Why yet another LDAP-based user management system?
All other similar products/projects focus on making data easily available everywhere and therefore are not suitable for really strict security/confidentiality requirements. Also other systems do not have a distinct data model for person / multi-user-account relationship.
What's the official name of the project and why I see those strange characters?
The official name is Æ-DIR to be distinguishable from any other project (and to challenge Unicode capabilities of software). AE-DIR is the official pure-ASCII representation.
Only capital letters are used in both representations when occuring in documentation.
Lower-cased letters are used for DNS names (e.g. ae-dir-p1.example.com and the default search base ou=ae-dir.
Æ-DIR seems complex. How to start with a simple setup for my very few systems?
You can install the system and start with one zone and a single host/service group for all your systems pointing to a single user group. Later you can extend that to your growing needs by adding more host/service and user groups and by moving hosts/services.
Can Æ-DIR server run on name-your-favourite-OS-here?
Æ-DIR is not limited to run on Linux. Provided you have packages of all the required software it could be installed on various OS platforms. But note that tweaking the automated ansible installation to run on different platforms is much work.
Can I use another LDAP server software for Æ-DIR?
No. Æ-DIR makes heavy use of OpenLDAP's access control. To best of my knowledge other LDAP server implementations do not provide similar powerful access control (despite by implementing custom server-side plugin). If you have different opinion/suggestion please let me know.
I prefer to install only packages shipped by my Linux (enterprise) distribution. Why are OpenLDAP packages from different repositories installed?
Æ-DIR has quite a complex OpenLDAP configuration which requires to have recent bug fix releases (see also OpenLDAP FAQ-O-MATIC).
Can I use another search base than ou=ae-dir?
Can I migrate my current user management to Æ-DIR?
On each Æ-DIR provider a CRON job exports the databases to LDIF files with command-line tool slapcat(8) (see also OpenLDAP Admin Guide). How often this happens, where the files are stored and how long they are kept around can be configured with ansible vars openldap_backup_cron_args, openldap_backup_path and openldap_backup_max_days.
Is there an API for bulk operations?
The official API for programming Æ-DIR is LDAPv3 (see RFC 4510). Access control rules and constraints in OpenLDAP configuration prevent your client role to access/alter entries in an invalid way.
A ready-to-use module is available for Python.
I always get an error message insufficientAccess when I try to delete a user or a group. What's wrong?
Nothing's wrong. It works as designed.
User names, group names and numeric POSIX Id must never be reused. This is enforced by unique constraints and therefore deletion of user and group entries is prevented by ACLs. Set the status to "archived" (2) to make the entries invisible even for the zone admins.
Why is the SSH key of a user entry not a self-service attribute?
Managing so-called authorized keys for SSH access to your servers requires that the authenticity of the keys is reliably checked to meet security requirements like NISTIR 7966, section 5.2 . If users would be able to add SSH keys themselves the SSH authentication would only be as strong as the password authentication. Thus the zone admin responsible for a certain user has to check with some out-of-band process that the public key really belongs to this user and only the user has control over the private key.
How to report list of active users?
In web2ldap you can export search results as CSV or Excel files (see example exporting with web2ldap).
Additionally there are two ready-to-use command-line tools which simply outputs CSV to stdout but can only be used by role Æ Admin.
Any client example configurations available?
Yes. Check out the directory client-examples/.
Why do the client examples not use group authorization (e.g. memberOf filter)?
The goal is to keep client configuration dumb. This makes it possible to change access rights (solely by changing entities' relationship) in the directory without touching the client configuration.
Is the netgroup map supported by Æ-DIR?
Æ-DIR is designed to replace netgroups completely by leveraging host/service groups referencing user groups as login groups (via attribute aeLoginGroups).
Are nested groups supported by Æ-DIR?
No, because of bad performance. Furthermore you will loose oversight over nested groups sooner or later. Try understanding/leveraging the power host/service groups referencing user groups which serves the same purpose in most practical cases.
I'm too lazy to add groups etc. Can I directly assign rights to a user account?
No! You always must add host/service groups and assign the rights to them to user groups. Think about it a few minutes. It makes sense!
Can I use another LDAP GUI client (e.g. Apache Directory Studio)?
While using any LDAP client (e.g. Apache Directory Studio) is certainly possible it will be rather uncomfortable for daily Æ-DIR maintenance resulting in a waste of your work time. web2ldap installed on each Æ-DIR provider has special customization (LDIF and HTML templates, plugin module) which greatly helps users to just do the right thing. In opposite non-customized clients typically require lots of clicks even for simple tasks, and do not know about Æ-DIR schema, thus probably leading to errornous input data.
Does every application integrated with Æ-DIR stick to its fixed role model?
If you are using shared infrastructure components it is very useful to simply use the Æ-DIR roles (e.g. Setup Admin) for access control in your infrastructure.
But if that model does not fit security requirements of a specific application you can simply maintain groups in Æ-DIR and map those to specific roles within your application just like with any other LDAP server.
Can I setup a Æ-DIR test instance without having to issue TLS certs?
No! In production you must use TLS anyway. So you should use your test environment to get familiar with it right from the start.
Can I let admins impersonate as a user for testing some issues with the user's access rights?
No! That's bad practice regarding audit logs! The admin should add a test user for himself with the very same groups membership and use this for testing.
When using two-factor authentication (2FA) is it possible to distinguish whether password or OTP input was wrong?
No! Both of these authentication factors are checked at once and this succeeds or fails. Æ-DIR deliberately does not tell the end user which authentication factor was wrong. This avoids the authentication factors being attacked separately.
However there are more detailed error messages written to system log on the Æ-DIR providers which can be examined by the authorized Æ-DIR sys admins if needed.
So you cannot delete users. How to comply to privacy / data protection rules, e.g. EU GDPR?
In default configuration the user names are generated as short random strings without personal naming information. So it's impossible to directly have a reference to a person just by looking at a username, e.g. by reviewing archived log files.
The attribute aeStatus is used to adjust visibility of person records and user accounts. This allows to preserve the data for enforcing global ID uniqueness and for complying to audit requirements while limiting access to a small group of people to meet privacy requirements.
How to find the owner of an object (entry)?
Although widely used the term "owner" is pretty blurry in real-life.
In Æ-DIR each entry resides within a zone and zones are used for delegation. Therefore finding the respective zone admin(s) of the object's zone is a good approach to find the currently responsible "owner(s)".
How to find the privileged users?
"Privileged" is yet another blurry term which oversimplifies access control to a single security class.
Basically access rights (for regular client access) are granted to user groups. So the current group membership of an account defines whether it has to be considered privileged. Note that the result is not a simple yes/no decision. The privileges have always to be reviewed carefully within a particular service context.


text:
Armie Hammer - The Social Network - 9/20/10
Aaron Sorkin—The Social Network, A Few Good Men—9/20/10
Aaron Sorkin made a major splash in 1989 with the Broadway debut of his play A Few Good Men. Hollywood immediately took notice, hiring Sorkin to adapt his play into a hit film. Sorkin went on to script The American President and Charlie Wilson's War, among others, and to create the television series Sports Night, The West Wing, and Studio 60 on the Sunset Strip. He also returned to Broadway in 2007 with his play The Farnsworth Invention, about the creation of television. Sorkin's latest screenplay, for David Fincher's The Social Network, also deals with invention—namely, the creation of the mega-popular social networking website Facebook. Sorkin met the press during a barnstorming college tour that saw him (along with Jesse Eisenberg, Andrew Garfield, and Armie Hammer) visiting Stanford and U.C. Berkeley; I spoke to him at Berkeley's Claremont Hotel.
Aaron Sorkin: I'm Aaron Sorkin. It's good to meet you.
Groucho: I'm Peter.
AS: Peter…
G: All right.
AS: Go ahead. Beat me up.
(Both laugh.)
G: I'm sure this will probably be put up for, and get, a nomination for adapted screenplay, but I was intrigued to discover that you technically didn't really adapt the book. You worked in parallel with Ben Mezrich. So can you talk a bit about that process and what you felt was important to research?
AS: Sure. I wouldn't want to reduce Ben's role. I don't think there'd have been a movie if Ben hadn't come along with a fourteen-page book proposal for The Accidental Billionaires. So that book proposal—his publisher was shopping it around to the studios to get a simultaneous film deal. That's how it wound up in my hands. And I said—I think I said "yes" on page three, or something. But you're right. I assumed that the studio would want me to wait until the book was written before I adapted it, that I'd start my work in about a year. They wanted me to start right away, so Ben and I were researching at the same time, writing at the same time. I really, I had no idea what he was going to write. He had no idea what I was going to write. And we met two or three times to share some information and, you know, just tell each other what we knew. I approached it from a slightly different angle, I think, than he did, but like I said, if Ben hadn't done what Ben did, we wouldn't be sitting here today.
G: What was most important to you to research as opposed to, you know, using your imagination based on the facts that were already in front of you?
AS: Well, there was really two different kinds of research. There was the available research out there that anybody could get their hands on, and then there was the first-person research: talking to the people who are characters in the movie, talking to people who aren't characters in the movie but were very close to the event and close to the subject. And what became clear was that there were two lawsuits brought against Facebook at roughly the same time, that the defendant, the plaintiffs, and the witnesses came into the deposition room, swore an oath, and what we came away with was three very different versions of a story. And so instead of picking one and deciding, "Well, I think that's the truth. That's the story I'll tell," or picking one and deciding, "I think that's the juiciest. That's the story I'll tell," what I liked was that there were three different versions of the story. And that the movie—I would tell all three. I would keep moving from point of view to point of view, whether it's the Winklevosses or Mark or Eduardo. And have the movie not take a—Rashomon-like—and have the movie not take a position on what the truth was and let those arguments happen in the parking lot. There was nothing in the movie that was invented for the sake of making it sensational. There was nothing in the movie that was Hollywood-ized. There are a couple cases where when it didn't matter at all, I conflated two characters. There are three cases where I changed a character's name. One of those characters we never actually see; it's an off-screen character. In the other two cases it's just there was no need to embarrass this person more. You have the exact same movie and the exact same truth if you don't do that. So don't do that. And that's it. And then the rest is whatever anybody does when they're writing nonfiction, you know? If you look at The Queen, Peter Morgan wrote a brilliant script there, but Peter Morgan wasn't in Queen Elizabeth's bedroom when she was talking to her husband about their daughter-in-law. You have to be a writer there and write a scene. Speaking of Peter Morgan, same thing with Frost/Nixon. Or William Goldman writing All the President's Men. He didn't even know who Deep Throat was, much less what he said. So you imagine those scenes in the garage. We—I, and then we, when David Fincher came along, actually had much more factual information than in any of those movies that I just mentioned. In fact, I'll give you a very small example. Early in the movie—right, we have a break-up scene with Erica and Mark in a bar, and then Mark goes back to his dorm room and he begins drinking, blogging, hacking, creating Facemash. Facemash goes viral and crashes the Harvard computers. All the while we're cutting to this punch party at the Phoenix house that's sort of in Mark's mind. That's what's on the other side of the glass that my nose is pressed up against. And I have Mark's blog from that night, which we hear almost verbatim in the movie as a voiceover as he's typing. I say almost verbatim only because I didn't change anything, I just shortened it a little bit so that it would fit in the space that I needed. And we know that he was drunk because he says in his—he tells us so. He says in his blog, "I'm pretty intoxicated. I won't lie to you. So what if it's only ten o'clock." And so on. And so in writing the scene, the intoxicated part, I had him in the script—he walks into his dorm room, walks into the frame, turns on the computer, walks out of the frame, comes back, the glass goes down, ice goes in the glass, vodka goes in the glass, orange juice goes in the glass, and as begins typing, "Erica Albright is a bitch." Okay. Shortly before—right before photography started, we found out that it was beer that he was drinking that night. And specifically what kind of beer he was drinking. So David Fincher said, "Okay. We're not going to do that. He's going to go to, you know, a little mini fridge in his dorm and he's going to take out a beer." I said, "David, come on. It's—drunk is drunk. That's the important part. That he was drunk." The screwdriver is just more cinematic, with the ice cubes going in, and this kind of thing, than just opening up a beer, which isn't particularly interesting. He said, "I don't care. If we know that it was beer and we know that it was this kind of beer—" I can't even remember—like Tecata or—now I can't remember what kind of beer [Ed. It was Beck's]. "That's what it's going to be." But two things that you can take away from that story. One: that's how much we cared about not making stuff up; two: it should tell you something—the fact that we know what kind of beer he was drinking on Tuesday night in October seven years ago should tell you something about how close our research sources were to the subject and the event.
G: Yeah, yeah…[Yours is] an actor's perspective, too, isn't it?
AS: Well, then there's a whole other thing—
G: Well, your perspective, as an actor.
AS: Yes, I'm also thinking about that, too. But since you raise the subject of actors. It helps that Jesse Eisenberg is playing the part. He is a sensational young actor who never asks the audience to like him. And I have to say that if—Jesse's about to be a movie star, but he wasn't when we cast him in this part. And there are a lot of movie stars—frankly there are a lot of directors and a lot of studios—who would have insisted that "Hang on, this character isn't lovable. Okay, he's not—we like the cuddly nerds from the eighties, okay? And if this guy isn't that, at the very least you have to open the movie with a scene of Mark being ten years old and his father beating him brutally with a stick and abusing him so that we'll forgive him this stuff." There was never any of that from Jesse, from Fincher, from the studio, anybody. We were just going to own this guy, these guys, and this situation…
G: This [title]'s got that lovely wordplay with Paddy Chayevsky.
AS: Yes, well you just named my hero, but it is—The Social Network is one of those titles that's meant to mean more to you after the movie than before.
G: You were once accused of writing as if you were perpetually on a first date with a girl you wanted to impress.
AS: Yes.
G: And I thought, you know, with this movie you dramatized that appraisal in that first scene.
AS: That's exactly right. And it doesn't work out very well, does it?
G: Well, I was going to ask—you know, it kind of goes back to what I was asking before. I mean, you trained as an actor, and it seems you have to sort of—you need to empathize with all of the characters as you write the script, right?
AS: Yeah. You can't not like the characters that you're writing...Even with, quote unquote, a "bad guy." You have to write them as if they're making their case to God why they belong in heaven. Just as Jack Nicholson does on the witness stand in that big speech. I mean, this is a guy who, clearly this is the villain of the thing, and he makes this speech about how it was probably a good idea that this guy was killed. And we all kind of sit there and go, "I tell you, you got a point." Um, so the—back in the day when I was studying acting, I think that what—the biggest thing that that helps me do now is I think that even if I write a story that stinks, where the structure just falls apart and nothing works, I think at least I'm writing dialogue that actors could say because I'm playing all the parts while I'm doing it and I'm—
G: You're giving it that authenticity of voice.
AS: It's also just that I love the sound of dialogue so much. My parents took me to plays starting from when I was very little. And lots of times they took me to see plays that I was too young to understand like Who's Afraid of Virginia Woolf? when I was eight years old. And so I wouldn't know—I wouldn't understand the story that was going on, but I loved the sound of the dialogue. It sounded like music to me. And I really wanted to imitate that sound, of just words crashing into each other, and speeches. It really—it follows the same pattern as the movements of a symphony and I wanted to imitate that sound.

redpajama_set_name: RedPajamaCommonCrawl


Sewing together two pieces of crocheted fabric can seem a little bit daunting. But don't fret! This tutorial will show you a very easy method of joining using an invisible seam. You don't even have to be good at sewing to achieve this clean, professional finish!
If you search around, you'll find a few different methods of producing invisible seams. While all of these methods will work, I'm going to show you my favorite: the mattress stitch. It's a lot like lacing up a pair of shoes and is easy to learn.
For the tutorial, I used a contrasting color to give you a good visual of how the crocheted pieces are being joined and where the joining yarn is going. When you seam your own pieces, it's best to use a yarn color that will blend in.
Cut a piece of yarn that's about 3 time the length of the edge you'll be seaming. Thread your tapestry needle with the yarn that you will use to join.
Hold your pieces of fabric together with the wrong sides together.
Insert the tapestry needle into the first stitch of the piece closest to you, moving the needle from back side to front side.
Pull the yarn through. Leave a small tail, about 1″ to 2″.
Insert needle into the first stitch of the crochet piece farthest from you, from the back of the work to the front of the work.
Pull yarn through, leaving a bit of slack between the two pieces of fabric.
Moving from right to left, insert the needle into next stitch in the crochet piece closest, again from the back of the work to the front of the work. Pull yarn through, leaving some slack.
Insert needle into the next stitch on the crochet piece farthest, from the back of the work to the front of the work, leaving some slack. Starting to see a pattern?
Continue to alternate inserting the needle from back to front on the crochet piece closest to you and then on the crochet piece farthest from you.
Once you have a few stitches sewn together, grab both tail ends of the yarn and pull tight. This will create the invisible seam.
Continue to sew the pieces together using the method above and pulling the yarn tails tight to create the invisible seam. You'll see that the teal colored yarn I used to join these squares is barely visible in the finished project.
After you've completed all the sewing, secure both ends by knotting and weaving in ends.
Measure the length of the area you plan on sewing, and cut about three times the amount of yarn. This ensures you have enough yarn to join and weave in ends.
When working with different colored motifs or pieces of fabric, don't stress about color — after all, it's called an invisible seam for a reason! Use a yarn color that matches either of the pieces.
As you go, pull the yarn tails tight after every few stitches. If you wait until the end, the yarn may be more difficult to pull tight to create that nice invisible seam.
On some motifs, there may be a tricky section where you fastened off. It usually looks like there are two stitches, but there's only one true stitch is joining. Count the stitches to ensure you don't end up with uneven joins.
Depending on how a garment is constructed, there may be a place to seam for the shoulder and/or sides. This seaming method works very well with garments to create seamless shoulders and sides.
Some hats are made by crocheting a rectangle before seaming together the sides to create a hat. Having an invisible seam will leave you wondering where the seam of the hat really is!
If made in various colors, granny squares and motifs may be difficult to join. Using the invisible seam method to sew them together will allow you to seam many colors without seeing the joining yarn color.
Now that you have a clear picture of how to join two pieces of crochet together in an easy and seamless manner, you can feel confident in tackling your next project that involves seaming any two pieces of crocheted fabric together!
Great post! Any idea where I can find the pattern for the granny square shown? Thanks!
Great stitch. Looking forward to surfing the site further.


Our favourite booking agency Lookout, who holds wonderful artists as Xinobi, Mustang, Moullinex, C90s, GLOVES, Black Strobe, Flight Facilities and many more nice ones (sorry for not mentioning you here) has made a nice mixtape. The mixtape consists of acts from Lookout and holds some new and exclusive tracks. Perfect to cook me and my friends a disco dinner while listening to this and perfect for you to dance to.


We decorated our gingerbread house the other night and my daughter thought it was such a hoot! We let her go for it and do it completely how she wanted. Here are a few of my favorite gingerbread ideas that have caught my eye so far this year. Also, have you seen these adorable gingerbread house invites? They would be perfect for a gingerbread house party. Are you going to decorate a gingerbread house or any gingerbread treats this year?
Love that tiny chair outside the camper. Such an adorable little detail!
Hilarious! We had a gingerbread building competition at my work this week. It was great to see everyone one so creative. I turned mine into a bird house.
Those are amazing! I love the camper.
thanks for the post! i love it.
WHAT?! these are so creative...i love the laptop.
You find some really great things!
I love it. Thinking outside the gingerbread box.
Looks like your having so much fun in making this.
i get very christmas-nostalgic here in italy so i will definitely be making a gingerbread house!
p.s. your house came out so cute! love the door!
I love the gingerbread camper- it would be fun to have everybody decorate their own, and you could have a whole camp!
We built our gingerbread house this weekend. I burnt my finger on the hot sugar mix. The kids decorated it and had a great time. Next time I'll get the icing sugar consistency right so that everything doesn't slide off it half an hour later!
I needed a good laugh...the camper is just the medicine...lovely!!!
These are soooo sweet! I love it!
Love these ideas :) Great post!
The camper is the best, hilarious!
I made gingerbread snowflake cookies yesterday that came out fantastic! Instead of the traditional gingerbread men, I cut out snowflakes and then used icing to pipe on different patterns and then sprinkled them with sugar so they'd sparkle like ice. I got the idea from Real Simple last year and finally tried it out.
I remember making gingerbread houses at a neighbor's house when I was younger. There were 5 of us kids making houses altogether and we had a whole village when we were done!
That caravan is so funny!
Love these! I did a post with the cutest gingerbread on a cup. So fun for a party!
Those are too cute! Lovely blog!


NEW YORK (AP) — Cyber Monday is turning into Cyber Month.
It is still expected to be the biggest online shopping day again, as it has been each year since 2010. That is good news for retailers after a Thanksgiving weekend that saw fewer shoppers and lower spending than last year, according to some estimates. Mobile traffic, which includes smartphones and tablets, has accounted for about 38 percent of all online traffic, compared with 30 percent a year ago. Average order value was $131.66, flat with 2013.
Forrester analyst Sucharita Mulpuru said retailers could be playing it safe on deal offers since shoppers have been conditioned to head online to look for sales on Monday.
Courtney Lane Greenley, 25, from Alexandria, Virginia, was feeling regret Monday that she didn't buy a knife block and cutlery earlier in the week, when she saw better deals online. Amazon was running a limited-time "lightning offer" for some Rachael Ray cookware on Friday under $100, but on Monday the same products cost more than $100.
"I should have pulled the trigger earlier," she said. Greenley didn't think she would make the purchases on Monday.
Jack Kananian, of Brunswick, Ohio, 31, was more satisfied with his purchase. He waited months to buy a computer because he wanted to wait for Cyber Monday deals. He found one on HP's mobile site and bought it via his smartphone on Monday, a computer with a touch screen for $550 marked down from $800.
"I've been taking a look at different prices, but I bought it once I saw the deal, it was the best price I saw by far," he said.
On Monday, Gap and Banana Republic offered 40 percent off all purchases. Amazon offered up to 45 percent off some Samsung TVs and a deal later in the day for its Amazon Fire TV video streaming box marked down to $69 from $99.
Wal-Mart said it has doubled its Cyber Week deals to 500 compared with last year, including up to half off some TVs, tablets and toys with free-shipping offers. Wal-Mart is also rolling out new deals later in the day in its so-called "Evening Edition" round of deals, including a Straight Talk Moto E Android Phone for $9.99, 90 percent off its regular price.
The name "Cyber Monday" was coined in 2005 by the National Retail Federation's online arm, Shop.org, to encourage people to shop online. After retailers revved up deals, it became the busiest online shopping day in 2010. The name was also a nod to online shopping being done at work, where faster connections made it easier to browse, less of a factor now.
This Cyber Monday comes after a weekend that saw 5.3 percent fewer shoppers and 11 percent less spending, according to estimates by the National Retail Federation.
Research firm comScore said late Sunday that e-commerce spending for the first 28 days of the November and December shopping season totaled $22.7 billion, up 15 percent from last year. Sales jumped 32 percent to $1 billion on Thanksgiving Day and 26 percent on Black Friday to $1.51 billion. The firm expects people to spend about $2.5 billion on Cyber Monday alone.
The NRF predicts 126.9 million people will shop online this year, down 4 percent from last year. It has forecast overall holiday sales will increase 4.1 percent to $616.9 billion in 2014.
In Asia and Europe, Black Friday and Cyber Monday have increasingly been used as marketing ploys by retailers, even though Thanksgiving isn't celebrated. In Asia, Singles Day, which occurs on Nov. 11, still is by far the biggest shopping day, with sales of $9.3 billion this year. That's bigger than U.S. sales of Thanksgiving through Cyber Monday combined.


When Scottish-born artist Paul Gardner came to the USA, he was bowled over by the scenery of the Southwest and, completely on his own, without artistic mentors or models to depend on he began a series that at first appeared three-dimensional and scientific rather than artistic. For two decades Gardner has been seeking to translate the endless and varied compositions of the planet using actual soil, different types of paint, glass, stones, and assorted objects that portray earth, wind and fire, terrain, water, river rocks, and tide pools. Entitled "Elements," this retrospective proves that persistence pays off. Gardner transformed his European training to realize his goal of finding ways to reveal how the earth is itself a work of art. In the process of continual exploration and never losing sight of his goal, the work has moved from being geological to distinctly aesthetic, a new form of landscape. As the exhibition is hung chronologically by series, it is evident that his latest work is remarkable. Where once he worked cautiously, treading slowly in new territory, he now applies paint and assorted media with expertise and assurance. Gardner shows, in his current output, that he is on to something very special, an originality that is nothing less than breathtaking.


Loftus RW, Robinson AM, Dexter F. Methicillin-Resistant S. aureus has Greater Risk of Transmission in the Operating Room than Methicillin-Sensitive S. aureus. Am J Infect Control 2017 (In Press).
Hadder B, Patel HM, Loftus RW. Dynamics of Intraoperative Klebsiella, Acinetobacter, Pseudomonas, and Enterobacter (KAPE) Transmission. Am J Infect Control 2018(In Press).
1431: Microbial Contamination of Today's Operating Room Environments. IARS 2018 Annual Meeting and International Science Symposium, April 28 – May 1, 2018. Chicago, Illinois.
Loftus RW, Dexter F, Robinson AM. High Risk S. aureus Transmission in the Operating Room; a Call for Widespread Improvements in Perioperative Hand Hygiene and Patient Decolonization Practices. Am J Infect control 2018 (In Press).
Loftus RW, Robinson AM, Dexter F. Methicillin-Resistant S. aureus has Greater Risk of Transmission in the OR than Methicillin-Sensitive S. aureus. Am J Infect Control 2018 (In Press).


text:
Q: Disabling a widget using angularjs I have four buttons:
<button ng-disabled = "isDisabled1" ng-click="someFunc('isDisabled1')"></button>
<button ng-disabled = "isDisabled2" ng-click="someFunc('isDisabled2')"></button>
<button ng-disabled = "isDisabled3" ng-click="someFunc('isDisabled3')"></button>
<button ng-disabled = "isDisabled4" ng-click="someFunc('isDisabled4')"></button>

Now when click event fires on any one of the button it calls the someFunc() function and inside that function I want to disable the button that was clicked.
I am doing this inside the controller:
$scope.someFunc(toDisable){
    $scope.toDisable = true;
}

But that does not work. Any idea how. I am new to AngularJS.

A: Use an map to store value
Ex : $scope.isDisabled={
isDisabled1:false,
isDisabled2:false,
.
.
.
}
and in
$scope.someFunc(toDisable){
$scope.isDisabled[toDisable]= true;

}

A: An alternative and simple way to do this is to use the ng-click directive to evaluate an expression that will manipulate the variable used in the ng-disabled directive.
e.g.
<button ng-disabled="ds1" ng-click="ds1 = true">btn1</button>
<button ng-disabled="ds2" ng-click="ds2 = true">btn2</button>
<button ng-disabled="ds3" ng-click="ds3 = true">btn3</button>
<button ng-disabled="ds4" ng-click="ds4 = true">btn4</button>

Associated plunker here.

redpajama_set_name: RedPajamaStackExchange


text:
Q: Tls Error while configure MQTT in awsiot mosquitto_sub --cafile rootCA.pem --cert cert.pem --key privateKey.pem -h a3380wclf1r5nk.iot.ap-southeast-2.amazonaws.com -p 8883 -q 1 -d -t lights/things/things01 -i thing01
Error: Unable to load client key file "privateKey.pem".
   Unable to connect (A TLS error occurred.).
Please help in this i am stuck


Is having a DAC all that important?
Hello everyone. I just recently built my first gaming pc and was doing some research for a good set of headphones. I think I'm sold on Audio Technica's ATH-ADG1x. After reading some reviews I keep hearing about "DAC" with plenty of people basically saying it's a necessity. I do want a great gaming experience, I'm very much into FPS games but I play a wide variety. I would also like to enjoy movies/ music on my PC. How important is this "DAC"? I am just now leaving the console peasantry so bear with me.
Thank you for the info! I really appreciate it. The reviews I read must have been written by complete audiophiles because they all acted as if you NEEDED a DAC!


Convention used to dictate that mixing metal colors in jewelry was a no-no. However, fashion is about creativity, breaking barriers and setting new standards. Our mixed white and yellow gold rings exemplify a more modern construct. You can find 14KT gold rings and 18KT gold rings. One intricately crafted ring features an unearthly blue sapphire gemstone expertly set among alternating symmetrical swirls of white and yellow gold. The other ring's focus is 19 shimmering, near colorless diamonds, creating an instant and modern classic! Pair either ring with any of our other yellow gold jewelry to complete a contemporary, yet timeless look!


text:
Rose Kennedy Schlossberg (born June 25, 1988) is an American actress, the oldest child of Caroline Kennedy, and first-born grandchild of John F. Kennedy. She is a 2010 graduate of Harvard University. Schlossberg has been described as a look-alike of her maternal grandmother, First Lady Jacqueline Kennedy Onassis. In 2016, Schlossberg, along with Mara Nelson-Greenberg, co-launched End Time Girls Club, an end time-apocalyptic web series on YouTube.

Early life
Schlossberg was born on June 25, 1988, at Weill Cornell Medical Center in New York City, New York, to designer Edwin Schlossberg and Caroline Kennedy, the oldest and only surviving child of U.S. President John F. Kennedy and his wife First Lady Jacqueline Bouvier Kennedy Onassis. She was named after her maternal great-grandmother, Rose Kennedy. Schlossberg has two younger siblings, Tatiana and  Jack. Schlossberg's mother is a Catholic of Irish, French, Scottish, and English descent, while her father comes from an Orthodox Jewish family of Ukrainian descent. She was raised in her mother's religion, but also observes Jewish traditions, holidays and holy days.

During her early childhood, Schlossberg attended Brearley School on the Upper East Side of Manhattan. In first grade, she went on a school field trip to the American Museum of Natural History accompanied by her grandmother, Jacqueline Kennedy Onassis. "She was the only grandparent in the group," said a father whose daughter was in the same class as Schlossberg.

In 1999, Schlossberg's uncle John F. Kennedy Jr., with whom she was close, died in a plane crash.

Education
In 2006, Schlossberg enrolled at Harvard College in Cambridge, Massachusetts where she earned a bachelor's degree in English studies, took film courses, and cultivated an interest in fashion. She graduated in 2010, going back to school a year later—at New York University's Interactive Telecommunications Program (ITP) —earning a Master of Professional Studies in 2013.

Career
In 2016, Schlossberg co-launched a comedy and end time-apocalyptic web series with Mara Nelson-Greenberg, titled End Times Girls Club, produced by Above Average Productions. The series follows two twentysomething young women, Bee (portrayed by Schlossberg) and Lara (portrayed by Nelson-Greenberg), as they give women comic tips to surviving the apocalypse. "It came up as a response to seeing the way that New York City responded to Hurricane Sandy, and how people were grossly underprepared – specifically, girls in damsel in distress mode," Schlossberg told Mashable. "I thought it would be interesting to create this world where girls have to be survivalists without compromising their cute factor."

Politics
During the 2008 United States presidential election, Schlossberg donated to Barack Obama's 2008 campaign and volunteered for Democrat Alan Khazei's campaign for the United States Senate in the 2010 special election in Massachusetts.

References

External links
End Time Girls Clubweb television series official website, in which Schlossberg portrays main character Bee.

1988 births
Living people
20th-century American actresses
21st-century American actresses
American people of English descent
American people of French descent
American people of Irish descent
American people of Scottish descent
American people of Ukrainian-Jewish descent
Bouvier family
Kennedy family
Harvard University alumni
New York University alumni
American women comedians
Actresses from New York City
American Roman Catholics
American YouTubers
American web series actresses
Brearley School alumni
21st-century American comedians
People from the Upper East Side

redpajama_set_name: RedPajamaWikipedia


text:
Chadwick Boseman (/ ˈ b oʊ z m ə n /; November 29, 1976 – August 28, 2020) was an American actor, playwright, and screenwriter hailing from Anderson, South Carolina. He graduated from Howard University and went on to study at the British American Dramatic Academy in Oxford. Boseman's play "Deep Azure" was nominated for a 2006 Joseph Jefferson Award for New Work. His breakout role was playing the lead Jackie Robinson in 2013's 42.
Boseman was best remembered for portraying T'Challa/Black Panther in the Marvel Cinematic Universe. He has portrayed the character in Captain America: Civil War (2016), Black Panther (2018), Avengers: Infinit...read more
Black / African Descent
Chadwick Boseman is known for:
Following the events of Age of Ultron, the collective governments of the world pass an act designed to regulate all superhuman activity. This polarizes opinion amongst the Avengers, causing two factions to side with Iron Man or Captain America, which causes an epic battle between former allies.
After the devastating events of Avengers: Infinity War, the universe is in ruins due to the efforts of the Mad Titan, Thanos. With the help of remaining allies, the Avengers must assemble once more in order to undo Thanos' actions and restore order to the universe once and for all, no matter what consequences may be in store.
King T'Challa returns home from America to the reclusive, technologically advanced African nation of Wakanda to serve as his country's new leader. However, T'Challa soon finds that he is challenged for the throne by factions within his own country as well as without. Using powers reserved to Wakandan kings, T'Challa assumes the Black Panther mantel to join with girlfriend Nakia, the queen-mother, his princess-kid sister, members of the Dora Milaje (the Wakandan 'special forces') and an American secret agent, to prevent Wakanda from being dragged into a world war.
These actors are frequently suggested for roles along with Chadwick Boseman.
Michael B. Jordan 180 roles in common
Anthony Mackie 139 roles in common
Idris Elba 133 roles in common
Will Smith 113 roles in common
Chiwetel Ejiofor 113 roles in common
Jamie Foxx 110 roles in common
Donald Glover 109 roles in common
Mahershala Ali 94 roles in common
Michael Fassbender 94 roles in common
Winston Duke 92 roles in common
Daniel Kaluuya 92 roles in common
David Oyelowo 86 roles in common
Samuel L. Jackson 82 roles in common
Dwayne Johnson 82 roles in common
John Boyega 79 roles in common
Chris Evans 77 roles in common
Sterling K. Brown 75 roles in common
Aldis Hodge 74 roles in common
John David Washington 72 roles in common
Djimon Hounsou 72 roles in common
Chadwick Boseman has been suggested to play 1,883 roles. Click below to see other actors suggested for each role, and vote for who you think would play the role best.
Best & Worst Comic Book Castings
294 Vote Yes
Best Marvel
Favorite Deceased Celebrity (Male)
MyCast Choice Awards
Saddest Death
The MyCast Awards
Celebrities You Wish Were Still Alive
Best Actor starting with every letter
Best Costumes
King T'Challa (Black Panther)
King T'Challa
Celebrity You Wish You Could Bring Back To Life
Dawn Medrek's myCast Choice Awards
T'Challa (Black Panther)
T'Challa
I Will Add All The Actors and Actress In The World
Best & Worst of Cartoons
Best & Worst Superhero Castings
Black Panther (T'Challa)
What Voices Do You Hear When You Read Comics? Fan Cast
Celebrities You Would Want To Bring Back To Life
Apollo Creed
Hercule Fontaine
Red Dead Redemption.
T'Challa (Black Panther)
The Illuminati (MCU)
T'Challa
Best Biopic Performance
Chadwick Boseman (/ ˈ b oʊ z m ə n /; November 29, 1976 – August 28, 2020) was an American actor, playwright, and screenwriter hailing from Anderson, South Carolina. He graduated from Howard University and went on to study at the British American Dramatic Academy in Oxford. Boseman's play "Deep Azure" was nominated for a 2006 Joseph Jefferson Award for New Work. His breakout role was playing the lead Jackie Robinson in 2013's 42. Boseman was best remembered for portraying T'Challa/Black Panther in the Marvel Cinematic Universe. He has portrayed the character in Captain America: Civil War (2016), Black Panther (2018), Avengers: Infinity War (2018), and Avengers: Endgame (2019).


There's a scene in the stunning soccer movie "Pelada" where a group of seriously past-their-prime Brazilian men are resting after a brutally poor match they've just played in. The whole game the old men scream and yell at each other about poor touches and scuffed shots oblivious to the fact that they were probably making the exact same mistakes moments earlier.
But it's after the game and that no longer matters. The first and second halves are in the past and they're onto what is referred to as "the third half". Surround by dozens of empty, half-empty, and soon-to-be empty beers they revel in stories of their past greatness and of the beauty of soccer in general. This is the sport stripped to its core; what's left is the game's fans and, not surprisingly, beer.
For long-time fans, and probably new fans to soccer, it's hardly a shock as to how ingrained beer is in the sport's culture. It's one of the reasons for the foundation and growth of the Free Beer Movement. Soccer and beer; the two are inseparable.
"There are things that you can count on. We were always sharing beers after a game," says Gwendolyn Oxenham, one of the "Pelada" filmmakers.
The stars of "Pelada" readily acknowledged the fact that they easily could have made a whole movie about the tie-in between beer and soccer.
"Every game that's what you do at the end is that people just start drinking and eating a lot," Oxenham continues.
Whether post-match in Brazil or pubs in England or in the streets of Austria during Euro 2008 or the living room of Luke Boughen's old soccer teammate from Germany, beer creeps into "Pelada" almost as much as the game itself.
Ryan White, another member of the "Pelada" crew laments the fact that they missed out on many opportunities to further investigate the connections between beer and soccer.
"I think if we'd hadn't been making a movie we would've been drunker a lot more," he says. "We probably didn't drink as much as we should have."
The sense of community that both soccer and drinking create that makes them so intertwined argues Rebekah Fergusson, the fourth member of "Pelada".
"It's those communal activities where you end up, like that one field in Brazil, in a zillion chairs around these teeny-tiny tables with beers being poured. It's just pouring."
Then it's not surprising that when you combine the world's oldest drink and the world's most popular sport you create at an atmosphere that almost no one can refuse to pass up. Certainly the filmmakers, despite their work responsibilities, found plenty of time to devote to drink.
And in a movie that examines the global appeal of not just soccer, but soccer in its most pure , simple, and prettiest form as pick-up, it's reassuring to know that beer has its rightful place alongside.


President of the Republic of Azerbaijan Ilham Aliyev has received a delegation led by Chief of the General Staff of the Turkish Armed Forces, Army General Hulusi Akar.
The head of state said that like in all areas Azerbaijani-Turkish cooperation is successfully developing and strengthening in the military field too. Highlighting good history of military cooperation, President Ilham Aliyev said the bilateral cooperation has expanded during the years of Azerbaijan`s independence. The head of state stressed the importance of the joint military exercises held in Azerbaijan and Turkey.
Saying that Azerbaijan and Turkey have the closest relations on the world scale, President Ilham Aliyev underlined the significance of the fact that the two countries are always supporting each other on all issues. President Ilham Aliyev expressed his confidence that a broad exchange of views on the expansion of the cooperation will be held during the visit of the delegation led by Hulusi Akar.
Chief of the General Staff of the Turkish Armed Forces, Army General Hulusi Akar said held on the foundations of brotherhood, the joint exercises were of great importance. He said that the two countries managed to achieve exemplary cooperation on a variety of fronts during the joint exercises held both in Turkey and Azerbaijan. Hulusi Akar said that there are not relations similar to those between Turkey and Azerbaijan on the world scale, emphasizing the significance of these ties. He expressed his confidence that under the leadership of the presidents of Turkey and Azerbaijan these relations will further expand in the years to come.


text:
Queen's Honour – MBE, OBE, CBE…
Public Appointment
The Ultimate Guide to Queen's Honours – FREE Download
The Ultimate Guide to Winning Business Awards
Mark Llewellyn Slade
Queen's Awards for Enterprise 2015 open for entries
By wpengine | May 14, 2014 | 0
The 162 proud winners in 2014 ranged from small, innovative private companies selling their goods worldwide, to large FTSE companies building on their successes.
Matthew Hancock, Skills and Enterprise Minister, encourages all companies to enter next year's historic 50th Anniversary Queen's Awards, saying "The fact that small businesses can share these honours with large household names illustrates that they are the backbone of our economy and should be recognised as such"
The benefits of winning this competition, which is considered to be the most prestigious business award in the world, are far-reaching, with winners reporting that the recognition they have received has enabled them to grow their business, expand in to new markets and open doors to new opportunities.
The 2015 competition is now open – do you have what it takes to be a winner? Watch our video to find out more.
Awards Intelligence are proud to be the leading independent business awards experts in the Queen's Awards for Enterprise competition. We are delighted to have helped many businesses achieve this incredible award year on year – our success rates stand at around 50% far above the industry average which is estimated to be around 11%.
Here are a few of our happy winners:
Colin Hamand, Marketing Manager, NGF Europe Ltd.
"Many thanks for all your help in ensuring our application met the criteria for The Queen's Awards for Enterprise 2014. This award recognises the achievements of our R+D team, the company's commitment to technical development and manufacturing excellence, and our outstanding marketing team who brought the product to market. We are delighted to be celebrating such incredible success and believe this award will be of great value and importance to the future of our business"
Leigh Chadwick, Joint Managing Director, Seasalt Ltd said:
"Thank you for all your help in building our entry to the Queen's Awards for Enterprise 2013. You clearly grasped how important sustainability is to Seasalt and we were delighted that your professional and innovative approach to constructing our entry highlighted our own exceptional achievements in the retail sector"
Jonathan Evitt, Managing Director, Techna Display said:
"With only 2 weeks to go before the 2012 deadline, we approached Awards Intelligence specifically to help us win a Queen's Awards for Enterprise and with their expert help we achieved our goal. To win the most prestigious business award in the world at the first attempt is no mean feat. What seemed daunting at the start was made very easy by Awards Intelligence, especially with the time scale created by our financial year end. The quality of the service was fast, efficient and professional. I would wholeheartedly recommend Awards Intelligence"
Increase your chances of winning and save valuable time
If you are serious about winning the Queen's Awards for Enterprise, Awards Intelligence can help you win by professionally handling your entry from start to finish. The entry process is rigorous, and there is no doubt that with our help you will significantly increase your chances of success and save valuable time.
Call us now on +44 (0)1444 230130 for a confidential discussion or email enquiries@awardsintelligence.co.uk to set the wheels in motion.
We will always give you an honest assessment of your chances of success before formally embarking upon the entry process.
Let our experts take care of your entry and give you that vital winning edge. We will also free up your time to focus on your core responsibilities.
Book your free Queen's Awards assessment today
Posted in Awards, Business
Opening Soon… International Business Awards 2020 (aka, The Stevies)
How Did The New Year Honours Recipients Get Their Gong?
Ernst & Young Entrepreneur of the Year 2020
Institute of Directors Awards 2020
Ernst & Young Entrepreneur of the Year Awards 2020
BE SOCIAL... CLICK BELOW TO FOLLOW US...
* The guarantee may only be activated on the condition that the Managing Director is informed of any issues in writing, a minimum of 48 hours ahead of the agreed award/application deadline.We are a commercial organisation and are not affiliated to the Cabinet Office, Honours and Appointments Secretariat or the House of Lords. Individuals and organisations featured on this website provide examples of the broad range of candidates considered for a variety of awards and honours and are not necessarily connected to Awards Intelligence.
© 2019 Awards Intelligence. All Rights Reserved. Web Design by Cardell Media. Privacy & Cookie Policy
Registered Office 161-163 Preston Rd, Brighton East Sussex, BN1 6AF Company Reg No 06255223


E – Farmer; Gogreve, S.. LOB – OSU 6; IND 5. 2B – Watkins; Prantl 2; Meyer.
HR – Watkins; Carrillo. HBP – Gresham; Rennie; Mathewson. SB – Saucedo.
Win – Hursh (3-5). Loss – Boetjer (3-4). Save – None.
WP – Olson. HBP – by Boetjer (Gresham); by Hursh (Mathewson); by Olson (Rennie).


text:
Random Oracle
Building and breaking systems
The opinions and views expressed here are my own, and do not reflect those of my employer.
CVV1, CVV2, CVV3: Demystifying credit card data (1/2)
Reading the US passport using Android -- overview
Ethereum, Solidity and integer overflows: programming blockchains like 1970
Using the secure element on Android devices (1/3)
Windows smartcard logon with Android secure element and NFC
Extracting OTP seeds from Authy
Threshold ECDSA, key sharding and multi-signature: a comparison
Filecoin, StorJ and the problem with decentralized storage (part I)
Smart card logon without Active Directory
Smart card logon with EIDAuthenticate -- under the hood
On Safenet HSM key-extraction vulnerability CVE-2015-5464 (part I)
This series of posts is provides a more in-depth explanation of the key-extraction vulnerability we discovered and reported to Safenet, designated as CVE-2015-5464.
Safenet HSMs are closely based on the PKCS#11 specification. This is a de facto standard designed to promote interoperability between cryptographic hardware by providing a consistent software interface. Imagine how difficult it would be to write a cryptographic application such as Bitcoin wallet to work with external hardware if each device required a different API for signing a Bitcoin transaction. Certainly at low-level differences between devices are apparent: some connect over USB while others are addressed over TCP/IP, each device typically requires different device driver much like brands of printers do. Instead PKCS11 seeks to provide a higher-level point where these differences can be abstracted behind a unified API, with a vendor-provided PKCS#11 module translating each function into the appropriate commands native to that brand of hardware.
PKCS#11 is a very complex standard with dozens of APIs and wide-range of cryptographic operations, called "mechanisms" for everything from encryption to random number generation. Safenet vulnerability involves the key derivation mechanisms. These are used to create a cryptographic key as a function of another key. For example BIP-32 for Bitcoin proposes the notion of hierarchical-deterministic wallets where a family of Bitcoin addresses are derived from a single "seed" secret. Designed properly, key-derivation provides such an amplification effect while protecting the primary secret.Even if a derived key is compromised, the damage is limited. One can not work their way back to the seed. But when designed improperly, the derived key has a simple relationship to the original secret and leaks information about it.
Some options are better left unimplemented
That turns out to be the problem with several of the key-derivation mechanisms defined in PKCS#11 and implemented by Safenet. (To give a flavor of what is supported, here is the list of options presented by the demonstration utility ckdemo shipped as part of Safenet client.) Many of these are sound. A few are problematic, with varying consequences. For example the ability to toggle secret-key bits using XOR and perform operations with the result leads to exploitable conditions for certain algorithms.
Related-key cryptanalysis is the specific branch specializing in these attacks. It turns out that for Safenet HSMs, we do not need to dig very deep into cryptanalytic results. There are at least two mechanisms that are easy to exploit and work generically against a wide-class of algorithms: extract-key-from-key and XOR-base-and-data.
Slicing-and-dicing secrets
Extract-key-from-key is defined in section 6.27.7 of PKCS#11 standard version 2.30. It may as well have been renamed "extract-substring" as the analog of standard operation on strings. This derivation scheme creates a new key by taking a contiguous sequence of bits at desired offset and length from an existing key. Here is an example of this in action with ckdemo utility provided by Safenet.
We start out with an existing 256-bit AES key with handle #37. Here are its PKCS #11 attributes:
PKCS #11 attributes of original AES key
Note CKA_VALUE_LEN attribute is 0x20 in hex, corresponding to 32 bytes as expected for 256-bit AES. Because the object is sensitive, those bytes comprising the key can not be displayed. But we can use key-derivation mechanism to extract a two-byte subkey from the original. We pick extract-key-from-key mechanism, start at the most-significant bit (ckdemo starts indexing bit-positions at 1 instead of 0) and extract 2 bytes:
Using extract-key-from-key derivation
Now we look at attributes of the derived key. In particular note that its length is reported as 2 bytes:
PKCS #11 attributes of derived key
So what can we do with this resulting two-byte key, which is not going to be very difficult to brute-force? Safenet supports HMAC with arbitrary sized keys so we can HMAC a chosen message:
HMAC chosen message using derived key
Given this primitive, the attack is straightforward: brute-force the short key by trying all possibilities against known message/HMAC pairs. In this case we get 0x5CD3 since:
$ echo -n ChosenMessage | openssl dgst -sha256 -hmac `echo -en "\x5c\xd3"`
(stdin)= 1db249f0e928b3aeff345aedaa3365ea690f06f3710433fc4a063b4cfffbe930
That corresponds to the two most-significant bytes of the original key. Now we can iterate: derive another short-key at different offset (say bits 17 through 32), brute-force that using a chosen message attack, repeat until all key bytes are recovered. Fully automated, this requires a couple of seconds with Luna G5, much less time with the more powerful SA7000 used in CloudHSM. Main trade-off is available computing power to brute-force key fragments offline. Given more resources, larger fragments of multiple contiguous bytes can be recovered at a time, necessitating fewer key derivation and HMAC operations. (Also since we have a chosen-plaintext attack with HMAC input that we control, there are time-space tradeoffs to speed up key recovery by building look-up tables ahead of time.)
Surprisingly this works not only against symmetric keys such as AES or generic HMAC secrets but also against elliptic-curve private keys (RSA, plain DSA and Diffie-Hellman were not affected.) This is an implementation quirk: these mechanisms are typically intended for symmetric-keys only. For elliptic-curve keys, the byte array being truncated is the secret scalar part of the key. For example the "secret" component for a Bitcoin ECDSA key is a discrete logarithm in secp256k1. Internally that discrete logarithms is just stored as 32-byte scalar value, and extract-key-from-key can be used to successively reveal chunks of that scalar value.
XOR-base-and-data suffers from a very similar problem. This operation derives a new key by XORing user-chosen data with original secret key. While there are cryptographic attacks exploiting that against specific algorithms such as 3DES, a design choice made by Safenet leads to simpler key recovery attack that works identically against any algorithm: when the size of data is less than size of the key, result is truncated to data size. XORing 256-bit AES key with one-byte data results in one-byte output. That provides another avenue for recovering a key incrementally: we derive new HMAC key by XORing with successively longer sequences of zero bytes, with only the last segment of new key left to brute-force at each step.
[continued in part II: exploit conditions, workarounds and mitigations]
August 13, 2015 Cem Paya
3 thoughts on "On Safenet HSM key-extraction vulnerability CVE-2015-5464 (part I)"
lsadehaan says:
That is why you should only allow the minimal required attributes on your keys. You should not enable Sign for a key with Derive enabled. If you really need to derive a key for signing from a master key, then you would need to find a better method of doing the derivation instead of enabling Derive.
I was under the impression that any key derived from a master key would have the same attributes as the master key, but I just checked the PKCS11 documentation and it only has restrictions on the sensitive and exportable attributes. This means that if a key has the derive attribute set, you can effectively create a new key with the same value that has any attributes you like (except exportable and sensitive). This means you are completely right that any key with Derive set to true would be vulnerable to these attacks.
Daniel Turissini (@turissd) says:
This a a general failure of the NIST (and other federal) testing/ evaluation programs in a PC environment that values the appearance of "equality" above the equally strict application and transparency of basic security requirements. All evaluated products are not equal, however, watering down of minimal requirements falsely cause the user community to assume one product is just as good as the other – "it's approved". For example, there are other FIPS 140-2 approved products that only support FIPS-approved KDFs, which use hashing and always use the entire secret, not parts of the secret as described in the vulnerability. SPYRUS is a prime example of a product that takes its position as a leading edge FIPS-approved product vendor seriously – here is a good read: http://www.spyrus.com/whats-a-pkcs-11-attack-and-how-do-you-prevent-it/
Take away, buyer beware. Look beyond the basic stamp of approval.
Randomness in real time
RT @moarbugs: Quote of the day: "Static analysis has found a few bugs in SQLite, but those are the exceptions. More bugs have been introduc… 6 hours ago
Open source doc management system called "Hermes"? Trademark infringement lawsuit begins in 3, 2, 1… hashicorp.com/blog/introduci… 6 hours ago
Not to mention: there is zero assurance that the code deployed on TikTok servers corresponds to audited source. It… twitter.com/i/web/status/1… 1 day ago
RT @klonkitchen: Similarly, TikTok makes assurances that only trusted U.S. based personnel will have access to American user data, but thes… 1 day ago
Strange this critical code review task is outsourced to Oracle of all places… Bozo the Clown was not available app… twitter.com/i/web/status/1… 1 day ago
RT @Iwillleavenow: Seems like a bad idea to take legal advice from someone actively encouraging several kinds of legal malpractice, but wha… 6 days ago
RT @AricToler: Big-time ruling with the second major court case tying Russia to the downing of MH17. The first was a trio of convictions fr… 6 days ago
RT @IanColdwater: "I take responsibility" is the new "thoughts and prayers" 6 days ago
RT @DinaSrinivasan: Many people don't realize that the largest electronically traded markets in the world are online ad markets. Today th… 1 week ago
RT @mikelacher: New thing I wrote: mcsweeneys.net/articles/macro… 1 week ago
Follow @randomoracle


I bought these wristbands and by doing so – I was able to recall lucid dreaming so much more efficiently. These reality check bands really do the trick!
I bought these for my kids who are interested in mindfulness and lucid dreaming. They love it!


On his daughter Evelyne's first birthday, country singer-songwriter Mo Pitney remembers the terrifying day she was born.
First birthdays are special for every family with a one-year-old. It isn't just a milestone for the little one, it's also a celebration for the mom and dad who managed to make it to a year, hopefully with minimal loss of sanity and usually with maximum loss of sleep. For country artist Mo Pitney and his musician wife Emily, though, the first birthday of their baby girl, Evelyne Nadine, is bigger than all of that.
Now, Mo is a pretty laid back singer and songwriter. Known and well respected for his traditional country sound, and beloved for his quiet, gentle demeanor, the Illinois native is also known for his strong faith. And while he is still in the early stages of his recording career, the release of his debut album, "Behind This Guitar," in 2016 made a lot of country music fans and critics stop and take notice.
Early in 2016, Mo took a walk down the aisle with sweet and beautiful Emily Bankester. Then, late in the summer, he shared the big news that he and his new bride would happily welcome their first baby in early 2017.
It almost seems like a fairy tale.
But even fairy tales have a moment of darkness, but those moments only serve to remind us that goodness prevails, and it did for Mo and Emily, too.
In a post on his Instagram page, Mo reflects back on the day that he and his wife welcomed their baby girl into the world. And the scenario isn't exactly picture perfect.
While we're sure the past 12 months have been filled with spit-up, dirty diapers and sleepless nights for the couple, we can't help but think that the highs for this little family have been super high. Heck, little Evelyne even made her Grand Ole Opry debut in the past year.
Making new friends at the @opry last night.
She's also already collected a few stamps in her passport!
And, since Daddy is an avid outdoorsman, Evelyne has also had her first taste of wild game, yummy pheasant!
So, as frightening as her arrival may have been, it was obviously worth it.


text:
Condos would replace last pre-Fire house on this Lakeview street
Dennis Rodkin
The house at right (shown here in the shade) is believed to have been built in 1870, a year before the Great Chicago Fire. A condo developer plans to replace it and the house on the left, built a few years later.
Developers are proposing an eight-unit condo building on a Lakeview site on Melrose Street that now holds two 19th century houses—one of them, the oldest on a three-block stretch, that's believed to predate the Chicago Fire of 1871.
According to Cook County Assessor records, the two-story wood frame house at 734 W. Melrose St. was built in 1870. (In the photo above, it is on the right, obscured by trees.)
At least three other houses on the three-block stretch of Melrose between Broadway and Halsted Street were built later in the 1870s. The other house on the proposed condo site, at 738 W. Melrose, is one of them, built in 1875, according to the same records. (It's at left in the photo.)
Several other vintage homes on Melrose have been torn down in recent years, making way for new houses and condos on the quiet street between the vibrant Broadway and Halsted commercial strips. "There's been construction along that street most of the time since 2010," said Bennett Lawson, chief of staff for 44th Ward Alderman Tom Tunney.
Tunney's office received the condo proposal within the past few weeks, Lawson said, and is in the process of contacting all neighbors of the site, because the proposal asks for variances from some rules about setbacks on the sides and rear of any new structure. The building height and unit count fit within current zoning, Lawson said, so a larger community meeting will not be required.
The properties at 734 and 738 were purchased in separate transactions in August for a combined total of slightly more than $2.6 million, according to the Cook County Recorder of Deeds.
The buyer is a development entity connected with William Broderick and Nicholas Kerins, who could not be reached for comment. The zoning attorney who filed their proposal with the alderman's office, Tom Moore of Anderson & Moore, did not respond to a request for comment.
Richard Driehaus' Lake Geneva estate sells for $36 million
The record home price in Woodlawn went up again
Here's how a dated Tuscan-style mansion will look after a facelift


text:
To Hull and Back
I was on my way to the Theatre Royal in Nottingham on Wednesday for Boeing Boeing, a fluffy farce set in the comforting innocence of the 60s. There's a spontaneous shrine where you step off the tram, to a youngster beaten to death outside a nightclub in the early hours of last Sunday morning. Bouquets are piled up against a traffic sign, which itself is covered in graffiti tributes. Letters of condolence and notes addressed FAO the deceased, mostly written in text-speak, mourn his loss. All around it are thoughtfully placed bottles of his favourite tipple (empty), complete with convenient paper cups, to smooth his progress to heaven. And this weekend, hundreds gathered in tribute to his memory; some in cars playing his favourite tracks on their stereos. Dozens, including the Nottm. Forest Football Club Captain, are reportedly having themselves tattooed with his name and date of death.
Without meaning any disrespect to the life cut short, all this could just as well have happened in some distant land and be one of those foreign rituals like when you see Palestinians running along carrying shrouded bodies above their heads. I've become so completely disconnected from urban youth culture that I can only comprehend an event such as random street manslaughter on a basic level, much as I might view the carnage in Gaza with pity and a squeamish horror whilst safe in the knowledge that it's somewhere else entirely. Interesting that they seem to share a belief in an afterlife though.
The vomit, spit and urine-stained pavements of Nottingham are mirrored in Hull, where I was on Friday for a concert by the Halle. Their City Hall is more classical in style than the ornate Victorian Phipps/Matcham interior of the Theatre Royal but the message in the design is much the same - with a relief over the stage showing the Muses paying tribute to Britannia seated on her throne, while the Royal was built (according to its first owners) to "add to the number of those who seek a healthful pleasure in intellectual recreation". Each venue embodies the conscious effort to heighten the public's spiritual wellbeing through art, from an age when it was believed that this was both possible and necessary. We've come a long way from that sentiment.
Kayfabe
In professional wrestling, kayfabe (pronounced [ˈkeɪfeɪb] KAY-fayb) refers to the portrayal of events within the industry as "real", that is, the portrayal of professional wrestling as being not staged or not worked. Wikipedia.
It depends, of course, on the public being a willing participant... willing to connive in the absurdity of what's being portrayed and to allow themselves knowingly to be manipulated accordingly. It's an equal covenant which, when broken, can't be repaired. Once the fiction is admitted, there's no going back. Everything that's been expected to be believed, even the parts that may or may not have contained a germ of truth, appear as no more than a sordid attempt to profit from gullibility.
I haven't blogged since the last trip to Spain - mainly because of idleness but also because having seen what I'd written previously, I found it hard to believe I could have felt a need to comment on serious affairs. Life is so full of opportunities for pleasure, that it seemed wrong to concentrate on matters which, unless I read about them somewhere, barely impact on me at all. Maybe it's our duty to vicariously share the horrors of Palestinians, the war-ravaged Congolese, Sudanese, Ugandans, famished cholera and Aids-ridden Zimbabweans, the downtrodden and oppressed everywhere, the rape of the planet or even the lesser outrages of society within Britain - but I've all but given up. The direct experience of most of us inside the comfortable English bubble is so wonderful, with every enterprise set up to gratify some whim or other that, truly, we've won the Lottery of Life simply by being here.
But anyway as I was saying... Kayfabe. Our Government tells us it's expecting to borrow £60bn this year and a further £100bn next. Many other countries in Europe will be doing much the same. In the US, as we know, Congress famously approved an extra $700bn of borrowing to fund the bail-outs. Obama says he's going to spend a similar amount on New Deal style projects - in addition to the regular Federal deficit of a $trillion or so. So I dunno... how much new Global borrowing does all this add up to? Couple of $trillion? Five trillion.. more? All this on top of an existing debt mountain of $what? So the ever-so-simple thing is - where's it all supposed to be borrowed from? No such sum of money waits, ready to be invested, anywhere in the world. That's bad kayfabe. People would feel cheated if they could be arsed to look into things like that.
What people really want to buy into is being kayfabed into what to drive, wear, eat or watch on TV; what phones and ring-tones to use, films to watch, bands to be a fan of, names to call their kids. Without kayfabe here, they'd have to make their own choices - so that's good kayfabe. It saves people from having to make up their mind what's cool - kayfabe-cool - because they can follow the human herd-instinct and join with millions of the like-minded by keying in to a few simple signals. Buy this and be that, goes the message - and straight away the world defragments for us and we're part of one modern-day tribe or another; no longer isolated.
In other news, Sunset Boulevard, at the Comedy, is well worth seeing if you can, if only for the towering bravura performance of Kathryn Evans as Norma Desmond. The onstage ensemble play the whole score, as well as act the piece. Just bewilders me that there's so much unknown talent - these people have spent the years I wasted as a youth, learning instruments to professional standard as well as taking dancing and acting classes. They go through a ruthlessly competitive audition process and then work to a standard of attention to detail and public scrutiny that would defeat most of us in our own jobs. All this for a pittance wage and complete insecurity of employment whilst producing something quite magical through their connection with an audience. I'm humbled by admiration for them.
Labels: Brown's Ponzi Scam, Comedy Theatre, Kathryn Evans, Kayfabe


text:
Music Genres List	Genres of Music | The Most Definitive Music Genre List on the Web!
Music Genres Blog
Alternative Music Genres List
The most comprehensive list of Alternative Music genres available on the Internet
The Music Genres List site covers many of the most popular styles of alternative music, we hope this becomes the definitive list of alternative music genres on the Internet, send an email to add @ musicgenreslist dot com if you feel any alternative music genres are missing and we'll add to complete the music list.
Alternative music was a phrase invented in early 80s describing bands which broke from the barrage of pop and hair metal and formed a new direction of more focused and honest rock. It includes many subcategories including but not limited to; Grunge, Hard Rock, Rock, Experimental Rock, Progressive Rock, Gothic Rock, Punk Rock, Hardcore Punk, New Wave. Their only real connection in terms of roots is the English punk movement. In the early eighties alternative music was limited to a few college radio stations. In the mid 80s as it became more popular It began to take over college radio throughout the country. In the late 80s commercial stations slowly began to embrace what up till then had been known as college rock. They never sold many albums but the influence on the music community would be felt in a big way soon when the format evolved to the next stage.
Shoegaze (with thanks to Jackie Herrera)
Steampunk (with thx to Christopher Schaeffer)
[one_half]Alternative rock music is really a name given to rock music that didn't fit any other genre. However, the technical meaning is usually any rock music that descended from punk rock. A lot of rock music has been classified as alternative rock music even though some of these did not exactly fit the meaning.
Alternative rock music became popular in the 1990's but the history or alternative rock music goes back farther than that. Before Nirvana brought alternative rock music to the mainstream audience, the music genre had been gaining popularity with the college crowds and music underground.
In the 1980's REM was making their start in alternative rock music. Most of their airtime was given by college radio stations. This is where their loyal fan base started. However, their commercial success started at about the time that alternative started to really become popular in the 1990's.
The popularity of alternative rock music came about after the grunge period. Grunge was a type of alternative rock music that denounced commercialism. This movement started in Seattle, Washington and soon took the world by storm. This was ironic since it was this type of music that helped to create the commercial success for alternative rock music. Bands such as Pearl Jam, Nirvana, Soundgarden, and the Red Hot Chili Peppers.
Alternative rock music also made a big splash in Britain where punk rock was more popular. In fact, Alternative rock music entered the mainstream earlier in Britain than it did in the United States. This gave alternative bands a broader venue even before the popularity of alternative music in the United States.
During the height of success for alternative rock music, many record companies handed out the name to bands that fit the requirements loosely at best. This was done in hopes that the label of alternative would help sales. However, looking back one can see that some of this music was more pop than alternative.
Steampunk (excerpt from Tor.com)
"… can there actually be a musical genre called steampunk, and more importantly, does there need to be?
This debate isn't exactly new; cyberpunk has seen this sort of thing before. Despite its established relationship with art and cinema, most people would struggle with naming any cyberpunk bands. The genre doesn't officially exist. However, there are bands that fit the bill. Front Line Assembly is a flagship example. Yellow Magic Orchestra is regarded by some as the original cyberpunk band. Arguably, Gary Numan counts, too. But musically speaking, these bands don't have much in common. This is the norm in the landscape of suggested cyberpunk offerings; from Front 242 to Information Society, Queensryche's Operation: Mindcrime to Billy Idol's Cyberpunk, there really is no sonic cohesion.
However, it's no lost effort. Cyberpunk has inspired musicians to write music that is decidedly against the grain while incorporating the cutting edge into their craft. The literature provides the substance, and new technologies provide the instruments. Ultimately, the selections hardly comprise a traditional genre, but they make for a satisfying playlist of musicians who understand cyberpunk's legacy."
Best Alternative Albums Ever?
Sigh No More – Mumford & Sons
When the World Comes Down (Deluxe Edition) – The All-American Rejects
Mylo Xyloto – Coldplay
Best known proponents today
Muse – U.K., Radiohead – U.K., Red Hot Chili Peppers – U.S.A., The Smashing Pumpkins – U.S.A., Foo Fighters – U.S.A., Incubus – U.S.A., Coldplay – U.K., The White Stripes – U.S.A., Linkin Park – U.S.A., Rage Against the Machine – U.S.A., R.E.M. – U.S.A., Barenaked Ladies – Canada, Nine Inch Nails – U.S.A. Steampunk – Abney Park[/one_half] [one_half_last]
Who is your Favorite Alternative Singer or Group?
Copyright © 2020 Music Genres List. All Rights Reserved.


Evolving is the only way of truly growing up & going forward, and that holds true even in the beautiful game. David Holmes documents the extinction of the loyal men of football and the new breed of tactical gaffers in the modern game.
We are witnessing changing times and attitudes, and some would say, a sad time in football; the extinction of the One-Club Man. Long gone are the days of Bobby Moore who would stand by his club whether trophies filled his shelf or not. Gone are the days of Steven Gerrard and Francesco Totti who have stood by their club through thick and thin despite the numerous offers of greater fame, fortune and money that presented themselves. This is a sad time for football fans as no one can become too attached to any player, as they are about as likely to stay with the club, as a favorite character on Game of Thrones is to survive to the next season.
It used to be that players stuck by their club and strove to become a legend; someone who the fans would sing songs about until they died and long after that point. I go back to Bobby Moore because he is the prime example of what it meant to be loyal to a club. He was one of the best centre backs (if not the best) in the world, a World Cup winner; anyone would have taken him if he'd wanted to leave. But Sir Bobby did not. He won no titles, no FA Cups, no European Cups, but that didn't matter. He was serving his club to his fullest and now he is a legend at Upton Park and will remain so for as long as that club and its fans exist.
This kind of player was very common during Moore's time, but has become a scarcity in the modern game. Very few top players have only ever stayed in one club. It has become acceptable now to watch players like Robin Van Persie leave the club that supported them for years and years through injury upon injury, just so that he can go off and get a Premier League medal elsewhere. In juxtaposition, it is considered to be incredible loyalty when players like Gerrard refuse offers from Chelsea and Real Madrid in order to stay at their boyhood club.
In today's game, both players and clubs have removed loyalty from the equation and added the bottom line, money. Just this year we saw Chelsea let go one of the greatest players in its history, Frank Lampard. The Englishman often stated his desire to stay at the club and retire with the Blues, but Chelsea could not meet him in that endeavor. Now we see the unimaginable sight of Frank Lampard in the blue of Manchester City scoring against his old club!
It is hard growing up in a time when even players like Frank Lampard are now considered surplus to requirement. It is hard listening to people around you get used to the idea of selling home-grown players when they feel they can make a profit off of them.
Fans across all teams understand the pain of watching a player, who up until that point had devoted their whole career to that club, just walk out or, in some cases, be pushed out. Manchester United can understand this more so than others right now as the sale of Danny Welbeck is fresh in their minds.
Welbeck, albeit not the brightest star when he was sold, was a young lad, born and raised in Manchester, who had come up through the academy to play for his boyhood club. He showed great potential early on and won the support of nearly all Manchester United fans, but when push came to shove, the club decided that there was no room for the young striker. Manchester United legends such as Paul Scholes and Gary Neville, both one-club men, were distraught to see the boy leave. Both felt this was an example of what is wrong with football. When you have a player who can play at a top level club in the league, is pushed aside because the club just sees them as a surplus when they have enough funds to attract a Falcao.
There are two sides to this mass extinction and as a fan you can only watch and hope that from time to time a player may arise that will remain at your club solely because they have as much faith and love invested in it as you do. Unfortunately, many times we are disappointed and must watch a player leave despite the great times they have shared with the club. It has almost become an expectation that players will leave as they get older.
As a Liverpool fan, I watch Raheem Sterling and marvel at the skill and talent that the young lad brings to the side, but at the same time I get a nagging feeling that his years with the club are numbered. I can see him progressing and each year getting better and better until Real Madrid decide they want him and put up the cash that tempts Liverpool into a sale, and two part ways.
Obviously I hope and pray that this magician on the ball doesn't leave and that we go on to do incredibly well for years with him as a talisman for the squad, but given the times that we live in, the thought always lingers in the back of my mind.
The extinction of the One-Club Man is a sad evolution of the business of football and one that no one had hoped would come. Perhaps at some point it will turn around, but from the look of things, it's only a matter of time before one leaves to some other team.
To quote another sportsman, the Cuban boxer Teofilo Stevenson, when he was offered a fortune to fight professionally, "What is one million dollars compared to the love of eight million Cubans." Clubs and players alike should remember that it's the love of the fans that is the greatest prize of all. The prize that they will be truly remembered for, and cherished for generations to come.
We are at point in time, in which we can see the emergence of a new kind of manager. One that over time has strayed away from the style of management implemented by such greats as Bobby Robson, Bill Shankly, and Matt Busby. The slow transition to this new breed a managers has added a far greater tactical awareness to the game and has raised the standard of play around Europe.
If we rewind back to the days of some of the great gaffers of the sport, we see that they're managerial style is very different than the one we see today. Managers of the mold of Shankly and Busby relied on the natural talent of their players and their own incredible man-management skills. You would not find many of these men planning out tactics that may vary game to game. These men motivated their players and raised their self-confidence, thus allowing them to compete against teams that perhaps they wouldn't normally have beaten. Shankly and Busby are excellent examples of managers who instilled a belief that every player should want to play for their club and that there was no team in the world that could compete with them. This belief was passed into the players and with this boost on top of the already incredible natural talent of players like Bobby Charlton and Ron Yates guaranteed that teams would experience an onslaught of intense passion.
This does not mean that these men did not organize their teams tactically in order to try and gain an advantage, but they did not out-think their opponents to the same extent that we see in today's managers.
The transition from the motivational manager to the modern day manager was not an instantaneous one, obviously. There has been a long period of growth and it has taken a great deal of time to arrive at the tactical geniuses that currently stride up and down the pitch-side.
There are obvious transitional managers such as Kenny Dalglish who took a small step forward from the style implemented by his predecessors. We also have transitional managers that were ahead of their time and have been inspirations for the tactical awareness shown today. None more so than Johann Cruyff. His tactical awareness was years ahead of his competitors. A perfect example of this is when Barcelona found themselves against Manchester United in the Champions League Semifinal in 1994. In the first leg the games ended with a 1-1 draw and when the second leg ended 4-0 to Barcelona it became evident that one manager had learned from the first match and the other manager had not. That other manager was none other than Sir Alex Ferguson. However, it did not take Fergie long to learn from this mistake and this is why he is the ideal embodiment of the transition to the modern day manager.
Managers such as Alex Ferguson and Arsene Wenger began their careers when the style of managing was still working towards in depth tactical analysis. These two managers specifically adapted their approach as the times changed and maintained success throughout their tenures. If you examine the period of Alex Ferguson's regime you can see that there is a distinct change in his tactical approach to games. When he began, he had the same motivational manager characteristics, but with more tactical awareness, and as you move forward in his time with Manchester United you can see that he begins to analyze teams more and begins to plan in advance and learn from the methods used by opposing teams. Alex Ferguson, although very adaptive never implemented the same style of management that is becoming increasingly prevalent in today's game.
The modern manager looks at every opponent and sets up the team differently for each game depending on the weakness that must be exploited. It does not matter if it is the Champions League Semifinals or the second round of the FA Cup, these managers change their tactics every game. This style was brought to prominence by Pep Guardiola, who learned from Johan Cruyff, and Jose Mourinho, arguably are the best managers in the game today. This was then picked up by such managers as Carlo Ancelloti who also adapted to this change and now embodies it whole-heartedly.
What is incredible about this change is that many upcoming managers utilizing this style to great success. Brendan Rodgers, Manuel Pellegrini, Jürgen Klopp, and Diego Simeone. We have even seen teams such as Southampton, Tottenham, and Zenit St. Petersburg employed under this method by Mauricio Pochettino and Andre Villas-Boas. This is becoming the norm. These managers must play out every pass, every move, every shot, every save, before the game is even played. There must not be anything that happens in the game that surprises them.
This manager is becoming more and more prevalent as time goes on and the approach is slowly being perfected and improved. We are going to continue down this path of improvement and soon we will see a managerial style that will change the game and the players alike. What a great time to be alive.
David Holmes is a University student with strong opinions and an even stronger passion for the game. He works hard to churn out articles and is working on making his own website soon.


The try-works are planted between the foremast and mainmast, the most roomy part of the deck. The timbers beneath are of a peculiar strength, fitted to sustain the weight of an almost solid mass of brick and mortar, some ten feet by eight square, and five in height. The foundation does not penetrate the deck.
On the flanks it is cased with wood, and at top completely covered by him.