Give iPads to all members of Congress? That's the recommendation of Melissa Bluey, the Atlantic's assistant art director, who correctly notes the general cluelessness of our solons on technological matters. It would be a good start, but we really should go beyond that with the iPad Stimulus Plan discussed here and earlier in the Atlantic blog of James Fallows, a former presidential speechwriter. Let's use tax credits and other means to get iPad-style machines into the hands of the nonelite so they can use the machines for purposes ranging from library e-books to healthcare forms.
In detail I've told of the paperwork hassles that an iPad and the right healthcare systems at the other end could have reduced for me when I suffered a heart attack. The more purposes we use iPads-type machines for, the more we'll cost-justify the tax credits and other expenditures. Among other things, the devices could distribute multimedia training materials to keep the U.S. workforce up to date and more productive—and more employed. The tablets alone can't work miracles, however, and we'll also need careful integration of the machine with schools, libraries and other institutions. A coordinated approach like the iPad Stimulus Plan could help.
Meanwhile I was pleased to see iPad Stimulus mentions from eBookNewser and TeleRead (my old site) as well as from the Web site of Federal News Radio. What's more, I remain grateful to Steve Rubel, a prominent PR blogger from the tech realm, for grasping the plan's potential and spreading word. A number of Web sites repeated his item. Let's hope that, with or without iPads, people on the Hill and in the White House will take notice and give the plan a chance.


text:
2237 North Hollywood Way
Andover, Hampshire SP10 5AN
Find Lee Filters on Google
About Lee Filters
LEE Filters manufactures a large variety of professional-quality lighting control filters for the lighting and imaging markets. Lighting filters include the Glass Series, fluorescent sleeves, color correction, color effects, and diffusions. With over 30 years of manufacturing experience, LEE Filters emphasizes both technical excellence and innovation in our filter production.
Competitors of Lee Filters
Litepanels, Inc.
Litepanels offers a full range of LED lighting products to meet the high demands of today's productions. From our revolutionary new Fresnel Series, to our diverse On-Camera Series, to our always popular Panel Series, there's a Litepanels LED fixtures for every need.
F.J. Westcott Co
F.J. Westcott Co manufactures durable, high-end lighting equipment and motion capture accessories for professional filmmakers and photographers across the globe.
ARRI is a leading designer and manufacturer of camera and lighting systems for the film and broadcast industry, with a worldwide distribution and service network. It is also an integrated media service provider in the fields of film post- and coproduction, international sales, as well as...
Rate and Review Lee Filters
Thanks for submitting your review of Lee Filters. We'll email you as soon as it's published, (typically within 48 hours). We really value your contributions, and so does our community of business professionals. They count on honest reviews like yours.
Thanks for submitting your review of Lee Filters.
Rate and Review Litepanels, Inc.
Thanks for submitting your review of Litepanels, Inc.. We'll email you as soon as it's published, (typically within 48 hours). We really value your contributions, and so does our community of business professionals. They count on honest reviews like yours.
Thanks for submitting your review of Litepanels, Inc..
Rate and Review F.J. Westcott Co
Thanks for submitting your review of F.J. Westcott Co. We'll email you as soon as it's published, (typically within 48 hours). We really value your contributions, and so does our community of business professionals. They count on honest reviews like yours.
Thanks for submitting your review of F.J. Westcott Co.
Rate and Review ARRI Inc.
Thanks for submitting your review of ARRI Inc.. We'll email you as soon as it's published, (typically within 48 hours). We really value your contributions, and so does our community of business professionals. They count on honest reviews like yours.
Thanks for submitting your review of ARRI Inc..

redpajama_set_name: RedPajamaCommonCrawl


text:
Home/US News/Army Civilian IT Leader Allegedly Ran Child Sex Abuse Ring, Compromised National Security
Army Civilian IT Leader Allegedly Ran Child Sex Abuse Ring, Compromised National Security
Laurel DugganMarch 29, 2022
David Frodsham, a top civilian commander at a U.S. air base in Afghanistan, was given security clearances while allegedly leading a child pornography ring, the Associated Press reported Tuesday.
Frodsham's involvement in child abuse, for which he pled guilty in 2016 and is currently serving a 17-year prison sentence, would have made him vulnerable to blackmail while he was conducting sensitive IT work at Fort Huachuca in Arizona, according to the AP.
The army gave security clearances to Frodsham at a time when nearly 20 complaints and attempted complaints of abuse, maltreatment and licensing violations were levied against him and his wife regarding children they fostered and adopted, the AP reported.
"He would have been an obvious target of foreign intelligence services because of his role and his location," Frank Figliuzzi, the former assistant director of counterintelligence for the FBI, told the AP.
Police identified Frodsham as an alleged leader of a child sex ring through Sgt. Randall Bischak, whom police discovered through an undercover Homeland Security sting which led to a raid of his home by federal and local law enforcement, according to the AP.
By spring of the following year, he was arrested in Arizona for leading a child sex abuse ring that included an Army sergeant who was posting child pornography to the internet. Among the victims was one of Frodsham's adopted sonshttps://t.co/C7xXXM4so5 via @Yahoo
— Joseph Barracato (@JoeBarracato) March 29, 2022
Bischak said Frodsham allegedly brought him at least one young child to have sex with, the AP reported. He also confessed to having sex with a 59-year-old man and his teenage son and recording at least one of the incidents.
The U.S. Army did not immediately respond to the Daily Caller News Foundation's request for comment.
Content created by The Daily Caller News Foundation is available without charge to any eligible news publisher that can provide a large audience. For licensing opportunities of our original content, please contact [email protected]
DeSantis Pledges Mandatory Life Sentence For Targeting Children With Fentanyl Resembling Candy
Tyson CFO Pleads Guilty To Public Intoxication, Trespassing After Being Found Asleep In Stranger's Bed
Catholic Churches Have Suffered 118 Attacks Since SCOTUS Dobbs Leak
Bezos Oversaw WaPo Editorial Meeting That Discussed Amazon, His Business Interests


text:
Good news: new Firefox for Android will support extensions
by Martin Brinkmann on October 24, 2019 in Firefox - Last Update: October 25, 2019 - 22 comments
Mozilla is working on a new mobile browser for Android. Firefox Preview, that is the current name of the browser to distinguish it from the soon-to-be-replaced Firefox for Android, was released to Google Play in mid-2019.
The browser will replace the current stable version of Firefox for Android eventually; users of that version may have noticed that it was moved to the ESR branch already to free up resources for Firefox Preview development.
Several features of Firefox Preview were not set in stone when Mozilla began development of the mobile browser for Android. One of these features, support for browser extensions, was on the to-be-decided list.
The removal of the feature would cut one of the distinguishing features of the web browser as most Android browsers don't support browser extensions. There was also the likelihood that the decision to ignore extensions would have irritated existing users who use extensions in the current version of the browser.
Mozilla announced on October 23, 2019 that Firefox Preview will support extensions. The browser, which is based on the new GeckoView engine, will support WebExtensions just like Desktop versions of the Firefox web browser do.
We're happy to confirm that GeckoView is currently building support for extensions through the WebExtensions API. This feature will be available in Firefox Preview, and we are looking forward to offering a great experience for both mobile users and developers.
Support for extension APIs won't match the current level of support in the classic version of Firefox for Android. Mozilla plans to focus its efforts on introducing support for APIs that extensions of the recommended extensions program require to function, and here specifically on APIs for extensions that "work well on mobile and cover a variety of utilities and features".
Popular browser extensions such as uBlock Origin, NoScript Security Suite, LastPass Password Manager, Enhancer for YouTube, or Firefox Multi-Account Containers are all recommended extensions. Whether all of these will be fully supported when Firefox Preview will be released as a final version remains to be seen.
Mozilla expects to introduce official support for extensions in Firefox Preview in the first half of 2020.
Android users interested in Firefox Preview may download the recent version from Google Play. The mobile browser can be installed next to Firefox for Android.
Extensions support is an important feature of Firefox for Android and it is good to see that Mozilla will implement support for -- some -- APIs in the upcoming version of Firefox as well. The initial release will support only some APIs and not all that Firefox for Android or the desktop versions of Firefox support.
While that is disappointing as it means that a number of extensions won't work in Firefox Preview, it is certainly better than not supporting extensions at all. It remains to be seen which extensions will be supported ultimately by the new mobile browser.
Now You: Which extensions would you like to see supported?
Mozilla announced on October 23, 2019 that Firefox Preview will support extensions. The browser, which is based on the new GeckoView engine, will support WebExtensions.
Previous Post: « Find tabs quickly with the Tabhunter extension for Firefox and Chrome
Next Post: How to restore the green lock icon in Firefox's address bar »
DropZz said on October 24, 2019 at 3:23 pm
Good, otherwise i would switch immediately. Today's web without at least an Ad and Popup blocker is a nightmare.
Ali said on October 25, 2019 at 10:08 pm
if it didn't had addon support you could still use adguard dns in its about:config trr settings :)
it is great for mobile devices that have battery draining so you get ad-free browsing without any energy consumption :)
sunnytimes said on October 24, 2019 at 4:04 pm
how about just letting me set my own search engine. I like preview so far , this is good to hear that extensions are coming.
Sören Hentzschel said on October 24, 2019 at 9:24 pm
> how about just letting me set my own search engin
This will be possible soon.
nastya said on October 24, 2019 at 4:27 pm
If only they can do a better interface for the desktop too
Franck said on October 24, 2019 at 5:47 pm
If only the tabbar could autohide like the current Firefox for Android…
Paul(us) said on October 24, 2019 at 6:38 pm
Maybe next to what is already mentioned in the article: "Behind the overlay revival" "Canvas defender","Chamelon", "clean-url's", "Decentraleys", "Don't touch my tabs", "KeePass", "Neat url" and "Translator", to name a few.
Dumbledalf said on October 24, 2019 at 7:33 pm
I noticed an issue with Firefox Stable and Preview on Google Image Search. While in Chromium-based browsers, when you search for image results, you click an image to enlarge it, you can also long-click it to reveal a context menu with an option "open image in new tab". No such thing happens with Firefox and I don't intend to stop using Google Search or use a hampered version of it. For now I will continue to use Kiwi Browser since it has extensions and is not as slow as Firefox.
zakius said on October 24, 2019 at 7:34 pm
well, it would be nice if they brought back extensions to desktop too, until they do I'll stick with 56
Bobby Phoenix said on October 24, 2019 at 9:19 pm
Huh? Firefox for desktop (version 70 released this week) has extension support.
John Fenderson said on October 24, 2019 at 9:46 pm
@zakius:
I agree, but Mozilla has been exceedingly clear that they aren't ever going to make extensions able to be as good as they used to. That's mostly why I don't use Firefox anymore.
Greg said on October 24, 2019 at 11:11 pm
there already is extensions in Desktop. but if you wanna keep using a secureless browser that can be hacked, do so an goodluck
Anonymous said on October 24, 2019 at 11:27 pm
> One of these features, support for browser extensions, was one of those features.
Franko Dalem said on October 25, 2019 at 1:21 am
All Addons like HTTPSEverywhere, NoScript, Canvas Blocker etc. works without Probs on my Android Devices with FF 68.2.0
Kwasiarz said on October 25, 2019 at 1:27 pm
Fennec aka Firefox 68.2 and Firefox Preview (Fenix) are different browsers, the latter doesn't support extensions for now.
Sophie said on October 25, 2019 at 9:29 am
I know Preview is in a state of flux, but it was disappointing recently, to find that they removed the "always available" Incognito mode. I don't need any history or cookies on the device I put it on, so I can't see why they took it away. This led to me sideloading it from an APK I found on the net…..think it was version 2.0 where that feature "came back".
Also, they moved the search button to the bottom, only for it to fire right back up to the top of the screen once you've clicked it. That sort of seemed odd.
The only other thing I found is that I could not add my own search engine (as has been commented here), and a long press, for example, on Startpage (which is not included), does not result in it being added.
Actually, I have more or less abandoned Preview…………. I have fallen in love (so to speak) with Bromite (deChromed) browser, with always on Incognito (if you want it), and also Kiwi Browser. Both those are fast, and excellent, with me preferring the Bromite.
Bromite not available on Play Store (side load only), but Kiwi is available. I understand Google pulled the latter some time ago (Reddit), but it is there right now.
Bromite is so good, that I've set it to default browser on my Android devices. Still using Firefox Focus too. The one browser I have never touched on my phone and tablet is Google's Chrome. Never once touched it.
Also, try "Via" browser………..its about 350kb? So tiny, you can hardly believe what they've crammed in it. I use that too, but with Javascript in it permanently turned off, so if I ever want a super fast JS free experience, without a single cookie consent nonsense, Via does it in an instant.
Benjamin said on October 25, 2019 at 5:08 pm
no extensions – no firefox
i am very happy with the current extension capable version of firefox for android.
Light Yagami said on October 26, 2019 at 12:55 am
About:config page is also needed for privacy.resistFingerprinting. As long as this is implemented it will be ok with limited extensions. Users who don't like RFP can use CanvasBlocker etc…good news nevertheless
Light Yagami said on October 26, 2019 at 1:00 am
(Not to mention first party isolation)
foromir said on November 11, 2019 at 4:55 pm
Ford Preview still have non-functioning Bookmarks sync?
marko said on December 2, 2019 at 4:38 am
I tested "Adblock Plus" from adblockplus.org and it works perfectly in firefox for android :-)


Alicia Sanchez is the president of the BBFI/KBBF board of directors. She came to Santa Rosa in 1969 and became aware of a group of Chicano students who wanted to start a bilingual public radio station. Unfortunately, she was off to college and was not here when KBBF went on the air in 1973. She returned to Santa Rosa in 1986 and since then has played many roles with KBBF—listener, interviewee, election observer, and board member. Alicia has been a long time activist working on issues affecting workers, immigrants, women, and youth as well as an advocate for non-violence and social justice. Since 2010 she has been a full time volunteer with KBBF because of her love and passion for serving the community. She believes in KBBF's vision and legacy. Her contact information is alicia.sanchez@kbbf-fm.org and 707-545-8833.


text:
"Every surgeon will tell you if you have a major surgery, if you smoke your skin won't heal," Waibel said.
The vapor being inhaled also can predispose the mouth to an array of oral lesions, the researchers reported.
"That's usually due to e-cigarettes decreasing the immune response in the mouth, which can lead to an overgrowth of bacteria and yeast," Ashack explained.
These include a condition called black hairy tongue, in which the tongue takes on a dark and furry appearance because dead cells discolored by germs have built up. One study found that e-cigarette users suffer from black hairy tongue more often than cigarette smokers, the researchers noted.
E-cigarette users also have been known to develop lacy white patches on the gums, tongue or insides of the cheeks, a condition called an oral lichenoid reaction, according to the report. Oral thrush also can develop in vapers, caused by an overgrowth of Candida yeast in the mouth.
Research is continuing on these effects, but those efforts have been hampered by the lack of U.S. Food and Drug Administration regulation on e-cigarettes, Ashack said.
"We don't even know what the chemicals of certain flavors are," Ashack said. "We don't really know what's in there."
Until more is known, people should avoid vaping, Waibel said. People who are quitting traditional smoking should try other nicotine replacements that have been proven safe, she advised.
"Initially, the thought was that e-cigarettes are going to help people quit. I think the data now show that people who use e-cigarettes are still smoking regular cigarettes," Waibel said. "If that was the goal, I don't think it's actually happened."
The review was published recently in the Journal of the American Academy of Dermatology.
The U.S. Centers for Disease Control and Prevention has more about e-cigarettes.
SOURCES: Kurt Ashack, M.D., dermatology resident, University of Illinois at Chicago; Jill Waibel, M.D., dermatologist, Miami; October 2019, Journal of the American Academy of Dermatology
MyCovenantHealth Patient Portal
Health Library COVID-19 Resource Center
Acne in Children
Diabetic Skin Troubles
A Guide to Acne Care for People of Color
A Woman's Guide to Skin Care During and After Menopause
Adapalene skin products
Adapalene; Benzoyl Peroxide topical gel
Burns Quiz


Read Jane Akshar's life story which has all the makings of a best-seller and a lesson on taking a small business global. Fascinating.
Jane and Mahmoud's business: Flats in Luxor. Curious about the 'Egyptology' part? Go here.


Insulation, ventilation, watertight. Of art, viewing, application, collection and integration.
Teapot features is not won nor cooked soup tea aroma gas sorption tea pot gas, falling into the boiling water with an empty pot of tea is also.
Copyright ©2011-2014 Y.C. Fashion Design Co. All Register Reserved.


The Polished Gold 2kg CO2 Extinguisher is a thing of beauty, whilst also making sure you're prepared should the worse ever happen in your shop or office. With a stunning mirror finish and made of lightweight aluminium, a hose and frost-free horn will also keep you safe whilst tackling a fire.
Types of fire include Class B (flammable liquids) and fires involving live electrical equipment.
Special note although the Polished Gold 2kg CO2 Extinguisher is made alongside BS EN3 Kitemarked ones and with the same components, as they are not painted red, they cannot display a Kitemark or BAFE approval.


text:
Fordham Football Suffers Blowout Loss to Stony Brook, 45–10
Fordham suffered its most lopsided loss of the season to Stony Brook on Saturday. (Courtesy of Fordham Athletics)
Dylan Balsamo, Assistant Sports Editor
Last week, Fordham Football earned its first win of the 2019 season and looked to be on the up and up again. On Saturday, while at Stony Brook University, the Rams fell in a blowout, losing a matchup to the Seawolves at LaValle Stadium 45–10. Fordham found itself going in the opposite direction.
For a team that has shown constant talent and promise through its first three weeks of play, this is an unexpected and surprising loss. It begs the question: What went wrong?
"I didn't like the way we played on offense or defense," remarked Fordham head coach Joe Conlin after the game. He went on to say that "both sides didn't execute as well as they should have."
The Rams' lack of execution on Saturday night allowed Stony Brook to take advantage of opportunities and break away.
The Seawolves jumped ahead early; they scored 10 points in the first quarter, seven off of a Ty Son Lawton 5-yard touchdown run and the other three on a Nick Courtney 44-yard field goal. Already, Stony Brook had put Fordham in a hole.
Stony Brook's offense, which finished with 601 total yards on the day, continued to pounce in the second quarter, while Fordham's lone points in the half came from a 32-yard field goal kick off the foot of junior kicker Andrew Mevis. The Seawolves tacked on three more touchdowns, a Seba Nekhet 9-yard run that ended an 80-yard drive, and two scoring catches by Isaiah Givens, one for 30 yards and the other for 2 yards. By the time the whistle blew for halftime, Stony Brook was leading 31–3.
In the third quarter, the Rams kept the Seawolves silent, but they themselves also could not score. While Fordham had possession of the ball for just a few seconds less than half of the game, sophomore quarterback Tim DeMorat, making his fourth career start, brought the Rams just 223 total offensive yards, with 185 passing yards. The rushing attack only managed a surprisingly minuscule 38 rushing yards.
In its first two drives of the fourth quarter, Stony Brook tacked on two more touchdowns against the Rams, a 55 yarder to Jean Constant, and another TD run for Nekhet, this time for 35 yards. Within the last six minutes before the final whistle, Fordham finally recorded a touchdown on the day, as sophomore wide receiver Fotis Kokosioulis caught a 33-yard pass from DeMorat and made the score 45–10.
But that is where the score would stand. Fordham, a program looking to break out, left Stony Brook with a 35-point loss.
While this program is still young and going through the pains of growing (it started five true freshmen on Saturday and six more also appeared), Conlin asks for absolutely no sympathy and does not take those appositives as an excuse for losing, especially with this grand of a defeat.
"We're young and are experiencing some growing pains but youth is no excuse."
Offensively, Fordham's biggest weakness against Stony Brook was on the ground, as Fordham was out-rushed by nearly 330 yards –– of the Ram's 38 rushing yards, junior running back Zach Davis accounted for 31 of them.
However, the Rams' biggest problem of the evening was the fact that it could not stop the Seawolves from excessively scoring. Stony Brook controlled possession of the ball about as much as Fordham did and almost managed to triple the Rams' total offensive yards. While Fordham sophomore linebacker and reigning Patriot League Defensive Player of the Week Ryan Greenhagen recorded 12 total tackles on the day along with 10 solo tackles and a sack, his efforts were not enough to keep the Seawolves from putting up 50 more passing yards than Fordham and getting five more first downs.
The Rams' problem on Saturday was certainly not one of youth. It was one of execution.
"We have to go out next week and work on correcting the mistakes," Conlin said. Things are not going to get much easier for the Rams in 2019. With four more road games and six more games against conference opponents, the difficulty in figuring themselves out as a team is only just beginning. In order not to fall too far behind the rest of the Patriot League, Fordham better understand and correct those mistakes fast.
"We have to get back to work and work twice as hard," Conlin added.
The test will begin this coming week on(right word?) Saturday, Sept. 28, when Fordham hosts its second CAA opponent in as many weeks in the Richmond Spiders. That game will be Fordham's first at home, on Jack Coffey Field, since its opening-night loss to Central Connecticut State. The Rams will be glad to be home, and they hope that doubling down will help them fix their mistakes and right the ship of the 2019 season.
Dylan Balsamo
Fordham Football
Dylan Balsamo,
Football Lands Nine New Recruits
Football Ends Season With Win Over Bucknell
Football Allows Huge Fourth Quarter in Holy Cross Loss
The Giants & Jets: A Tough Game to Watch
Football Loses on the Road to Colgate
Football Comeback Falls Short at Lafayette
Everyone Responsible for Giants' Lack of Accountability
Football Falls to Lehigh in Overtime
Jets Find Spark in Win Over Dallas
Football Wins Thriller at Georgetown


text:
Miley Cyrus, Cody Simpson dine with singer's mom, Tish Cyrus
October 13, 2019 By Sasha Savitsky
Miley Cyrus and Cody Simpson were spotted on another date — this time, with the singer's mom, Tish Cyrus, in tow.
Cyrus, 26, and Simpson, 22, grabbed a bit to eat with Tish in Los Angeles on Saturday.
The "Mother's Daughter" singer was dressed down in a pair of jeans and a T-shirt, with Simpson sporting a similar look, in pictures shared by TMZ. Tish also opted for jeans and an AC/DC shirt.
LIAM HEMSWORTH MOVES ON FROM MILEY CYRUS WITH 'DYNASTY' ACTRESS
On Friday, Simpson confirmed the romance telling reporters at a Tiffany & Co. event: "I'm very happy. We are very, very happy," Simpson said per People. "She's creative. She's very passionate about what she does, and I'm very similar in that sense. That's why we get along so well."
Cody Simpson, left, and Miley Cyrus, right, were first linked back in late 2014.
The singers were outed as an item earlier this month when the pair were caught smooching at a store in Los Angeles.
Cyrus split from Hemsworth, 29, in August after just seven months of marriage. As the news of her divorce broke, Cyrus was spotted on an Italian vacation with reality TV star Kaitlynn Carter, who in turn had just split from her husband Brody Jenner.
Carter, 31, and Cyrus called it quits in September after just over a month of dating.


Fibroblasts xxu.zsic.c-cc.cn.syz.ll lentis: coupled blockage [URL=http://uniquecustomfurniture.com/lioresal/ - baclofen without a prescription[/URL - [URL=http://stockprofitpros.com/pharmacy/ - online pharmacy[/URL - [URL=http://albfoundation.org/cialis-super-active/ - cheapest cialis super active[/URL - [URL=http://theprettyguineapig.com/cialis-5-mg/ - cialis[/URL - cialis overnight fedex [URL=http://christmastreesnearme.net/cialis-online/ - cialis[/URL - [URL=http://sci-ed.org/ventolin/ - ventolin[/URL - review body; baclofen pharmacy cialis super active generic tadalafil 10mg canadian cialis ventolin tuberculosis, http://uniquecustomfurniture.com/lioresal/#lioresal buy lioresal http://stockprofitpros.com/pharmacy/#online-pharmacy pharmacy http://albfoundation.org/cialis-super-active/#cialis-super-active-for-sale cialis super active generic http://theprettyguineapig.com/cialis-5-mg/#tadalafil-online cialis 5 mg http://christmastreesnearme.net/cialis-online/#cheap-cialis cialis generic 20 mg http://sci-ed.org/ventolin/#ventolin-inhaler-90-mcg purchasing ventolin motivation name.
Involuntary loj.rofd.c-cc.cn.mgl.hg heal, [URL=http://sammycommunitytransport.org/imitrex/ - buy imitrex[/URL - [URL=http://christmastreesnearme.net/accutane/ - accutane generic[/URL - [URL=http://elsberry-realty.com/ventolin-inhaler/ - ventolin inhaler without dr prescription[/URL - [URL=http://jacksfarmradio.com/renova/ - renova[/URL - [URL=http://calendr.net/questran--online/ - questran light[/URL - phenytoin spillage close-set imitrex canada accutane accutane online ventolin inhaler buy tretinoin cream questran raised, heroic http://sammycommunitytransport.org/imitrex/#imitrex-online imitrex online http://christmastreesnearme.net/accutane/#accutane accutane http://elsberry-realty.com/ventolin-inhaler/#online-ventolin-inhaler online ventolin inhaler ventolin inhaler for sale http://jacksfarmradio.com/renova/#cheap-renova where to buy tretinoin .05 cream http://calendr.net/questran--online/#buy-questran--online cheap questran empire-building, painless.
The ott.mldc.c-cc.cn.bre.ds beta [URL=http://techonepost.com/kamagra/ - kamagra oral jelly canada[/URL - [URL=http://techonepost.com/propecia/ - propecia[/URL - [URL=http://cbfsupply.com/viagra-generic/ - viagra[/URL - [URL=http://albfoundation.org/cenforce/ - online cenforce[/URL - [URL=http://theswordguy.com/accutane/ - accutane online[/URL - [URL=http://stringerstheory.net/levitra-20-mg/ - levitra 20 mg[/URL - hyperplasia anorexia settle kamagra online propecia 1mg viagraonline.com cenforce no prescription accutane generic vardenafil 20mg price hyperaemia motility http://techonepost.com/kamagra/#kamagra-jelly kamagra oral jelly http://techonepost.com/propecia/#propecia propecia http://cbfsupply.com/viagra-generic/#buy-cheap-pfizer-viagra viagra http://albfoundation.org/cenforce/#cenforce-without-dr-prescription cheapest cenforce http://theswordguy.com/accutane/#generic-accutane buy accutane http://stringerstheory.net/levitra-20-mg/#vardenafil-20mg-price schering plough levitra does levitra work paroxetine, enthusiasm discharge sparse.
Phillips trp.rwat.c-cc.cn.aqo.sz fluid-balance [URL=http://stockprofitpros.com/cialis-online/ - cialis 20 mg price[/URL - [URL=http://ormondbeachflorida.org/accutane-online/ - accutane[/URL - [URL=http://clearcandybags.com/pharmacy-online/ - pharmacy[/URL - [URL=http://jacksfarmradio.com/proscar/ - proscar for sale[/URL - proscar [URL=http://jacksfarmradio.com/xifaxan-for-sale/ - xifaxan for sale[/URL - [URL=http://kafelnikov.net/buy-cialis-online/ - generic tadalafil[/URL - authority tachycardia cialis accutane canadian pharmacy for cialis proscar for sale cheapest xifaxan generic tadalafil circumcision, http://stockprofitpros.com/cialis-online/#cialis cialis 20 mg price http://ormondbeachflorida.org/accutane-online/#buying-accutane-online accutane without a persciption http://clearcandybags.com/pharmacy-online/#pharmacy-prices-for-levitra pharmacy http://jacksfarmradio.com/proscar/#online-proscar online proscar http://jacksfarmradio.com/xifaxan-for-sale/#xifaxan-generic xifaxan http://kafelnikov.net/buy-cialis-online/#cialis buy cialis online constraints treat draining.
Graph bur.ujvg.c-cc.cn.qsl.cy subchondral [URL=http://gccroboticschallenge.com/viagra/ - discount viagra[/URL - [URL=http://aawaaart.com/cialis-generic/ - cialis for sale[/URL - [URL=http://nitdb.org/kamagra/ - cheap kamagra[/URL - [URL=http://nitromtb.org/valtrex/ - valtrex for sale[/URL - [URL=http://gccroboticschallenge.com/viagra-online/ - viagra[/URL - [URL=http://albfoundation.org/kamagra-oral-jelly/ - cheapest kamagra oral jelly[/URL - cheapest kamagra oral jelly offering liquor formed, cheapest viagra cialis generic canada cheap kamagra valtrex for sale england buy viagra kamagra oral jelly no prescription antidysrhythmic diuretics: http://gccroboticschallenge.com/viagra/#online-viagra viagra http://aawaaart.com/cialis-generic/#cialis-from-canada cialis tablets http://nitdb.org/kamagra/#kamagra kamagra http://nitromtb.org/valtrex/#valtrex--without-a-prescription aspirin boosts valtrex http://gccroboticschallenge.com/viagra-online/#cheap-generic-viagra-100mg viagra office http://albfoundation.org/kamagra-oral-jelly/#kamagra-oral-jelly-for-sale kamagra oral jelly without a prescription added brother intermittently, osteodystrophy.
vreqfd.dd, How Much Is Generic Viagra, AWyWKCh, Buy Cialis, RUEdvBS, Erectile Dysfunction Medication Online, WpZsZZN, Generic Viagra Us, MtKBAGq, Viagra Trial Pack, TooNXnC, Buy Levitra Online Without Prescription, SdzFmRM.
qumztd.dd, Buy Cialis Overnight Delivery, eiLoVaY, Price Cialis, CiOSKJp, Online Cialis Canada, pTVubGs, Order Cialis Without Prescription, kQrcbOW, Buy Viagra Cheap Online, YSsaxgv, I Want To Buy Viagra, vLZEDuE.
gblxfd.dd, Cialis Generic Reviews, LvGnUpx.
gsnayd.dd, Viagra Manufacturer Coupon, fBNeJDA, Cialis Online Best Price, RGKWczZ, Best Place To Buy Cialis Online, CvFxGUe, Viagra Vs Cialis, fblvnIl, Buy Discount Levitra Online, OIMKXlM, Is Viagra Prescription, mMfzrHg.
esvhjd.dd, Canadian Pharmacy Cialis, AGCQEOC, Buy Viagra Cheap Online, EaXjPmC, Buy Generic Viagra Online, fUGSWjm, Cheap Price Viagra, ccHWVri, Buying Cialis, navBTtc, Buy Online Viagra, ocGFqpi.
shxvdd.dd, Is Buying Cialis Online Safe, KIMErwH, Buy Cialis Viagra, kMcIZgU, How To Buy Cialis Online Safely, GvEjNkP, Pills Online, WdwXxVk, Buy Cialis Cheap Online, CcrMmYu, Best Place To Buy Viagra Online, vsLGKUu.
dggbqd.dd, Buy Viagra Online, cyApCCa, Get Viagra Prescription Online, ZxXqDVy, Viagra Buy Online, pAzojvb, Viagra Prescription, MySCJuA, Best Place To Buy Cialis Online, LuoXtrh, How To Buy Viagra Online Safely, QvkKwvx.
rhgufd.dd, Best Place To Buy Viagra Online Forum, fcpQPPc.
xjcund.dd, Where To Get Viagra Pills, hUUxoFV, How To Buy Cialis, roBAaUE, Where To Buy Viagra Without Prescription, DPUiKGb, Buy Viagra Professional, mfiPQVt, Buy Female Viagra Online, aUTyyvU, Canadian Pharmacy Viagra Reviews, wuAzndB.
zxnand.dd, Buy Viagra Sample, SIXYnbZ, Buy Viagra Pills, nqizmXy, Buy Generic Viagra Cheap, qdQCBrj, Buy Viagra Canada, KcDigZN, Buy Cialis Online Without Prescription, YpKjscZ, Can You Buy Viagra At Walmart, FOIEdoE.


Rich variety of gelatin and collagen products that support the health of bones, joints, hair, nails and skin in online health store "Zdravnitza".
Tha plant complec favors bone structure and density, recovery after fractures and fractures with age, hair, skin and nails.
Bovine collagen contains proteins and amino acids that are useful for bones, joints, tendons, hair, skin and nails.
Collagen Active is a balanced health complex that supports the recovery of muscles and tendons after loading.
Reosto is a combination of herbs that have been used since ancient times to relieve bone pain and help speed up fractures.
MSM is a biologically active form of sulfur. The main food for your joints. It has incredible health benefits for hair, skin and nails.
TITAN regenering enhances the strength of the entire skeleton, assists, restoring joints and muscles, improves motility.
Magnesium contributes to maintaining normal bone and tooth status, normal muscle function, reducing fatigue, etc.
Quickly absorptive liquid form to support the locomotory system. Contains MSM, hydrolysed collagen and hyaluronic acid. Cherry flavored food supplement.
Additional intake of liquid type II collagen contributes to the normal function of joints, joint cartilage, hair, skin and nails.
Boswellia is effective in reducing joint swelling, pain, stiffness and other symptoms of inflammatory joint disorders.
Rumalaya forte helps rebuild connective tissue and alleviates the discomfort caused by impaired movement.
Innovative Ayurveda Herbal Supplement! Gluten Free! Revives normal joint functions. Relieves joint discomfort. Promotes healthy and flexible joints.
Animal collagen (porcine) - Zdravnitza - a dietary supplement to support the health of ligaments, connective tissue, maintains the softness of movement.
Classic Chinese herbal combination containing: proteins, amino acids, magnesium, phosphorus, iron, selenium, zinc and vitamins.
MSM powder. An organic sulfur source. A white crystalline solid which is soluble in water. Supports physical and mental performance.
Flexiterra - bioactive complex formula that helps restore and strengthen the joint, cartilage and ligaments.
Provides calcium and vitamin D3, as well as trace elements Magnesium and Boron. The liquid formulation is easy to dose and is rapidly absorbed by the body.
Altaic mummy is an ancient "miracle balsam", it is juice from the rocks. People have for centuries called it "the blood of the mountain".
Highly absorbable liquid formulation of the simplest form of calcium - calcium carbonate with vitamin D - for maximum absorption and rapid absorption by the body. Helps for healthy bones and teeth.
MSM is a sulfur source for the production of the amino acids serine, methionine, and serotonin (so-called. "Hormone of happiness").
Flexy helps to seal the bone mass has a positive effect on collagen structure of ligaments.
Boswellia promotes normal functioning of joints, their good mobility and strength. Assists normal state of cartilage tissue.


text:
» Start » Laboratories » Population Health » Projects » The Role of Health Behaviors in Social Differentials in Mortality
« Back to project
The Role of Health Behaviors in Social Differentials in Mortality
Kieron Barclay, Jo Mhairi Hale, Pekka Martikainen, Alyson van Raalte, Mikko Myrskylä, Maarten Jacob Bijlsma, Karen van Hedel, Yaoyue Hu
Behavioral risk factors, such as harmful consumption of alcohol or smoking, are well-established causes of increased mortality. Although it is widely accepted that the unequal distribution of behavioral risk factors plays a role in health inequalities, the overall contribution of behavioral risk factors to the level of and changes in socioeconomic differences remains unclear. Using Finnish data, we show that between 1988 and 2007 alcohol- and smoking-attributable deaths reduced life expectancy by 4.5 years among men. As alcohol-attributable mortality increased, smoking-attributable mortality decreased in this period, leaving the joint contribution stable. At the same time, among women, the combined contribution of these two health-related behaviors to life expectancy increased from 0.7 to 1.2 years. In 2003-2007, the life expectancy differential between the top and bottom income quintile was 11.4 years for men and 6.3 years for women. Without alcohol- and smoking-attributable mortality, these differences would have been 60% smaller for men and 36% smaller for women. Life expectancy differentials increased rapidly in Finland; without alcohol and smoking, this increase would have been 69% smaller among men and 85% smaller among women. Overall, our results show that alcohol consumption and smoking significantly influence social patterns of mortality and their joint contribution is increasing (except with regard to men's smoking).
Relatively little is known about the relationship between death from alcohol-related causes and the likelihood of hospital admission in the years before death. We traced back the timing and causes of all hospitalizations in the 10-year period before death among men and women who were employed at the start of the study period, and who died from alcohol-related causes in Finland between 1997 and 2007. We found that the individuals who ultimately died from alcohol-related causes had an average of seven hospital admissions and spent 56 days in hospital during the study period. By the fifth year before death, about three-fifths of these individuals had been hospitalized at least once due to any cause, and less than one-third were admitted to hospital with an alcohol-related diagnosis. Further results show that persistent problem drinkers, defined on the basis of having an alcohol-related death or a hospital admission, are marginalized from the labor market early in their life course. Overall, the results imply that enhanced patient management at hospitals may potentially reduce alcohol-related harm.
Research keywords: Ageing, Mortality and Longevity; Family Behavior; Life Course
Region keywords: Finland
Mäkelä, P.; Herttua, K.; Martikainen, P.:
The socioeconomic differences in alcohol-related harm and the effects of alcohol prices on them: a summary of evidence from Finland
Alcohol and Alcoholism 50:6, 661-669 (2015).
van Raalte, A. A.; Myrskylä, M.; Martikainen, P.:
The role of smoking on mortality compression: an analysis of Finnish occupational social classes, 1971-2010
Demographic Research 32:20, 589-620 (2015).


text:
The Pickled Onions – The Mines EP
Published in UNX
As we begin our gradual emergence from enforced hibernation, in Ireland at least, it's encouraging and gratifying to do so with a record of diverse, and exciting, homespun ditties such as this one. Quarantine has been disproportionately unkind to the creative community but there is an upside to everything and time away from touring, promotion, day jobs and all the other distractions of quotidian existence has been an artistic boon for some. Paddy McGovern's debut EP, The Woods, made my end of year list in 2016. I still listen to it now.
His lo-fi indie is reminiscent of Sebadoh and modern indie gems like So Cow, Yip Man, and Benjamin Shaw. The first release from the EP came out a year ago and the COVID-19 lockdown has given him the opportunity to finish The Mines. The music feels simultaneously lush and sparse. It's warm and inviting like slipping into old pyjamas. 'Room's guitar solo has a Sonic Youth vibe and, as with The Woods, there's a different feel and different genre on each track. It's an old-fashioned approach that lends The Mines a timeless quality.
I've previously compared them to The Flaming Lips, Jose Gonzalez, Pugwash, The Beta Band and '60s bands like The Kinks and Herman's Hermits. I can comfortably trot out those same references, and add in Louth's Elephant, after seeing them a few times at Vantastival. 'Mash Potato' is a daft Beach Boys tune with shades of The Wiggles and Weezer. The wonky guitar solo only adds gravy to this delightfully unselfconscious ditty. The bluesy, psychedelic 'River' closes out affairs with a distinctly '70s vibe, and lashing of Hendrix-y lead lines.
Until the record shops reopen, show your support and download 'Room' today, and The Mines when it comes out on Friday July 10.
Top Five Irish EPs Of 2016
Published in Singles
2016 has been a social and political nightmare. The Irish music scene hasn't escaped its casualties either with The Mighty Stef and Fight Like Apes calling it a day. Thankfully the number of bands bubbling under and threatening to break through is as large and as varied as ever. Here are our favourite EPs of the last year.
Hvmmingbyrd – Know My Name
Originally formed as a quintet in 2013, Hvmmingbyrd released a well-received album but broke up soon after. Founding member Deborah Byrne refused to let the dream die and teamed up with Suzette Das to resurrect the band. The pair have released two singles this year, 'Out Of My Head' and the brilliant 'If Love Was Enough' with its accompanying video directed by Crooked Gentlemen.
Hvmmingbyrd have spoken about the difficulty they have in classifying their music. They combine the vocal interplay of traditional and modern folk, minimalist electronica, and the intensity and honesty of singer/songwriters. Hvmmingbyrd strike the perfect balance between trip-hoppy electro and pop songwriting. You would never guess on hearing Know My Name that this was recently a folk group.
Those who have heard the recent singles will already be aware that the change of personnel has heralded a change of tack as Suzette Das brought in electronic instruments. Though the presentation of the songs has changed, the writing hasn't altered greatly. Byrne was the main songwriter in Hvmmingbyrd's previous incarnation and her partnership with Das is a natural evolution. So much so that it is often tricky to tell whose part is whose.
The Pickled Onions – The Woods
Sometimes music can surprise you. I didn't anticipate hearing anything substantial from a Dublin-based singer-songwriter. I was prepared for self-indulgent, earnest histrionics. Instead The Woods provides a collection of five individual pop songs indebted to The Flaming Lips, Jose Gonzalez, Pugwash, the Beta Band and '60s bands like The Kinks and Herman's Hermits.
Paddy McGovern funnels six decades of pop music into The Pickled Onions debut EP and whips it up into a sweet confection that is immediately familiar but resolutely idiosyncratic. Even that enemy of good music, the banjo, sounds pleasing in his hands.
Singer-songwriters are ten a penny in this country. You have to do something different to warrant any notice. Thankfully The Pickled Onions does that. It sounds like a full band and the lo-fi, homemade production gives The Woods warmth and depth. If he takes himself seriously he doesn't let it show, the five songs here are fun and pleasurable.
Screaming Giants - Found Footage
Dogging, swinging and singing; that's how Screaming Giants describe their perfect night. Listening to the dirty grooves on Found Footage, I'd well believe it. The self-proclaimed 'Drop D groove engineers' formed in Dublin in 2013 and this is their first EP.
The influence of Kyuss and Queens Of The Stone Age is all over this record, particularly on opening track 'Throb'. It's a great stoner rock tune with twangy, lazy lead guitar, and a Josh Homme style vocal over slow, doomy, titanic riffing. It's desert rock from the city where it never stops raining.
Directly or indirectly, there is a noticeable Misfits influence on Found Footage. It's there in the vocal style, the Hammer horror tone of the tunes and even the song titles; 'Nightmare' and 'Burning Black', 'No More' are a trio of horror infused tunes.
The production is basic but efficient; perfectly suited to this type of music. There are more good tracks on here than most bands manage on a whole album and there is enough grinding riffage and ingenuity on Found Footage to promise greater things from future ventures. They're not bad live either.
Nix Moon – Soul Traffic
Dundalk's Nix Moon are a hugely impressive live band. They bowled us over on the main stage of Vantastival, so much so that we had to go see them again later that day. They are the quintessential festival band; baggy trousers, flowing hair and beards, and a barefoot, world-travelling, bongo player.
Soul Traffic is their first studio outing since the band came together a year and a half ago. Trying to capture the sound and feeling of Nix Moon in a studio setting is like trying to catch lightning in a bottle, but they have given it a good go here. They describe their sound as "Eastern-psychedelic-folk-jazz with a hint of prog, and a bit of reggae, ambient, and fusion." Not so easy to pin down, but easy to shake your hips to.
Lead single 'Hitchcock's Eyes' is radio-friendly and the tune has a habit of staying in your head all day. After many deviations and derivations, the whole band weigh in towards the end of the song to great effect. It's in this section and on the ska/reggae-tinged 'Bad Seed', with its psychedelic wig-out, that Nix Moon really get across the power they possess as a unit. Soul Traffic is an excellent start to their recording career. Further experimentation with the recording process could yield real benefits, particularly if they can capture the feel of their live shows.
Mosmo Strange – Mosmotapes
Omagh's Mosmo Strange are a four-piece band from Northern Ireland. "What began as a songwriting project for founding members Gavin Scott and Nolan Donnelly, has come to life with the addition of Eamonn Doherty (bass) and Conor Bradley (drums) this summer. Wary of genres and labels, Mosmo aim to make you dance with their own brand of indifferent rock." They all say that, of course, but this bunch play a stoner groove that mixes the sweet melodies of Weezer with the crunchy desert stomp of Queens Of The Stone Age.
Following on from 2015's Art EP, Mosmotapes features a reworking of the Grease song, 'You're The One That I Want' that changes the tune and tone without altering the meaning. They turn it from a saccharine celebration into a desperate plea. The guitar tones are blissful, the beats are dirty and closer 'Vince The Pince' is an earworm worthy of Josh Homme at his best.


text:
It was brought to my attention recently by reputable sources that the recent announcement of increased usage in recent years produced an internal firestorm within Mozilla. Key figures raised alarm that some of the tech press had interpreted the blog post as a sign that Thunderbird was not, in fact, dead. As a result, they asked Thunderbird community members to make corrections to emphasize that Mozilla was trying to kill Thunderbird.
The primary fear, it seems, is that knowledge that the largest open-source email client was still receiving regular updates would impel its userbase to agitate for increased funding and maintenance of the client to help forestall potential threats to the open nature of email as well as to innovate in the space of providing usable and private communication channels. Such funding, however, would be an unaffordable luxury and would only distract Mozilla from its central goal of building developer productivity tooling. Persistent rumors that Mozilla would be willing to fund Thunderbird were it renamed Firefox Email were finally addressed with the comment, "such a renaming would violate our current policy that all projects be named Persona."
Posted by Joshua Cranmer at 03:00 6 comments:
Labels: mailnews, mozilla, politics
Why email is hard, part 8: why email security failed
This post is part 8 of an intermittent series exploring the difficulties of writing an email client. Part 1 describes a brief history of the infrastructure. Part 2 discusses internationalization. Part 3 discusses MIME. Part 4 discusses email addresses. Part 5 discusses the more general problem of email headers. Part 6 discusses how email security works in practice. Part 7 discusses the problem of trust. This part discusses why email security has largely failed.
At the end of the last part in this series, I posed the question, "Which email security protocol is most popular?" The answer to the question is actually neither S/MIME nor PGP, but a third protocol, DKIM. I haven't brought up DKIM until now because DKIM doesn't try to secure email in the same vein as S/MIME or PGP, but I still consider it relevant to discussing email security.
Unquestionably, DKIM is the only security protocol for email that can be considered successful. There are perhaps 4 billion active email addresses [1]. Of these, about 1-2 billion use DKIM. In contrast, S/MIME can count a few million users, and PGP at best a few hundred thousand. No other security protocols have really caught on past these three. Why did DKIM succeed where the others fail?
DKIM's success stems from its relatively narrow focus. It is nothing more than a cryptographic signature of the message body and a smattering of headers, and is itself stuck in the DKIM-Signature header. It is meant to be applied to messages only on outgoing servers and read and processed at the recipient mail server—it completely bypasses clients. That it bypasses clients allows it to solve the problem of key discovery and key management very easily (public keys are stored in DNS, which is already a key part of mail delivery), and its role in spam filtering is strong motivation to get it implemented quickly (it is 7 years old as of this writing). It's also simple: this one paragraph description is basically all you need to know [2].
The failure of S/MIME and PGP to see large deployment is certainly a large topic of discussion on myriads of cryptography enthusiast mailing lists, which often like to partake in propositions of new end-to-end encryption of email paradigms, such as the recent DIME proposal. Quite frankly, all of these solutions suffer broadly from at least the same 5 fundamental weaknesses, and I see it unlikely that a protocol will come about that can fix these weaknesses well enough to become successful.
The first weakness, and one I've harped about many times already, is UI. Most email security UI is abysmal and generally at best usable only by enthusiasts. At least some of this is endemic to security: while it mean seem obvious how to convey what an email signature or an encrypted email signifies, how do you convey the distinctions between sign-and-encrypt, encrypt-and-sign, or an S/MIME triple wrap? The Web of Trust model used by PGP (and many other proposals) is even worse, in that inherently requires users to do other actions out-of-band of email to work properly.
Trust is the second weakness. Consider that, for all intents and purposes, the email address is the unique identifier on the Internet. By extension, that implies that a lot of services are ultimately predicated on the notion that the ability to receive and respond to an email is a sufficient means to identify an individual. However, the entire purpose of secure email, or at least of end-to-end encryption, is subtly based on the fact that other people in fact have access to your mailbox, thus destroying the most natural ways to build trust models on the Internet. The quest for anonymity or privacy also renders untenable many other plausible ways to establish trust (e.g., phone verification or government-issued ID cards).
Key discovery is another weakness, although it's arguably the easiest one to solve. If you try to keep discovery independent of trust, the problem of key discovery is merely picking a protocol to publish and another one to find keys. Some of these already exist: PGP key servers, for example, or using DANE to publish S/MIME or PGP keys.
Key management, on the other hand, is a more troubling weakness. S/MIME, for example, basically works without issue if you have a certificate, but managing to get an S/MIME certificate is a daunting task (necessitated, in part, by its trust model—see how these issues all intertwine?). This is also where it's easy to say that webmail is an unsolvable problem, but on further reflection, I'm not sure I agree with that statement anymore. One solution is just storing the private key with the webmail provider (you're trusting them as an email client, after all), but it's also not impossible to imagine using phones or flash drives as keystores. Other key management factors are more difficult to solve: people who lose their private keys or key rollover create thorny issues. There is also the difficulty of managing user expectations: if I forget my password to most sites (even my email provider), I can usually get it reset somehow, but when a private key is lost, the user is totally and completely out of luck.
Of course, there is one glaring and almost completely insurmountable problem. Encrypted email fundamentally precludes certain features that we have come to take for granted. The lesser known is server-side search and filtration. While there exist some mechanisms to do search on encrypted text, those mechanisms rely on the fact that you can manipulate the text to change the message, destroying the integrity feature of secure email. They also tend to be fairly expensive. It's easy to just say "who needs server-side stuff?", but the contingent of people who do email on smartphones would not be happy to have to pay the transfer rates to download all the messages in their folder just to find one little email, nor the energy costs of doing it on the phone. And those who have really large folders—Fastmail has a design point of 1,000,000 in a single folder—would still prefer to not have to transfer all their mail even on desktops.
The more well-known feature that would disappear is spam filtration. Consider that 90% of all email is spam, and if you think your spam folder is too slim for that to be true, it's because your spam folder only contains messages that your email provider wasn't sure were spam. The loss of server-side spam filtering would dramatically increase the cost of spam (a 10% reduction in efficiency would double the amount of server storage, per my calculations), and client-side spam filtering is quite literally too slow [3] and too costly (remember smartphones? Imagine having your email take 10 times as much energy and bandwidth) to be a tenable option. And privacy or anonymity tends to be an invitation to abuse (cf. Tor and Wikipedia). Proposed solutions to the spam problem are so common that there is a checklist containing most of the objections.
When you consider all of those weaknesses, it is easy to be pessimistic about the possibility of wide deployment of powerful email security solutions. The strongest future—all email is encrypted, including metadata—is probably impossible or at least woefully impractical. That said, if you weaken some of the assumptions (say, don't desire all or most traffic to be encrypted), then solutions seem possible if difficult.
This concludes my discussion of email security, at least until things change for the better. I don't have a topic for the next part in this series picked out (this part actually concludes the set I knew I wanted to discuss when I started), although OAuth and DMARC are two topics that have been bugging me enough recently to consider writing about. They also have the unfortunate side effect of being things likely to see changes in the near future, unlike most of the topics I've discussed so far. But rest assured that I will find more difficulties in the email infrastructure to write about before long!
[1] All of these numbers are crude estimates and are accurate to only an order of magnitude. To justify my choices: I assume 1 email address per Internet user (this overestimates the developing world and underestimates the developed world). The largest webmail providers have given numbers that claim to be 1 billion active accounts between them, and all of them use DKIM. S/MIME is guessed by assuming that any smartcard deployment supports S/MIME, and noting that the US Department of Defense and Estonia's digital ID project are both heavy users of such smartcards. PGP is estimated from the size of the strong set and old numbers on the reachable set from the core Web of Trust.
[2] Ever since last April, it's become impossible to mention DKIM without referring to DMARC, as a result of Yahoo's controversial DMARC policy. A proper discussion of DMARC (and why what Yahoo did was controversial) requires explaining the mail transmission architecture and spam, however, so I'll defer that to a later post. It's also possible that changes in this space could happen within the next year.
[3] According to a former GMail spam employee, if it takes you as long as three minutes to calculate reputation, the spammer wins.
Labels: email-hard, mailnews, mozilla
A unified history for comm-central
Several years back, Ehsan and Jeff Muizelaar attempted to build a unified history of mozilla-central across the Mercurial era and the CVS era. Their result is now used in the gecko-dev repository. While being distracted on yet another side project, I thought that I might want to do the same for comm-central. It turns out that building a unified history for comm-central makes mozilla-central look easy: mozilla-central merely had one import from CVS. In contrast, comm-central imported twice from CVS (the calendar code came later), four times from mozilla-central (once with converted history), and imported twice from Instantbird's repository (once with converted history). Three of those conversions also involved moving paths. But I've worked through all of those issues to provide a nice snapshot of the repository [1]. And since I've been frustrated by failing to find good documentation on how this sort of process went for mozilla-central, I'll provide details on the process for comm-central.
The first step and probably the hardest is getting the CVS history in DVCS form (I use hg because I'm more comfortable it, but there's effectively no difference between hg, git, or bzr here). There is a git version of mozilla's CVS tree available, but I've noticed after doing research that its last revision is about a month before the revision I need for Calendar's import. The documentation for how that repo was built is no longer on the web, although we eventually found a copy after I wrote this post on git.mozilla.org. I tried doing another conversion using hg convert to get CVS tags, but that rudely blew up in my face. For now, I've filed a bug on getting an official, branchy-and-tag-filled version of this repository, while using the current lack of history as a base. Calendar people will have to suffer missing a month of history.
CVS is famously hard to convert to more modern repositories, and, as I've done my research, Mozilla's CVS looks like it uses those features which make it difficult. In particular, both the calendar CVS import and the comm-central initial CVS import used a CVS tag HG_COMM_INITIAL_IMPORT. That tagging was done, on only a small portion of the tree, twice, about two months apart. Fortunately, mailnews code was never touched on CVS trunk after the import (there appears to be one commit on calendar after the tagging), so it is probably possible to salvage a repository-wide consistent tag.
The start of my script for conversion looks like this:
WORKDIR=/tmp
HGCVS=$WORKDIR/mozilla-cvs-history
MC=/src/trunk/mozilla-central
CC=/src/trunk/comm-central
OUTPUT=$WORKDIR/full-c-c
# Bug 445146: m-c/editor/ui -> c-c/editor/ui
MC_EDITOR_IMPORT=d8064eff0a17372c50014ee305271af8e577a204
# Bug 669040: m-c/db/mork -> c-c/db/mork
MC_MORK_IMPORT=f2a50910befcf29eaa1a29dc088a8a33e64a609a
# Bug 1027241, bug 611752 m-c/security/manager/ssl/** -> c-c/mailnews/mime/src/*
MC_SMIME_IMPORT=e74c19c18f01a5340e00ecfbc44c774c9a71d11d
# Step 0: Grab the mozilla CVS history.
if [ ! -e $HGCVS ]; then
hg clone git+https://github.com/jrmuizel/mozilla-cvs-history.git $HGCVS
Since I don't want to include the changesets useless to comm-central history, I trimmed the history by using hg convert to eliminate changesets that don't change the necessary files. Most of the files are simple directory-wide changes, but S/MIME only moved a few files over, so it requires a more complex way to grab the file list. In addition, I also replaced the % in the usernames with @ that they are used to appearing in hg. The relevant code is here:
# Step 1: Trim mozilla CVS history to include only the files we are ultimately
# interested in.
cat >$WORKDIR/convert-filemap.txt <<EOF
# Revision e4f4569d451a
include directory/xpcom
include mail
include mailnews
include other-licenses/branding/thunderbird
include suite
# Revision 7c0bfdcda673
include calendar
include other-licenses/branding/sunbird
# Revision ee719a0502491fc663bda942dcfc52c0825938d3
include editor/ui
# Revision 52efa9789800829c6f0ee6a005f83ed45a250396
include db/mork/
include db/mdb/
# Add the S/MIME import files
hg -R $MC log -r "children($MC_SMIME_IMPORT)" \
--template "{file_dels % 'include {file}\n'}" >>$WORKDIR/convert-filemap.txt
if [ ! -e $WORKDIR/convert-authormap.txt ]; then
hg -R $HGCVS log --template "{email(author)}={sub('%', '@', email(author))}\n" \
| sort -u > $WORKDIR/convert-authormap.txt
cd $WORKDIR
hg convert $HGCVS $OUTPUT --filemap convert-filemap.txt -A convert-authormap.txt
That last command provides us the subset of the CVS history that we need for unified history. Strictly speaking, I should be pulling a specific revision, but I happen to know that there's no need to (we're cloning the only head) in this case. At this point, we now need to pull in the mozilla-central changes before we pull in comm-central. Order is key; hg convert will only apply the graft points when converting the child changeset (which it does but once), and it needs the parents to exist before it can do that. We also need to ensure that the mozilla-central graft point is included before continuing, so we do that, and then pull mozilla-central:
CC_CVS_BASE=$(hg log -R $HGCVS -r 'tip' --template '{node}')
CC_CVS_BASE=$(grep $CC_CVS_BASE $OUTPUT/.hg/shamap | cut -d' ' -f2)
MC_CVS_BASE=$(hg log -R $HGCVS -r 'gitnode(215f52d06f4260fdcca797eebd78266524ea3d2c)' --template '{node}')
MC_CVS_BASE=$(grep $MC_CVS_BASE $OUTPUT/.hg/shamap | cut -d' ' -f2)
# Okay, now we need to build the map of revisions.
cat >$WORKDIR/convert-revmap.txt <<EOF
e4f4569d451a5e0d12a6aa33ebd916f979dd8faa $CC_CVS_BASE # Thunderbird / Suite
7c0bfdcda6731e77303f3c47b01736aaa93d5534 d4b728dc9da418f8d5601ed6735e9a00ac963c4e, $CC_CVS_BASE # Calendar
9b2a99adc05e53cd4010de512f50118594756650 $MC_CVS_BASE # Mozilla graft point
ee719a0502491fc663bda942dcfc52c0825938d3 78b3d6c649f71eff41fe3f486c6cc4f4b899fd35, $MC_EDITOR_IMPORT # Editor
8cdfed92867f885fda98664395236b7829947a1d 4b5da7e5d0680c6617ec743109e6efc88ca413da, e4e612fcae9d0e5181a5543ed17f705a83a3de71 # Chat
# Next, import mozilla-central revisions
for rev in $MC_MORK_IMPORT $MC_EDITOR_IMPORT $MC_SMIME_IMPORT; do
hg convert $MC $OUTPUT -r $rev --splicemap $WORKDIR/convert-revmap.txt \
--filemap $WORKDIR/convert-filemap.txt
Some notes about all of the revision ids in the script. The splicemap requires the full 40-character SHA ids; anything less and the thing complains. I also need to specify the parents of the revisions that deleted the code for the mozilla-central import, so if you go hunting for those revisions and are surprised that they don't remove the code in question, that's why.
I mentioned complications about the merges earlier. The Mork and S/MIME import codes here moved files, so that what was db/mdb in mozilla-central became db/mork. There's no support for causing the generated splice to record these as a move, so I have to manually construct those renamings:
# We need to execute a few hg move commands due to renamings.
pushd $OUTPUT
hg update -r $(grep $MC_MORK_IMPORT .hg/shamap | cut -d' ' -f2)
(hg -R $MC log -r "children($MC_MORK_IMPORT)" \
--template "{file_dels % 'hg mv {file} {sub(\"db/mdb\", \"db/mork\", file)}\n'}") | bash
hg commit -m 'Pseudo-changeset to move Mork files' -d '2011-08-06 17:25:21 +0200'
MC_MORK_IMPORT=$(hg log -r tip --template '{node}')
hg update -r $(grep $MC_SMIME_IMPORT .hg/shamap | cut -d' ' -f2)
(hg -R $MC log -r "children($MC_SMIME_IMPORT)" \
--template "{file_dels % 'hg mv {file} {sub(\"security/manager/ssl\", \"mailnews/mime\", file)}\n'}") | bash
hg commit -m 'Pseudo-changeset to move S/MIME files' -d '2014-06-15 20:51:51 -0700'
MC_SMIME_IMPORT=$(hg log -r tip --template '{node}')
popd
# Echo the new move commands to the changeset conversion map.
cat >>$WORKDIR/convert-revmap.txt <<EOF
52efa9789800829c6f0ee6a005f83ed45a250396 abfd23d7c5042bc87502506c9f34c965fb9a09d1, $MC_MORK_IMPORT # Mork
50f5b5fc3f53c680dba4f237856e530e2097adfd 97253b3cca68f1c287eb5729647ba6f9a5dab08a, $MC_SMIME_IMPORT # S/MIME
Now that we have all of the graft points defined, and all of the external code ready, we can pull comm-central and do the conversion. That's not quite it, though—when we graft the S/MIME history to the original mozilla-central history, we have a small segment of abandoned converted history. A call to hg strip removes that.
# Now, import comm-central revisions that we need
hg convert $CC $OUTPUT --splicemap $WORKDIR/convert-revmap.txt
hg strip 2f69e0a3a05a
[1] I left out one of the graft points because I just didn't want to deal with it. I'll leave it as an exercise to the reader to figure out which one it was. Hint: it's the only one I didn't know about before I searched for the archive points [2].
[2] Since I wasn't sure I knew all of the graft points, I decided to try to comb through all of the changesets to figure out who imported code. It turns out that hg log -r 'adds("**")' narrows it down nicely (1667 changesets to look at instead of 17547), and using the {file_adds} template helps winnow it down more easily.
Labels: mailnews, mozilla
Why email is hard, part 7: email security and trust
This post is part 7 of an intermittent series exploring the difficulties of writing an email client. Part 1 describes a brief history of the infrastructure. Part 2 discusses internationalization. Part 3 discusses MIME. Part 4 discusses email addresses. Part 5 discusses the more general problem of email headers. Part 6 discusses how email security works in practice. This part discusses the problem of trust.
At a technical level, S/MIME and PGP (or at least PGP/MIME) use cryptography essentially identically. Yet the two are treated as radically different models of email security because they diverge on the most important question of public key cryptography: how do you trust the identity of a public key? Trust is critical, as it is the only way to stop an active, man-in-the-middle (MITM) attack. MITM attacks are actually easier to pull off in email, since all email messages effectively have to pass through both the sender's and the recipients' email servers [1], allowing attackers to be able to pull off permanent, long-lasting MITM attacks [2].
S/MIME uses the same trust model that SSL uses, based on X.509 certificates and certificate authorities. X.509 certificates effectively work by providing a certificate that says who you are which is signed by another authority. In the original concept (as you might guess from the name "X.509"), the trusted authority was your telecom provider, and the certificates were furthermore intended to be a part of the global X.500 directory—a natural extension of the OSI internet model. The OSI model of the internet never gained traction, and the trusted telecom providers were replaced with trusted root CAs.
PGP, by contrast, uses a trust model that's generally known as the Web of Trust. Every user has a PGP key (containing their identity and their public key), and users can sign others' public keys. Trust generally flows from these signatures: if you trust a user, you know the keys that they sign are correct. The name "Web of Trust" comes from the vision that trust flows along the paths of signatures, building a tight web of trust.
And now for the controversial part of the post, the comparisons and critiques of these trust models. A disclaimer: I am not a security expert, although I am a programmer who revels in dreaming up arcane edge cases. I also don't use PGP at all, and use S/MIME to a very limited extent for some Mozilla work [3], although I did try a few abortive attempts to dogfood it in the past. I've attempted to replace personal experience with comprehensive research [4], but most existing critiques and comparisons of these two trust models are about 10-15 years old and predate several changes to CA certificate practices.
A basic tenet of development that I have found is that the average user is fairly ignorant. At the same time, a lot of the defense of trust models, both CAs and Web of Trust, tends to hinge on configurability. How many people, for example, know how to add or remove a CA root from Firefox, Windows, or Android? Even among the subgroup of Mozilla developers, I suspect the number of people who know how to do so are rather few. Or in the case of PGP, how many people know how to change the maximum path length? Or even understand the security implications of doing so?
Seen in the light of ignorant users, the Web of Trust is a UX disaster. Its entire security model is predicated on having users precisely specify how much they trust other people to trust others (ultimate, full, marginal, none, unknown) and also on having them continually do out-of-band verification procedures and publicly reporting those steps. In 1998, a seminal paper on the usability of a GUI for PGP encryption came to the conclusion that the UI was effectively unusable for users, to the point that only a third of the users were able to send an encrypted email (and even then, only with significant help from the test administrators), and a quarter managed to publicly announce their private keys at some point, which is pretty much the worst thing you can do. They also noted that the complex trust UI was never used by participants, although the failure of many users to get that far makes generalization dangerous [5]. While newer versions of security UI have undoubtedly fixed many of the original issues found (in no small part due to the paper, one of the first to argue that usability is integral, not orthogonal, to security), I have yet to find an actual study on the usability of the trust model itself.
The Web of Trust has other faults. The notion of "marginal" trust it turns out is rather broken: if you marginally trust a user who has two keys who both signed another person's key, that's the same as fully trusting a user with one key who signed that key. There are several proposals for different trust formulas [6], but none of them have caught on in practice to my knowledge.
A hidden fault is associated with its manner of presentation: in sharp contrast to CAs, the Web of Trust appears to not delegate trust, but any practical widespread deployment needs to solve the problem of contacting people who have had no prior contact. Combined with the need to bootstrap new users, this implies that there needs to be some keys that have signed a lot of other keys that are essentially default-trusted—in other words, a CA, a fact sometimes lost on advocates of the Web of Trust.
That said, a valid point in favor of the Web of Trust is that it more easily allows people to distrust CAs if they wish to. While I'm skeptical of its utility to a broader audience, the ability to do so for is crucial for a not-insignificant portion of the population, and it's important enough to be explicitly called out.
X.509 certificates are most commonly discussed in the context of SSL/TLS connections, so I'll discuss them in that context as well, as the implications for S/MIME are mostly the same. Almost all criticism of this trust model essentially boils down to a single complaint: certificate authorities aren't trustworthy. A historical criticism is that the addition of CAs to the main root trust stores was ad-hoc. Since then, however, the main oligopoly of these root stores (Microsoft, Apple, Google, and Mozilla) have made their policies public and clear [7]. The introduction of the CA/Browser Forum in 2005, with a collection of major CAs and the major browsers as members, and several [8] helps in articulating common policies. These policies, simplified immensely, boil down to:
You must verify information (depending on certificate type). This information must be relatively recent.
You must not use weak algorithms in your certificates (e.g., no MD5).
You must not make certificates that are valid for too long.
You must maintain revocation checking services.
You must have fairly stringent physical and digital security practices and intrusion detection mechanisms.
You must be [externally] audited every year that you follow the above rules.
If you screw up, we can kick you out.
I'm not going to claim that this is necessarily the best policy or even that any policy can feasibly stop intrusions from happening. But it's a policy, so CAs must abide by some set of rules.
Another CA criticism is the fear that they may be suborned by national government spy agencies. I find this claim underwhelming, considering that the number of certificates acquired by intrusions that were used in the wild is larger than the number of certificates acquired by national governments that were used in the wild: 1 and 0, respectively. Yet no one complains about the untrustworthiness of CAs due to their ability to be hacked by outsiders. Another attack is that CAs are controlled by profit-seeking corporations, which misses the point because the business of CAs is not selling certificates but selling their access to the root databases. As we will see shortly, jeopardizing that access is a great way for a CA to go out of business.
To understand issues involving CAs in greater detail, there are two CAs that are particularly useful to look at. The first is CACert. CACert is favored by many by its attempt to handle X.509 certificates in a Web of Trust model, so invariably every public discussion about CACert ends up devolving into an attack on other CAs for their perceived capture by national governments or corporate interests. Yet what many of the proponents for inclusion of CACert miss (or dismiss) is the fact that CACert actually failed the required audit, and it is unlikely to ever pass an audit. This shows a central failure of both CAs and Web of Trust: different people have different definitions of "trust," and in the case of CACert, some people are favoring a subjective definition (I trust their owners because they're not evil) when an objective definition fails (in this case, that the root signing key is securely kept).
The other CA of note here is DigiNotar. In July 2011, some hackers managed to acquire a few fraudulent certificates by hacking into DigiNotar's systems. By late August, people had become aware of these certificates being used in practice [9] to intercept communications, mostly in Iran. The use appears to have been caught after Chromium updates failed due to invalid certificate fingerprints. After it became clear that the fraudulent certificates were not limited to a single fake Google certificate, and that DigiNotar had failed to notify potentially affected companies of its breach, DigiNotar was swiftly removed from all of the trust databases. It ended up declaring bankruptcy within two weeks.
DigiNotar indicates several things. One, SSL MITM attacks are not theoretical (I have seen at least two or three security experts advising pre-DigiNotar that SSL MITM attacks are "theoretical" and therefore the wrong target for security mechanisms). Two, keeping the trust of browsers is necessary for commercial operation of CAs. Three, the notion that a CA is "too big to fail" is false: DigiNotar played an important role in the Dutch community as a major CA and the operator of Staat der Nederlanden. Yet when DigiNotar screwed up and lost its trust, it was swiftly kicked out despite this role. I suspect that even Verisign could be kicked out if it manages to screw up badly enough.
This isn't to say that the CA model isn't problematic. But the source of its problems is that delegating trust isn't a feasible model in the first place, a problem that it shares with the Web of Trust as well. Different notions of what "trust" actually means and the uncertainty that gets introduced as chains of trust get longer both make delegating trust weak to both social engineering and technical engineering attacks. There appears to be an increasing consensus that the best way forward is some variant of key pinning, much akin to how SSH works: once you know someone's public key, you complain if that public key appears to change, even if it appears to be "trusted." This does leave people open to attacks on first use, and the question of what to do when you need to legitimately re-key is not easy to solve.
In short, both CAs and the Web of Trust have issues. Whether or not you should prefer S/MIME or PGP ultimately comes down to the very conscious question of how you want to deal with trust—a question without a clear, obvious answer. If I appear to be painting CAs and S/MIME in a positive light and the Web of Trust and PGP in a negative one in this post, it is more because I am trying to focus on the positions less commonly taken to balance perspective on the internet. In my next post, I'll round out the discussion on email security by explaining why email security has seen poor uptake and answering the question as to which email security protocol is most popular. The answer may surprise you!
[1] Strictly speaking, you can bypass the sender's SMTP server. In practice, this is considered a hole in the SMTP system that email providers are trying to plug.
[2] I've had 13 different connections to the internet in the same time as I've had my main email address, not counting all the public wifis that I have used. Whereas an attacker would find it extraordinarily difficult to intercept all of my SSH sessions for a MITM attack, intercepting all of my email sessions is clearly far easier if the attacker were my email provider.
[3] Before you read too much into this personal choice of S/MIME over PGP, it's entirely motivated by a simple concern: S/MIME is built into Thunderbird; PGP is not. As someone who does a lot of Thunderbird development work that could easily break the Enigmail extension locally, needing to use an extension would be disruptive to workflow.
[4] This is not to say that I don't heavily research many of my other posts, but I did go so far for this one as to actually start going through a lot of published journals in an attempt to find information.
[5] It's questionable how well the usability of a trust model UI can be measured in a lab setting, since the observer effect is particularly strong for all metrics of trust.
[6] The web of trust makes a nice graph, and graphs invite lots of interesting mathematical metrics. I've always been partial to eigenvectors of the graph, myself.
[7] Mozilla's policy for addition to NSS is basically the standard policy adopted by all open-source Linux or BSD distributions, seeing as OpenSSL never attempted to produce a root database.
[8] It looks to me that it's the browsers who are more in charge in this forum than the CAs.
[9] To my knowledge, this is the first—and so far only—attempt to actively MITM an SSL connection.
Posted by Joshua Cranmer at 23:39 1 comment:
Why email is hard, part 6: today's email security
This post is part 6 of an intermittent series exploring the difficulties of writing an email client. Part 1 describes a brief history of the infrastructure. Part 2 discusses internationalization. Part 3 discusses MIME. Part 4 discusses email addresses. Part 5 discusses the more general problem of email headers. This part discusses how email security works in practice.
Email security is a rather wide-ranging topic, and one that I've wanted to cover for some time, well before several recent events that have made it come up in the wider public knowledge. There is no way I can hope to cover it in a single post (I think it would outpace even the length of my internationalization discussion), and there are definitely parts for which I am underqualified, as I am by no means an expert in cryptography. Instead, I will be discussing this over the course of several posts of which this is but the first; to ease up on the amount of background explanation, I will assume passing familiarity with cryptographic concepts like public keys, hash functions, as well as knowing what SSL and SSH are (though not necessarily how they work). If you don't have that knowledge, ask Wikipedia.
Before discussing how email security works, it is first necessary to ask what email security actually means. Unfortunately, the layman's interpretation is likely going to differ from the actual precise definition. Security is often treated by laymen as a boolean interpretation: something is either secure or insecure. The most prevalent model of security to people is SSL connections: these allow the establishment of a communication channel whose contents are secret to outside observers while also guaranteeing to the client the authenticity of the server. The server often then gets authenticity of the client via a more normal authentication scheme (i.e., the client sends a username and password). Thus there is, at the end, a channel that has both secrecy and authenticity [1]: channels with both of these are considered secure and channels without these are considered insecure [2].
In email, the situation becomes more difficult. Whereas an SSL connection is between a client and a server, the architecture of email is such that email providers must be considered as distinct entities from end users. In addition, messages can be sent from one person to multiple parties. Thus secure email is a more complex undertaking than just porting relevant details of SSL. There are two major cryptographic implementations of secure email [3]: S/MIME and PGP. In terms of implementation, they are basically the same [4], although PGP has an extra mode which wraps general ASCII (known as "ASCII-armor"), which I have been led to believe is less recommended these days. Since I know the S/MIME specifications better, I'll refer specifically to how S/MIME works.
S/MIME defines two main MIME types: multipart/signed, which contains the message text as a subpart followed by data indicating the cryptographic signature, and application/pkcs7-mime, which contains an encrypted MIME part. The important things to note about this delineation are that only the body data is encrypted [5], that it's theoretically possible to encrypt only part of a message's body, and that the signing and encryption constitute different steps. These factors combine to make for a potentially infuriating UI setup.
How does S/MIME tackle the challenges of encrypting email? First, rather than encrypting using recipients' public keys, the message is encrypted with a symmetric key. This symmetric key is then encrypted with each of the recipients' keys and then attached to the message. Second, by only signing or encrypting the body of the message, the transit headers are kept intact for the mail system to retain its ability to route, process, and deliver the message. The body is supposed to be prepared in the "safest" form before transit to avoid intermediate routers munging the contents. Finally, to actually ascertain what the recipients' public keys are, clients typically passively pull the information from signed emails. LDAP, unsurprisingly, contains an entry for a user's public key certificate, which could be useful in large enterprise deployments. There is also work ongoing right now to publish keys via DNS and DANE.
I mentioned before that S/MIME's use can present some interesting UI design decisions. I ended up actually testing some common email clients on how they handled S/MIME messages: Thunderbird, Apple Mail, Outlook [6], and Evolution. In my attempts to create a surreptitious signed part to confuse the UI, Outlook decided that the message had no body at all, and Thunderbird decided to ignore all indication of the existence of said part. Apple Mail managed to claim the message was signed in one of these scenarios, and Evolution took the cake by always agreeing that the message was signed [7]. It didn't even bother questioning the signature if the certificate's identity disagreed with the easily-spoofable From address. I was actually surprised by how well people did in my tests—I expected far more confusion among clients, particularly since the will to maintain S/MIME has clearly been relatively low, judging by poor support for "new" features such as triple-wrapping or header protection.
Another fault of S/MIME's design is that it makes the mistaken belief that composing a signing step and an encryption step is equivalent in strength to a simultaneous sign-and-encrypt. Another page describes this in far better detail than I have room to; note that this flaw is fixed via triple-wrapping (which has relatively poor support). This creates yet more UI burden into how to adequately describe in UI all the various minutiae in differing security guarantees. Considering that users already have a hard time even understanding that just because a message says it's from example@isp.invalid doesn't actually mean it's from example@isp.invalid, trying to develop UI that both adequately expresses the security issues and is understandable to end-users is an extreme challenge.
What we have in S/MIME (and PGP) is a system that allows for strong guarantees, if certain conditions are met, yet is also vulnerable to breaches of security if the message handling subsystems are poorly designed. Hopefully this is a sufficient guide to the technical impacts of secure email in the email world. My next post will discuss the most critical component of secure email: the trust model. After that, I will discuss why secure email has seen poor uptake and other relevant concerns on the future of email security.
[1] This is a bit of a lie: a channel that does secrecy and authentication at different times isn't as secure as one that does them at the same time.
[2] It is worth noting that authenticity is, in many respects, necessary to achieve secrecy.
[3] This, too, is a bit of a lie. More on this in a subsequent post.
[4] I'm very aware that S/MIME and PGP use radically different trust models. Trust models will be covered later.
[5] S/MIME 3.0 did add a provision stating that if the signed/encrypted part is a message/rfc822 part, the headers of that part should override the outer message's headers. However, I am not aware of a major email client that actually handles these kind of messages gracefully.
[6] Actually, I tested Windows Live Mail instead of Outlook, but given the presence of an official MIME-to-Microsoft's-internal-message-format document which seems to agree with what Windows Live Mail was doing, I figure their output would be identical.
[7] On a more careful examination after the fact, it appears that Evolution may have tried to indicate signedness on a part-by-part basis, but the UI was sufficiently confusing that ordinary users are going to be easily confused.
Announcing jsmime 0.2
Previously, I've been developing JSMime as a subdirectory within comm-central. However, after discussions with other developers, I have moved the official repository of record for JSMime to its own repository, now found on GitHub. The repository has been cleaned up and the feature set for version 0.2 has been selected, so that the current tip on JSMime (also the initial version) is version 0.2. This contains the feature set I imported into Thunderbird's source code last night, which is to say support for parsing MIME messages into the MIME tree, as well as support for parsing and encoding email address headers.
Thunderbird doesn't actually use the new code quite yet (as my current tree is stuck on a mozilla-central build error, so I haven't had time to run those patches through a last minute sanity check before requesting review), but the intent is to replace the current C++ implementations of nsIMsgHeaderParser and nsIMimeConverter with JSMime instead. Once those are done, I will be moving forward with my structured header plans which more or less ought to make those interfaces obsolete.
Within JSMime itself, the pieces which I will be working on next will be rounding out the implementation of header parsing and encoding support (I have prototypes for Date headers and the infernal RFC 2231 encoding that Content-Disposition needs), as well as support for building MIME messages from their constituent parts (a feature which would be greatly appreciated in the depths of compose and import in Thunderbird). I also want to implement full IDN and EAI support, but that's hampered by the lack of a JS implementation I can use for IDN (yes, there's punycode.js, but that doesn't do StringPrep). The important task of converting the MIME tree to a list of body parts and attachments is something I do want to work on as well, but I've vacillated on the implementation here several times and I'm not sure I've found one I like yet.
JSMime, as its name implies, tries to work in as pure JS as possible, augmented with several web APIs as necessary (such as TextDecoder for charset decoding). I'm using ES6 as the base here, because it gives me several features I consider invaluable for implementing JavaScript: Promises, Map, generators, let. This means it can run on an unprivileged web page—I test JSMime using Firefox nightlies and the Firefox debugger where necessary. Unfortunately, it only really works in Firefox at the moment because V8 doesn't support many ES6 features yet (such as destructuring, which is annoying but simple enough to work around, or Map iteration, which is completely necessary for the code). I'm not opposed to changing it to make it work on Node.js or Chrome, but I don't realistically have the time to spend doing it myself; if someone else has the time, please feel free to contact me or send patches.
Labels: jsmime, mailnews, mozilla


On April 13, 2015, U.S. Citizenship and Immigration Services ("USCIS") announced that nearly 233,000 H-1B petitions were received for fiscal year 2016 which begins on October 1, 2015. The number tops last year's record by more than 60,000 petitions. This is an indication of the number of positions in the US that are a specialty occupation where the US Employer seeks to fill with a foreign worker. As a result of the high number of filings, USCIS conducted a computer-generated random selection process (i.e. lottery) to choose which of the petitions would be considered for an H-1B visa. Given that there are only 85,000 H-1B visas available under the statutory cap, including 20,000 specifically reserved for U.S. Master's degree recipients, thousands of talented foreign workers will be denied the opportunity to live, work in the U.S. and contribute to our society. All non-selected H-1B petitions will be returned to the petitioners, along with the filing fees later in May or June.
USCIS also issued an update to its earlier projection of premium processing timelines for those chosen in the lottery on April 14, 2015, stating that the 15-day processing period for premium processing cap-subject H-1B petitions will begin on April 27, 2015. This start date will apply regardless of the receipt date listed on the H-1B petition receipt notice.
USCIS will continue to accept and process cap-exempt H-1B petitions, including petitions to extend or amend existing H-1B status, change employers, or concurrently work for a second employer.
Interested in filing a cap-exempt H-1B petition? Contact GoffWilson today for assistance. We are the immigration pros.


text:
Pianist Panos Karan in Bach Around the World Part 4: Siberia
Renowned Greek-bo pianist Panos Karan performing 24 Chopin Etudes presented by Keys of Change at Caegie Hall's Weill Concert Hall in New York. (Photo: John Caruso)
SURREY, UK – Greek-born pianist Panos Karan continues his Bach Around the World series with part four of this musical journey as he travels on the Trans-Siberian Railway. Karan said via email, "Trains for me belong to an era when the journey was as important as the destination itself and this 5,500 miles journey from Moscow to Vladivostok takes seven days. It was at the end of that trip, in Vladivostok's children's hospital, in the ICU of the cancer ward that I learned that an audience of one person can be more powerful than thousands."
In the video, Karan performs Bach's Prelude and Fugue No. 4 in C Sharp Minor. The video is available online: https://vimeo.com/user10633114.
The videos of his previous musical journeys to Quito, Luang Prabang in Laos, and Athens, Greece, the city of Karan's childhood, are also available on Vimeo.
In the next musical journey in the series, Karan visits Adelaide, Australia.
More information about Panos Karan is available online: https://www.panoskaran.com.
NASHVILLE, Tenn — It's been a peach of a past year for Justin Bieber, who leads the iHeartRadio Music Awards with nine nominations thanks to his two major collaborative hits of 2021, "Peaches" with Daniel Caesar and Giveon, and "Stay" with The Kid LAROI.
Spotify Says It Will Grant Young's Request to Remove Music
Jury Awards Cardi B $1.25 Million in Defamation Lawsuit