wise, in response to specific attacks, e.g., SYN cookies and RST
window attenuation [4][10].
Transport layer solutions are not only per-protocol, but often per-
connection.  Each connection needs to negotiate and maintain
authentication state separately.  Some overhead is not amortized over
multiple connections, e.g., overheads in packet exchanges, whereas
other overheads are not amortized over different transport protocols,
e.g., design and implementation complexity - both as would be the
case in a network layer solution.  Finally, because the
authentication happens later in packet processing than is required,
additional endpoint resources may be needlessly consumed, e.g., in
demultiplexing received packets, indexing connection identifiers,
etc., only to be dropped later at the transport layer.
5.2. Network Layer (IP)
A network layer solution avoids the hazards of multiple transport
variants, using a single shared endpoint authentication mechanism
early in receiver packet processing to discard unauthenticated
packets at the network layer instead.  This defeats spoofing entirely
because spoofing involves masquerading as another endpoint, and
network layer security validates the endpoint as the source of the
packets it emits. Such a network level solution protects all
transport protocols as a result, including both legacy and emerging
protocols, and reduces the complexity of these protocols as well.  A
shared solution also reduces protocol overhead, and decouples the
management (and refreshing) of authentication state from that of
individual transport connections.  Finally, a network layer solution
protects not only the transport layer but the network layer as well,
e.g., from ICMP, IGMP, etc., spoofing attacks.
The ubiquitous protocol for network layer authentication is IPsec
[22][25].  IPsec specifies the overall architecture, including header
authentication (AH) [21][23] and encapsulation (ESP) modes [24].  AH
authenticates both the IP header and IP data, whereas ESP
authenticates only the IP data (e.g., transport header and payload).
AH is deprecated since ESP is more efficient and the SPI includes
sufficient information to verify the IP header anyway.  These two
modes describe the security applied to individual packets within the
IPsec system; key exchange and management is performed either out-of-
band (via pre-shared keys) or by an automated key exchange protocol
IKE [17][20].
IPsec already provides authentication of an IP header and its data
contents sufficient to defeat both on-path and off-path third-party
spoofing attacks.  IKE can configure authentication between two
endpoints on a per-endpoint, per-protocol, or per-connection basis,
as desired.  IKE also can perform automatic periodic re-keying,
further defeating crypto-analysis based on snooping (clandestine data
collection).  The use of IPsec is already commonly strongly
recommended for protected infrastructure.
Existing IPsec is not appropriate for many deployments.  It is
computationally intensive both in key management and individual
packet authentication [36].  As importantly, IKE is not anonymous;
keys can be exchanged between parties only if they trust each others'
X.509 certificates, trust some other third-party to help with key
generation (e.g., Kerberos), or pre-share a key.  These certificates
provide identification (the other party knows who you are) only where
the certificates themselves are signed by certificate authorities
(CAs) that both parties already trust.  To a large extent, the CAs
themselves are the pre-shared keys which help IKE establish security
association keys, which are then used in the authentication
algorithms.
Alternative mechanisms are under development to address this
limitation, to allow publicly-accessible servers to secure
connections to clients not known in advance, or to allow unilateral
relaxation of identity validation so that the remaining protections
of IPsec to be available [38][39]. In particular, these mechanisms
can prevent a client (but without knowing who that client is) from
being affected by spoofing from other clients, even when the
attackers are on the communications path.
IPsec, although widely available both in commercial routers and
commodity end-systems, is not often utilized except between parties
that already have a preexisting relationship (employee/employer,
between two ISPs, etc.) Servers to anonymous clients (e.g., customer/
business) or more open services (e.g., BGP, where routers may have
large numbers of peers) are unmanageable, due to the breadth and flux
of CAs.  New endpoints cannot establish IPsec associations with such
servers unless their own certificate is signed by a CA already
trusted by the server.  Different servers - even within the same
overall system (e.g., BGP) - often cannot or will not trust
overlapping subsets of CAs in general.
5.3. Application Layer
There are a number of application layer authentication mechanisms,
often implicit within end-to-end encryption.  Application-layer
security (e.g., TLS, SSH, or MD5 checksums within a BGP stream)
provides the ultimate protection of application data from all
intermediaries, including network routers as well as exposure at
other layers in the end-systems.  This is the only way to ultimately
protect the application data.
Application authentication cannot protect either the network or
transport protocols from spoofing attacks, however.  Spoofed packets
interfere with network processing or reset transport connections
before the application checks the data.  Authentication needs to
winnow these packets and drop them before they interfere at these
lower layers.
An alternate application layer solution would involve resilience to
reset connections. If the application can recover from such
connection interruptions, then such attacks have less impact.
Unfortunately, attackers still affect the application, e.g., in the
cost of restarting connections, delays until connections are
restarted, or increased connection establishment messages on the
network. Some applications - notably BGP - even interpret TCP
connection reliability as an indicator of route path stability, which
is why attacks on BGP have such substantial consequences.
5.4. Shim Transport/Application Layer
Security can also be provided over the transport layer but below the
application layer, in a kind of 'shim' protocol, such as SSL or TLS.
These protocols provide data protection for a variety of applications
over a single, legacy transport protocol, such as SSL/TCP for HTTPS.
Unfortunately, as with application authentication, they do not
protect the transport layer against spoofing attacks.
5.5. Link Layer
Link layer security operates separately on each hop of an Internet.
Such security can be critical in protecting link resources, such as
bandwidth and link management protocols.  Protection at this layer
cannot suffice for network or transport layers, because it cannot
authenticate the endpoint source of a packet.  Link authentication
ensures only the source of the current link hop where it is examined.
5.6. Issues Discussion
The issues raised in this section suggest that there are challenges
with all solutions to transport protection from spoofing attacks.
This raises the potential need for alternate security levels.  While
it is already widely recognized that security needs to occur
simultaneously at many protocol layers, there also may be utility in
supporting a variety of strengths at a single layer.  For example,
IPsec already supports a variety of algorithms (MD5, SHA1, etc. for
authentication), but always assumes that:
4. the entire body of the packet is secured
5. security associations are established only where identity is
authenticated by a know certificate authority or other pre-shared
6. both on-path and off-path third-party spoofing attacks   must be
These assumptions are prohibitive, especially in many cases of
spoofing attacks.  For spoofing, the primary issue is whether packets
are coming from the same party the server can reach.  Only the IP
header is fundamentally in question, so securing the entire packet
(1) is computational overkill.  It is sufficient to authenticate the
other party as "a party you have exchanged packets with", rather than
establishing their trusted identity ("Bill" vs.  "Bob") as in (2).
Finally, many cookie systems use clear-text (unencrypted), fixed
cookie values, providing reasonable (1 in 2^{cookie-size}) protection
against off-path third-party spoof attacks, but not addressing on-
path attacks at all. Such potential solutions are discussed in the
ANONsec document, in the BTNS (Better Than Nothing Security) BOF
[5][38][39]. Note also that NULL Encryption in IPsec applies a
variant of this cookie, where the SPI is the cookie, and no further
encryption is applied [15].
This entire document focuses on increasing the security of transport
protocols and their resistance to spoofing attacks.  Security is
addressed throughout.
This document describes a number of techniques for defeating spoofing
attacks.  Those relying on clear-text cookies, either explicit or
implicit (e.g., window sequence attenuation) do not protect from on-
path spoofing attacks, since valid values can be learned from prior
traffic.  Those relying on true authentication algorithms are
stronger, protecting even from on-path attacks, because the
authentication hash in a single packet approaches the behavior of
"one time" cookies.
The security of various levels of the protocol stack is addressed.
Spoofing attacks are fundamentally identity masquerading, so we
believe the most appropriate solutions defeat these at the network
layer, where end-to-end identity lies.  Some transport protocols
subsume endpoint identity information from the network layer (e.g.,
TCP pseudo-headers), whereas others establish per-connection identity
based on exchanged nonces (e.g., SCTP).  It is reasonable, if not
recommended, to address security at all layers of the protocol stack.
There are no IANA considerations in this document.
This section should be removed by the RFC-Editor upon publication as
an RFC.
This document describes the details of the recent BGP spoofing
attacks involving spurious RSTs which could be used to shutdown TCP
connections.  It summarizes and discusses a variety of current and
proposed solutions at various protocol layers.
9. Acknowledgments
This document was inspired by discussions on the
<http://www.ietf.org/html.charters/tcpm-charter.html> about the
recent spoofed RST attacks on BGP routers, including R. Stewart's
draft (which is now edited by M. Dalal) [10][35].  The analysis of
the attack issues, alternate solutions, and the anonymous security
proposed solutions were the result of discussions on that list as
well as with USC/ISI's T. Faber, A. Falk, G. Finn, and Y. Wang.  Ran
Atkinson suggested the UDP variant of TCP/MD5, Paul Goyette suggested
using the ISN to seed TCP/MD5, and Lloyd Wood suggested using the ISN
to validate RSTs.  Other improvements are due to the input of various
members of the IETF's TCPM WG, notably detailed feedback from Pekka
Savola.
[1]   Allman, M., V. Paxson, W. Stephens, "TCP Congestion Control,"
RFC 2581, Apr. 1999.
[2]   Baker, F. and P. Savola, "Ingress Filtering for Multihomed
Networks," RFC 2827 / BCP 84, March 2004.
[3]   Bellovin, S. and A. Zinin, "Standards Maturity Variance
Regarding the TCP MD5 Signature Option (RFC 2385) and the BGP-4
Specification," (work in progress),
draft-iesg-tcpmd5app-01.txt, Sept. 2004.
[4]   Bernstein, D., "SYN cookies - http://cr.yp.to/syncookies.html",
[5]   Better Than Nothing Security [BTNS] BOF, IETF-61, Wash. DC.,
http://www.ietf.org/ietf/04nov/btns.txt
[6]   Braden, R., "Requirements for Internet Hosts -- Communication
Layers," RFC 1122, Oct. 1989.
[7]   Braden, R., "TIME-WAIT Assassination Hazards in TCP", RFC 1337,
[8]   CERT alert: "Technical Cyber Security Alert TA04-111A:
Vulnerabilities in   TCP --
http://www.us-cert.gov/cas/techalerts/TA04-111A.html", April 20
[9]   Convery, S. and M. Franz, "BGP Vulnerability Testing:
Separating Fact from FUD", 2003,
http://www.nanog.org/mtg-0306/pdf/franz.pdf
[10]  Dalal, M., (ed.), "Transmission Control Protocol security
considerations", draft-ietf-tcpm-tcpsecure-02 (work in
progress), Nov. 2004.
[11]  Faber, T., J. Touch, and W. Yue, "The TIME-WAIT state in TCP
and Its Effect on Busy Servers", Proc. Infocom 1999 pp. 1573-
1583, March 1999.
[12]  Ferguson, P. and D. Senie, Network Ingress Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Address
Spoofing," RFC 2267 / BCP 38, May 2000.
[13]  Floyd, S., "Inappropriate TCP Resets Considered Harmful", BCP
60, RFC 3360, August 2002.
[14]  Gill, V., J. Heasley, and D. Meyer, "The Generalized TTL
Security Mechanism (GTSM)," RFC 3682 (Experimental), Feb. 2004.
[15]  Glenn, R. and S. Kent, "The NULL Encryption Algorithm and Its
Use With IPsec", RFC 2410 (Standards Track), November 1998.
[16]  Gont, F., "ICMP attacks against TCP," (work in progress), Sept.
[17]  Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)",
RFC 2409 (Standards Track), November 1998.
[18]  Heffernan, A., "Protection of BGP Sessions via the TCP MD5
Signature Option", RFC 2385 (Standards Track), August 1998.
[19]  Jacobson, V., B. Braden, and D. Borman, "TCP Extensions for
High Performance", RFC 1323, May 1992.
[20]  Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
draft-ietf-ipsec-ikev2-14 (work in progress), June 2004.
[21]  Kent, S., "IP Authentication Header",
draft-ietf-ipsec-rfc2402bis-07 (work in progress), March 2004.
[22]  Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401 (Standards Track), November 1998.
[23]  Kent, S. and R. Atkinson, "IP Authentication Header", RFC 2402
(Standards Track),   November 1998.
[24]  Kent, S. and R. Atkinson, "IP Encapsulating Security Payload
(ESP)", RFC 2406 (Standards Track), November 1998.
[25]  Kent, S. and K. Seo, "Security Architecture for the Internet
Protocol", draft-ietf-ipsec-rfc2401bis-06 (work in progress),
[26]  Kohler, E., M. Handley, and S. Floyd, "Datagram Congestion
Control Protocol (DCCP)",   draft-ietf-dccp-spec-11 (work in
progress), March 2005.
[27]  Leech, M., "Key Management Considerations for the TCP MD5
Signature Option," RFC 3562 (Informational), July 2003.
[28]  O'Malley, S. and L. Peterson, "TCP Extensions Considered
Harmful", RFC 1263, October 1991.
[29]  Perkins, C., "IP Encapsulation within IP," RFC 2003 (Standards
Track), Oct. 1996.
[30]  Poon, K., "Use of TCP timestamp option to defend against blind
spoofing attack," draft-poon-tcp-tstamp-mod-01 (work in
progress), Oct. 2004.
[31]  Postel, J., "Transmission Control Protocol," RFC 793 / STD 7,
[32]  Rekhter, Y. and T. Li, (eds.), "A Border Gateway Protocol 4
(BGP-4)," RFC 1771 (Standards Track), March 1995.
[33]  Semke, J., J. Mahdavi, M. Mathis, "Automatic TCP Buffer
Tuning", ACM SIGCOMM '98/ Computer Communication Review, volume
28, number 4, October 1998
[34]  Stewart, R., Q. Xie, K. Morneault, C. Sharp, H. Schwarzbauer,
T. Taylor, I. Rytina, M. Kalla, L. Zhang, and V. Paxson,
"Stream Control Transmission Protocol," RFC 2960 (Standards
Track), October 2000.
[35]  TCPM: IETF TCPM Working Group and mailing list-
http://www.ietf.org/html.charters/tcpm-charter.html.
[36]  Touch, J., "Report on MD5 Performance," RFC 1810
(Informational), June 1995.
[37]  Touch, J., "Performance Analysis of MD5," Proc. Sigcomm 1995
77-86., March 1999.
[38]  Touch, J., "ANONsec: Anonymous Security to Defend Against
Spoofing Attacks," draft-touch-anonsec-00 (work in progress),
[39]  Touch, J., D. Black, and Y. Wang, "Problem and Applicability
Statement for Better Than Nothing Security (BTNS)," draft-ietf-
btns-prob-and-applic-01 (work in progress), Sept. 2005.
[40]  Watson, P., "Slipping in the Window: TCP Reset attacks,"
Presentation at 2004 CanSecWest.
http://www.cansecwest.com/archives.html
[41]  Wood, L., Post to TCPM mailing list regarding use of ISN in
RSTs, ID=Pine.GSO.4.50.0404232249570.5889-
100000@argos.ee.surrey.ac.uk, Apr. 23, 2004.
http://www1.ietf.org/mail-
archive/web/tcpm/current/msg00213.html
Author's Addresses
Joe Touch
USC/ISI
4676 Admiralty Way
Marina del Rey, CA 90292-6695
Fax:   +1 (310) 448-9300
Email: touch@isi.edu
URI:   http://www.isi.edu/touch
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights.  Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard.  Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
Funding for the RFC Editor function is currently provided by the
Internet Society.


With an ever-evolving fragrance market we know how important it is for Heart & Home to not only stay ahead of the trends but to be innovative with our ongoing development And this is what you will see in the new core range. Reflecting the sophistication of a sector which never stands still we have created a new look that adds excitement to the brand whilst maintaining our environmentally friendly credentials and superior luxury fragrances.
The new and improved Heart & Home Collection focusses on the top-selling fragrances we all know and love, as well as introducing a selection of beautiful new scents for the Spring/Summer period.There has never been a better time to stock our unique Soy Blend candles as the world continues to look for more sustainable, environmentally friendly products.Fall in love with the new Heart & Home Collection.


text:
The Shins - The Gaelic Club - 09/12/03
I never particularly liked The Shins, certainly not enough to bother buying an album, but, driven by boredom, I decided to check them out anyway. The supports acts were Starkey (Starky?) and Iron & Wine.
I left home too late to catch Starky (Starkey?) and I was kind of disappointed because there's a song of theirs on the radio that I don't entirely hate.
I did, unfortunately, manage to see Iron & Wine. I have never seen a more boring band in all my puff. It was this slow to mid-tempo-ish folk music. All of the songs sounded the exactly the same with no change in dynamics.
I turned to the guy selling shirts (who I'd met a few times) and I told him that I'd never seen a band "suck so much cock," only to have it pointed out that he was wearing an Iron & Wine shirt. Oops, my bad.
The Shins, for those who don't know them, are a pop/rock band. They're the kind of band which write melodies that are often described as being "gorgeous" in popular music magazines.
They had a little success on the back of a single called Know Your Onion!, and, in fact, this was the only song that I really wanted to hear, and, in fact, I knew that the gig wasn't going to be over until they played that particular song.
And play it they did, at the end of a six—six, mind you!—song encore. Who encores for six songs? The encore was half the length of the gig itself.
The Shins put on a pretty good show, I guess, probably worth the forty bucks that I paid to see them. It was worth it for the crowd alone—I have never seen so many angular haircuts in all my life and neither have I seen so many boys that looked like girls, and girls that looked boys.
Incidentally, their drummer looks like he is made entirely out of ham.
Just as I left the Gaelic Club I saw a guy walking up to public telephones and ripping the handsets off the receivers.
Woo! Go get 'em, Tiger! THE REVOLUTION WILL NOT BE TELEVISED!!
Also, I bumped into Bluto's Cousin and some of her friends - peace and love.
I am never happy
I am always sad
Belvedere Jehosophat
Reviewed on Wednesday, 10 December 2003
Fart a dutch oven and have the fresh new delivered right to your feed reader.
the shins
gaelic club
starky
iron and wine
Other reviews by Belvedere Jehosophat
Goodbye 20th Century – the SYR sessions
Nigeria, Biafra & Boko Haram: Ending the Genocides through Multi-State Solution by Osita Ebiem
Sebadoh - Defend Yourself
Sierra - Sierra
Bigg Jus - Machines That Make Civilization Fun
Aesop Rock - Skelethon
Squarepusher - Ufabulum
Those Darlins - Screws Get Loose
Royal Headache - Royal Headache


text:
Book Launch: Poet and Businessman
Organizing Institution: Institute for the Study of Muslim Civilisations
End Date: August 25, 2022 (7:00pm)
Website: https://www.aku.edu/ismc/events/pages/event-detail.aspx?EventID=2161&Title=Book%20Launch:%20Poet%20and%20Businessman
Aga Khan Centre (Room 215) – London – United Kingdom
Abd al-Aziz al-Babtain and the Formation of Modern Kuwait
Poet and Businessman reviews and analyses the modern history of Kuwait by telling the story of Abd al-Aziz al-Babtain (b. 1936), a businessman, philanthropist, and poet whose own story closely interweaves with the history of the Gulf state.
Constructing an overview of the modern history of Kuwait in parallel with the life of al-Babtain, Professor Leif Stenberg presents a rare study of an individual whose generation experienced first-hand the discovery of oil and the incredible changes it wrought on their small society. The costs of that discovery, alongside its many benefits, continue to play a crucial part in the socio-economic and cultural development of Kuwait and the wider region. Addressing an otherwise neglected area of Arabian history and the contemporary Middle East, this book is a balanced account of the development of Kuwait, enriched by the story of a remarkable and influential individual.
Leif Stenberg is Dean and Professor of Islamic Studies at the Aga Khan University's Institute for the Study of Muslim Civilisations (AKU-ISMC), London. Between 2010 and 2019 Stenberg was President of the Nordic Society of Middle Eastern Studies and he is currently a member of the World Congress of Middle Eastern Studies (WOCMES) Council and vice-president of the European Association for Middle Eastern Studies (EURAMES). His latest research has been on the various intersections between football, religion and social identities.
Walid Ghali is the Head of the Aga Khan Library, London, and Associate Professor of Islamic and Arabic Studies at AKU-ISMC. He is also a member of the Editorial Board of Abdou Filali-Ansary Occasional Papers, and in 2020, he was elected as a board member of The Islamic Manuscript Association. Dr. Ghali publishes in many different research areas. His forthcoming publication is a critical edition of previously unknown documents belonging to the leading Egyptian figure and Muslim reformer Muhammad Abduh (d.1905).
*The discussion will be followed by a reception.
Aga Khan Centre (Room 215)
10 Handyside Street
London , N1C 4DN United Kingdom
London, N1C 4DN United Kingdom


The largest part of the United Kingdom, this gallery includes the spectacular Peaks District, Chatsworth house, Fountains Abbey, Whitby Abbey, Bempton Cliffs, the Duddo Stone, Nine Stones Close, Stonehenge and Beachy Head.
Duddo Stone Circle in black and white with threatening clouds.
Duddo Stone Circle. The Duddo stones are 4000 years old. They have unique vertical scars or grooves. Their purpose is unknown, of course. I loved seeing a stone circle I could have completely to myself with my family. What an enchanting location.
Duddo Stones in a Field with distant yellow rapeseed and wonderful blue skies.
Duddo Stones Detail: 3 of the 5 Duddo stones are seen in this photo, but it shows the deep groves in more detail. Each stone is unique.
Duddo Stone Circle on a Hilltop. A 5th stone is hidden behind the largest stone. These 5 stones form a picturesque circle in the remote corner of England.
Bamburgh beach and Rapeseed Field: This amazing glorious view of Bamburgh Castle has a wonderful yellow field of blossoms, flowers and the distant cold blue Atlantic Ocean.
Hadrian's Door: a door in the Housesteads Fort along Hadrian's Wall. Sheep graze in the center of the photograph.
Hadrian's Columns stand only a foot or so tall but they are a few of the remains of Housesteads Roman Fort. A few small flowers grew here and there. They show up well in this black and white photograph.
Hadrian's Wall and Woods. The wall extends into the verdant woods.
Roman Arch along Hadrian's Wall: A broken arch and gate along the great wall build by Romans.
Hadrian's Wall extending over hills and peaks.
Hadrian's Wall at Steel Rigg undulating snake-like over the hills and bumps. I love hiking along this part of the wall.
Steel Rigg and Hadrian's Wall: a classic scene along this most-beautiful section of the wall.
Seeing under Prebend's Bridge in Durham, England.
Durham Cathedral, River Wear: Durham Cathedral hides in the reflection of the murky waters.
Framwellgate Bridge in Durham with a pedestrian walk under the oldest bridge in the town.
Durham Cathedral Cloister Window looking out onto the lawn.
Durham Cloisters of the Norman Cathedral, the best in all of Europe.
Whitby Abbey Ruined Shell standing over Whitby town and harbor on the northeast coast of England. This ruin is infamous for one thing: Dracula's attack on Lucy occurred right here. The vampire spirit still haunts this spooky place.
Inside Whitby Abbey Ruins on a foggy day.
Whitby Abbey Corridor: Exploring this amazing ruin is so awesome if you are a fan of Bram Stoker's incredible novel Dracula.
Dracula's Whitby Abbey: a ruined abbey standing over the town and harbor of the same name. This is an awesome place to visit. It makes the novel Dracula come alive to visit.
Whitby Abbey East Face is highest and most intact. This gets the harsh winter winds from the North Sea.
Whitby Abbey Graves: I would not want to be buried here at the location known for vampires.
Puffins of Bempton Cliffs come primarily in the months of May and early June. Here are three puffins enjoying a blustery cliff with numberless other birds.
Fountains Abbey Octagon Tower on the hill overlook these marvellous grounds.
Fountains Abbey Tower in the octagon shape. You can visit the whole garden and ruined abbey throughout the year. A leisurely walk along the pond is great on a sunny day.
Fountains Abbey Main Hall with massive columns.
Monsal Head Viaduct in the Peaks District is historic, beautiful and playful. Now bike riders whiz across.
Winnats Pass at Sunrise is a wonderful place to spend some time. This deep gorge reminds me of Hawaiian canyons because of it's steepness and greenery.


Due to the world becoming over populated, it is becoming increasingly difficult to supply food for everyone. The only believed solution to this issue is to find ways to make plants more productive so that less land will have to be used to grow more food in the future. Conventional breeding is too time consuming too keep up with a fast populating world and the amount of land that would be required to grow enough food is excessive. Luckily, plant research has been advancing rapidly and now we have a modern breeding technique called "Genome editing" with sequence-specific nucleases (SSNs). Genome editing already allows scientists to edit plant genomes for research and molecular breeding. Unfortunately, with all the tools provided for genome editing the ability to make large-scale genome modifications has been limited in plants. There have been attempts of large genome modifications in plants with some more successful than others. However, for the plant model, Arabidopsis thaliana, there have not been any reports of site-specific large T-DNA insertions using TALEN and few reports of Large chromosomal deletions using a CRISPR/Cas9 system. This study demonstrated the potential of a proof-of-concept for large T-DNA insertions mediated by TALEN and large chromosomal deletions mediated by CRISPR/Cas9 in a site-specific manner. A. thaliana wild type plants were transformed with genome editing T-DNA constructs and their seeds were screened using either hygromycin antibiotic or BASTA herbicide treatments. The surviving plants were genotyped through PCR and gel electrophoresis to analyze their genome modifications. The results suggest that there are candidate plants with successful large-scale genome editing in both projects. Results in the large chromosomal deletion project suggest that there are a small number of cells containing successful deletion that can produce enough BAR protein to provide the entire plant herbicide resistance. Identifying these candidate plants will help future projects to better understand SSN mutational inheritance to progeny and the probability of obtaining fully mutant plants.
Kirkland, Elida R. Large-scale genome modifications in Arabidopsis thaliana using TALEN and CRISPR/Cas9. Master's Thesis. East Carolina University, May 2017. The Scholarship. http://hdl.handle.net/10342/6179. April 23, 2019.
Kirkland, Elida R, "Large-scale genome modifications in Arabidopsis thaliana using TALEN and CRISPR/Cas9" (Master's Thesis., East Carolina University, May 2017).
Kirkland, Elida R. Large-scale genome modifications in Arabidopsis thaliana using TALEN and CRISPR/Cas9 [Master's Thesis]. Greenville, NC: East Carolina University; May 2017.