This is the practices handbook for Assurance, authorised under Assurance Policy.
This is a working document for us Assurers. It will likely always be in need of help!
Please correct and complete it so it is soon useful for our new assurers.
making it a living document.
you can help: add comments in italics where it needs work.
Also note: OA needs a Handbook as well.
What about that CAP form?
What is an Experienced Assurer?
What is a Senior Assurer?
What is a co-audited Assurance?
What is the goal of CAcert?
What is the difference to other CAs?
Is CAcert included in browsers by default?
How many people use CAcert?
What can I do with a certificate?
This handbook is intended for fresh CAcert assurers. It should give you a first guide on what to do and what to know when acting as a CAcert assurer, and serve as a starting point for more in depth research on specific topics.
Documentation on Assurance is split between Assurance Policy (AP) and this Assurance Handbook (AH).
Assurance Handbook has further related Practice sub documents to clarify AP. If AH or Practice documents contradicts AP, AP is binding. Practice documents are also leading for Arbitration.
This Handbook is not a policy, but a working practices guide. In the case of contradictions, policies are the final authority, so this Handbook has to conform to those documents. If you find such contradictions please make them known to CAcert's policy mailing list at [ cacert-policy@lists.cacert.org ].
Other policies and documents of CAcert can be found at OfficialDocument. The work of creating policies is controlled by Policy on Policy and is conducted in the open at CAcert's policy mailing list at [ cacert-policy@lists.cacert.org ]; any Member may join and contribute. When documents are still being written they are referred to as work-in-progress or WIP, above. When approved in DRAFT, they are binding on the community, but still being finalised. When fully approved they are marked as POLICY and are officially published on the controlled website at https://www.cacert.org/policy.
You have to conduct Assurances according to the rules given in the policies, especially the Assurance Policy (POLICY).
You have to keep yourself informed about changes in CAcert policies.
Subscribe to cacert@lists.cacert.org Mailinglist. It is comparatively low-volume.
Occasionally browse the CAcert Blog or subscribe the RSS feed.
Retry the AssurerChallenge once a year.
By joining CAcert you accept the CAcert Community Agreement (CCA), which defines the risks and liabilities of CAcert members. You should be very familiar with this document so that you can understand these risks and liabilities for yourself and for any new and prospective Members that ask questions about the issues.
There is both good news and bad news: The CCA places a limit on monetary liability to you of 1.000 EUR (one thousand Euros). Each member accepts Arbitration, which is our system to keep disputes internal, rather than expose our members to courts in far away lands, expensive lawyers, and judgments that might not fully appreciate what certificates are about. The limit of liability is balanced across the Community, as it applies to you as well as to anyone who has a dispute with you, so it is both a maximum to protect you and a liability directly to you.
Therefore, you should always be careful when doing Assurances, because you can be held responsible by the Arbitrator up to this limit!
The assurance procedure is a crucial part of the CAcert project. If the assurances are conducted in a reliable way, members will be able to usefully rely on the CAcert certificates. If assurances are made superficially, this reliance will fail and the project will go down the drain. So we all depend on you!
The following procedure is a proposal. You may alter the process, but then you have to make sure that your process conforms to CAcert's Assurance Policy (POLICY) !!
Probably the best way to do this is to enter a location into your profile and allow your entry to be shown in the users list. Other ways, like advertising yourself among your friends and colleagues, are left at your discretion.
Assurance within web of trust is a two-way street, and you should share some minimum information such as your email address and Name. For example, on a business card. See also Mutual Assurance.
Now let's assume that someone has contacted you and asks you to assure his or her identity for CAcert. There are other ways to do a correct assurance, but this is a good way to start with.
First of all you should check whether the applicant already has an account at CAcert. Go to https://secure.cacert.org/wot.php?id=5 and enter the applicant's mail address [nowadays also DoB - date of birth - is necessary]. If the email was correct you will be shown the interactive assurance form. Do not fill out anything at this time! Just use one of the links at the bottom to open and print out a PDF document containing the pre-filled CAP form.
If the email address is not found within the system, ask the Member to give you the primary email address for the account.
The old CAP form is now being deprecated, you can find the new forms since June 2009 at https://www.cacert.org/cap.php (modified old form).
A 2nd form, that can also be used and includes several lines for name variations in different ID documents you can find at https://www.cacert.org/capnew.php.
Comment to maintainers: the different versions of the CAP document are confusing. Please consider adding at least effective date and perhaps version number (not just copyright) to each one.
Do you have an Account at www.cacert.org ?
Mark the users answer with your individual notation somewhere on the CAP form eg.
If the user has not yet created the account, you will not be able to find it. In this case, the user is not yet a Member, and you should ask her to create her account and become a Member before doing the Assurance.
In some circumstances, such as mass Assurance Events like CeBIT or a chance meeting, it may be reasonable to do the Assurance in advance of the user becoming a Member. However, this should be avoided where possible, as there are some security and legal risks if a person is assured first and the account is created later. For instance, the user will not have had time to read the CCA, which she could more easily do online or later on (at these events, always have copies of the CCA to hand out).
you mark it pending account creation.
you give her a copy of the CCA, or tell her where to find it.
give her your email address so that she can instruct you to destroy the form if she chooses not to agree and become a Member.
In this way, you indicate that the member-to-be will have time later on to read the CCA, and on account creation, she will confirm her agreement. If the account is never created, the agreement is null and void, and your CAP can be marked so or destroyed. Meanwhile, you and she have both agreed to conduct the Assurance under CAcert's policies and dispute resolution procedures.
You should ask the applicant which ID document s/he wants to present. Remind him/her that you have to see the originals of at least one (two are preferred!) photo IDs, at least one of them has to be government issued containing the birth date. If s/he wants to present unusual or foreign documents please inform yourself in advance how these documents should look. You may use the page AcceptableDocuments as a starting point for such a research.
You may want to ask the applicant to check expiry dates of the documents, so s/he does not leave you in the difficult situation of deciding whether expired documents are valid.
You have to meet the applicant face to face and shake hands with him/her. No assuring on the phone, not even via video phones!
So you have to find a meeting place. If your employer tolerates this, your office may be a good meeting point. Of course you can meet at your home if you want to. Otherwise some not too crowded pub would be a nice place.
Take the pre-filled CAP form to the meeting, and don't forget a ballpoint pen, since the applicant has to sign the form!
Please try to make sure that you are not in a hurry during the meeting. You should have at least five minutes to check the documents and let the applicant sign the form! Take your time.
Shake hands with the applicant, maybe give him/her a nice smile. Give the Member a business card with your Name, email address and title of CAcert Assurer, if possible. This can be handwritten as well, CAcert is a community not a corporation.
The data contained in the documents (Names and date of birth) is identical to that on the CAP form.
Ask if the account is already created.
Ask if the email address is the primary address of the account. If unsure, copy down alternates.
Verify that the applicant has checked the "I agree to the CAcert Community Agreement". If time allows explain the key points of the CCA (liability and arbitration). Maybe hand out a printed CCA.
Let the applicant sign the CAP form.
Verify the person against the documents.
Note the kind of presented documents (like passport, ID-card, driver's license) and possible name variations (additional middle names, academic titles, birthnames...) on them. If names in the documents differ from the (pre-printed) name on the CAP form copy the name from the documents as exactly as possible to the CAP from. The CAP form is your only evidence of what you have seen!
In some countries driver's licenses never expire so you have to be aware of very old pictures and signatures.
it is preferable that the customer makes her/his signature on the form while the assurer is watching.
If the form is already signed ask the applicant to repeat the signature somewhere else on the form.
(sometimes newer bankcards are good indication if the signature changed dramatically, but it is forbidden to copy down details from financial cards. Hold your thumb over the sensitive numbers, or ask the Member to hide the numbers.).
if any document is not signed please ask the customer to sign it now.
human readable data should match the machine readable zone on the document.
driver's licenses often have none (depends on the country).
expired documents are acceptable as indication, you may reduce the points you give.
you should inform the customer if documents will expire soon.
don't get confused by the different formats all over the world. Check your input twice if the formats are the same on the form, the documents and the web interface. If the date in the web interface is wrong, it must be changed BEFORE you can give the points. File a dispute to get it changed.
does the member seem to be around that age?
Names! The Assurance works with Name variations.
Write down any additional names on the form.
The online account should include the longest and fullest form of the name possible.
The Assurance is over one or more Names. Carefully write down each name variation fully on the CAP form against the document that it is found on.
Often you will find the Name on the CAP is different to the name on the ID documents, and again the online web interface is different again. Discuss with the Member what the best form of the name should be, and consider filing a dispute to get the online web interface name changed to the best form.
artist names are officially-recognised alternate names that a person in an artistic field uses. As they are supported by the documents, they can be Assured.
often bonafide members gets encouraged to enter their title as suffix in the Join form and find the samples on the linked wikipedia site, but these titles aren't in any govermental photo ID. So these suffixes cannot be assured. Not in the face-2-face meeting, nor later on the online form.
Note that unique numbers on Identity Documents should not to be stored due to problems with liability and the potential to cause ID theft.
What it means to be a Member. In 2007, the Community became more organised with the introduction of the CCA. Members agree to that document, although like all contracts and legal blah blah, it is likely that the new Member has not read it all or understood it all. You as Assurer have read the CCA, and can introduce some important ideas to the new Member.
The Assurance covers the 5 points listed in "The Assurance Statement" of the AP. It is not just a check of Identity.
Security and Obligations. In CCA there are a set of obligations which can be discussed: things like looking after your private keys, and understanding the difficulties of modern virus-ridden platforms, complicated websites and script-driven browsers.
Arbitration and dispute resolution. As a Community, we resolve our disputes internally. For some people this is scary, as they believe in the protection of their own courts. It is often good to point out why Arbitration works for CAcert: in the international context of the Internet, Arbitration means we can protect the Member from disputes in far away places. See the section on Arbitration in this Handbook, and DRP's last section for more discussion on this.
What the Member wants to use certificates for. It is generally hard to figure out how a lot of technology is used in the field, and meeting someone is a good time to get a view. As a user, the person finds difficulties and experiences that the more technically-oriented people are blind to. This is your chance to listen to user experiences, and think strategically about how to improve her security.
Helping CAcert: Try to find out, in which area the Assuree has skills. What hobbies he has. What kind of job he is doing. CAcert searches for volunteers in many places: Assurers, Events, Presentations, Support, Documentation, System administration, Development, Deployment, Arbitration, Communicators, Consultants, Managers ... make a note on the CAP form for which area the Assuree is interested in and forward the contact details to the appropiate team leader by CC'ing the Assuree to the email you'll send.
If you do get a chance to discuss anything with the Assuree, it is good to make a small note on the CAP form about what it was.
if something "just didn't feel right"
Those notes might help you to remember what happened later, just in case a dispute is filed and someone asks you about details of the meeting.
Now login to the CAcert website, go to https://secure.cacert.org/wot.php?id=5 once again and enter the applicants email [nowadays also DoB - date of birth - is necessary]. Now fill out the assurance form, check the data once again and issue your points if there are no reasons against. If the situation was not ideal you should give less points, see Assurance/PracticeOnIdChecking for some guidelines about the number of points to give.
The Assurance Statement is confirmed.
If the documents look good but are unfamilliar to you (like foreign documents), you may decide to issue partial points (although some Assurers choose to issue only maximum or none).
There are two special cases: if you have no confidence in the Assurance Statement, then issue zero points. This will most often occur if the documents are totally unfamiliar to you. For example, a Finnish driver's license presented to an Australian Assurer at an event in Chile! The documents mean nothing to you, but as you have still made a good faith attempt to do the Assurance, it is good to record that fact. It is still worth experience, and your CAP form is still a good record. Advise the Member that this may happen, and the reasons why, so as to maintain good faith.
The second special case is if you have negative confidence. That is, you think there is something wrong, such as some of the documents are false or inconsistent. In this case, do not complete the Assurance (do not sign the form and do not press the "I am sure of myself"-Button on the web application), but instead consider filing dispute.
do not log in from a Computer which is not secure (possibly has any malware like viruses and trojans on it).
do not use other people's computers unless you are sure that you can trust them. If in doubt do it from a Live-CD like knoppix.
use an up-to-date browser and go to https://www.cacert.org/.
FOR SECURITY REASONS: LOGOFF AND CLOSE THE BROWSER WHEN WORK IS DONE.
If someone tried to use faked IDs or otherwise tried to obtain an assurance by fraud, file a dispute by emailing support at c.o.
applicant's signature made by his/her own hand.
applicant's permission to conduct the Assurance.
applicant's acceptance of the CCA and thus the risks, liabilities and obligations of membership.
all covered by your signature.
if the other Member is unsure, you may keep the CAP form(s) on her behalf (and take responsibility for both Assurances) which is why the form itself has both sets of details on it.
if the other Member is about to become an Assurer, or you otherwise judge the Member is capable of meeting the storage requirements, then she may keep her CAP form recording her Assurance over you.
Storage. The Assurer has to securely keep the paper CAP form for at least seven years. You are personally responsible for this (and in the mutual assurance with a non-Assurer, you remain responsible!) ! It is your evidence that you have followed CAcert's Assurance Policy and that you met the applicant in person (face to face).
For data protection and privacy reasons no-one else should have access to the CAP forms, once completed. Do not scan the CAP form and keep it electronically. CAcert's Assurance is deliberately designed to create a paper foundation on which digital certificates are issued; by maintaining a base of paper, the digital framework is strongly constructed with a classical legal foundation. Not only does scanning weaken that foundation, you may also violate data protection laws on electronic data storage.
In the case of a dispute you may be requested to send the original paper form to a CAcert Arbitrator. See below for more details.
If you find yourself unable to keep the CAP forms for whatever reason, file a dispute at support@cacert.org, explain the circumstances, and request the Arbitrator to provide instructions.
An Arbitrator may request you to send him the CAP forms, maybe because there was a complaint about a certificate or just as part of a quality assurance process. CAP forms contain personal data, so the requester has to be authorized to see them and you have to make sure that no-one else can read that data.
Verify that the requester's email is @cacert.org. No other TLD (like .com, .net etc) is allowed!
Verify that the requester is an Arbitrator or Case Manager for a case relating to the person who has signed the CAP form. Current Arbitration cases are listed at ArbitrationCases, the Arbitrator/Case Manager should have stated the case number in her request.
The request will be sent to you either signed by a CAcert verified PGP key or using a CAcert-issued S/MIME certificate. Please ensure that the certificate is valid and issued/signed by CAcert.
If you do not know how to reliably verify a signature please ask someone for help on on IRC (irc://irc.cacert.org/cacert or irc://irc.cacert.org/cacert.ger) or one of the mailinglists (like mailto:cacert@lists.cacert.org or mailto:cacert-de@lists.cacert.org). This is not a trivial task, don't just trust your mailer's icon!
Usually you will be requested to send a scan of the CAP form. Please make sure that you send the image using an encrypted mail. If you cannot send it encrypted for any reason, send a copy of the form via paper mail. After you confirm receipt of the scanned CAP form, delete your digital copy carefully.
If you are requested to send in the original CAP form, keep a copy of it in your documents. N.B.: I have not heard of this being requested, but it may be necessary some time.
If you have any doubts about a request ask for help. Once again, try IRC or mailing list(s)! If the request tries to discourage you from getting help (stating it a top secret business or something like that) there's something fishy about the request!
Certificates are free! Customers create them themselves using the web interface.
Assurances may cost money but the price has to be set out before the meeting. Otherwise it must be done at no charge.
If you choose to demand money for the assurance, keep it to a sensible amount of "expense recovery". If the applicant visits you, something between 5 and 15 EUR seems sensible in central Europe. If you visit an applicant yourself you may add travel expenses.
Note: if you demand money for the service of assurance this may make you a commercial service provider, which, in turn, may have other legal consequences (like paying taxes, the need for a trade license or such things), depending on the laws of your country.
You may be asked to be an Assurer at an Event. Have a look at EventOrganisation. This is a great opportunity to build up experience as an Assurer because you will be working with other experienced people, and you can discuss all sorts of issues and difficulties. This should also be reflected in your Experience Points!
Also, see Assurance Policy (POLICY) ... which should nail down the Standard of Assurance ... once and for all iang.
Maintaining a sufficient strength in the Assurance process (web-of-trust) to meet the agreed needs of the Community.
For a full-points Assurance, at least one government-issued photo ID containing the name and date of birth must be verified by the Assurer.
Acceptable forms include Passports, Drivers Licenses and National Identity Cards.
This may be customary - and even preferred - but does not actually match up with AP - as far as I can see, the only requirement is for the name to be in the photo-ID doc (AP 2.1) and that "Sufficient quality identity documents have been checked" (AP 4.3). As far as I can see the DOB in photo ID requirement is not mentioned specifically elsewhere in either AP or Assessors Handbook!
For a Name to appear in a certificate, the Member should have been verified by at least two Assurers.
Exceptions see below in "Major Variations".
Your Assurance is a CAcert Assurer Reliable Statement, or CARS. This means that anyone in the community may rely on your statement.
An Assurer may control minor variation, such as poor quality ID or missing ID, by reducing Assurance points.
It would be extremely unusual to issue full points if the Member does not have a good government-issued photo ID. On the other, such an ID does not mean full points; look at the additional documents to confirm.
the Super-Assurer programme, see SuperAssurers. This programme is administered by the board and can result in an Assurer getting more experience points temporarily. Terminated Permanently in April 2009.
Tverify, which takes certificates and other information from other CAs. Terminated Permanently on 16th November 2009.
the Organisation Assurance programme, see OrganisationAssurance.
The relevant policy text for name matching is Chapter 2.1 and 2.2 of the Assurance Policy. More specific information as well as many examples can be found at PracticeOnNames.
Usual transliterations, missing accents and similar things are accepted. So if the ID doc says "André Müller" but the name in the account is "Andre Mueller" that's OK.
Note that the reason for accepting plain ASCII representations of non-ASCII characters are usual restrictions of computer environments. Therefore it is not accepted to assure someone as "Müller" if the ID documents contain "Mueller".
[[http://en.wikipedia.org/wiki/Transliteration|Transliteration]] of characters as defined in the transliteration character table ([[http://svn.cacert.org/CAcert/Policies/transtab.utf|UTF Transtab]]) for names is permitted, but the result must be 7-bit ASCII for the full name. Transliteration is one way and is towards 7-bit ASCII. Transliteration is a way to compare two names. However transliteration of a Name makes the Name less discriminative.
In general names are handled case insensitively.
Abbreviation of second given name(s), middle name(s), titles and name extensions in the name of an individual to one character and the dot indicating the abbreviation, is permitted. If the first given name in the ID document is abbreviated, the first given name in the web account Name may be abbreviated. Abbreviation of a name makes the name less discriminative, so it is deprecated.
A Name on an ID which has initials (abbreviations) for titles, name extensions and given names, and/or transliterations as defined in the transliteration table can be taken into account for assurance for a Name in the account which is not abbreviated or transliterated.
Titles and name extensions in the name of an individual may be omitted.
The assurance ambition is to pursue a highly discriminative assured Name in the account. The ambition is to have only a Name in the account which has no abbreviation(s), no transliteration and is case sensitive.
End of insert from WiP-AP.
Naming and the writing of names is a complicated subject that follows different rules in different cultures. Even within a culture there is a multitude of difference in how names may be spelled.
Capitalization is the subset of name spelling at issue here. There are a multitude of countries in which the script used differs wildly from western letters. In such scripts capitalization may not even exist. Names that are transliterated from such scripts would then have an arbitrary capitalization, since who is to say which parts of such a transliterated name are capitalized.
The claimant has himself stated that often times names in official documents are spelled in all capital letters although the name would generally be spelled with an initial capital letter followed by letters in lower case. So it is evident that even within the culture of the claimant capitalization rules for names (especially when taken outside the context of sentences) are unsettled.
However there are instances where capitalization of names does make a difference. As an example one can think of McCain or DeHaviland. Both names are properly spelled with a capital letter at the beginning and the interior of the name. Capitalizing correctly here may alter the name significantly at least within the culture of origin.
As a result naming and name capitalization is not something that can easily be prescribed.
The purpose of Assurance is to add confidence in the Assurance Statement made by the CAcert Community of a Member.
With sufficient assurances, a Member may: (a) issue certificates with their assured Name included, (b) participate in assuring others, and (c) other related activities. The strength of these activities is based on the strength of the assurance.
5. Some personal details of the Member are known to CAcert: the individual Name(s), primary and other listed individual email address(es), secondary distinguishing feature (e.g. DoB).
The confidence level of the Assurance Statement is expressed by the Assurance Points.
If I tell you that my name is "philipp dunkel" do you then know my name?
In this specific case I would answer that question with yes. However that is a judgment call that will depend highly on the name and culture at issue. Throughout the Assurance Process the Assurer should be guided by their own sound judgment. In fact the entire system of the CAcert Web of Trust is based on us trusting an Assurers judgment. Since none of the items mentioned in point 3.1 of the Assurance Policy as guidelines resolve the issue of capitalization the Assurer is allowed, or in fact required, to use his own judgment.
There is nothing that would explicitly prohibit this Assurance from being completed at this time.
However whether the Assurer feels confident that CAcert knows the Assurees name given the capitalization, he will have to use his own judgment.
According to the AP it is preferred that all given names which can be verified in one of the ID documents are recorded in the account.
If a person has multiple given names (or middle names) at least one given name must be used in the account unabbreviated. Additional names may be omitted or abbreviated, usually to the first character with or without a dot to indicate the abbreviation.
So someone called "Bernhard Andreas Fröhlich" may create his account as "Bernhard Fröhlich", "Andreas Fröhlich" or "Bernhard Andreas Fröhlich". Initials are deprecated, but are currently tolerated, so if the said person would use the name "Bernhard A. Fröhlich" this would currently be OK.
But remember, you may not assure an Account with a name you did not see on at least one ID document! If all ID docs state "Bernhard Fröhlich", assuring him as "Bernhard Andreas Fröhlich" is prohibited!
If the name on the presented ID documents is not identical to that on the CAP form it is the best to note the name as exactly as possible somewhere on the paper, including all given/middle names. If the account is disputed later then you can remember the exact name you've seen.
According to the Assurance Policy (POLICY), multiple names are accepted, if matching ID documents can be presented.
Currently the CAcert software cannot handle them, but if you note them on the CAP form you can assure them later once the feature is implemented.
Currently this is an interpretation based on the Assurance Policy at http://www.cacert.org/policy/AssurancePolicy.php#2.1 to specify more clearly how to match names found in official ID documents with names stored in CAcert accounts.
It is intended to be a bit on the safe side and might be more restrictive as the policy itself. Also the interpretation concentrates on "western names". Though some thought has been given to other regions, it might be not suited well to special situations. If you encounter such a situation, feel free to explain it on the Education mailing list.
This probably belongs in the Assurance Policy.
This needs a linkage from Assurance Handbook that clearly explains what are the rules, how much we can rely on this document. I.e., either this document is acceptable and approved practice in Names variations as per AP, or it is ... not!
There needs to be a linking into the CPS on how the Names are used.
It is preferred that the name used in the account can be matched exactly to the name as written in at least one government-issued Identity document.
For several reasons some deviations of this preferred standard are accepted.
We assure only names, that we can find in at least one ID document.
Its allowed to reduce information, but its prohibited to add information.
Document missing names on the CAP.
It is always preferred to have the name(s) in the account exactly like the name(s) in the ID documents.
In general names are handled case insensitively. If usage of different cases is very unusual or could indicate abuse, a dispute should be filed to clarify the specific case.
According to AcceptableDocuments this would be the "official" translation in the passport. Note that if the translated/transcribed name is contained in a ID document this translation should be preferred to manual transliteration using ISO or other rules.
if an artist name is included in official ID documents it may be used in a CAcert account.
It is allowed but deprecated for german people. See the chapter on "Hyphen Rule" below.
Family name must not be abbreviated. Even if all names are given names, like for example in Indonesia, at least two names must be included without abbreviations (if present).
If there is a given name in the docs at least one has to be used.
At least one given name must be used completely.
Though a usual nickname it is not acceptable, since it cannot be found on any document.
Note: If ID documents for other alphabets also contain the name(s) in Latin characters, like many passports do, these would be acceptable even if not conforming to ISO transliteration rules, because they are contained in official documents.
Despite the fact there is a link on the join form, most suffixes cannot be accepted, 'cause they are not listed in any ID docs. So the simple rule here is: prevent adding suffixes and only accept suffixes you may find in at least one ID doc.
If you find a suffix in the online account, ask the assuree, to correct his name in the online account or if once received assurance points, ask Assuree to file a dispute.
Hence, the Assurance Statement goes some distance to detune or soften the need for pure identity documents ... as long as we can reliably get the guy to Arbitration, the precise Name and Documents matter less.
Can case be handled under Strict Rules?
Can case be handled under Relaxed Rules?
One of the requirement to allow relaxed rules is the quality in documentation by the assurers. In case of an arbitration, the Arbitrator can request required infos from the Assurer. If documentation is missing or is incomplete, the Assurer and CAcert has a problem.
For the purposes of checking the Name against PoN, a hyphen in given names is to be treated as OPTIONAL.
The reasons for this are detailed in the Arbitration Precedents Case a20100302.1.
Since, in contrary to other countries, German custom and practice considers the hyphen as an essential part which connects two given names to one single name, German members are advised to use names in their account accordingly.
But since it is not possible for Assurers to verify every aspect of name customs it is considered acceptable to leave out the hyphen and treat two hyphenated names as different names if the member insists on it.
Note: CAcert can not and will not enforce every aspects of national laws and customs.
if the Assurer has confidence into the members identity.
Note the Arbitration precedent set in a20120115.2 allows for most, if not all, of the known country variations listed below - however that listing is retained as it contains useful reference material for those from outside the countries concerned.
the assurer is convinced that the assuree can be brought into arbitration if needed.
If these conditions are not met, there is the fallback option of filing a dispute for arbitration.
ij vs. y (digraph) - Y is a known common substitution in the dutch language for IJ (see references Netherlands Language and Languages (Alphabetical Order) and http://en.wikipedia.org/wiki/IJ_(digraph)) (added 2011-02-07 by AO).
Definition: In the Dutch language, the letter combination ij is considered a single letter. It has the same value as y, and it is usually alphabetized as if it were a y.
As Belgium is bilingual you have to decide whether you are dealing with a Flemish firstname "roepnaam" then see the Netherland country variations. If you are dealing with French first names see the French country variations.
Please contact Assurance Officer if you have further details so we can update these infos.
Personal names in Chinese culture follow a number of conventions different from those of personal names in Western cultures. Most noticeably, a Chinese name is written with the family name first and the given name next, therefore "John-Paul Smith" as a Chinese name would be "Smith John-Paul". For instance, the basketball player Yao Ming should be addressed as "Mr. Yao", not "Mr. Ming".
Nominal conjunctions are optional. Nominal conjunctions are for better identification of surnames from other name parts. ID docs probably drops nominal conjunctions.
Though Spanish people generally have two surnames, one surname (generally the paternal) is sufficient. Portuguese people have up to four surnames, here again one is sufficient.
If a name is written as LASTNAME, Givenname on the CAP form, the Givenname and Lastname part are identifiable as this is a known definition on writing names.
and I am sure there are many more examples...Γεώργιος and Ιωάννης are the two most common greek male names though.
This discussion is about Assurance: matching ID documents with the names recorded in a CAcert account. What it is not about, or is less about, is what Name (if any) goes into the CN of certificates.
Assurance Policy may provide methods for variations for Names in the CN, such as transliterations and short forms.
u60 - x1) read "Top Down Procedure to handle Strict and Relaxed Rules"
http://en.wikipedia.org/wiki/List_of_personal_naming_conventions and http://en.wikipedia.org/wiki/Family_name for some background about personal names.
Arbitration Case a20090618.12: An example of an accepted country variation.
Dates - the magic 8 numbers ... seems to be complicated to new members also to Assurers. New members, who enters their DoB into the online account and didn't noticed the missing number, as they'll enter their DoB on a recuring basis and their keyboard has a hiccup. There are many more error conditions, that makes the DoB checking a challenge of its own.
As yet to be known.
As long the date can be identified clearly (12 can be a month, 4 too for above example), but in 30.03.1980 a switch between day and month is impossible, the format on the CAP form can be used freely.
All these errors applies to errors on CAP forms AND all these errors applies to errors in online data !!!
In principle, children or minors or juniors can also be assured. There is no minimum age set by CAcert.
There are, however, some difficulties that need to be taken into account.
The way that persons enter into CAcert's Community is by agreeing to the CCA. This is in effect a legal contract, and in general, entering into legal contracts is for adults, not minors/juniors/children.
This is one area where you should be aware of your country's laws, if they apply.
In general, a minor may be able to enter into an agreement with permission of the parent or legal guardian. So you can ask for a co-signing of the form by a parent or legal guardian. However you should stress that the form is signed first by the minor, and then counter-signed by the parent.
Treat the minor as an adult, with respect, always. One day soon, she will be.
You will likely have to test points of understanding with both the Member and the parent.
Acceptable photo IDs are not so useful for young people under 10.
Basically, this may result in some interesting Arbitrations. An Arbitrator may have to take into account that the CCA is not as strong in the case of a minor.
Does it make sense to assure children at infant age? The reason I'd not assure infants (let's say up to age 14) is that they protect their credentials against theft even less well than most grown ups.
Proposed is a ParentsKit, a CAP form related form that describes the consent and the required confirmation for becoming assured for the Junior Member. This ParentsKit should also include an informations package for the parents, what is CAcert, what does the CCA mean and so on, to be aware that the parents will understand easily what happens with the assurance. Please also add your phone number or an email address to the package, where the parents gets additional infos, where they can ask additional questions. The assurer has to make an arrangement how the signed ParentsForm receives the Assurer and the signed parents form can be returned to the Junior Member, maybe possible by snail-mail, or a second face-to-face meeting. The assurer has to notify the parents confirmation and that he has seen the signature from the parents, probably by a copy or an additional statement onto the CAP form. This procedure is for a single form carried by the Junior Member for showing to the Assurer, rather than a parent's signature over each individual CAP form.
The Junior Member asks an Assurer to assure him.
The first Assurer hands out to the Junior Member a ParentsKit that includes a ParentsForm and an info package.
The Assurer returns the original ParentForm to the Junior Member for future assurances.
A scanned ParentForm is not sent back by email.
Mutual assurance should be done where practical (AP4.2). Note that an assurance is always at the request of the Assuree and the agreement of the Assurer, so mutual assurance remains a voluntary process for both sides.
it helps experienced assurers to pass knowledge to junior assurers about new and better practices.
it can slow down the process, which will be a nuisance at booths where there are crowds.
if the other member is not an Assurer, she may not be ready or familiar with the responsibility of keeping the CAP form safe (you may have to do that).
Conducting a Mutual Assurance with another Assurer is easy, and the process is mostly left open to you and your partner-Assurer. Here are some tips.
use phrases like "I do it this way," rather than "you should do it that way."
explain your logic for any variation. Ask her to explain hers.
even if you know the answer, allow a journey of discovery. Instead of saying "policy X says Y," try this instead: "I wonder what policy X says?" And look it up (of course, you will need to have the copy there as well).
do not use Arbitration as a weapon. Instead of saying "or else you'll face Arbitration," rather say this: "In the end, we might have to ask the Arbitrator to decide which way is best."
Conducting a Mutual Assurance with a Member who is not yet an Assurer is harder than an ordinary Assurance. But it is more valuable, because it is a really good way to train the Member towards becoming an Assurer!
Take an extra CAP form, or use a CAP form that is designed to be mutual (includes the same detail for both parties).
After doing the process on the Member, ask her to take the forms and repeat the process it on yourself.
Coach the Member as she does the steps.
Explain why we do it that way.
Allow her to make mistakes, and then explain gently the nature of the mistake.
Ask questions to make sure she understood what she has done.
Do not go too deep, do not get into detail. Concentrate on the essentials, and be prepared to compromise on detail. The essence is the overall feeling of the Assurance, not on getting every detail correct. Details and perfection come later with the Assurer Challenge.
Once the checks over the Assurance Statement are done by her over you, she is now ready to allocate Assurance Points to you.
She can allocate 0, 1 or 2 Assurance Points to you.
Coach her in what the points mean.
It is entirely up to her judgment as to how many points.
Indeed, encourage her to be critical, and if it is her first time, issue 0 points to you. For example, if she is unfamiliar with the process, how can she be familiar with the meaning of the points?
In this process, you yourself are not collecting more Assurance Points, but instead training a future generation of Assurer. Your mission is to teach her the best ways and understandings.
Once she has allocated the points, have her write them onto the CAP form(s).
Because you are the Assurer, you are totally responsible for the results.
She is not responsible because she is not an Assurer.
You should keep the primary forms.
If she is taking copies away, that is OK too. But advise her of the Assurer's 7 year responsibility, and write that on the form. She now holds your privacy data.
At the moment, there is no way to enter these points into the system.
These points will have to wait for a future system enhancement. So for the moment, the result is lost.
But the real benefit of training remains.
This above procedure can and will change as we get more experience.
Who keeps the CAP form?
you should share sufficient information with the Member to protect her. For example, your email address and Name would be a minimum. A business card would be a good idea.
Mutual Assurances are highly recommended.
Likely these things will become standard in the future (see 20090517-MiniTOP on Assurance), once Assurance Team figures out all the details. Let us know your experiences.
An Assurance is a CAcert Assurer Reliable Statement, CARS for short. It is the primary one you make to the community, as part of our overall Assurance process, or web-of-trust.
reports prepared by system administrators on changes to the software are relied upon by the Board, and can be verified and scrutinised by audit.
co-auditing involves senior assurers checking the assurance process, and making reports back to the Assurance Officer and Auditor.
Event Coordinators are required to make sure that all Assurers at an event follow Assurance Policy, and report this back to board.
In order to signal a statement of reliance, you can add the term "This is a reliable statement." or CARS to the end of your name. This is useful if it is not totally obvious that your statement might be relied upon. And will rob you of some excuses if the statement turns out to be false and you end up in an Arbitration. "Obviously this was an ironic statement" won't work anymore!
Ted 20180904: I'd prefer the explicit "This is a reliable statement." because it is easily recognisable by everyone, not only by those confident with CAcert terminology.
Everyone may ask for an explicit reliable statement from you. Normally you are not required to give one (unless you are obliged to assist for some reason, as in an Arbitration), but if you choose to give one you are bound to it!
This is a reliable statement.
To construct its global web of trust, CAcert uses a metrics system called Assurance Points to measure how well we know you.
The number of Assurance Points measure how much you have been verified in Assurance processes and other approved processes, as per Assurance Policy (POLICY). They go from 0 (new Member) to 100 (fully assured Member).
This Member is not assured and her name cannot be included in certificates.
her certificates will expire after a maximum 6 months.
With more than 0 points, the personal details cannot be changed anymore by the Member.
Each Assured Name can be added to a certificate.
Server certificates are valid for 2 years.
You can get a signed PGP/GPG key.
the maximum number of points one can get from other Assurers.
Code signing authorisation may be requested.
Currently points acquired do not "expire" or "decay", but this might be changed in the future.
For every assurance, an Assurer generally gets 2 points, up to the maximum of 50 points.
Note that this system is currently unimplemented, and the experience is collected as points in the Assurance Points scheme, being points above 100. See below.
Note: The meaning of the points has changed since the new [[http://www.cacert.org/policy/AssurancePolicy.php|Assurance Policy (POLICY)]].  The change split the old points into Assurance Points and Experience Points.
Before, they were the same points system with different meanings, below and above 100 points. Below 100 the number of old points showed the amount of trust CAcert had in your identity. The points above 100 made a statement about your experience as an Assurer.
Now, there are two points systems, one for each meaning.  Assurance Points ONLY show how well you have been assured.  Experience Points indicate how well an Assurer can do their job.
The separation of Experience Points has not as yet been implemented in the online system.
For each assurance done, an Assurer is given 2 Experience Points ("EPs"). There are also some exceptions such as 5 EPs for attending an ATE (currently its technical impossible).
When an Assurer has gained the full 50 EPs, probably by conducting 25 assurances, the Assurer is often termed an Experienced Assurer.
This definition was reached at the Brussels MiniTOP on Assurance.
A co-auditor is a very experienced Assurer who helps the Assurance Officer collect results suitable for verifying the entire system of Assurance. These results are collated for audit over CAcert.
A co-audit or a co-audited assurance is an assurance that you the Assurer conduct over the co-auditor, see above. This is done as a Quality Assurance activity so the Assurance Officer has some means to judge the quality of the Assurer Network, as it is requires by the Audit Criteria.
During the assurance, the co-auditor checks lots of things and records the results. There is no fail for this. At the end, you should get some helpful feedback.
Co-audits are most often conducted during ATEs, so you should try and attend.
For each co-audited assurance data is collected and stored in a database as directed by Assurance Officer. Each record includes the email address of an Assurer as a unique identifier, a collection of pass / fail / not tested results of a seasonal test set, and some context data (location, number of experience points, attendance at ATEs).
The co-audit project is initiated by DRC-A.2.y, it is instantiated into policy within TTP-Assist 5. (In coordination with internal and external auditors, the Assurance Officer shall design and implement a suitable programme to meet the needs of audit.), and is further controlled under AP 6.2 High Risk Applications.
Such an account is the link between the Member (person) and the CAcert system, and information regarding the member (like name, DoB, assurance status) is linked to that account. Although there is no rule that forbids having two or more accounts, it is not recommended, since it can cause problems.
There is no rule that forbids a CAcert Member to have two accounts with assurer status. However, a Member with assurer status assures, and uses a CAcert account to register the assurance. Since an Assurer can only assure another member (a person) only once, it is forbidden for an assurer to assure a single person and register that assurance with more than one account. An assurer can only give the number of points linked to the account that is used to assure someone. Therefore, since having multiple assurer accounts is not required, it is strongly advised not to allow them.
Ruling: An assurer cannot meet himself/herself face-2-face. Therefore all assurances by Respondent of accounts of the Respondent are invalid and must be revoked incl. revocation of experience points.
Ruling: As long as each name in each account is only assured by one assurer up to the maximal number of points that the assurer may award and as long as the assurance process is followed for each assurance separately and nobody assures accounts of themselves, the AP is honoured.
Ruling: Assuring multiple accounts of the same person may not be used to excessively push the experience points of an assurer. A single occurrence of an assurance of a secondary account of an assuree cannot be seen as such a push.
Ruling: An assurer of multiple accounts from the same person should nonetheless be advised to consider the reasons why the assuree requests an additional assurance.
Comments: CAcert when it started in 2002 required that copies of ID's were archived for 7-10 years in the archives of CAcert or archives of CAcert Assurers. In a later instance CAcert required to take note of ID numbers and/or social security numbers of the individual. For privacy reasons both (copy of ID, personal numbers) were dropped. The CAcert Assurance Programme form states that the information should be kept 7-10 years. CAcert Inc. drops the requirements for copies of ID and personal numbers and decides to remove these information from the CAcert archives and requires the CAcert Assurers who are in position of that information to do the same. The information should be deleted with care.
Copies of ID are not needed for operational purposes and are not compliant with European privacy Directive (EU DPA).
Actions: delete paper and digital copies from archive; denote the action and decision in CAcert blog; ask CAcert Assurers to follow CAcert decision. Blog on DoB and Copy IS drop done as well board order to destroy them by operators/adminsitratores has been given in May 2008.
Section 6.2 falls under the 6. Subsidiary Policies section.
This doesn't mean, that its allowed to make a photocopy of identity documents, but maybe Subsidiary Policies can define such actions.
Also an Arbitrator may request a photocopy of an identity document. But this are all individual events and by request.
As section 6.2 High Risk Applications says, to take a photocopy is a High Risk Application. So therefor CAcert has decided by a board motion back in 2008 that this action is not in compliance with the EU DPA and therefor dropped it entirely.
You are CAcert's "face to the customer". So you should be able to give at least some basic information about CAcert itself.
CAcert is a non profit association incorporated in Australia. It is supported by a growing community of assurers (like you) who are part of a "Web-of-Trust" for identity verifications.
CAcert is a community of like-minded people working to improve our security, generally circulating around PKI technology based on x.509 "certificates" and PGP's web-of-trust.
make security affordable and available for everyone.
secure the Internet and increase trustworthiness.
For more information see the Principles of the Community.
CAcert is a "non-profit" community of volunteers. It is independent from commercial CA's.
Some CAs issue free certs, and some use a WoT, but they tend to only issue low-level client certificates, but no server certificates or strongly verified certs. These free certs are intended to drive you to their CA so they can sell you higher value products. There is nothing wrong with that (your supermarket does the same thing) but it might not be appropriate to your needs.
Arbitration is CAcert's main channel for dealing with anything unexpected or unusual that might go wrong. This includes complaints about inappropriate conduct of an Assurance, invalid or inappropriate data in any member account, or inappropriate usage of certificates, but also unclear policies or practices. Indeed, just about anything may be disputed, and the policy documents often defer difficult issues by simply saying file a dispute. In this way, the policy documents and Arbitration work hand-in-hand: Policy handles the expected and the easy; Arbitration handles the unexpected and the hard, and both of them together provide the foundation for all work done in CAcert.
As a part of accepting the CAcert Community Agreement (CCA), every member accepts Arbitration according to CAcert's Dispute Resolution Policy (DRP). Anyone who has a complaint about anything relating to CAcert may file a Dispute by sending a mail to mailto:support@cacert.org. You will be notified of any dispute via your primary email address, so you are required in CCA to keep this working.
Once a dispute is filed and notified, an Arbitrator is chosen by CAcert from amongst our own senior and experienced Assurers. Arbitrators are strongly familiar with the policies, rules, principles, customs and specialties of CAcert. As an Assurer, you should be somewhat familiar with the rules, and at the least, know where to find them so as to answer basic questions from members.
The ruling is binding on you, all members, and CAcert itself. It is generally published so that all the Community can watch and govern the system, and we can improve our policies and practices over time.
As we use Arbitration for all sorts of unusual and difficult questions, being named in an Arbitration is no bad thing, in and of itself; indeed, it is a mark of experience to participate. One day, you may be asked to sit as an Arbitrator, and this will likely require you to have been named in Arbitrations already. You can find more details and many references at our ArbitrationForum.
CAcert has introduced Arbitration as a protection for its members.
Normally, if something goes terribly wrong, you might be dragged into a civil court to face a lawsuit. Especially, as CAcert provides certificates making statements about people across the world, it is highly likely that any lawsuit would be filed in a country far away. In your country, the system of justice may have a reputation for looking after you, but this is not true of all places. At a minimum, remote systems of justice will be difficult and expensive for you to understand and navigate, even if they are fair. As well, there will be expensive lawyers, and you may be hit with a harsh judgment that does not fully appreciate what certificates are about and what we as a Community are about. Even if the court rules in your favour, it could be a Phyrric victory, one that you could not afford.
You agree, with CAcert and all of the Community, that all disputes arising out of or in connection to our use of CAcert services shall be referred to and finally resolved by Arbitration under the rules within the Dispute Resolution Policy of CAcert (DRP => COD7). The rules select a single Arbitrator chosen by CAcert from among senior Members in the Community. The ruling of the Arbitrator is binding and final on Members and CAcert alike.
You should be familiar with that clause and how to explain it to new and prospective Members.
Most countries have Arbitration Acts in place as law (see for example the German Arbitration Act (The text of this act, entered into force on 1998-01-01, is integrated into the Code of Civil Procedure, Book 10, Article 1025 ff)) that permits and even encourages internal Arbitration such as ours. This makes sense where a local or specialised community might have a better understanding of their own conventions and rules, where international affairs make it impractical to choose a neutral or cost-effective court, and where the real natures of the disputes do not justify the expense of the courts (and especially the lawyers).
These aspects are a natural fit for CAcert because we are in a complex international environment of Assurances, the Internet and certificates. The Arbitration Act provides us with a way to deal with any disputes internally, rather than going to courts, which likely are in far away countries, involve expensive lawyers, and have little knowledge of the process of certificates. Hence, we achieve a balanced and cost-effective legal approach across the entire Community, which applies to you as well as every other member, and to CAcert itself.
In the event of any lawsuit filed against you in relation to your CAcert activities, you should ask the court to refer the case back to Arbitration, citing the above clause and Act. There is no guarantee that a case will be so referred, and criminal cases are not referred, but as a matter of public policy courts will routinely refer cases back to Arbitration where this was the agreement.
The intent is to protect you and all members. This means that, in order to protect other members, an Arbitration case may result in some penalty imposed upon you if the Arbitrator finds that you were acting against CAcert's policies, rules and/or principles! See DRP section on remedies for more details.
Forms stay with the assurer and are only forwarded to CAcert under special circumstances.
From the outside it is not evident who assured whom, the online system keeps that information private.
CAcert will not give any data to third persons or third parties, except when ordered by an Arbitrator during dispute resolution.
for current data, go to the website, click on About CAcert.org at the right, then on CAcert Statistics. Do this manually, the link isn't published because the statistics collection is live and this slows the server down a lot.
While assuring people they may ask you some technical questions. Just to help you to pose as a real crack, here are some basics.
"Public key cryptography" works with pairs of public and private keys. Each key in the pair can be used to encrypt data that can be decrypted only by someone with the other key. By convention, one of the pair is designated the "public key", and the other is designated the "private key".
The private key is kept secret and protected. It is never shared.
The public key is made available as broadly as possible since this is the one that can be used to encrypt data that only the owner of the private key can decrypt. It also allows decryption of data which has been encrypted by the private key.
So if you want to send someone an encrypted message you need your partner's public key. If you loose your private key you cannot decrypt messages sent to you any more.
By encrypting a document's hash value with your private key you can create a digital signature, which everyone can verify using your public key.
The public part of the key can be created from the private key (really?), but the public part does not allow anyone to guess the corresponding private key. Or better, it is really very very hard to guess the private key from the public part if the private key is "big enough".
A digital signature is a kind of "seal" attached to a document that guarantees that the signed document has not been changed since the creation of the signature and it guarantees that it was created by someone who has access to the corresponding private key.
Technically speaking it is a hash value of the document encrypted by the private key of the signer. There are many different ways to implement this.
A certificate in this context is a "document" containing a public key, some information about the owner of this key, and a signature from a Certification Authority ("CA").
Certificates following the X509 standard (including those issued by CAcert) contain issuing and expiry dates, hashes (or "data fingerprints") used to validate the certificate, and a unique serial number. In addition, certificates generally include some information about the user, such as the name or email address.
the "Certificate Practice Statement" (CPS) generally states the meaning of the certificate and what checks are made to support this meaning. In theory, you should examine a CA's CPS very closely before deciding what to do with any given CA's certificates. For CAcert, look for the relying party statement and then look at the Assurance Policy to see what the source of that information is.
the "Relying Party Agreement" (RPA) is where the legal info is, and in particular whether you have the right to do so. For CAcert, this is the CAcert Community Agreement.
errrr ... the certificate certifies something, the "subject" of the certificate. Ordinarily this is the e-mail address of the owner, and name if s/he has enough assurance points, or the web address/domain of a web server. The last sentence of the previous paragraph makes it seem that both e-mail address and name are optional for a client certificate, when in fact at least one should be there, otherwise what is the certificate certifying?
You can generate certificates for https servers. Though at the moment CAcert's root is not included in standard Mozilla and Internet Explorer, it is already included in several Unix-like distributions.
And it's easy to install CAcert's root certificates manually.
These can be used to encrypt and/or digitally sign emails. See ClientCerts for our growing list of places you can yse your client cert. They may also used as a way of authenticating with web servers, like the certificate login on CAcerts website or VPN servers.
If you are an Assurer, you can get certificates signed/issued by CAcert for code signing and IDNs (International Domain Names).
Due to the increased possibilities for abuse those certificates have additional requirements. The CPS states that this requires Assurer level, which you meet if you are reading this Handbook. However note that as of 20091106, there is a move to reduce these requirements. Watch this space.
Get your PGP keys signed by CAcert's key. This should considerably increase the trust in your PGP key since many people trust CAcert's signature.
CAcert offers online certification verification via the Online Certificate Status Protocol. Whether your applications actually use it, is another question.
Best places for technical help are the wiki and IRC, see the #Appendix below.
Support is maintained by the Support Team, as directed under Security Policy Section 8. The Channels of support are listed in the Security Manual.
As an Assurer, you should consider joining the support mailing list and helping out. Or, hang around the IRC chat room.


The cost of these events is $50.00 per event.
You may only register for one monthly hiring event each month.
Employers may start setting up at 12:30pm. The events run from 1pm to 3pm.
Stop by and browse the "pop up" boutique at Workforce Development Center. OI Closet is a free service that offers gently used professional and leisure clothing and accessories for individuals within the community. Stop in and get some updated threads for your next job interview!
Booth space is limited to 120 employers. Please note the time change to 11am to 3pm.
There is a bundle rate if you register for both events, 3/20/2019 and 8/28/2019 and pay by 2/20/2019.
Your booth fee must be paid in order to guarantee your spot.


Suspect was seen on CCTV entering changing room with merchadise and putting it on under her clothes. She was brought to backroom and suspicions were confirmed. Suspect was motivated to keep infraction off books.


Elisabeth Ditomassi is not the type to shy away from a challenge. In her former role as General Counsel and Deputy Commissioner of the Massachusetts Division of Insurance, Elisabeth tackled head-on some of the most pressing regulatory issues to face the industry in the Commonwealth for decades, including the introduction of competition into the Massachusetts personal auto insurance market. These days, however, Elisabeth is taking on new challenges, this time at the helm of U.S. Compliance and Regulatory Affairs for Beazley Group, an emerging presence in the U.S. property and casualty market.
I recently had the pleasure of sitting down with Elisabeth to discuss her unique perspectives on the insurance industry and her transition from the halls of state government to her new, in-house role. Given Elisabeth�s energy and tireless enthusiasm for her work, as well as her disarming and affable nature, it is not at all surprising that she has risen so far so quickly.
Like so many who find themselves working in insurance, Elisabeth ended up in the industry by pure chance. After graduating from Boston University School of Law, Elisabeth worked as an attorney in both private practice and state government. Her roles included working as a litigation associate at a small Wall Street law firm, and later, the law firm formerly known as Kirkpatrick & Lockhart; serving as a prosecutor of public corruption for the Massachusetts Attorney General; and working as Chief of Litigation at the Massachusetts Department of Revenue. In 2003, when Elisabeth was seeking a general counsel position, an opportunity opened up � by chance � at the Massachusetts DOI, where she went on to serve as General Counsel and Deputy Commissioner for seven years. Elisabeth�s position at the DOI was her first, but certainly not her last, position in the insurance industry.
At the DOI, Elisabeth wore many hats. A few of her many roles included monitoring and participating in all litigation involving the Division, presiding over administrative hearings, reviewing and analyzing all insurance-related legislation that had any likelihood of becoming law, advising the commissioner on numerous matters, working with the Governor�s counsel to carry out certain objectives affecting the insurance market, and drafting regulations. However, Elisabeth�s favorite role was that of policymaker. �It was a blast creating policy,� Elisabeth observed; politics, however, sometimes dampened some of the fun involved in that endeavor.
When asked to opine on the biggest misconception about the Massachusetts DOI, Elisabeth noted that the �the industry often underestimates and undervalues� the Division: �I worked with some of the hardest-working and committed individuals in my career [there]. They really care about sustaining a healthy market and protecting consumers from bad practices. They work very hard to achieve these goals and often under less-than-desirable circumstances, including a shortage of resources.� Significantly, Elisabeth observed that although Massachusetts has the tenth-largest insurance market in the country, its department of insurance has the smallest budget (in relation to premiums) of any in the nation.
Beazley is primarily a property and casualty writer in both the admitted and the non-admitted markets. The company started in the United Kingdom twenty-five years ago and made its debut in the U.S. market around 2005. Beazley has eight offices in the United States; a thriving business in the U.K. and other parts of the E.U.; and operations in Australia, Singapore, and Hong Kong, among other locations. Elisabeth describes Beazley as an �innovative company that likes to specialize in unique risks.� One of Elizabeth�s primary tasks is helping Beazley navigate the regulatory waters during this time of expansion and growth.
Beazley�s international presence poses complex challenges for someone in Elisabeth�s shoes. As she describes, �U.S. and Global Compliance move in lockstep.� While foreign regulators do not have a direct impact on U.S. operations, their mandates still instruct the manner in which Beazley formulates its company policies in the U.S. For instance, Elisabeth was recently involved in formulating U.S. company policy in the wake of sweeping anti-bribery legislation that was passed in England. As Elisabeth explained, although U.S. operations are not formally subject to the new English legislation, it is necessary to make sure that U.S. operations are conducted in a manner consistent with the new legislation so as not to adversely impact U.K. operations or U.K. regulatory compliance. With its global operations growing continually, Elisabeth must be mindful of the multi-national aspect of Beazley at all times, even though her focus is on U.S. regulatory compliance.
In addition to keeping busy with her new position, Elisabeth also devotes her time to developing young attorneys and giving back to the legal community. Elisabeth teaches LLM courses to students enrolled in Boston University�s Banking and Financial Law program. She is also a distinguished member of the Commonwealth�s Board of Bar Overseers and an active member of MReBA.
Elisabeth also finds time in her busy schedule to devote to her husband, Tom, and several hobbies. She describes herself as an �antiques fanatic,� and she has a particular affinity for Georgian jewelry and early American silver. Our aim is to supply cheap burberry bags,replica iwc watches,replica cartier watches and replica breitling at very affordable prices.
If you would like to discuss the issues raised in this article, you can contact Elisabeth at Elisabeth.Ditomassi@beazley.com.
Kristin Suga Heres may be reached at kheres@zelle.com.
� 2011 Zelle Hofmann Voelbel & Mason LLP. All rights reserved.


This box is a bit smaller than my last one, but it fits every token for each faction and all of the other tokens into it. It doesn't fit the dice though, and the combat/ reinforcement tokens share a slot, which is sad. But the box is just the right size for the space in the box, and I can live with having the dice in a plastic bag and the combat tokens sharing space.
The label was made using official artwork from Fantasy Flight Games, which I then cut up into the four section graphic. The golden border and game logo were taken from a scan of the rulebook and then cut out using the pen tool in Photoshop.
When it was all finished, I printed it on glossy brouchure paper, rather than sticker paper like the SDE one, and then I sprayed it with gloss enamel to help protect the ink.
Once it was all dry, a little cutting with the hobby knife and it was ready to adhere to the box. This was done with spray glue and carefully mounted to the lid of the box.
Overall, I'm really happy with this one, except for the Chaos Marine which turned out a little dark and is sometimes hard to see. Either way, it's always nice to flex my graphics training, since I don't use it in my everyday job.
I have one more token box to make and it's for Space Hulk. More info on that one soon.


We offer half hour and hour long dog walks in Leamington Spa locations that your dog will love. We treat each dog like we would our own.
Do you live in Leamington Spa or the surrounding area and need the services of a dog walker? If so then we think we offer the quality of service you and your dog deserves.
Perhaps you work long hours during the week or a change in personal circumstances means you are no longer able to walk your own dog. Our service is both reliable and professional, meaning you can be sure your dog(s) are in good hands.
Our group walks are limited to a maximum of 4 dogs at once. This means we can give each dog the attention it deserves and also limits the time they spend in our vehicle. Our dedicated vehicle is ideal for transporting animals and is fitted with Lintran safety cages.
All dogs must be microchipped. We also insist on dogs having an ID tag on collar or harness. We can supply ID tag with our details if needed.
Any cancellations must be notified to us by 8:00pm the evening before the walk. Failure to notify by this time will mean the walk is charged. Cancellations can be by phone, text or email.
Payments for walks must be in advance. Most clients pay at the weekend for the walks they require the following week. Payment can be either by bank transfer or cash.
Make sure they are covered for all the services they offer.
Does the person you are giving a key to have a criminal record?
Has your dog walker taken a first aid course?


It all started with the advent of Marshmallow or Android 6.0 when the search engine giant Google offered additional control to the Android device users regarding an Android app's access to capabilities or information aka permissions. In other terms, the user can control what type of data an app can access after installation from phone memory. Google's permission-related new approach has brought a radical change in Android app development. App permissions are aimed to protect sensitive information stored in a device through restricting the access.
Android 6.0 and upper versions have the app permissions available as Body sensors, calendar, camera, contacts, location, microphone, phone, SMS, and storage, and the developers have to keep them in mind while building the app for these versions.
App permissions act as a double-edged sword in the domain of Android app development. On one hand, they are necessary for ensuring a smooth functioning of an app, and on the other hand, they are inversely proportional to the number of downloads. It is noteworthy that asking for fewer permissions lead an app to more downloads. One study has revealed that users are 3 times more likely to download the app with fewer permissions requests as compared to the app that requests more permissions.
The user's approach of downloading apps that require less permission has brought the downward trend for permission requests. A recent Play Store analysis showed that Android app developers tend to reduce permissions after publishing their apps, which clearly suggests that they may be exercising more caution in declaring permission groups.
In brief, the number of necessary permissions plays a vital role in deciding the number of app downloads. Let's go through a few of the best practices for app permissions.
Permission requests protect the sensitive information by restricting access. Only the information necessary for proper functioning of an app is accessible thanks to app permission requests.
System intents, backgrounding for phone calls are a few alternatives to get what you need for the seamless functionality of an app. Such alternatives can eliminate the requirement of depending on sensitive information and help you reduce the number of permission requests.
For example, if you develop an app that targets Android 4.4 or higher version, it has an automatic access to external storage directory, and you need not request the READ EXTERNAL STORAGE and WRITE EXTERNAL STORAGE permissions. MediaStore.ACTION IMAGE CAPTURE and MediaStore.ACTION VIDEO CAPTURE are two system intent action types for capturing images and video respectively without directly using the smartphone camera. You don't require the permission for using the camera as the system intent will ask for the permission of using the camera every time on your behalf.
During Android app development process, at times, you use libraries, and permissions are required by the libraries. For example, libraries related to ad and analytics may need Location or Identity permissions groups. But the user considers it as your app's permission request. It is, therefore, advisable to review your libraries and select third-party SDKs that do not use unnecessary permissions. You should care for the permissions the libraries require and their ultimate use.
It is better to keep the objective behind making permission request for the specific access clear so that the app users can make informed decisions. You can consider putting this information alongside the permission request. A research revealed that users feel less uncomfortable with permissions request if they have a clear idea about why the app needs them.
In other words, if they know the purpose associated with a specific permission, they can willingly give permission.
How about giving a continuous indication about accessing sensitive capabilities like the camera or microphone to the user? Well, explicit system access can make it clear to the users when you are collecting the data through access. It helps you keep your users away from any wrong perception regarding data collection.
Android app development is thriving and at the same time, becomes a highly competitive domain. Such best practices regarding app permissions can help you build the trust among your app's users and you can get more and more downloads for your app as an outcome.
As a developer, you should keep these notable tenants in mind during Android app development to get the most from a green robot!


text:
PCMag UK Computers & Electronics Laptops Netbooks
Lenovo ThinkPad X1 Carbon (2018) Review
The Lenovo ThinkPad X1 Carbon offers premium features in a slim and attractive package that business users will love—just be prepared to open your wallet wide for this top-notch ultraportable laptop.
byTom Brant Mar 06, 2018
Best Deal£1367.1
Lenovo £1367.1
Premium build quality.
Thin and light.
Very good battery life.
Quick charging.
Finicky touch screen.
Anemic speakers.
No Ethernet port.
The sixth-generation Lenovo ThinkPad X1 Carbon (starts at $1,519; $1,789 as tested) is more of a status symbol than the workhorse ThinkPad that business users know and love. But incredible battery life and a pleasingly premium soft-touch chassis, among other features, mean that this ultraportable laptop is far from a gimmick. It even brings back a few things that were removed in last year's model. All told, the X1 Carbon delivers most of what we love about the ThinkPad T470 in a much smaller package, which makes it the best high-end laptop you can buy for your business.
Familiar Looks
The consumer ultraportable laptop market is flooded with head-turning designs (see, for instance, the vanishingly thin bezels on the Dell XPS 13 or the snow white expanses that adorn the HP Spectre 13), but ultraportables meant for business can be far more stodgy. Lenovo is somewhat responsible for this trend, since its chunky black ThinkPad notebooks have been the gold standard in enterprise mobile computing for years.
With the latest X1 Carbon, however, the Chinese tech giant fuses a traditional black aesthetic—complete with a slightly soft exterior of carbon fiber and magnesium alloy that makes it feel so premium—with a thin screen bezel and a light weight. The result is an ultraportable that weighs just 2.49 pounds, measures 0.63 by 12.74 by 8.55 inches (HWD), and still manages to fit in legendary ThinkPad characteristics like a comfortable keyboard, long battery life, and a semi-rugged enclosure. The ThinkPad T470 ($881.10 at Lenovo) , by contrast, is 0.79 by 13.25 by 9.15 inches and weighs 3.74 pounds.
And yes, in case you're wondering, Lenovo throws in a red pointing stick to please the most discerning ThinkPad purists. Why you'd still use one is a bit of a mystery, especially since Lenovo has also brought back a touch display, which was missing from the last generation of the X1 Carbon.
You can also upgrade to either a glossy or matte QHD (2,560-by-1440) display that lacks touch capability. This high-end screen is targeted at well-heeled enthusiasts rather than corporate IT departments, Lenovo said at CES this year when it unveiled the new X1 Carbon. The glossy version promises to be the first HDR laptop screen once an update is rolled out this spring to unlock the Dolby Vision functionality on the software side. You'l likely take a battery life hit by choosing this configuration, however.
The 14-inch full HD (1,920-by-1,080) touch screen on our base model Carbon X1 is still unique, in both good and bad ways. Instead of adding weight and complexity to the screen by enabling touch the old-fashioned way, with a protective layer on top of the display, Lenovo engineers instead added capacitors directly into the screen. The result is a matte, anti-glare touch display that is perfect for bright office environments and easy on the battery, but that also includes touch for when you need it.
Ideally you won't need it too often, though, because the unconventional integrated capacitors are much less precise than you might expect if you're used to tapping on a glossy screen like the one that comes with the HP Spectre 13 ($1,099.99 at HP) . The X1 Carbon's screen isn't very responsive, but whether that's a worthy sacrifice for an anti-glare screen is a matter of personal preference. Note also that the touch capabilities of the competing MacBook Pro are relegated to the TouchBar.
Along with the screen, you can also upgrade the memory, storage, and hard drive (which will increase the price to more than $2,000). You can also choose a silver version that ThinkPad purists will likely scoff at. This entry-level model is equipped with an eighth-generation Intel Core i5 processor, 8GB of RAM, a 512GB SSD. The processor and memory might initially seem a bit anemic for a laptop that costs more than $1,700, but they can handle most common computing tasks with aplomb, as you'll see in the performance section below.
Luxurious Keyboard
When you're not tapping, you'll likely be luxuriating in the X1 Carbon's backlit island-style keyboard, which boasts excellent travel and supremely sturdy, sculpted keys. This is largely the same board we loved on the ThinkPad T470, and the fact that Lenovo manages to stuff it into a much thinner chassis is impressive. I appreciate that the Fn and Control keys are swappable using the Lenovo settings app, which means you can decide if you'd like the outermost key to perform the Control function as it would on a standalone keyboard.
The clickable touchpad is better than you'd expect for a Windows laptop, but it's rather small and can't match the excellent Force Touch capabilities nor the gargantuan size of the one on the MacBook Pro. Next to the pad is a fingerprint reader complete with its own processing chip, so that it verifies your prints on the chip without Windows having access to them, a security enhancement that's new on this year's X1 Carbon and sure to please wary corporate security managers. Other corporate-friendly features include Intel's vPro management and an integrated cover for the webcam when you're not using it, but there's no keycard functionality like you'll find on a business workstation.
The port selection is excellent for such a thin machine. Unlike Apple, which equips the MacBook Pro ($1,119.00 at Amazon) solely with USB-C ports, Lenovo gives business users several more options. There are two USB-C ports with Thunderbolt 3 support that are also used for charging, as well two USB 3.0 ports and an HDMI-out port. The left edge also features a dock connector for the new ThinkPad dock (old ones that connect to the bottom of the laptop won't work), while there's a Kensington lock slot on the right. There's even a microSD card slot located at the back of the laptop, in the same enclosure that houses the SIM card for cellular-equipped models.
Your only disappointment will be if, like us, you expect to find an Ethernet port on your business laptop, which can make your life much easier if you're faced with poor Wi-Fi in a hotel or crowded banquet hall, but manage to find a wired connection. At least there's 802.11ac Wi-Fi and Bluetooth 4.2 to help you stay connected.
Impressive audio isn't expected on an ultraportable, and the X1 Carbon didn't surprise us. It offers present if not startling bass and treble, but the downward-firing speakers aim directly at your desk or lap, resulting in an anemic sound.
Lenovo includes a one-year warranty with mail-in hardware support for the X1 Carbon.
Power on the Go
Let's face it: You're not buying ultraportables for the multimedia content creators, programmers, and data scientists in your company. You're buying them for workers whose jobs entail word processing, email checking, and maybe some light Excel work. The Intel Core i5-8250U processor running at 1.6GHz with integrated graphics should be more than adequate for these tasks, even though you can find more powerful processors for less money in consumer ultraportables.
As proof, the X1 Carbon turned in a respectable score of 3,363 on the proprietary PCMark 8 benchmark test, which is within a few hundred points of its competitors—even within striking distance of the HP EliteBook 1040 G4 ($1,479.00 at HP) and its more powerful Intel Core i7. Any PCMark 8 score above 3,000 indicates more than enough juice for basic computing tasks. On a more anecdotal level, app loading was snappy and startup times were lightning fast—less than 10 seconds—over several days of heavy use.
Tasks such as rendering video footage and editing photos are better suited to laptops with discrete graphics cards and CPUs with more processing cores. Still, if you had to do it in a pinch, note that X1 Carbon was faster than the MacBook Pro on our Handbrake video-encoding test, our Cinebench 3D-rendering benchmark, and our series of Photoshop editing tasks.
Gaming performance is predictably subpar, with neither the X1 Carbon nor any of its Windows competitors turning in frame rates higher than 30 frames per second, which we consider to be the absolute minimum threshold for enjoyable gaming. Thanks to its superior Intel Iris Plus graphics card, the MacBook Pro offers slightly better frame rates, but it's still not a substitute for a machine with a dedicated graphics card.
The X1 Carbon's fans spooled up during the benchmark tests, producing audible exhaust noise, but they were silent during a weekend of mixed regular use, including web browsing and watching Netflix. That's a huge benefit that this laptop shares with the MacBook Pro over similar consumer ultraportables like the Asus ZenBook UX430U, which produces audible fan noise even during casual tasks like web browsing.
See How We Test Laptops
Battery life is excellent, as you'd expect from a Lenovo laptop. I was on the edge of my seat during our battery rundown test, wondering if the X1 Carbon would outlast the ThinkPad T470's excellent result of 17 hours and 36 minutes. Alas, it did not, coming in just a few minutes short at 17:26. That is still very impressive, even more so when you consider that the T470 requires two batteries to last that long. No other business ultraportable comes close.
When it comes time to charge, you can fill up the battery from empty in less than an hour and a half, thanks to Lenovo's quick-charging technology.
Everything Excellent in a Smaller Package
For road warriors who value portability and are blessed with generous IT budgets, it doesn't get much better than the Lenovo ThinkPad X1 Carbon. This ultraportable takes nearly everything there is to love about full-size ThinkPads and puts it in a much smaller, but just as good-looking, package. From all-day battery life to a wonderfully comfortable keyboard, the X1 Carbon's feature list is made for business, and will even please enthusiasts with cutting-edge options like an HDR display. For all these reasons, it's our Editors' Choice for business ultraportables.
Best Laptop Picks
The Best Cheap Gaming Laptops for 2020
The Best Ultraportable Laptops for 2020
Tested: The Lightest Laptops for 2020
The Best Battery Life Laptops for 2020
More Laptop Reviews
More from Lenovo
Laptop Product Comparisons
Slick Ultraportables Face Off: 2020 Apple MacBook Air vs. Microsoft Surface Laptop 3
High-End Mac Showdown: Apple iMac vs. Apple MacBook Pro
Microsoft Blames Liquid Nitrogen for Soldered RAM in Surface Devices
What to Do if Your Laptop Is Plugged In But Not Charging
PC Trends For 2020: Lighter and Smaller Machines, But Bigger Displays
Report: Apple to Launch a 12-Core ARM Mac
Razer Launches Updated Blade Stealth 13 Laptop With GeForce GTX 1650 Ti Graphics, 120Hz Display
HP Tips New Pavilion Laptops Starting at $579
AMD to Power More Chromebooks With Ryzen, Athlon '3000 C-Series' Chips
HP Preps Business Laptops and Desktops With AMD Ryzen Chips
US Blocks Imports From Chinese Laptop Maker Tied to Lenovo, Google
The Gateway PC Brand Returns With New Laptops
About Tom Brant
I'm the deputy managing editor of the hardware team at PCMag.com. Reading this during the day? Then you've caught me testing gear and editing reviews of laptops, desktop PCs, and tons of other personal tech. (Reading this at night? Then I'm probably dreaming about all those cool products.) I've covered the consumer tech world as an editor, reporter, and analyst since 2015.
More From Tom Brant
The Best Apple MacBook Air and MacBook Pro Laptops for 2023
The Best Budget Laptops for 2023
The Best Laptops for Kids in 2023
The Best Desktop Computers for 2023

redpajama_set_name: RedPajamaCommonCrawl


* * * * * * * * * * Welcome to Dru's Cozy Report: January 2014. This month I have two new series for your reading pleasure, and highlights from recent releases. Enjoy!
Izzy McHale wants her new Trendy Tails Pet Boutique in Merryville, Minnesota, to be the height of canine couture and feline fashions. But at the store's opening, it turns out it's a human who's dressed to kill.
Izzy's own beloved pets are dressed to the nines for the grand opening of Trendy Tails. Feisty feline Jinx is large and in charge, and happy mutt Packer is lapping up the attention. Izzy and her best friend Rena have their hands full meeting Merryville's menagerie and serving tasty pupcakes and kitty canapes from their "barkery." The last thing they need is Sherry Harper, the town's local activist, scaring off customers and getting tongues wagging by picketing the event.
As many cozy mysteries that I read, I liked this one as it was quite different in that you never really saw the police investigating this murder, but instead you had a Izzy, our heroine and Sean, the lawyer, looking for others with a stronger motive to have murdered the local activist than Izzy's best friend.
This was a fast-paced, action-filled drama that once I started I could not put down. I love the comfortable tone and the ease at which each chapter flowed from one to the other. The author did a great job in keeping the suspense going and it was fun narrowing down the list of suspects as each clue gathered kept the pages turning in this wonderful tailor-made mystery.
It was fun getting to know each of the main characters including their four-legged friends, from Izzy, to her sisters, and family and friends. The author description of the animals outfit had me looking for a picture of Packer in his cute little Hells Angel's outfit.
With a lovable, yet quirky cast of characters, witty and engaging dialogue and a feel good atmosphere, this book is full of tailor-made charm and I can't wait to see what adventures awaits Izzy and her friends in this wonderful addition to the cozy genre field.
Welcome to San Fernando Valley, California, where Martha Rose and her coterie of quilters are enjoying life on the good side of retirement—until murder pulls a stitch out of their plans.
Martha and her besties Lucy and Birdie are set to expand their Quilty Tuesdays by inviting newcomer Claire Terry into their group. Though at forty Claire's a tad younger than their average age, her crafty reputation could perk up their patchwork proceedings, especially as they prepare for the fancy quilt show coming to town. But when they arrive at Claire's home and find her dead inside the front door, and her exquisite, prize-winning quilts soon missing, Martha is not one to leave a mystery unravelled. Especially if she wants to stop a killer from establishing a deadly pattern.
The author did a good job in delivering a fast-paced, fun and lighthearted whodunit centered around three quilters who happened to find the dead body of another quilter and what followed was their eagerness to find a murderer who's hiding in plain sight. With plenty of suspects to choose from, I loved the twists and turns the mystery took as it rapidly pulled me into an intriguing storyline where secrets are uncovered and threats are made. Everyone had a role to play and it was done in a way that each clue gathered took us closer to the killer's identity.
This was an enjoyable read featuring a lovable cast of characters and good conversations in this engaging debut novel. You don't necessarily have to be a quilter to enjoy this book, but the tidbits and tips will add to a quilter's repertoire. I look forward to more exploits with Martha and her friends in this lovely new series.
FTC Disclosure - The author sent me a copy of this book, in hopes I would review it.
When an enchanted grove is set ablaze, Ella realizes she has more grave problems. With her magic waning, she's going to have to sleuth from scratch to stop an arsonist who has no respect for sacred ground—or human life.
Adding fuel to the fire, Stella's parents soon arrive—with her ex-boyfriend—hoping to persuade her to return to Chicago. Now Stella is torn between the life she left behind and uncovering what happened to her ghostly friend. But she'd better think fast or more than her investigation could go up in flames.
Food and cocktails columnist Hayley Powell is not looking for love this Valentine's Day. Of course she also isn't planning on looking for a murderer.
Turns out Bessie had more enemies than a boxful of chocolates, each one a suspicious flavour. It's sticky business juggling a job, two teenagers and finding a killer, but it's better than letting a killer find Hayley first.
Alone in the mountains, Gracie will have to use all her expertise to keep Rob alive. But with an unknown killer lurking somewhere in the dark, even that might not be enough to save them.
Hey Dru, nice list. There were a couple of books listed that I'm surprised I hadn't heard about months ago.
Some great new reads! I've read a couple of them and a few are on my TBR.
Thanks, DruAnn! Another good list. We value you work for mystery readers and authors.
Thanks for the reviews, Dru. I always enjoy them and get ideas for new series I otherwise wouldn't hear of.
Hey, Dru! Thanks for putting Murder Strikes a Pose on the list!


Not all playing, but also some researching on one of my newest collections - feed sacks and older pattern books. Strange how we can begin to fall in love with so many things; yet this brings back memories! Everything was saved and used, nothing thrown away if they could use in some way. Even the string was pulled (nice chain stitch) from the feed sacks and used in crochet. Now, I should really call them cotton bags, as there were feed sacks with chicken feed, and also various sizes for flour, sugar, salt, meal, and the feed bags. I have found a nice vintage booklet giving some ideas of what to sew and how many sacks of which type you needed.
Want to sew a laundry bag? It took 2 bags that were 30x34. This could be two flour sacks (50 lbs each). A small waist apron took 3 bags, size 36x39. This could be 3 flour bags of 100 lbs each.
I know exactly how you feel! Maybe when I accumulate more sacks I will feel I can cut into them. Hard to find them still intact (but they are certainly out there!); as every scrap of one was used.
No matter how we spell it - accumulating fabric is VERY addictive.
They are a beauty to look at just the way they are. Inspiring in the sewing room. Especially those with the labels still on them. Someday they won't be around at all. There are thousands of different designs and I was so amazed after browsing through a new book.


If you're a Podio Partner and have created App Packs that you wish to sell to your customers, here's how.
Most simple e-commerce plugins for websites have a confirmation page after a sale is completed. Using a ProcFu HTML Widget, you can allow customers to install an app pack from a web page after the purchase transaction is completed.
Unfortunately you cannot iframe this widget because Podio doesn't like to be framed in, but a simple link to a new page will do the trick.
Remove the customer from our space again (optional), and redirect him to refresh his GF account so that flows get imported.
We want the customer to see your company details when installing the app pack, so you will need to create an API key in Podio.
Since we will need the ID of our new HTML Widget to set up the API service in ProcFu, we'll need to create the HTML Widget first.
Remember the Code Block Name you chose as you'll need this later when creating the code to install the app pack.
Make note of this widget ID.
To create the Code Block, click on "Code" in ProcFu, and create a new code block by clicking on "+ Create New" in the sidebar.
Be sure to give the code block the same name that you specified when you created the HTML Widget!
The full source for the code block can be found here.
Simply copy and paste it over.
$api_service = "ppdemo"; // the name you gave your podio integration on the Account page under "API Services"
$remove_customer_after = true; // should the customer be removed from the above space after install?
$sucess_message = '
Installation Successful
' .
'
The Podio Apps have been installed in your selected workspace. ' .
'To complete the setup and install the Flows, please Refresh your GlobiFlow account ' .
'by clicking THIS LINK.
' .
Feel free to also change any styling etc to make the resulting HTML look better. I've minimized code for ease-of-reading for demonstration purposes here.
The last thing you need to do is to redirect the customer to the HTML Widget with the confirmation number or transaction ID to install the app pack.
Note: Change the name of the url parameter and widget id to your own.
And once GF has refreshed, any Flows used in the App Pack should be installed in the user's account.