text:
China ready to lift the Great Firewall. Maybe. In part of Shanghai
Posted: September 24, 2013 | Author: hongkongblogger | Filed under: Uncategorized | Tags: censorship, china, facebook, great firewall, hong kong, li keqiang, shanghai, shanghai free trade zone, twitter | Leave a comment
Reports emerged from China today that at first sight seem almost unbelievable: the Communist Party about to lift the Great Firewall and unblock access to Facebook, Twitter and a host of other banned sites.
Then the small print. If the anonymous government sources are speaking the truth, it will be only be relevant to Shanghai Free Trade Zone, a 28 sq km pilot project designed to encourage greater foreign investment in China and open its economy up to the international markets.
"In order to welcome foreign companies to invest and to let foreigners live and work happily in the free-trade zone, we must think about how we can make them feel like at home," one government source told the South China Morning Post.
"If they can't get onto Facebook or read The New York Times, they may naturally wonder how special the free-trade zone is compared with the rest of China."
Now while that seems fair enough, the Communist Party isn't known for its love of unfettered access to the internet – after all the free flow of information online is precisely the sort of thing which it knows will lead to its demise.
So what's this all about? Well, a few things sprung to mind:
China is in the middle of one of the worst crack downs on online freedom anyone can remember, so don't expect this localised liberalisation to spread anywhere else in the Middle Kingdom. The party is very much still for the suppression of any discussion it deems "harmful".
Even if the Great Firewall is lifted in the Shanghai zone, doing so from a technical standpoint will take time, according to Forrester analyst Bryan Wang.
"The network within the free trade zone will exist something like an intranet, which is connected to the international backbone without going through the Great Wall firewall," he told me. "Current infrastructure will not be enough to support the future development. China Telecom or Unicom will need to lay out new fibre in the free trade zone."
The Party giveth and it taketh away. Nothing is confirmed yet, and until state-run media reprint the story, we can probably take it as just a rumour, possibly one designed to increase international publicity for the zone, which is a pet project of new premier Li Keqiang.
The whole free trade zone itself is only a pilot, so we can expect Beijing to bring the Great Firewall crashing back down on the region if its censorship-free internet policy backfires.
On a side note, how will Hong Kong react to the free trade zone?
If the Shanghai pilot is successful, more of them could spring up across China, effectively stealing its thunder as the only truly outward facing, economically liberalised, online censorship-free region in the Middle Kingdom.
Although a free and unfettered internet may soon no longer be a differentiator for Honkers, however, it's likely that its superior IP protection regime, rule of law and business friendly visa system will still tip the balance in its favour for most MNCs.
Microsoft's Windows Phone challenge: selling Nokia-less Lumias in India
Posted: September 19, 2013 | Author: hongkongblogger | Filed under: Uncategorized | Tags: brand Trust report, branding, china, IDC, india, lumia, lumia 520, microsoft, nokia, smartphones, windows phone, windows phone 8 | Leave a comment
A couple of weeks ago I wrote how Asia would be the key to Microsoft's success with its soon to be acquired handset business and Windows Phone. Well, new IDC stats out this week confirmed the importance to Redmond of one of Asia's biggest markets, India, but also that it may struggle without the Nokia brand.
India is now rated by many analysts as the fastest growing smartphone market in the world.
The numbers speak for themselves. The largest democracy on the planet has a population of over 1.3 billion but smartphone penetration of only around 10 per cent – in this it's some way even behind China and has huge growth potential.
The question is who's going to capitalise? Well, at the moment it's the same old story of cheap, local Android handset providers. In India Karbonn and Micromax are two of the most prominent.
Windows Phone was a surprise second place in Q2, however, with a market share of 5.3 per cent, according to IDC. Granted, this is way behind Android's 90+ per cent, but still above iOS and BlackBerry and remember that percentages translate into 500,000+ units.
The key to success going forward, however, will be how it handles the Lumia, according to IDC analyst Kiranjeet Kaur.
She told me that although Nokia sells the Lumia 520, 620, 625, 720, 820, 920 and 925 in India it has been the 520's low price point of around Rs 10,000 (£100) which has made it popular.
Microsoft can't rely on the Lumia range to continue attracting buyers in the future though, because the all important Nokia brand will soon be removed.
"People buy the Lumia because they've had an association with Nokia for many years and see it as a good brand," she said. "But if the [acquisition] deal goes through in the next few months I'm not sure how quickly Microsoft can do the rebranding."
Time will tell whether this makes a big difference. It has to be said that Nokia was far from coasting in India. Despite winning the country's Brand Trust Report for the third year in a row in February, it has been mired by tax problems and slowing sales.
Still, India remains Nokia's second largest market after China, according to IDC, so the next 12 months will be a key test of whether Microsoft can continue the momentum and take on the likes of HTC and Samsung in the mid-range as well as stealing a bit of share from domestic players at the lower end.
It will be an uphill task.
No news is bad news for Apple in China
Posted: September 11, 2013 | Author: hongkongblogger | Filed under: Uncategorized | Tags: apple, china, china mobile, cupertino, forrester, huawei, iphone 5C, iphone 5S, iphone launch, lenovo, meizu, smartphone, xiaomi | Leave a comment
So there it is. Apple's much publicised Beijing iPhone launch event ended. With no news.
It appears that the fruit-themed company, while claiming that China will be its biggest market soon, does not believe it's THAT important. At least yet. All the poor hacks were offered was a video of last night's US launch. Ouch.
More importantly for Cupertino, the prices it has stuck on its new 5C and 5S devices will mean only the most hardy fanboys and girls will want to buy them. The iPhone 5C is definitely not budget, so it will fail to appeal to the mass low-end market currently consuming smartphones in China and India like there's no tomorrow.
A 5C will retail for between 4,488 and 5,288 yuan ($733-864, £466-549). Compare this with the price for the high-end 5S in the US ($649-849) and you can see why some commentators reckon it will fail in the PRC.
It's certainly not enough to beat Xiaomi's impressively spec'd Mi-3 at 1,999 yuan ($326).
Forrester analyst Bryan Wang told me that it needs to come down to 2,999-3,499 yuan in order to "eat up the market share" of the likes of Huawei, Lenovo and Meizu, but that at present prices, the local Android players will be "really relieved".
However, Apple is likely to have left itself some breathing room. It's plan? Test the market out with these inflated prices and then "lower the price after a couple of months".
Apple's other hope of gaining much needed market share in China come from a possible tie up with the world's largest operator, China Mobile, which has over 700 million subscribers.
No announcement was made at the Beijing press "conference" today but Wang believes it will come, when the carrier has a 4G network to announce. The reason? The 5C and 5S both support TD-LTE, a standard China Mobile helped to build.
APAC the key to Micr-okia success
Posted: September 6, 2013 | Author: hongkongblogger | Filed under: Uncategorized | Tags: apac, asha, brands, china, huawei, IDC, india, lumia, M&A, micromax, microsoft, nokia, smartphone, zte | 1 Comment
It was Microsoft and Nokia's big week this week and I'm sure the two will be hoping to hog the headlines going forward as much as they did over the past seven days. Now some might have unkindly described the alliance as "the sounds of two garbage trucks colliding", but I've been getting the low down on why the deal should matter to APAC, or more realistically, why APAC should matter to Microsoft.
Let's get one thing straight, APAC is essential to Microsoft's future success in the smartphone space, not just because it has the world's largest and fastest growing market – China and India respectively – but because Nokia has a really good legacy footprint there thanks to its feature phone biz.
The problem for Redmond, however, is that we're not talking about feature phones any more, but smartphones. These markets are increasingly demanding smartphones, albeit low-end handsets, not feature phones. It's why local players like Huawei, ZTE, Micromax and others are growing at such speed.
Nokia's stock is greatest in India, where it has been voted most trusted brand for two years in a row, despite on-going tax problems with the authorities. Yet according to IDC's Melissa Chau its relationship with operators isn't particularly great anymore, so to large extent Microsoft is going to have to start from scratch here.
Building a budget Lumia will be vital and Chau told me Microsoft could do two things to help achieve this:
Remove licensing charges – at the moment it's built into the cost of the phone – which would wipe about $10 off per handset
Use its combined internal expertise now with software and hardware to tweak Windows Phone so that it can run on hardware specs more suited to a lower price point.
It also needs to sort out Asha, she told me, starting with making the handset more attractive by sticking some Microsoft apps on it, and then hopefully in time transitioning those customers to a low cost Lumia.
This ain't gonna be easy. The competition is fierce out there and with Nokia's star waning and a severe lack of apps in the ecosystem the best Redmond can probably hope for is cementing it in third place behind the deadly duo of iOS and Android. With four of the Lumia's top selling markets in APAC (including no. 1 and 2) however, it must make the region a priority.
Time will tell how successful it is, of course, but time, as we all know, is probably something Micr-okia doesn't have.
Come in Agent Elop, your work is done
Posted: September 3, 2013 | Author: hongkongblogger | Filed under: Uncategorized | Tags: acquisitions, android, apple, CEO, devices and services, finland, M&A, microsoft, microsoft buys nokia, nokia, redmond, RIM, smartphones, stephen elop, steve ballmer, windows phone | Leave a comment
It's finally happened. Microsoft today announced it is buying most of Nokia's mobile phone business for a bargain €5.44bn (£4.62bn) in cash.
The deal will see Redmond snap up the Finnish giant's Devices and Services business for €3.79bn (£3.2bn), license Nokia's patents for €1.65bn (£1.4bn).
It's a dramatic last roll of the dice for outgoing CEO Steve Ballmer and neatly brings back former Redmondite Stephen Elop into the fold.
He'll be stepping aside as Nokia boss to become EVP of Devices and Services, but must be one of the favourites now to succeed Ballmer. If so, this will be one of the most expensive pieces of headhunting in corporate history.
Nokia's chairman of the board Risto Siilasmaa will take the reins as interim CEO while the deal goes through the usual shareholder and regulatory approvals. Microsoft said it expects the transaction to close in Q1 2014, all being well.
For Microsoft the deal is proof if any were needed that it's no longer a software company, that it sees success in the smartphone space as crucial to its future and that it can't rely on a partner like Nokia to deal with the hardware side of things.
A few things occur to me:
HTC and RIM will be pretty disappointed – who are they going to get to buy up their failing businesses now?
Agent Elop has now been recalled after 2 years out in the field persuading Nokia's board to sell to Microsoft. Job done – you may now progress to Microsoft CEO.
China's up and coming smartphone poster child Xiaomi was recently valued at $10bn, nearly $2bn more than Nokia at this sale. Surely over-inflated.
This deal, while it could theoretically ensure phones get out faster to market, is not going to make life any easier for Microsoft or its new Nokia Devices and Services division. Especially in Asia. Its lack of apps will still hold it back.
Is Nokia still Europe's largest technology firm? Over 30,000 staff will now be Microsofties but it still has over 50,000 employees on its books working on the reasonably profitable NSN biz and location services. It should be in pretty good shape.
IDC analyst Bryan Ma told me that the deal would give Microsoft a shortcut or "jump start" into the hardware space, but could end up alienating OEM partners.
"It's got device, manufacturing, economies of scale, and channels to sell into which would have all take it longer to grow organically, as well as valuable patents," he argued.
"My concern is as much as this can help it doesn't solve the biggest problem facing Windows Phone and Windows 8 on tablet and PC – it doesn't have enough apps to make a compelling platform."
Tellingly, Microsoft only devotes one bullet point on the app ecosystem in a mammoth 27-slide presentation explaining its strategic rationale, he pointed out.
Ma added that the deal could end up alienating more OEM partners.
"The whole debate Microsoft got into when it released Surface was that its hardware partners like Acer said it was stepping on their toes. This will raise questions over whether this is more salt in the wounds for them."
As for smartphone OEMs well Windows Phone has very few of those beyond Nokia anyway so it will step on fewer toes, he said.
However, I'd agree with Canalys VP research Rachel Lashford that it's not exactly going to attract any more into the fold either.
"It reminds me of a decade ago when Nokia owned Symbian and tried to license it out but it didn't work out," she told me. I can't think of many OEM vendors would fancy going head-to-head with Microsoft on Windows Phone now.
As for Asia-specific repercussions, well I'll be taking a look at those – and there should be some given Nokia's legacy in India and Microsoft's desire to crack China – in my next post.


An email series for prospective undergraduate students and parents.
Here in Financial Aid, we know that financing your education can be intimidating and confusing. That's why we developed "Financial Aid 101"—an email series designed to help you fully understand the financial aid process at DU. Find past emails and future topics in our series below.
This series is sent automatically to prospective undergraduate students (and their parents) who applied for admission to DU, and who indicated on their admission application that they're interested in receiving need-based financial aid. If you're a prospective student (or the parent of a prospective student) and are currently not receiving these emails but would like to, please contact Lisa Westendorf at [email protected].


Conforme al dilema entre la mezuza y el tapu en la familia, Ombre retrata una relacion compleja entre hija y madre creando asi un efecto de deja-vu, de familiaridad en los lectores que lo identifican inmediatamente como una situacion observada con frecuencia en su propio medio ambiente.
During today's ceremony, rabbis from the Reform, Conservative and Orthodox traditions of Judaism will bless the mezuzas.
Whenever she acquired a new mezuza, she invited friends to dinner to join in a celebration of the event.
A mezuza at the entryway would have helped--but the spot on the doorpost where it might have been placed was empty of marks.
Kunitz to the Stockmals for gifts they sent him over the years of their friendship - for the perfectly preserved parchment blessing from inside a mezuza Mr.
Less than an hour later, someone threw another firebomb at the home of a Jewish family and ripped a sacred mezuza from the door frame.
Dencik attempts to distinguish between practicing Judaism through celebrating Shabbes, keeping kosher, and having a mezuza on your door, and religious beliefs; he argues that one can be a practitioner without being a believer, and that Jewishness is more than mere religion, but shared social, historical, cultural, and ethic traditions and values developed through thousands of years of Diaspora existence.
Another step Jews can take, he said, is to place a traditional mezuza on their doors.
Hunting for a place to raise a family in Thousand Oaks, Debbie Leshon would survey the neighborhoods, looking for one tiny detail - a mezuza, the sign of a Jewish home, on the door.


MĂRȚIȘOR, the celebration of Spring on the first day of March, is – to use a Romanian expression – as ancient as Earth itself. On this day, women receive a gift of a double-threaded red and white string, together with a small trinket – called mărțișor. This mărțișor is worn for the next week, on the lapel. In some parts of the country tradition dictates that the string would then be tied to a flowering tree, so as to bring good luck and a good crop. The colours, red and white, recall a time of pagan beliefs, red symbolising blood and death, and white purity and rebirth.
Over the years, small charms and coins came to be attached to the string. Nowadays the charms take the form of flowers or animals, and can be made of a wide range of materials, from wood and plastic to silver, gold, and precious stones. As March approaches the mărțișor makers gather on the corners of the big public squares exhibiting their wares. A version of this custom is also found in Bulgaria, called Martenitsa, but it involves only a red and white twine being tied to the wrist of people's loved ones.
Read All About It! Profusion News Issue No. 2 is out now! Read about Romanian Spring customs, cultural news and events, and some very handy tips. Plus a short diary of Romania-related cultural events taking place in the UK, and a short portrait of award-winning film director Calin Peter Netzer.
Ultima Oră, Ediție Specială! S-a lansat numărul 2 al buletinului de știri Profusion News! Citiți în acest număr despre: obiceiuri românești de primăvară, știri și evenimente culturale românești sau legate de România, precum și informații foarte utile. Plus, o mică agendă a evenimentelor culturale românești din Marea Britanie și un scurt portret al regizorului Călin Peter Netzer, câștigătorul premiului "Ursul de aur" la ediția din 2013 a Berlinalei. Buletinul de știri Profusion News se distribuie gratuit, pe e-mail. Doriți să-l citiți? Trimiteți-ne un e-mail la adresa ramonamitrica@gmail.com.
Just like classic "heart & dagger" love tattoos, Profusion Crime books are for life, not just for Valentine's Day. Share the love with a little Noir from Eastern Europe.
More about the books here.


SIMSOFT INDUSTRY has developed a powerful natural language dialog manager that interacts with a machine dynamically depending on context. Going beyond a preprogrammed list of questions / responses expected, our dialog manager allows the understanding of a greater number of exchanges and allows the speaker turns to refine a request of an operator or to clarify its response. The user experience has naturally strengthened. Adding an own ontology to a business specializing the dialog manager and makes the virtual assistant SIMSOFT INDUSTRY "intelligent" in its support for the operator.
Speech synthesis allows the machine to speak with the voice and in a very large number of languages. fully configurable (intonation, timbre, debit, accent, man Woman) and able to recreate the voice of a particular person, it humanizes and makes more efficient the traditional man-machine interaction in particular to strengthen understanding instructions or when the voice becomes the only usable modality workstation.
The proactive and intelligent assistant developed by SIMSOFT INDUSTRY adapts to the operator's business, understands their needs and responds to requests on the ground. Relying on a powerful natural language dialog manager, he drives a multimodal interface (voice, tactile, text, diagram, photo, video, 3D) and can support advanced optical detection means, the Internet of Things (IoT) or augmented reality (OUT). The wizard interacts with document databases, actions or knowledge bases (know how) and is able to bring to the operator using a contextualized to the task it is trying to achieve.
The mission of the proactive assistant is to simplify human-system connection in the technological environment of increasingly complex industry that will 4.0 of tomorrow.


"Biggest applause of the night! This crowd is abuzz. That's just awesome! He's got everyone standing.""
CAMERON HUGHES IS THE SPORTS INDUSTRY'S MOST TRUSTED CHOICE FOR ELECTRIFYING CROWDS AT THE BIGGEST SPORTING EVENTS AROUND THE WORLD.


text:
package org.elasticsearch.xpack.security.authc;

import org.elasticsearch.Version;
import org.elasticsearch.action.ActionListener;
import org.elasticsearch.action.support.PlainActionFuture;
import org.elasticsearch.client.Client;
import org.elasticsearch.common.bytes.BytesReference;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.common.util.concurrent.ThreadContext;
import org.elasticsearch.common.xcontent.ToXContent;
import org.elasticsearch.common.xcontent.XContentBuilder;
import org.elasticsearch.common.xcontent.XContentHelper;
import org.elasticsearch.common.xcontent.XContentType;
import org.elasticsearch.common.xcontent.json.JsonXContent;
import org.elasticsearch.license.XPackLicenseState;
import org.elasticsearch.test.ClusterServiceUtils;
import org.elasticsearch.test.ESTestCase;
import org.elasticsearch.threadpool.TestThreadPool;
import org.elasticsearch.threadpool.ThreadPool;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.xpack.core.security.authc.Authentication;
import org.elasticsearch.xpack.core.security.authc.Authentication.AuthenticationType;
import org.elasticsearch.xpack.core.security.authc.Authentication.RealmRef;
import org.elasticsearch.xpack.core.security.authc.AuthenticationResult;
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor;
import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilege;
import org.elasticsearch.xpack.core.security.user.User;
import org.elasticsearch.xpack.security.authc.ApiKeyService.ApiKeyCredentials;
import org.elasticsearch.xpack.security.authc.ApiKeyService.ApiKeyRoleDescriptors;
import org.elasticsearch.xpack.security.authc.ApiKeyService.CachedApiKeyHashResult;
import org.elasticsearch.xpack.security.authz.store.NativePrivilegeStore;
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
import org.elasticsearch.xpack.security.test.SecurityMocks;
import org.junit.After;
import org.junit.Before;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.time.Clock;
import java.time.Duration;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Arrays;
import java.util.Base64;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;

import static org.elasticsearch.xpack.core.security.authz.store.ReservedRolesStore.SUPERUSER_ROLE_DESCRIPTOR;
import static org.hamcrest.Matchers.arrayContaining;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.instanceOf;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.notNullValue;
import static org.hamcrest.Matchers.nullValue;
import static org.hamcrest.Matchers.sameInstance;
import static org.mockito.Matchers.any;
import static org.mockito.Mockito.doAnswer;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

public class ApiKeyServiceTests extends ESTestCase {

    private ThreadPool threadPool;
    private XPackLicenseState licenseState;
    private Client client;
    private SecurityIndexManager securityIndex;

    @Before
    public void createThreadPool() {
        threadPool = new TestThreadPool("api key service tests");
    }

    @After
    public void stopThreadPool() {
        terminate(threadPool);
    }

    @Before
    public void setupMocks() {
        this.licenseState = mock(XPackLicenseState.class);
        when(licenseState.isApiKeyServiceAllowed()).thenReturn(true);

        this.client = mock(Client.class);
        this.securityIndex = SecurityMocks.mockSecurityIndexManager();
    }

    public void testGetCredentialsFromThreadContext() {
        ThreadContext threadContext = threadPool.getThreadContext();
        assertNull(ApiKeyService.getCredentialsFromHeader(threadContext));

        final String apiKeyAuthScheme = randomFrom("apikey", "apiKey", "ApiKey", "APikey", "APIKEY");
        final String id = randomAlphaOfLength(12);
        final String key = randomAlphaOfLength(16);
        String headerValue = apiKeyAuthScheme + " " + Base64.getEncoder().encodeToString((id + ":" + key).getBytes(StandardCharsets.UTF_8));

        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
            threadContext.putHeader("Authorization", headerValue);
            ApiKeyService.ApiKeyCredentials creds = ApiKeyService.getCredentialsFromHeader(threadContext);
            assertNotNull(creds);
            assertEquals(id, creds.getId());
            assertEquals(key, creds.getKey().toString());
        }

        // missing space
        headerValue = apiKeyAuthScheme + Base64.getEncoder().encodeToString((id + ":" + key).getBytes(StandardCharsets.UTF_8));
        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
            threadContext.putHeader("Authorization", headerValue);
            ApiKeyService.ApiKeyCredentials creds = ApiKeyService.getCredentialsFromHeader(threadContext);
            assertNull(creds);
        }

        // missing colon
        headerValue = apiKeyAuthScheme + " " + Base64.getEncoder().encodeToString((id + key).getBytes(StandardCharsets.UTF_8));
        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
            threadContext.putHeader("Authorization", headerValue);
            IllegalArgumentException e =
                expectThrows(IllegalArgumentException.class, () -> ApiKeyService.getCredentialsFromHeader(threadContext));
            assertEquals("invalid ApiKey value", e.getMessage());
        }
    }

    public void testAuthenticateWithApiKey() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String key = randomAlphaOfLength(16);

        mockKeyDocument(service, id, key, new User("hulk", "superuser"));

        final AuthenticationResult auth = tryAuthenticate(service, id, key);
        assertThat(auth.getStatus(), is(AuthenticationResult.Status.SUCCESS));
        assertThat(auth.getUser(), notNullValue());
        assertThat(auth.getUser().principal(), is("hulk"));
    }

    public void testAuthenticationIsSkippedIfLicenseDoesNotAllowIt() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String key = randomAlphaOfLength(16);

        mockKeyDocument(service, id, key, new User(randomAlphaOfLength(6), randomAlphaOfLength(12)));

        when(licenseState.isApiKeyServiceAllowed()).thenReturn(false);
        final AuthenticationResult auth = tryAuthenticate(service, id, key);
        assertThat(auth.getStatus(), is(AuthenticationResult.Status.CONTINUE));
        assertThat(auth.getUser(), nullValue());
    }

    public void testAuthenticationFailureWithInvalidatedApiKey() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String key = randomAlphaOfLength(16);

        mockKeyDocument(service, id, key, new User("hulk", "superuser"), true, Duration.ofSeconds(3600));

        final AuthenticationResult auth = tryAuthenticate(service, id, key);
        assertThat(auth.getStatus(), is(AuthenticationResult.Status.CONTINUE));
        assertThat(auth.getUser(), nullValue());
        assertThat(auth.getMessage(), containsString("invalidated"));
    }

    public void testAuthenticationFailureWithInvalidCredentials() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String realKey = randomAlphaOfLength(16);
        final String wrongKey = "#" + realKey.substring(1);

        mockKeyDocument(service, id, realKey, new User("hulk", "superuser"));

        final AuthenticationResult auth = tryAuthenticate(service, id, wrongKey);
        assertThat(auth.getStatus(), is(AuthenticationResult.Status.CONTINUE));
        assertThat(auth.getUser(), nullValue());
        assertThat(auth.getMessage(), containsString("invalid credentials"));
    }

    public void testAuthenticationFailureWithExpiredKey() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String key = randomAlphaOfLength(16);

        mockKeyDocument(service, id, key, new User("hulk", "superuser"), false, Duration.ofSeconds(-1));

        final AuthenticationResult auth = tryAuthenticate(service, id, key);
        assertThat(auth.getStatus(), is(AuthenticationResult.Status.CONTINUE));
        assertThat(auth.getUser(), nullValue());
        assertThat(auth.getMessage(), containsString("expired"));
    }

    /**
     * We cache valid and invalid responses. This test verifies that we handle these correctly.
     */
    public void testMixingValidAndInvalidCredentials() throws Exception {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        final ApiKeyService service = createApiKeyService(settings);

        final String id = randomAlphaOfLength(12);
        final String realKey = randomAlphaOfLength(16);

        mockKeyDocument(service, id, realKey, new User("hulk", "superuser"));

        for (int i = 0; i < 3; i++) {
            final String wrongKey = "=" + randomAlphaOfLength(14) + "@";
            AuthenticationResult auth = tryAuthenticate(service, id, wrongKey);
            assertThat(auth.getStatus(), is(AuthenticationResult.Status.CONTINUE));
            assertThat(auth.getUser(), nullValue());
            assertThat(auth.getMessage(), containsString("invalid credentials"));

            auth = tryAuthenticate(service, id, realKey);
            assertThat(auth.getStatus(), is(AuthenticationResult.Status.SUCCESS));
            assertThat(auth.getUser(), notNullValue());
            assertThat(auth.getUser().principal(), is("hulk"));
        }
    }

    private void mockKeyDocument(ApiKeyService service, String id, String key, User user) throws IOException {
        mockKeyDocument(service, id, key, user, false, Duration.ofSeconds(3600));
    }

    private void mockKeyDocument(ApiKeyService service, String id, String key, User user, boolean invalidated,
                                 Duration expiry) throws IOException {
        final Authentication authentication = new Authentication(user, new RealmRef("realm1", "native",
            "node01"), null, Version.CURRENT);
        XContentBuilder docSource = service.newDocument(new SecureString(key.toCharArray()), "test", authentication,
            Collections.singleton(SUPERUSER_ROLE_DESCRIPTOR), Instant.now(), Instant.now().plus(expiry), null,
            Version.CURRENT);
        if (invalidated) {
            Map<String, Object> map = XContentHelper.convertToMap(BytesReference.bytes(docSource), true, XContentType.JSON).v2();
            map.put("api_key_invalidated", true);
            docSource = XContentBuilder.builder(XContentType.JSON.xContent()).map(map);
        }
        SecurityMocks.mockGetRequest(client, id, BytesReference.bytes(docSource));
    }

    private AuthenticationResult tryAuthenticate(ApiKeyService service, String id, String key) throws Exception {
        final ThreadContext threadContext = threadPool.getThreadContext();
        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
            final String header = "ApiKey " + Base64.getEncoder().encodeToString((id + ":" + key).getBytes(StandardCharsets.UTF_8));
            threadContext.putHeader("Authorization", header);

            final PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
            service.authenticateWithApiKeyIfPresent(threadContext, future);

            final AuthenticationResult auth = future.get();
            assertThat(auth, notNullValue());
            return auth;
        }
    }

    public void testValidateApiKey() throws Exception {
        final String apiKey = randomAlphaOfLength(16);
        Hasher hasher = randomFrom(Hasher.PBKDF2, Hasher.BCRYPT4, Hasher.BCRYPT);
        final char[] hash = hasher.hash(new SecureString(apiKey.toCharArray()));

        Map<String, Object> sourceMap = new HashMap<>();
        sourceMap.put("doc_type", "api_key");
        sourceMap.put("api_key_hash", new String(hash));
        sourceMap.put("role_descriptors", Collections.singletonMap("a role", Collections.singletonMap("cluster", "all")));
        sourceMap.put("limited_by_role_descriptors", Collections.singletonMap("limited role", Collections.singletonMap("cluster", "all")));
        Map<String, Object> creatorMap = new HashMap<>();
        creatorMap.put("principal", "test_user");
        creatorMap.put("realm", "realm1");
        creatorMap.put("metadata", Collections.emptyMap());
        sourceMap.put("creator", creatorMap);
        sourceMap.put("api_key_invalidated", false);

        ApiKeyService service = createApiKeyService(Settings.EMPTY);
        ApiKeyService.ApiKeyCredentials creds =
            new ApiKeyService.ApiKeyCredentials(randomAlphaOfLength(12), new SecureString(apiKey.toCharArray()));
        PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        AuthenticationResult result = future.get();
        assertNotNull(result);
        assertTrue(result.isAuthenticated());
        assertThat(result.getUser().principal(), is("test_user"));
        assertThat(result.getUser().roles(), arrayContaining("a role"));
        assertThat(result.getUser().metadata(), is(Collections.emptyMap()));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_ROLE_DESCRIPTORS_KEY), equalTo(sourceMap.get("role_descriptors")));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY),
            equalTo(sourceMap.get("limited_by_role_descriptors")));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_CREATOR_REALM), is("realm1"));

        sourceMap.put("expiration_time", Clock.systemUTC().instant().plus(1L, ChronoUnit.HOURS).toEpochMilli());
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.get();
        assertNotNull(result);
        assertTrue(result.isAuthenticated());
        assertThat(result.getUser().principal(), is("test_user"));
        assertThat(result.getUser().roles(), arrayContaining("a role"));
        assertThat(result.getUser().metadata(), is(Collections.emptyMap()));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_ROLE_DESCRIPTORS_KEY), equalTo(sourceMap.get("role_descriptors")));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY),
            equalTo(sourceMap.get("limited_by_role_descriptors")));
        assertThat(result.getMetadata().get(ApiKeyService.API_KEY_CREATOR_REALM), is("realm1"));

        sourceMap.put("expiration_time", Clock.systemUTC().instant().minus(1L, ChronoUnit.HOURS).toEpochMilli());
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.get();
        assertNotNull(result);
        assertFalse(result.isAuthenticated());

        sourceMap.remove("expiration_time");
        creds = new ApiKeyService.ApiKeyCredentials(randomAlphaOfLength(12), new SecureString(randomAlphaOfLength(15).toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.get();
        assertNotNull(result);
        assertFalse(result.isAuthenticated());

        sourceMap.put("api_key_invalidated", true);
        creds = new ApiKeyService.ApiKeyCredentials(randomAlphaOfLength(12), new SecureString(randomAlphaOfLength(15).toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.get();
        assertNotNull(result);
        assertFalse(result.isAuthenticated());
    }

    public void testGetRolesForApiKeyNotInContext() throws Exception {
        Map<String, Object> superUserRdMap;
        try (XContentBuilder builder = JsonXContent.contentBuilder()) {
            superUserRdMap = XContentHelper.convertToMap(XContentType.JSON.xContent(),
                BytesReference.bytes(SUPERUSER_ROLE_DESCRIPTOR
                    .toXContent(builder, ToXContent.EMPTY_PARAMS, true))
                    .streamInput(),
                false);
        }
        Map<String, Object> authMetadata = new HashMap<>();
        authMetadata.put(ApiKeyService.API_KEY_ID_KEY, randomAlphaOfLength(12));
        authMetadata.put(ApiKeyService.API_KEY_ROLE_DESCRIPTORS_KEY,
            Collections.singletonMap(SUPERUSER_ROLE_DESCRIPTOR.getName(), superUserRdMap));
        authMetadata.put(ApiKeyService.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY,
            Collections.singletonMap(SUPERUSER_ROLE_DESCRIPTOR.getName(), superUserRdMap));

        final Authentication authentication = new Authentication(new User("joe"), new RealmRef("apikey", "apikey", "node"), null,
            Version.CURRENT, AuthenticationType.API_KEY, authMetadata);
        ApiKeyService service = createApiKeyService(Settings.EMPTY);

        PlainActionFuture<ApiKeyRoleDescriptors> roleFuture = new PlainActionFuture<>();
        service.getRoleForApiKey(authentication, roleFuture);
        ApiKeyRoleDescriptors result = roleFuture.get();
        assertThat(result.getRoleDescriptors().size(), is(1));
        assertThat(result.getRoleDescriptors().get(0).getName(), is("superuser"));
    }

    public void testGetRolesForApiKey() throws Exception {
        Map<String, Object> authMetadata = new HashMap<>();
        authMetadata.put(ApiKeyService.API_KEY_ID_KEY, randomAlphaOfLength(12));
        boolean emptyApiKeyRoleDescriptor = randomBoolean();
        final RoleDescriptor roleARoleDescriptor = new RoleDescriptor("a role", new String[] { "monitor" },
            new RoleDescriptor.IndicesPrivileges[] {
                RoleDescriptor.IndicesPrivileges.builder().indices("*").privileges("monitor").build() },
            null);
        Map<String, Object> roleARDMap;
        try (XContentBuilder builder = JsonXContent.contentBuilder()) {
            roleARDMap = XContentHelper.convertToMap(XContentType.JSON.xContent(),
                BytesReference.bytes(roleARoleDescriptor.toXContent(builder, ToXContent.EMPTY_PARAMS, true)).streamInput(), false);
        }
        authMetadata.put(ApiKeyService.API_KEY_ROLE_DESCRIPTORS_KEY,
            (emptyApiKeyRoleDescriptor) ? randomFrom(Arrays.asList(null, Collections.emptyMap()))
                : Collections.singletonMap("a role", roleARDMap));

        final RoleDescriptor limitedRoleDescriptor = new RoleDescriptor("limited role", new String[] { "all" },
            new RoleDescriptor.IndicesPrivileges[] {
                RoleDescriptor.IndicesPrivileges.builder().indices("*").privileges("all").build() },
            null);
        Map<String, Object> limitedRdMap;
        try (XContentBuilder builder = JsonXContent.contentBuilder()) {
            limitedRdMap = XContentHelper.convertToMap(XContentType.JSON.xContent(),
                BytesReference.bytes(limitedRoleDescriptor
                    .toXContent(builder, ToXContent.EMPTY_PARAMS, true))
                    .streamInput(),
                false);
        }
        authMetadata.put(ApiKeyService.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY, Collections.singletonMap("limited role", limitedRdMap));

        final Authentication authentication = new Authentication(new User("joe"), new RealmRef("apikey", "apikey", "node"), null,
            Version.CURRENT, AuthenticationType.API_KEY, authMetadata);

        final NativePrivilegeStore privilegesStore = mock(NativePrivilegeStore.class);
        doAnswer(i -> {
                assertThat(i.getArguments().length, equalTo(3));
                final Object arg2 = i.getArguments()[2];
                assertThat(arg2, instanceOf(ActionListener.class));
                ActionListener<Collection<ApplicationPrivilege>> listener = (ActionListener<Collection<ApplicationPrivilege>>) arg2;
                listener.onResponse(Collections.emptyList());
                return null;
            }
        ).when(privilegesStore).getPrivileges(any(Collection.class), any(Collection.class), any(ActionListener.class));
        ApiKeyService service = createApiKeyService(Settings.EMPTY);

        PlainActionFuture<ApiKeyRoleDescriptors> roleFuture = new PlainActionFuture<>();
        service.getRoleForApiKey(authentication, roleFuture);
        ApiKeyRoleDescriptors result = roleFuture.get();
        if (emptyApiKeyRoleDescriptor) {
            assertNull(result.getLimitedByRoleDescriptors());
            assertThat(result.getRoleDescriptors().size(), is(1));
            assertThat(result.getRoleDescriptors().get(0).getName(), is("limited role"));
        } else {
            assertThat(result.getRoleDescriptors().size(), is(1));
            assertThat(result.getLimitedByRoleDescriptors().size(), is(1));
            assertThat(result.getRoleDescriptors().get(0).getName(), is("a role"));
            assertThat(result.getLimitedByRoleDescriptors().get(0).getName(), is("limited role"));
        }
    }

    public void testApiKeyCache() {
        final String apiKey = randomAlphaOfLength(16);
        Hasher hasher = randomFrom(Hasher.PBKDF2, Hasher.BCRYPT4, Hasher.BCRYPT);
        final char[] hash = hasher.hash(new SecureString(apiKey.toCharArray()));

        Map<String, Object> sourceMap = new HashMap<>();
        sourceMap.put("doc_type", "api_key");
        sourceMap.put("api_key_hash", new String(hash));
        sourceMap.put("role_descriptors", Collections.singletonMap("a role", Collections.singletonMap("cluster", "all")));
        sourceMap.put("limited_by_role_descriptors", Collections.singletonMap("limited role", Collections.singletonMap("cluster", "all")));
        Map<String, Object> creatorMap = new HashMap<>();
        creatorMap.put("principal", "test_user");
        creatorMap.put("metadata", Collections.emptyMap());
        sourceMap.put("creator", creatorMap);
        sourceMap.put("api_key_invalidated", false);

        ApiKeyService service = createApiKeyService(Settings.EMPTY);
        ApiKeyCredentials creds = new ApiKeyCredentials(randomAlphaOfLength(12), new SecureString(apiKey.toCharArray()));
        PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        AuthenticationResult result = future.actionGet();
        assertThat(result.isAuthenticated(), is(true));
        CachedApiKeyHashResult cachedApiKeyHashResult = service.getFromCache(creds.getId());
        assertNotNull(cachedApiKeyHashResult);
        assertThat(cachedApiKeyHashResult.success, is(true));

        creds = new ApiKeyCredentials(creds.getId(), new SecureString("foobar".toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.actionGet();
        assertThat(result.isAuthenticated(), is(false));
        final CachedApiKeyHashResult shouldBeSame = service.getFromCache(creds.getId());
        assertNotNull(shouldBeSame);
        assertThat(shouldBeSame, sameInstance(cachedApiKeyHashResult));

        sourceMap.put("api_key_hash", new String(hasher.hash(new SecureString("foobar".toCharArray()))));
        creds = new ApiKeyCredentials(randomAlphaOfLength(12), new SecureString("foobar1".toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.actionGet();
        assertThat(result.isAuthenticated(), is(false));
        cachedApiKeyHashResult = service.getFromCache(creds.getId());
        assertNotNull(cachedApiKeyHashResult);
        assertThat(cachedApiKeyHashResult.success, is(false));

        creds = new ApiKeyCredentials(creds.getId(), new SecureString("foobar2".toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.actionGet();
        assertThat(result.isAuthenticated(), is(false));
        assertThat(service.getFromCache(creds.getId()), not(sameInstance(cachedApiKeyHashResult)));
        assertThat(service.getFromCache(creds.getId()).success, is(false));

        creds = new ApiKeyCredentials(creds.getId(), new SecureString("foobar".toCharArray()));
        future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        result = future.actionGet();
        assertThat(result.isAuthenticated(), is(true));
        assertThat(service.getFromCache(creds.getId()), not(sameInstance(cachedApiKeyHashResult)));
        assertThat(service.getFromCache(creds.getId()).success, is(true));
    }

    public void testApiKeyCacheDisabled() {
        final String apiKey = randomAlphaOfLength(16);
        Hasher hasher = randomFrom(Hasher.PBKDF2, Hasher.BCRYPT4, Hasher.BCRYPT);
        final char[] hash = hasher.hash(new SecureString(apiKey.toCharArray()));
        final Settings settings = Settings.builder()
            .put(ApiKeyService.CACHE_TTL_SETTING.getKey(), "0s")
            .build();

        Map<String, Object> sourceMap = new HashMap<>();
        sourceMap.put("doc_type", "api_key");
        sourceMap.put("api_key_hash", new String(hash));
        sourceMap.put("role_descriptors", Collections.singletonMap("a role", Collections.singletonMap("cluster", "all")));
        sourceMap.put("limited_by_role_descriptors", Collections.singletonMap("limited role", Collections.singletonMap("cluster", "all")));
        Map<String, Object> creatorMap = new HashMap<>();
        creatorMap.put("principal", "test_user");
        creatorMap.put("metadata", Collections.emptyMap());
        sourceMap.put("creator", creatorMap);
        sourceMap.put("api_key_invalidated", false);

        ApiKeyService service = createApiKeyService(settings);
        ApiKeyCredentials creds = new ApiKeyCredentials(randomAlphaOfLength(12), new SecureString(apiKey.toCharArray()));
        PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
        service.validateApiKeyCredentials(creds.getId(), sourceMap, creds, Clock.systemUTC(), future);
        AuthenticationResult result = future.actionGet();
        assertThat(result.isAuthenticated(), is(true));
        CachedApiKeyHashResult cachedApiKeyHashResult = service.getFromCache(creds.getId());
        assertNull(cachedApiKeyHashResult);
    }

    private ApiKeyService createApiKeyService(Settings settings) {
        return new ApiKeyService(settings, Clock.systemUTC(), client, licenseState, securityIndex,
            ClusterServiceUtils.createClusterService(threadPool), threadPool);
    }

}

redpajama_set_name: RedPajamaGithub


text:
‹ Back to all Events
No Small Matter – Chicago Screening Events
June 21 @ 4:00 pm - June 27 @ 8:00 pm
| COST: $8
No Small Matter is the first feature documentary to explore the most overlooked, underestimated, and powerful force for good in America today: early childhood education. Through poignant stories and surprising humor, the film lays out the overwhelming evidence for the importance of the first five years, and reveals how our failure to act on that evidence has resulted in an everyday crisis for American families, and a slow-motion catastrophe for the country.
We invite you to join Join Illinois Action for Children, our partners, and the No Small Matter filmmakers in person
for the Chicago SCREENINGS of No Small Matter
Thursday, June 20 – THURSDAY, JUNE 27, at the Gene Siskel Film Center!
(View the schedule of screening topics and confirmed panelists below.)
There are 24 million children under the age of six in America today. You know how many of them have to be taken care of all day, every day by an adult?
Who provides that care—and how they do it—is the most overlooked, underestimated, and potentially game-changing issue in America today. Directed by an award-winning team of filmmakers, No Small Matter is the first feature documentary to lay out the overwhelming evidence for the importance of the first five years, and to reveal how our failure to act on that evidence has resulted in an everyday crisis for American families, and a slow-motion catastrophe for our country.
Over the last twenty years, a revolution in our understanding of early childhood has led to one, inescapable conclusion: the experiences we have in the first five years of life shape our brains and bodies in profound and lasting ways; it's no longer about "nature versus nurture", but how the two work together to shape who we become.
But even as we've come to understand what kids truly need to thrive, social, economic, and demographic changes have made it harder and harder for parents to give it to them. In order to make ends meet, parents desperately need to find a place to put their kids. But today, in 33 states, childcare for an infant costs more than tuition at a public college, and just 10% of the childcare in America is considered high quality.
No Small Matter brings the case for early childhood education to life in a variety of ways, from high-end 2d graphics, animation, and YouTube videos, to expert interviews and unexpected doses of humor (like Cookie Monster singing "Total Eclipse of the Heart"). But it's the memorable characters that give the story its emotional punch.
As with all early learning settings, the success of that classroom is the result of the relationships between the adults and the children. Like the kids, audiences will fall in love with Ms. Giannini, the wry, tattooed lead teacher of the "Yellow Room", only to be heartbroken to learn that she's leaving at the end of the school year because she simply can't make ends meet, even with a second job as a bartender. The early learning workforce is among the most poorly paid in the country, making less on average than dog walkers and parking attendants. Ms. Giannini's departure is a stark reminder that, first and foremost, investing in young children means investing in the people who teach and take care of them when their families can't. Illinois Action for Children was honored to have Ms. Giannini join us as our Keynote Speaker at our annual public policy and advocacy conference, Spring Into Action, held in April of this year.
No Small Matter is unusual for an issue documentary in that there's no real villain—unlike battles against Big Ag or Big Pharma, there's no "Big Small Child" standing in the way of progress. Instead, the film is more an investment brief than an exposé, an argument that early childhood education is both the most powerful and the most plausible solution we have to begin to address a host of American problems.
Special guests are scheduled to be present for audience discussion at all screenings except for Friday at 4 pm and Sunday at 2 pm.
Friday, June 21 | 4 p.m
Friday, June 21 | 8 p.m. – Early Educators Night!
Moderator – Greg Jacobs, Co-Director
Panelists confirmed:
Rachel Giannini, Early Childhood Advocate
Dan Harris, Executive Director, INCCRRA
Brenda Eiland-Williford, Director, Early Childhood Quality and Impact, Ounce of Prevention Fund
Saturday, June 22 | 3 p.m. – Parents Day (Hear from IAFCs President and CEO, Maria Whelan)
Moderator – Danny Alpert, Co-Director
Maria Whelan, President and CEO, Illinois Action for Children
Yeny Duran, POWER-PAC Illinois
Yolanda Williams, POWER-PAC Illinois
Sunday, June 23 | 2 p.m.
Sunday, June 23 | 5:15 p.m. – Q&A with Directors & Subjects
Moderator – Laura Fallsgraff, Co-Producer
Danny Alpert, Co-Director
Greg Jacobs, Co-Director
Jon Siskel, Co-Director
Rachel Pikelny, Producer
Monday, June 24 | 8 p.m. – Maternal and Child Health Night
Moderator: Greg Jacobs, Co-Director
Confirmed panelists:
Michele Brown, Senior Manager, Illinois Birth to Three Institute at the Ounce of Prevention Fund
Brenda Blasingame, Executive Director, HealthConnect One
Dr. Gina Lowell, Rush University Medical Center
Tuesday, June 25 | 6 p.m. – MOVIE CLUB!
The Business Case for Early Education
Moderator: Rachel Pikelny, Producer
David Sabathne, CEO of the Western DuPage Chamber of Commerce
Shirley Neiman, Bright Horizons UChicago
Wednesday, June 26 | 8 p.m. – Health Care and Early Education
Dr. Mariana Glusman, Chair, Reach Out and Read Illinois
Dr. Colleen Cicchetti, Executive Director, Center for Childhood Resilience (CCR) at Lurie Children's Hospital of Chicago
Thursday, June 27 | 6 p.m. – The Early Education – k12 Continuum
Aneesh Sohoni, Executive Director, Teach for America Chicago
Daniel Montgomery, President, Illinois Federation of Teachers
Google Calendar iCal
https://www.siskelfilmcenter.org/no-small-matter
Gene Siskel Film Center | School of the Art Institute
164 N. State Street, Chicago, IL 60601 United States + Google Map

redpajama_set_name: RedPajamaCommonCrawl


text:
Johanne Defay, Hossegor
Kyuss King, Hawaiian Pro
Join Vans surfer Kyuss King behind the scenes at the Hawaiian Pro, the first jewel of the Vans Triple Crown of Surfing.
Saturday, December 28, 2019 Updated: Tuesday, January 21, 2020
Follow Johanne Defay behind the scenes in France during one of the most important events of her career.
Released 7 months and 1 day ago
Episode 12: Kyuss King, Hawaiian Pro
Episode 13: Malia Manuel, Honolua Bay
Join lululemon and Jeep surfer Malia Manuel behind the scenes at the final stop of the season - the lululemon Maui Pro.
Episode 14: Matthew McGillivray, Vans World Cup
Join McGillivray during his pursuit of 2020 Championship Tour qualification at this year's Vans World Cup at Sunset.
Episode 1: Seth Moniz, Gold Coast
WSL Studios presents the first episode of Sound Waves. Take an exclusive, personal look at Seth's Championship Tour debut on the Gold Coast.


All the honking during the rush hour on the Seal Beach might give you a headache. But it should also remind you to renew your car insurance with a reliable car insurance provider in Seal Beach, this time. Surely you do not want to face grave financial consequences if while driving on the roads of Seal Beach in Orange County, you get involved in an accident.
It is your responsibility to protect yourself and your family against these kinds of financial hassles and for that; you need to purchase a car insurance in Seal Beach from Rais Insurance, that is just right for you.
Enjoy Discounts: Often residents of Seal Beach will find that they are given the benefit of the doubt, and their insurance rates are not raised due to your clean background. Also, if you have been accident-free for say around five years, you are eligible for discounts.
Easy Payment Options: We know that you are very busy, and so they provide you various payment options. You can pay online by either debit or credit card or through your mobile phone.
Our experienced agents will personally help you to get a deal which suits your needs.
We make sure that there is no unnecessary paperwork.
We have designed schemes and policies keeping the needs of each of the Seal Beach residents in mind. If you call us, we assure you that it won't be a waste of your time. Get in touch with us as soon as possible and let us serve you with our best car insurance in Seal Beach only at Rais Insurance.


Ever wonder why Google is definitely the preferred search tool on the net? Could it be because Google is not hard? One search field; one search button… just type in a keyword or maybe more, and visit.
Various coaching websites, particularly people that have more than 20 pages, are difficult to apply and badly organized. That they lose guests simply because they happen to be hard to navigate.
And it is a disgrace if persons leave your site without choosing action. Your prospect list won't develop as quickly, and you'll miss out on sales and client- the better opportunities.
The ideal the navigation makes it easy and fast with regards to prospective clients to hop about your website and perform jobs. And when it could easy, persons do things – like buy products, sign up for teleclasses, and call one to explore nearby. The bottom line? Your business grows.
Thus, you need to organize your content, internet pages and backlinks in a way that answers these problems and complies with the unique requirements of your visitor. As a result, your website becomes user-friendly and easy to use.
Just like a book provides a table of contents, every single website really should have "primary navigation" – the central, most obvious set of links that regulates the website. This is usually found across the top or perhaps down the left of the webpage.
To make certain your primary sat nav is constant, keep it in the same position on each page, and be certain to use the same labels.
It might sound noticeable, but the more quickly and a lot easier it is to discover content and links on your website, the much, very much, much better it can be for you.
This doesn't mean you should link your home page to each single site. That would associated with home page hard to look at. Rather, you should understand the top elements that most of your visitors are looking for and produce finding those activities very easy.
For example , parenthetically you undoubtedly are a new trainer and you do most of the promotion by networking. And, as part of your client-securing strategies, you recommend content to qualified prospects and compel them to download them from your website. Then simply, when it comes to relating, you should set "Articles" inside your primary navigation (mentioned above) and put links to the top one or two recommended articles — right on the property page.
It's also essential to avoid over-organizing your content. For instance, if you've written 8 articles, you don't need three different types in which to organize them. Basically create a person page named "Articles" and list them there.
Furthermore, keep in mind that mainly because the number of clicks to find things on your webpage increases, the longer it takes just for pages to launch — as well as the more probabilities there are just for errors to happen. And the even more errors that occur, the greater chances you will discover for people to get jammed. That's NOT what you want; not with a long taken.
Each page assists a purpose – whether it's to inform the visitor or have them complete a form. When an internet user is hence finished with each page, be sure to lead them on to the subsequent logical 1. Using words like: "Your next step" and tips such as arrows are very beneficial.
For instance , if a visitor has just finished signing up for the newsletter, make certain to send those to a recent article. After they browse an article, invite them to have a look at your backlinks page with respect to other useful websites.
Your website is normally an informational tool, and its particular job is usually to provide site visitors with content material and means to help them.
Certainly, it's essential to organize your internet site from a visitor's perspective and make it easy for them to browse through. But additionally it is vital to ensure the steps taken when using your websites lead the visitor toward your company objectives.
Thus, be sure to keep the business targets in mind within the overall site organization. Help prospective clients receive what they want while getting what YOU want — a win/win.
To insure your website is flow easily to use, accomplish this: Sit down using a friend, essentially someone in the target audience, and watch him or her work with your website. If you find yourself having to make clear things, your web site is probably not as simple to use as it ought to be.
During the period of a year, the worth you get from watching a single person use your website can make a marvelous difference inside your email sign-up rates, original sessions and product sales. Which can easily represent thousands of dollars in corporate.
Create, remember that on the net, ease of use is essential when it comes to websites.
Like a coach trying to convince potential customers that you can help them, it's the duty as being a good leader. You desire that personal message to shine through on your own website. www.annenusselder.nl Produce it easy to use and action-oriented, and you'll discover youself to be meeting – and even surpassing – the expectations.


The uppermost layer of the skin is necrosing and peeling off continuously, the new cells replace them. However this natural reformation process slows down with the progress of the age and because of the different environmental effects hitting the skin. The necrozed cells do not peel off continuously but cohere so the horn layer become lusterless, pale, and tired; small ruptures, wrinkles take shape on it and the formation of the new cells also slows down.
Not too deep wrinkles, former scars disappear with the help of the chemical peel, the state of the pimply skin gets better considerably, the pale, floppy facial skin is reborn, and the skin of the décolletage rejuvenates. During the procedure we remove the outer, necrozed epidermis of the skin with the help of a special substance so the resistance capacity of the skin increases. Its advantage is that it stimulates the lower layers of the skin as well so it has effect there too where actually the problems start.
We recommend chemical peel for those who have many small, surface pimples, their skin is greasy with enlarged pores, they have scars keeping the marks of pimples, their face is pigment stained or they just simply would like to freshen up their facial skin.
At the first meeting you can discuss with your dermatologist what kind of expectations you have in connection to the treatment then after a few examinations your doctor decides whether this method or any other facial rejuvenation procedure brings the best result in your case.
The dermatologist informs you how to groom your skin in the period before the treatment as well as explains what you can expect in the period after the peeling.
The treatment consists of minimum two sessions, and can be repeated every half a year depending on the state of the skin.
What happens during the chemical peel?
Before the treatment the dermatologist cleans and degreases the skin thoroughly then put the selected peeling material on. Following up the reaction of your skin the doctor decides how long the given material should be left on your face, and then washes it off thoroughly. It can be superficial, medium depth or deep peeling, however this latter can be performed only under general anesthesia and we use it rarely because its risks.
The skin reddens right after the treatment but this redness reduces within few days then the skin starts to peel, the intensity of which depends on the skin type. This process requires about 5 days and you should spend these few days home.
You have to come back to the clinic for control on the second week after the peeling where your dermatologist gives you advices what kind of face treatment products you should use in the following days. As it may happen that you need other products instead of the formerly used face cleaners and creams.
The skin is continuously regenerating due to the chemical peeling and it results in a tighter, shinier face skin.


table money plus some so more than worth the trip. There are 25 photos on my FB page if anyone wants to look.
now have a National Health dentist, and they are always changing so no raport with one.
Love the outfit!!!! The ruffled top is adorable!!!!
Hate the dentist! I have a dr appointment today too...luckily not the dentist!
Beautiful outfit like always Maxina!!! I dread the dentist ALWAYS have and ALWAYS will!!! Hope all goes easily for you!!
Glad the show went well and was a success for you!!
I'm the receptionist for a dentist office here in the U.S. and our adult patients get at least 45 minutes each. Wow, four patients per hour...are your teeth even clean afterward?!
Yes they do feel lovely and clean, I see the lady for this we had booked the dentist for check up afterwards, but the dentist had left and they did not tell us until a day or two before lol. So another booked to see another dentist in two weeks time has been made.


text:
Home/Politics/'Don't be deceived by APC's last-minute projects' – PDP's Aderinokun warns people of Ogun Central
'Don't be deceived by APC's last-minute projects' – PDP's Aderinokun warns people of Ogun Central
The People's Democratic Party (PDP) Senatorial candidate in Ogun Central, Chief Olumide Aderinokun has enlightened people to be resolute with their votes in next month's general elections.
Chief Aderinokun made the statement during his engagement at Olambe Community Development Council and Aare Boulwatife Community Development Council (CDC) general meetings in Ifo Local Government Area this week.
The Akinruyiwa of Owu Kingdom lamented about the poor road network in Ifo and lack of government support to communities in the area.
"The state of roads in Ifo Local Government is terrible, it is glaring that the APC government has failed," Chief Aderinokun said. "Our roads and buildings have been gathering dust for years, don't let them deceive you with last-minute projects.
"I can assure you that PDP will make things work better for everyone in this Local Government. Starting with the Local autonomy promised by our governorship candidate, Hon. (Dr.) Oladipupo Adebutu and the empowerment programmes I have for our Senatorial District.
"The young and old are tired of the failure called APC and we must be ready to make corrections by voting PDP across all levels on February 25 for a people-oriented government."
The leadership of the CDCs disclosed that they have received no support from the current government for road grading, water provision or transformers and all developmental projects have been facilitated by contributions of residents.
Earlier in the week, Chief Aderinokun and his entourage visited victims of a fire incident in Abeokuta South Local Government Area after the entire house burnt to ashes in the early hours of Monday.
He supported the affected residents with an immediate relief package of ₦150,000 with assurances of support in the re-construction of the building.
Chief Aderinokun also monitored the collection of permanent voter's card at his Ward 8 in Obafemi-Owode Local Government Area during the week and he applauded the INEC officials for the orderliness.
Naira Redesign Policy: CBN Launches Cash Swap Programme in Rural, Underserved Areas
Daniel Onjeh Condoles BSU Governing Council, Management and Citizens of Benue State on Demise of Prof. Armstrong Adejoh
Atiku Pledges To Reopen All Land Borders As He Campaigns In Kebbi State


Once local jurisdictions adopt the 2009 IRC, blower door technicians are likely to get very busy.
One of the most cost-effective ways of lowering residential energy costs is to reduce a home's air leakage rate, so it makes sense for energy codes to ratchet up air-sealing requirements. The latest (2009) version of the International Residential Code does exactly that.
In addition to these provisions, the 2009 IRC includes further air-sealing requirements in section N1102.4.2.
The items on the air barrier and insulation inspection checklist (see Image 2, below) make sense, although two provisions (the provisions requiring that crawl space walls and the corners of above-grade walls must be insulated) are vaguely worded and therefore ambiguous.
What's All This Hot Air About Air-Sealing Measures?
Rim joists, window headers, and door headers must be insulated.
The code states that the items on this list should — "where required by the code official" — be "field verified" by "an approved party independent from the installer of the insulation." The language leaves some wiggle room, implying that the code official has the discretion to allow a builder to self-certify that these items are complete, or even to waive the checklist requirements altogether.
If a builder chooses the blower-door option, the bar has been set quite low. While Passivhaus builders are aiming for 0.6 ach50, and many energy-efficient builders strive for 1.5 ach50, the building code is satisfied if your home is quite leaky: All you need to show is 7 ach50.
The code is fairly specific about the circumstances of the blower door test. It requires that "testing shall occur after rough-in and after installation of penetrations of the building envelope, including penetrations for utilities, plumbing, electrical, ventilation and combustion appliances." It also specifies which openings should be open during testing (interior doors), which openings should be closed but not sealed (windows, exterior doors, fireplace doors, dampers), and which openings should be sealed (exterior openings for ventilation systems).
However, the writers of the code provision forgot an important detail: the code is silent about who is allowed to perform the test. As written, the code allows anyone to perform a blower-door test. In fact, builders can conduct their own blower-door tests — in effect, they can self-certify the air leakage rate of the home they are building.
In light of this obvious mistake, building code experts are scrambling to present their own interpretations of the new code. One source notes (correctly) that "verification requirements are up to the AHJ" — that is, the "authority having jurisdiction," otherwise known as your local building official. Of course, that's true — local code officials have always had broad authority to interpret the code as they see fit.
According to DeWein, at least one state — New York — caught the code error before incorporating sections of the 2009 IRC into the New York building code and included a provision requiring a qualified third-party technician to perform the referenced blower-door test.
It's nice to see the IRC join the IECC in the air-sealing requirements. The state of Georgia last year passed a new energy code (http://hub.am/bPEXiz) that disallows the visual inspection to demonstrate compliance. Every new house must have a Blower Door test.
As for who can do the testing in Georgia, they decided to keep it loose now. Builders can test their own work, but first they have to get certified as Duct & Envelope Tightness (DET) Verifiers (http://hub.am/gR0WJC). It's a start.
Martin, I thought one of the conditions of accepting DOE Weatherization $ as part of the stimulus package was states accepting funds are required to adopt the latest IRC code. What is the timeline for state adoption of the 2009 IRC , what about 2012 IRC and IECC? I checked energycodes.gov and they are showing about 2/3 of the states adopting 2009 IRC by 2015, sounds kind of pokey. We will have 2 new code cycles by then.
"The state of Georgia last year passed a new energy code (http://hub.am/bPEXiz) that disallows the visual inspection to demonstrate compliance. Every new house must have a Blower Door test."
That's fabulous news for me as I'm planning to build here in GA.
But earlier this year two new subdivisions opened locally for buyers in the $300k range. Given the market locally I wondered at the logic and imagined they were doing something "new" -- i.e., up my alley. They had their first open houses in late March, a finished unit and 3 more on the way.
I left disgusted. They were big, and they were all framed and insulated -- without any sign of sealing either in the framing envelope or in the crawlspaces. These are, according to the code revisions Allison witnessed being passed, subject to the 2009 IRC.
This week I plan to stop by the Planning Dept in the same county. While I'm there I think I'll stop by the Code Enforcement office upstairs to ask when their training will begin.
As in the case of the TARP money that was handed out to banks and was not accounted for, so goes much of the money from the Recovery and Reinvestment Act. Many cities around the country received the money without following the mandates, and follow-up supervision and accountability of the funds was lax. In response to Joe, I find your sarcasm regarding code officials a bit disconcerting. As a Building Official in the State of Connecticut (21 years), as well as a Designer and Builder (36 years), an accredited Green Professional with the NAHB, and presently achieving LEED accreditation, it is my opinion that one does not get the result they are looking for with sarcasm and negative criticism.. Joe do the Building Officials in your municipality approach you with a sarcastic, condescending attitude toward your projects, your training, or your certifications and intellect? If they do then they are not doing their job correctly as code officials, educators, and facilitators of the letter and intent of the codes. If they do not, then it makes one appear quite shallow and adversarial presenting a condescending attitude toward them. Primarily though, it does very little in promoting an integrated harmonious process between you and the officials of your local municipality. States are just catching up on the training aspects of the new IRC 2009 & 2012, IECC 2009 & 2012. Building department budgets for code books and training facilities have been devastated by the economy. Adoption of the codes is always behind schedule, and in many instances reactive as opposed to proactive. That is no excuse for any of us not understanding the technical aspects of our jobs. Besides being a builder, what are your credentials? The ICC has offered free training for the IECC 2009 in all states, have you taken it? They even give you a copy of the code book and workbook. Instead of the "sheesh", if you already have not done it, you would be better served to educate yourself in the ICC family of codes. Also maybe you should get accredited in the field of green building through USGBC or the NAHB or one of the many excellent local grass roots organizations found around the country. That would be something "new" and up your "alley". At that point you would be able to speak from an "educated" platform instead of one without any intellectual foundation except negativity and criticism.
Washington has its own energy code, modeled on the IECC. The airtightness requirement is not volume based (ACH) but is derived from square footage of floor area. It sets the bar at *roughly* 5 ACH50 for a house with 8-foot ceilings, but houses with higher ceilings get a break because their volume is larger for a given footprint.
I need to check back and see what the AHJ here is requiring as to who does the test. It may be that a builder can self-certify.
"Joe do the Building Officials in your municipality approach you with a sarcastic, condescending attitude toward your projects, your training, or your certifications and intellect?"
Not at all, Edward. Nor would I ever speak that way to them. On the other hand, I wasn't talking to them but expressing my chagrin that they apparently accepted these traditional (in the sense of inadequate and outmoded) buildings without a fair-thee-well ... nor upgrades in any area. But I will inquire, as I said, because I want to enthusiastically support the direction of the code changes (in case they've been running into reluctance or resistance), and I want them to know that a resident of the county who wishes to build a new home is eager and anticipating the progress which only THEY can assure.
I never said, nor meant to imply, that they have an easy job of it. I know better.
In the interest of disclosure, Edward, I'm sorry if my comment was misleading ... I'm not in any sense a pro -- I'm here at GBA as a consumer with just the learning attitude you suggest I should have. And while I'm not a contractor, or anything more than an amateur who has muddled through other home building adventures, I think as a consumer (and taxpayer) I'm in an ideal position to support, encourage, and even be a little insistent that steps be taken to insure progress and responsible environmentalism ... as specified by code.
I apologize if my comments seemed to dismiss the problems or difficulties of officials or anyone else in the trades as I have nothing but admiration for the skill and knowledge y'all have to be successful. All the same, in my own career I've never been given a "pass" just because I found it hard to adapt to new technology or methods or standards.
Your impression is basically correct. The energy efficiency funds that were part of the stimulus bill were handed out with the understanding that states would adopt the 2009 IRC, but there really weren't any teeth in the legislation.
The last time I wrote a blog about energy codes, Mike DeWein commented on the issue. "We know that some states have adopted the code but have done nothing to ensure implementation," said DeWein. "There were great amounts of money in the Recovery Act for energy efficiency — funds that were handed out to all the states. They all took that money. While there wasn't any great set of teeth to the Recovery Act preconditions, it was understood that the states were supposed to adopt the 2009 code and meet compliance goals by 2017."
The building inspectors here were able to get a day's worth of training on the new energy code requirements, including blower door testing, courtesy of Washington State U's energy program, which has done the same thing many other places in the state. While I agree they should know the latest and greatest, I do not envy them the task of trying to educate builders and others on how to build better buildings. I find myself in that position sometimes now, and there are a lot of guys out there who don't want to do anything differently, no matter how easy or important it is.
I have been teaching classes for the last year and a half on how to comply with the new codes here in Washington State. To date, only a handful of builders have taken the classes, and even fewer code officials. The problem seems to be two-fold; most builders don't have a new home to build right now, so the codes are strictly academic, and the local jurisdictions don't have the funds to send what staff they have left (which is less than half what they had two years ago) to take the classes.
Many builders seem totally unaware that there have been changes to the code that will significantly impact they way they do business. Whenever the economy starts to turn around, and builders start building homes again, I expect to see huge (but hopefully ineffective) push-back on the new blower-door requirements, and many other elements of the new codes. For now, ignorance seems to be bliss.
I have a different take on the new housing slowdown and the adoption of more restrictive energy codes. More and more I see the large production builders offering energy efficiency packages for new homes. The market is so tight and buyers so fickle, energy efficiency is viewed as a marketing advantage. If new home buyers equate efficiency with quality construction this puts the builder in a stronger selling position.
Marketing advantage, or lip service?
I see the same thing you do, almost. I see the big builders paying lip service to energy efficiency, while continuing to do what they always do best, build the same old stuff for the lowest possible cost. I will grant you that there are a select few big builders doing an outstanding job of cranking out very high quality, very energy efficient homes, but these are the exception, not the rule. We have not yet done a good enough job educating homeowners on what they should be able to expect in the way of energy efficiency to really see that change.
Professional code officials understand that educating the public is as much of a responsibillity as educating staff'. Builders will cooperate willingly if they're 1)given time to adjust pricing and contracts and train trade partners, 2)able to pass increased costs on to consumers, and 3)not subject to unnecessary delays. These are reasonable expectations, and code officials can facillitate them all. Testing of systems, and the authority to set the testing conditions and other requirements, are settled policy familiar to building inspectors in most places, and the disincentives for providing fraudulent test results are substantial. Traditionally, the one-time owner-builder is a much more problematic player than professional contractors.
All, Good string of comments on the state of IECC 2009 code adoption and enforcement. Since 7ACH50 is the (huge, except in the case of very small houses.) leakage metric, someone has to figure out the accurate volume of the house that's being tested. Personally, that's no easy task for lg custom homes w/ vaulted ceilings, dormers and so forth. Is the basement or conditioned attic volume included? As a rater, I follow RESNET guidelines, but what about those doing testing that don't know the guidelines. Also, Don't forget the 09 also requires duct testing when any portion of the ductwork is outside of conditioned space.
The code compliance path does not fork, sometimes.
First, I think that the testing option should be the only option. Few things impact energy efficiency as drastically as air sealing, and none as effectively for the dollar spent. The fact is, even in high enforcement areas, such as mine (southeastern Pa), Chapter 11 is not fully enforced. For instance, If ducts are installed in non-conditioned space, R-8 ductwork is required and so is a duct blaster test (N1103.2.2 #1.) I have seen the R-8 ducts, but I talk to a lot of builders, inspectors, and building performance specialists in the course of a day, and testing is not widely enforced. So, if enforcement is stepped up on at least thes homes with ducts in attics, basements or crawls, then I see this as the perfect opportunity to sell the testing path of the envelope (blower door) as the proper equipment will likely already be on site. This is probably the single most important item in the IRC that can affect real change to building performance. Once builders get used to air leakage testing, the 7ach50 number can be revised downward. Visual inspection will never be able to do this.
Secondly, as a point of clarification to an earlier post, New York does not adopt IRC in its entirety, but publishes their own statewide building code (through ICC), which looks a lot like IRC for residential construction.
There is a lot of good information on this site but for someone like myself that wants to do some of his own work building a house it all sound like a catch 22. You have to hope the person you get to do the blower door test (if you can find one) wont gouge you because you are completely at their mercy. It is in my best interest to build a sound cost effective house but having to depend on a certified technician that is also in the business of charging you to "fix the problems" is like the fox watching the hen house. From what I can see in Washington state the fees for test range for 75$ plus 50$ per hour to fix problem to 250$ to set up the test, and to fix the problems with rates up to thousands of dollars. Its like the State of Washington is more interested in looking like they doing something rather then adjudicating the problems with the millions of older housing that are leaking heat like a screen door i.e. an academic 2 dimensional solution to a 3 dimensional problem. It's new construction and ultimately the new consumer that will pay the bill.
Although it's certainly possible to build a house without conducting a blower-door test, such houses are usually leaky and expensive to heat and cool. Investments in air sealing and testing ultimately pay for themselves in lower energy bills.
In many parts of the country, the cost of blower-door testing is subsidized for builders enrolled in the Energy Star Homes program. In some areas, blower door tests are free for Energy Star builders. You should contact your local Energy Star Homes program representative to see if such subsidies exist in your area.
My wife and I have decided not to apply for a building permit at this time thank you all for your input but because of the uncertainties of the law and our inability to budget for the costs we just can not go forward. From what we can gather the cost for the blower door test is between 150 and 500 per test but there is no limit to how many times we will have to have the test to comply 1, 2, 5 no one can say. Then there are cost for foam caulk tape to seal and labor to seal every crack according to the state of Washington's new energy code 502.4. plus the upgrade of all doors and windows the uncertainties of cost is just to great. The project is scary enough with out the thought of spending weeks and thousands of dollars on test after test its all to much. This to me signals the end to the owner / builder because of the inability to budget for ramifications of unforeseen number of tests.
Like you, I am an owner/builder. To build a house, you either have to learn certain skills -- mixing concrete, rough carpentry, roofing, and air sealing -- or you have to hire a contractor who has those skills. And yes, you have to budget for all of these things.
If your budget isn't quite large enough for a home-building project, that's perfectly understandable. But the problem isn't the blower-door test. After all, the blower-door test is designed to help you lower costs, because the test will result in an energy-efficient building that will save you money for years.
Perhaps you can design and build a smaller, more affordable house. If you do, be sure to build it tight! You'll be glad you did.


How To View Sideways Pictures Right Way Up!!
Forum issue on android ?
Private messages possibly not working?
How to Purchase PT Gifts and receive them!!
How to post pics without doing an edit to get them full size!
How to view another users Album?
how to get notified of social group post's?
How to Start a New Thread!!


For our current Geospatial Portal project, using Portal SDK, we need to be able to manipulate/customise the options menu for layers in the legend.
Currently the customer is not keen on the way the "Layers" tab arranges the layers, but at the same time the "Categories" tab options menu, for each layer, lacks the "Translucency" option.
I can't seem to find any suggestions that the option menu can be manipulated via the API or any examples on how to do it via customising files.
Be able to add e.g. translucency to the legend item options menu in categories tab.
Be able to hide unused legend item options menu items.
Could you please advice us on how we can achieve this?
I have taken a look at the examples - thank you. However, one requirement is that this functionality would have to (or at least preferred to) be done without building/rebuilding sources as the current solution is "straight out of the box" only using the API from the SDK.
Is there a way around the serverside controls for the context menu? Are there any events that we could take advantage of, to override the default context menu being opened - so that we could show our own custom ExtJS menu?
P.S. Why is the transparency bar not present in the categories tab in the first place? Seems like it is the only one missing, comparing to the layers tab. It is also missing for analysis layers.


text:
HomeNewsTamil Solidarity AGM: Reviewing 2016 – looking forward to 2017
December 16, 2016 senan News
Report of the Tamil Solidarity annual general meeting
By Piriyasha
Tamil Solidarity's annual general meeting (AGM) took place on Saturday 10 December at Unite the Union's building in London. It consisted of two ram packed sessions. The first was the annual report of the activities throughout the year, plans for 2017 and the election of a new National Coordinating Committee. The second consisted of a discussion about the latest developments in India, including the 'demonetisation' policy of Narendra Modi, and the situation in Sri Lanka.
The day began with opening remarks by Bharathi as chair. Keerthikan gave the report of 2016, including helping to initiate the Refugee Rights campaign which is being led by Tamil refugees and being supported by Tamil Solidarity. It is an important breakthrough in the community and a campaign that is seen to give more confidence to the refugees to fight back.
There were also contributions made about the student work progress that was taking place – with specific reference to SOAS, Queen Mary's and the University of Sheffield. An increasing interest and desire to get back involved is developing among students again.
The high media presence of young Tamil Solidarity activists of has also been noted by the community and made a positive impact in support of what the campaign stands for. In addition, Tamil Solidarity played an important role in support of Jeremy Corbyn's election – and re-election – as Labour Party leader.
The trade union work conducted for the past year was elaborated on by Isai Priya who was able to identify the trade unions who have and who continue to affiliate with the Tamil Solidarity campaign. The trade union movement, which organises over six million workers across Britain, highlights the fact that they are the natural allies of the Tamil people and other oppressed sections in our society.
This important link was reinforced by the solidarity greetings and addresses given to the AGM by Dave Hunt, London and South East regional organiser for the Bakers Food and Allied Workers Union (BFAWU), a trade union organising low-paid workers in food and hotel. Kumaran Bose, a BFAWU activist fighting against victimisation by his bosses, also spoke at the AGM. As did Hugo Pierre, from the executive of Unison Black Members group – Unison is the largest public-sector union in Britain.
In the finance report, where the accounts were presented, explained and agreed, the high level of financial commitment, and of volunteer work, was highlighted. Tamil Solidarity has a strong tradition of giving importance to finance – our income coming from regular donations and subs from workers, students, refugees, etc., and through affiliations from trade unions, and not from big businesses. It's important that more finance is collected for more work to be done.
Nadesan outlined the plans for 2017 which was a proposal of four main topics. These included continuing our support for the Refugee Rights campaign, increasing our work with the trade unions and in colleges, and developing a new campaign to demand the release of political prisoners in Sri Lanka, among other demands.
The session concluded with Manny Thain introducing proposals for the National Coordinating Committee (NCC), which were voted on and agreed by the AGM. As Tamil Solidarity has developed more responsibilities are being taken on by a wider group of people – and these are now reflected on the NCC. It was an important session, maintaining the campaign's open democratic structure and process, allowing members and trade union affiliates to discuss issues and decision-making.
The second half was a riveting discussion, co-led by Jagadish Chandra, from the New Socialist Alternative, India, and a founder in 2009 of the campaign Stop the Slaughter of Tamils – the predecessor of Tamil Solidarity. He spoke about demonetisation of cash within India by Modi, and other developments in that country. Senan, international coordinator of Tamil Solidarity, talked about the situation in Sri Lanka and the lack of an alternative for the oppressed members of Sri Lanka. The floor was then opened for questions and contributions which made this session all the more engaging.
In summary, the success of the year in Tamil Solidarity is evident in the increase in contributing members and a successful opening of the Refugee Rights Campaign. It can be concluded that it has been a positive year for Tamil Solidarity and the success is expected to continue next year.
Thanks for ntamilnews.com for the pictures
Refugee Rights Public Meeting – Video and Pictures included


text:
Plants for Pollinators: Culver's Root
By Justin Wheeler on 24 May 2017
Justin Wheeler
This post is part of an ongoing series highlighting some of the best plants for pollinators from coast-to-coast. Drawing from our books 100 Plants to Feed the Bees, Gardening for Butterflies , and our Monarch Nectar Plant Guides.
Culver's Root
Veranicastrum virginicum spp.
Culver's Root has largely been ignored by beekeepers and gardeners, but has seen a surge in popularity amongst native landscapers drawn to its unique and ethereal towers of blooms. For pollinators, the bloom period fills an important gap – flowering in late May to early June, when spring ephemerals have petered out and mid-summer flowers haven't yet opened. The densely flowered spikes can reach up to 6 feet in height and are mobbed with all manner of bees when in bloom, and often a few butterflies as well. Honey bees seem particularly drawn to the flowers suggesting the nectar is of high-quality.
Culver's Root stands tall amongst ornamental grasses on New York City's High Line.
Culver's root demands full sun except when grown in hotter southern areas where it will tolerate some afternoon shade. If grown in a location that is too shady it has a tendency to "flop" and may need support. It prefers semi-moist soil and should not be allowed to dry out. After blooming, the plant produces interesting seed heads that may be left in place to be enjoyed by birds, or deadheaded to encourage a second late-season bloom. Several cultivars are available including 'Diane', with a more compact growing habit and 'Lavender Towers' with dense purple flower spikes.
Native Range: Culver's root is native across most of eastern North America from the plains to the east coast and from northern Canada through Florida.
Best For: Providing an important source of nectar in late spring/early summer.