text:
Parafia św. Leonarda w Turbi – parafia należąca do dekanatu pysznickiego diecezji sandomierskiej.

Turbia pierwotnie należała do parafii Gorzyce. W XIII wieku została przyłączona do Charzewic, następnie do Rozwadowa.
Pierwsze wzmianki na temat turebskiego kościoła pojawiają się na początku XVII wieku, kiedy to w dokumencie z wizytacji biskupa Maciejewskiego wspomniano przywilej nadany przez biskupa Radziwiłła w 1598 oraz patrona kaplicy – Św. Leonarda. Erygowanie parafii turebskiej nastąpiło w roku 1757. Drewniany kościół parafialny trzykrotnie ulegał pożarowi w ciągu XIX i na początku XX wieku.

Obecny murowany kościół został wybudowany w latach 1922-24. Kościół stojący w centrum wsi  jest  ozdobny biało tynkowanymi gzymsami i pilastrami. Budowniczym kościoła był ksiądz Jan Marek (proboszcz w latach 1921-1944). Jego następcą został wikariusz pracujący w tej parafii ks. Albin Blajer i był proboszczem w latach 1944-1978. Kolejnym proboszczem był ks. kan. Ryszard Englot (w latach 1979-2000) a następnie ks. kan. Stanisław Knap (2000-2015). Postanowieniem ks. biskupa Andrzeja Dzięgi, ówczesnego ordynariusza diecezji sandomierskiej, administratorem parafii został dotychczasowy wikariusz ks. Piotr Cecuła (2009-2010). Następcą na urzędzie administratora ks. Piotra Cecuły został ks. dr Grzegorz Miszczak, który od 2015 roku został proboszczem tej parafii.

Parafia posiada akta parafialne od 1784 roku. Obecnie parafia obejmuje Turbię, Obojną (2 km), Wólkę Turebską (4 km) i Zbydniów Kolonię (2 km). Do parafii należy kaplica w Wólce Turebskiej.

Linki zewnętrzne
 Opis parafii na stronie diecezji

Parafie pod wezwaniem św. Leonarda
Parafie diecezji sandomierskiej
Religia w gminie Zaleszany
Turbia


text:
Politically Responsible Investing
MAGA ETF
Fund Summary
Investor Materials
Chinese Student Visas Should Be Part of Trade Negotiations
by Invest Politically | Jan 17, 2019 | Commentary | 0 comments
Chinese nationals have been attending American universities in burgeoning numbers over the last decade. There are more than 360,000 of these students now enrolled in U.S. colleges, up fivefold since 2006. As a reference point, the total is equal to the population of Anaheim, Calif., the 55th largest city in the country. Many of these Chinese nationals are taking away highly prized, limited seats from American students at our top universities.
National security advisers in the Trump administration have become increasingly concerned with the threat of Chinese students studying here. Fearing that they are committing acts of espionage and cybertheft, the administration restricted the visas of Chinese graduate students involved in scientific and technological research to one year (from five). The administration is also considering additional procedures to vet students before they arrive in the United States.
In 2000, one in 10 Chinese students returned home after their studies here; today, eight in 10 do so. The Chinese Communist government has become much more involved with international students' activities since President Xi's rise to power in 2012. In December 2017, Xi urged these students to adopt the attitude of "studying abroad to serve the country."
Chinese Student Groups Are Often Puppets of Their Government
Students are now heavily encouraged to create overseas party branches when studying abroad. These branches are reported to be "responsible for promoting party and government policies." They want students to avoid the influence of ideologies perceived to be harmful and they even ask students to report on each other's behaviors and beliefs.
The Chinese Students and Scholars Association and the Confucius Institute are two organizations on American college campuses where the Chinese government is pushing its ideas under the guise of multiculturalism. Both groups have grown to dozens of chapters across the country.
CSSA groups regularly accept funds from local Chinese consulates, raising concerns about the extent of Beijing's reach. The CSSA has worked with consulates to create large student welcomes for Xi Jinping during his U.S. state visits. The consulate collects the students' contact information to text them about events and pays them for attending.
More than 100 universities allow Confucius Institute chapters on their campuses. The schools receive funding for Chinese language and culture classes. In return, the Chinese government controls the curricula and message. These programs are run by a branch of the Chinese Ministry of Education known as Hanban.
The Confucius Institute actively undermines freedom of speech and religion on campus. The group worked to prevent the Dalai Lama from speaking at North Carolina State University, and it has censored ideas that the Chinese government considers taboo, such as the history of Tibet, the Tiananmen Square Massacre, and Falun Gong.
Li Changchun, a former member of China's Politburo, openly admitted that the institute chapters are an attempt to censor and control the message on college campuses. "It has made an important contribution toward improving our soft power. The 'Confucius' brand has a natural attractiveness. Using the excuse of teaching Chinese language, everything looks reasonable and logical," Changchun said.
While university officials largely have accepted these groups as part of campus, U.S. officials are finally taking notice. Congressmen such as Christopher H. Smith of New Jersey are bringing long-awaited attention to this issue. "They [the campus groups] are nests of influence, reconnaissance," he wrote. "They keep tabs on Chinese students, and those who attend their classes are getting a Pollyannaish take on what China is about today."
Sen. Ted Cruz sponsored language in the 2019 National Defense Authorization Act requiring U.S. universities to get a Pentagon waiver if they want to keep both Pentagon-funded programs and Chinese government-funded language programs. President Trump signed the bill into law in August. The University of South Florida, University of Michigan, and the University of Rhode Island all shuttered their Confucius Institute chapters in the past month.
Applicant Fraud, Shady Agents, and Revenue-Obsessed Universities
Chinese middle-class and upper-class families in growing numbers are pushing their children to attend prestigious American universities, going to extreme measures to get them accepted. Even as U.S. colleges accept these students in large numbers, universities have not proven themselves capable of vetting students properly, calling into question the integrity of the application process.
Cheating on standardized tests like the SAT in Asia is ubiquitous, and test results frequently are thrown out. Cheating has taken all forms: having substitute test takers for the student, buying the test in advance, posting the answers online, and taking advantage of large testing halls to share answers with neighbors.
In 2016, the Justice Department indicted 15 Chinese involved in a cheating ring. The students paid up to $6,000 to have substitutes take the SAT in Pennsylvania with a fake passport. Chinese students could face expulsion or jail time for cheating on their own nation's entrance exam but face no punishment for doing the same on a foreign standardized test.
Many Chinese families pay thousands of dollars to agents who serve as the bridge between students and the university they hope to attend. Some agents provide legitimate services to applicants, including video interviews and tutoring, while others offer to write essays, provide fake recommendations, or even fill out the entire application. These students arrive on campuses unprepared and incapable of understanding the material, and yet they take thousands of spots at top universities, squeezing out qualified American students.
In 2016, Dipont Education Management Group, a Shanghai-based education company, paid out thousands of dollars in cash and benefits to admissions officers at top American universities. Dipont admitted to allegations that it had a special relationship with 20 schools, including Vanderbilt University, Tulane University, and the University of Virginia. Admissions officers were flown to Shanghai to provide exclusive sessions for Dipont clients about the admissions process for their respective schools. Schools rationalized the scandal by saying that they needed to recruit Chinese students willing to pay expensive international tuition. From 2008 to 2012, the amount of money spent by Chinese students on American university tuition was nearly $7 billion.
The importance of Chinese money is so great that the University of Illinois took out a $60 million insurance policy to protect itself from a drop of 20 percent or more in revenue from Chinese students in a 12-month period. And who pays the insurance premium? The tuition of other students. While universities care deeply about losing revenue, many have ignored the potential risks of accepting so many Chinese students.
The Trump administration and Congress see the risks and have begun to act. However, it is also an issue of fairness to U.S. students.
Available slots at top colleges are few. Many of these schools are accepting less than 10 percent of American applicants. Should Chinese nationals with academic credentials that cannot be vetted, and a Chinese government that wants its students to maintain their Communist Party allegiance, take thousands of seats away from highly vetted and well qualified American students at schools like MIT, Harvard, Stanford, and Columbia?
With trade negotiations heating up, the Trump administration should take an additional look at how many visas are permitted and the vetting process of students.
Hal Lambert is the founder of Point Bridge Capital, which launched the first-ever Republican stock index: MAGA. He is a frequent guest on Fox News, CNBC, and Fox Business. Learn more at Point Bridge Capital and follow Hal on Twitter at @MAGAINDEX
Carefully consider the Fund's investment objectives, risk factors, charges, and expenses before investing. This and additional information can be found in the Fund's prospectus. Read the prospectus carefully before investing.
Investing involves risk, including possible loss of principal. Mid-capitalization companies may be more vulnerable to adverse business or economic events than larger, more established companies. The Fund is non-diversified, which means that it may invest more of its assets in the securities of a single issuer or a smaller number of issuers than if it were a diversified fund. As a result, the Fund may be more exposed to the risks associated with and developments affecting an individual issuer or a smaller number of issuers than a fund that invests more widely. This may increase the Fund's volatility and cause the performance of a relatively smaller number of issuers to have a greater impact on the Fund's performance. Index composition is heavily dependent on quantitative models and data supplied by third parties. Where such models and data are incorrect or incomplete, the composition of the Index will reflect such errors and likewise the Fund's portfolio. Because the methodology of the Index selects securities of issuers for non-financial reasons, the Fund may underperform the broader equity market or other funds that do not utilize similar criteria when selecting investments. The Fund is not actively managed and therefore would not sell shares of an equity security unless that security is removed from the Index or the selling of shares is otherwise required upon a rebalancing of the Index. Real Estate investments are subject to changes in economic conditions, credit risk, and interest rate fluctuations.
Shares are bought and sold at market price (closing price), not net asset value (NAV), and are not individually redeemed from the Fund. Market performance is determined using the bid/ask midpoint at 4:00 pm ET when NAV is typically calculated. Brokerage commissions will reduce returns.
Median 30 Day Spread is a calculation of Fund's median bid-ask spread, expressed as a percentage rounded to the nearest hundredth, computed by: identifying the Fund's national best bid and national best offer as of the end of each 10 second interval during each trading day of the last 30 calendar days; dividing the difference between each such bid and offer by the midpoint of the national best bid and national best offer; and identifying the median of those values.
Point Bridge Capital, LLC serves as the investment advisor, and Vident Investment Advisory, LLC serves as the sub-advisor to the fund. The fund is distributed by Foreside Fund Services, LLC, which is not affiliated with Point Bridge Capital, LLC or Vident Investment Advisory, LLC. TD Ameritrade, Edward Jones, E*Trade, Fidelity, and Charles Schwab are not affiliated with Point Bridge Capital, LLC, Vident Investment Advisory, LLC, or Foreside Fund Services, LLC.
Point Bridge Capital is an SEC-registered investment advisor based in Fort Worth, Texas, and serves as the Advisor to the MAGA ETF. Point Bridge Capital was established in 2013 by Hal Lambert and manages assets for high-net-worth clients.
Learn more at pointbridgecapital.com
Hal Lambert, CFA, founded Point Bridge Capital in 2013 and has over 20 years of investment experience. He is a frequent political and economic commentator on Fox Business, CNBC, and Fox News.
Learn more at hal-lambert.com
300 Throckmorton, Suite 1550
© 2020 Point Bridge Capital
Point Bridge Capital

redpajama_set_name: RedPajamaCommonCrawl


Your little Dodgers fan is growing up fast. Keep your youngster lookin' good and feelin' good at the next game with the Home Run hoodie sweatshirt by adidas. It displays an embroidered tackle twill team logo on the chest a large pixilated team name printed on the left shoulder contrast team color piping and a mesh hood sleeves and pocket trim for a game-ready expression of die-hard team pride! Hopefully it'll be enough to amp up your young fan's team spirit!


This illustration by Loujah highlights the Cheshire Cat. The cat has an accordion-shaped tail. To end in apotheosis, the end of the tail is represented by a heart. A perfect image to sublimate and create your case Hisense U962. On a pink, violet background, this naughty cat from the world of Alice in Wonderland will be admired. You will succumb under his sweet eyes!
What is Wallet Case Ribbon Cat for Hisense U962 ?
This Ribbon Cat case by Mobilinnov represents excellent value for money as well as excellent protection for your Hisense U962. It is made from a tough polycarbonate, which will shield your device from impact damage and accidental drops.
Keep the design of your Hisense U962 with this slim protective shell. This Hisense U962 case has a design developed in collaboration with LouJah named Ribbon Cat.
How to know wich material Hisense U962 Ribbon Cat Case i need to select ?


text:
Hacker Leaves Message for Microsoft in Trojan Code
By Robert McMillan
Here's a new way to get Microsoft to pay attention to you: Slip a brief message into the malicious Trojan horse program you just wrote.
That's what an unnamed Russian hacker did recently with a variation of Win32/Zlob, a Trojan program victims are being tricked into installing on their computers.
The message is surprisingly cordial, given that Microsoft's security researchers spend their days trying to put people like Zlob's author out of business. "Just want to say 'Hello' from Russia. You are really good guys. It was a surprise for me that Microsoft can respond on threats so fast," the hacker wrote, adding, "Happy New Year, guys, and good luck!"
Zlob is one of the most common types of Trojan programs used to attack Windows these days. In a typical Zlob scam, the victim is sent a link to what looks like an interesting video. When the link is clicked, the user is told to install a multimedia codec file in order to watch the video. That file is actually malicious software.
It's not clear whether the author of this message is the creator of Zlob, according to Joe Stewart, a researcher with SecureWorks. That's because "Zlob is one of those things that gets mislabeled by AV companies a lot," he said via e-mail. "Basically any time they see malware being spread by 'you need this video codec...' messages in multimedia files, it gets the Zlob label."
This isn't the first time this particular hacker has sent a note to Microsoft's security group. Last October he wrote a slightly creepy message, saying, "I want to see your eyes the man from Windows Defender's team."
Unlike the October message, this latest note wasn't caught by Microsoft. It was found Friday by a French security researcher using the hacker handle S!Ri.
[ Further reading: The best antivirus for Windows PCs ]
According to this latest message, it may be the Zlob hacker's last note to Microsoft. "We are closing soon," he wrote. "So, you will not see some of my great ;) ideas in that family of software."
"It warms my heart that they're 'closing soon,'" wrote Microsoft spokesman Tareq Saade in a blog post Friday.
All things considered, hiding messages in source code may not be the most effective way of reaching the Windows Defender team. "Considering the enormous amount of malware we go through every day, it can be difficult to track follow up samples like this," Saade wrote.
The hacker also claimed that Microsoft had once offered him a job to help improve Windows Vista's security. Microsoft hired a large number of outside security consultants to test Vista's code before it was released in late 2006. "It's not interesting for me," the hacker concluded. "Just a life's irony."
15% off computers and tablets with eBay coupon code


Masha'Allah keep up the good work if God wills.
Once the Prophet went to the dumps of some people and passed urine while standing. He then asked for water and so I brought it to him and he performed ablution"
Don't you think that it's a wrong hadees? kindly clarify.


Product Warranty - Floyd Bell, Inc.
Floyd Bell Inc. warrants for a period of two years from the date of manufacture that its signal devices will, when used under normal operating conditions, 1) conform to the company's then-current literature in use at the time of product purchase, and 2) be free of defects in materials and workmanship. The above warranty will become void with respect to products that have been subjected to alteration, abnormal use or environmental conditions, or unauthorized repairs. Signal devices found upon company's examination to have failed to conform to relevant literature or to have malfunctioned due to faulty materials or workmanship during the warranty period will be repaired or replaced at company's election at no charge, which shall be purchaser's sole and exclusive remedy. "Normal operating conditions" are defined in Floyd Bell Inc.'s General Specifications and Environmental Specifications in effect at the time of product purchase, and can be obtained from the company's web site or upon request of the company. The company shall not be liable, under any legal or equitable theory of recovery, for special, incidental or consequential damages, regardless of the circumstances.
EXCEPT FOR THE EXPRESS WARRANTY SET FORTH ABOVE, ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, ARE EXCLUDED AND DISCLAIMED BY FLOYD BELL INC., INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR ANY PARTICULAR PURPOSE.


text:
Patent application title: DYNAMIC SECURITY SANDBOXING BASED ON INTRUDER INTENT
Inventors: Paul A. Ashley (Toowong, AU) Paul A. Ashley (Toowong, AU) Anthony M. Butler (Dubai, AE) Anthony M. Butler (Dubai, AE) Ghada M. Elkeissi (Dubai, AE) Leny Veliyathuparambil (Winnipeg, CA)
A method of security sandboxing which may include detecting an illicit intrusion to a computer on a first computer system; cloning the intruded computer; directing all traffic from the illicit intrusion to the cloned computer; observing activities of the illicit intrusion interacting with the cloned computer; and dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion. The steps of the method may be performed by one or more computing devices.
1. A method of security sandboxing comprising: detecting an illicit intrusion to a computer on a first computer system; responsive to detecting the illicit intrusion to the computer, cloning the computer to create a copy of the computer; redirecting all traffic from the illicit intrusion to the computer to the cloned computer while directing all traffic not from the illicit intrusion to the computer; observing activities of the illicit intrusion interacting with the cloned computer while directing all traffic not from the illicit intrusion to the computer; and dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion on the cloned computer while directing all traffic not from the illicit intrusion to the computer, wherein the steps of the method are performed by one or more computing devices.
2. The method of claim 1, wherein the computer is a virtual machine and the cloned computer is a cloned virtual machine.
3. The method of claim 2 wherein cloning the intruded virtual machine comprises: creating a new virtual machine to form a cloned virtual machine; moving the cloned virtual machine to a second computer system that is logically or physically separate from the first computer system; and copying memory pages from the virtual machine to the cloned virtual machine until the virtual machine and the cloned virtual machine are synchronized;
4. The method of claim 2 further comprising injecting behaviors in the form of components, files, data and vulnerabilities into the cloned virtual machine to satisfy the activities of the illicit intrusion interacting with the cloned virtual machine.
5. The method of claim 2 further comprising removing sensitive information from the virtual machine before copying memory pages to the cloned virtual machine.
6. The method of claim 5 further comprising adding nonsensitive information to the cloned virtual machine to replace the removed sensitive information.
7. The method of claim 1 further comprising recording activities of the illicit intrusion.
8. The method of claim 4 wherein at least some of the injecting behaviors contain agents or code to capture information from the illicit intrusion when the behaviors are downloaded by the illicit intrusion.
9. The method of claim 2 wherein responsive to activities of the illicit intrusion interacting with the cloned virtual machine, further comprising spawning additional virtual machines on the second computer system supplementing the cloned virtual machine to perform activities of predicted interest to the illicit intrusion.
10. The method of claim 1 wherein dynamically adapting includes adapting the cloned machine in real time to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion.
11. The method of claim 10 wherein dynamically adapting further includes generating data and exhibiting behaviors/display characteristics based on the predicted interests of the intruder based on their observed activities.
12. A computer program product for dynamic security sandboxing based on intruder intent, the computer program product comprising: a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising: computer readable program code configured to detect an illicit intrusion to a computer on a first computer system; responsive to an illicit intrusion detected to the computer, computer readable program code configured to clone the computer to create a copy of the computer; computer readable program code configured to redirect all traffic from the illicit intrusion to the computer to the cloned computer while all traffic not from the illicit intrusion is directed to the computer; and computer readable program code configured to dynamically adapt the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion on the cloned computer while all traffic not from the illicit intrusion is directed to the computer.
13. The computer program product of claim 12 wherein the computer is a virtual machine and the cloned computer is a cloned virtual machine.
14. The computer program product of claim 13 wherein cloning the virtual machine comprises: computer readable program code configured to create a new virtual machine to form a cloned virtual machine; computer readable program code configured to move the cloned virtual machine to a second computer system that is logically or physically separate from the first computer system; and computer readable program code configured to copy memory pages from the virtual machine to the cloned virtual machine until the virtual machine and the cloned virtual machine are synchronized;
15. The computer program product of claim 13 further comprising computer readable program code configured to inject behaviors in the form of components, files, data and vulnerabilities into the cloned virtual machine to satisfy the activities of the illicit intrusion interacting with the cloned virtual machine.
16. The computer program product of claim 13 wherein responsive to activities of the illicit intrusion interacting with the cloned virtual machine, further comprising computer program product to spawn additional virtual machines on the second computer system supplementing the cloned virtual machine to perform activities of predicted interest to the illicit intrusion.
17. The computer program product of claim 12 wherein computer program product to dynamically adapting includes computer program product to adapt the cloned machine in real time to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion.
18. The computer program product of claim 17 wherein computer program product to dynamically adapt further includes computer program product to generate data and exhibit behaviors/display characteristics based on the predicted interests of the intruder based on their observed activities.
19. A method of providing a security sandboxing service to a first party comprising: detecting an illicit intrusion to a computer on a first computer system of the first party; responsive to detecting the illicit intrusion to the computer, cloning the computer to create a copy of the computer; redirecting all traffic from the illicit intrusion to the computer to the cloned computer while directing all traffic not from the illicit intrusion to the computer; observing activities of the illicit intrusion interacting with the cloned computer while directing all traffic not from the illicit intrusion to the intruded computer; and dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion on the cloned computer while directing all traffic not from the illicit intrusion to the intruded computer; and performing on a second computer system of a second party that is not the first party the steps of detecting, cloning, directing, observing and dynamically adapting wherein the first computer system and second computer system are physically separate and the step of performing is a service for the first party, and wherein the steps of the method are performed by one or more computing devices.
20. The method of claim 19, wherein the computer is a virtual machine and the cloned computer is a cloned virtual machine.
[0001] The present exemplary embodiments relate to network security and, more particularly, relate to the cloning of a compromised machine to a controlled environment.
[0002] Hacking, defacement and other forms of computer intrusion remain significant threats to enterprises, small businesses and governments. Current approaches typically address the issue by detecting and alerting access or by detecting and blocking such access. For example, a firewall or Intrusion Prevention System (IPS) may monitor the flow of traffic into a given server and block any attempts that appear to be made with the intent of gaining unauthorized access, such as via SQL injection or similar.
[0003] The drawbacks of these solutions are at least twofold. First, often the compromises involve new or as yet unknown attack vectors--so-called "zero day" vulnerabilities--and by blocking a request, the opportunity to better understand the attack vector and the technique cannot be taken advantage of. Further, by blocking the request, the ability to build future defenses is reduced as often the attack is blocked but the preceding events and future events are not known and these may expose other vulnerabilities.
[0004] Second, when an attack is blocked, it is very difficult to trace and identify the intruder as their connection to the server is ephemeral. Difficulty in tracing and identifying the culprits is not in the interests of the company and also not in the broader interests of the community as the attackers may go on to carry out other attacks.
[0005] On the other hand, prolonging the access that the intruder has to the compromised machine in order to allow time for them to be traced can extend the risk that the company is exposed.
[0006] Accordingly, a balance needs to be found between blocking access by the intruder and allowing the intruder prolonged access to the compromised machine.
[0007] The various advantages and purposes of the exemplary embodiments as described above and hereafter are achieved by providing, according to a first aspect of the exemplary embodiments, a method of security sandboxing which includes: detecting an illicit intrusion to a computer on a first computer system; cloning the intruded computer; directing all traffic from the illicit intrusion to the cloned computer; observing activities of the illicit intrusion interacting with the cloned computer; and dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion. The steps of the method are performed by one or more computing devices.
[0008] According to a second aspect of the exemplary embodiments, there is provided a computer program product for dynamic security sandboxing based on intruder intent. The computer program product including a computer readable storage medium having computer readable program code embodied therewith. The computer readable program code including: computer readable program code configured to detect an illicit intrusion to a computer on a first computer system; computer readable program code configured to clone the intruded computer; computer readable program code configured to direct all traffic from the illicit intrusion to the cloned computer; and computer readable program code configured to dynamically adapt the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion.
[0009] According to a third aspect of the exemplary embodiments, there is provided a method of providing a security sandboxing service to a customer including: detecting an illicit intrusion to a computer on a first computer system of a first party; cloning the intruded computer; directing all traffic from the illicit intrusion to the cloned computer; observing activities of the illicit intrusion interacting with the cloned computer; dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion; performing on a second computer system of a second party at least one of the steps of detecting, cloning, directing, observing and dynamically adapting wherein the first computer system and second computer system are physically separate and the step of performing is a service for the first party, and wherein the steps of the method are performed by one or more computing devices.
BRIEF DESCRIPTION OF SEVERAL VIEWS OF THE DRAWINGS
[0010] The features of the exemplary embodiments believed to be novel and the elements characteristic of the exemplary embodiments are set forth with particularity in the appended claims. The Figures are for illustration purposes only and are not drawn to scale. The exemplary embodiments, both as to organization and method of operation, may best be understood by reference to the detailed description which follows taken in conjunction with the accompanying drawings in which:
[0011] FIG. 1 is an overall view of a virtual machine being attacked by an intruder and cloning the attacked virtual machine to a secure target machine containing the cloned virtual machine.
[0012] FIG. 2 is a block diagram of the various components of the secure target machine.
[0013] FIG. 3 is a block diagram of the various components of FIG. 2 in a distributed environment.
[0014] FIGS. 4A and 4B are illustrations of different types of virtual machines wherein FIG. 4A is a virtual machine with a hypervisor and FIG. 4B is a virtual machine with containers and a container engine.
[0015] FIG. 5 is a flow chart illustrating one exemplary method of security sandboxing.
[0016] There are two known solutions for profiling attack behavior. These solutions may be referred to as the "honey pot" and the "sandbox".
[0017] A honey pot is a server that has been established explicitly to be attacked or to draw attackers into it--like bees might be attracted to a honey pot. By doing so, intruders may be distracted from actual production servers as they will instinctively focus on the server(s) that appear most vulnerable. The honey pot approach generally has a shortcoming in that it is static and it does not reflect actual production environments so an intruder who was looking for some corporate information or had domain/local knowledge might not necessarily be fooled by the honeypot. If an intruder is specifically targeting a particular server(s) and is not merely opportunistic, the intruder may also not be distracted/deceived by a honeypot and may instead focus on their objective. For example, the intruder may be intending to compromise the mail system and so may focus their efforts on the SMTP gateway and not be distracted into attacking a honey pot server just because it appears to be easily compromisable.
[0018] The purpose of sandboxing is to identify and profile incoming malware by convincing it to "execute" in the sandbox. The sandbox then allows the malware to continue its processing so that the characteristics of the malware, such as Command and Control (C&C) server addresses, can be identified. The limitation of sandboxing solutions is that they only allow knowledge of file based malware to be profiled. More general attack scenarios are not supported.
[0019] A new solution is required that a) entraps the intruder for a longer period of time so that data can be captured; b) addresses more advanced attack scenarios such as corporate espionage, disgruntled employees or others who possess domain knowledge such that they might not easily be deceived by a honeypot; and c) supports more than file based profiling.
[0020] The exemplary embodiments pertain to a system that reacts to a detected intrusion by a) cloning the compromised machine "live" to a controlled environment, and b) continuing to expand and adapt (i.e., evolve) that controlled environment based on the observed and/or predicted behavior of the intrusion. "Live" in this context means that the running (compromised) machine is cloned such that the clone is a runtime/real-time copy of it. While this is happening, the compromised machine continues to function "as is" with any updates/changes that are made while the cloning is occurring subsequently replicated to the clone. At the end of the clone process, the clone machine is an exact replica of the compromised machine. The benefit of a live clone is that it does not do anything to alert the intruder and allows legitimate access to continue unimpeded.
[0021] The intruder may continue interacting with the cloned machine once it is copied without awareness that they are now interacting with a copy and not the original. It is possible that, as part of the cloning, any sensitive information or content is removed from the copy or replaced with dummy (i.e., nonsensitive) information or content.
[0022] The cloning process may strip sensitive information such that when it copies the compromised machine it only copies aspects/data that are deemed non-sensitive or it may copy the entire machine and then strip the sensitive data after copying. Alternatively, rather than simply strip the sensitive information, the cloning process could replace the sensitive data with either generated data (that resembles the sensitive data in some qualitiative/quantitative way) or data that has been pre-generated or generated based on some rules or heuristics. For example, if the compromised machine contained banking details, the clone might be generated with bogus accounts and values while retaining the same size/structure of the original. All of this would be configurable.
[0023] The cloned machine environment may then be dynamically adapted based on the observed/predicted behavior of the intruder. Once inside the sandboxed server, the behavior of the intruder may be observed and, within a secure, contained environment, the cloned machine is dynamically adapted, that is, dynamically modified (through placement of files, injection of kernel and other parameters, and other elements within the virtual machine) and extended (by spawning of networks and other machines that the intruder(s) may then explore) based on the observed/predicted behavior of the intruder. "Dynamically adapted" means the cloned machine is adapted (or evolved) in real time to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion and to also generate data and exhibit behaviors/display characteristics based on the predicted interests of the intruder based on their observed activities.
[0024] For example, if an intruder was found to be probing the network for a server called "Accounting", the sandbox could spawn a server with this name; if an intruder was observed searching for a type of data, it could insert data of this type (non-sensitive) to distract the intruder; or if the intruder was attempting to guess the password for a particular user account, the system might let the intruder gain access with a guessed password to further ensnare the intruder and further the illusion that they have progressed towards their objectives (allowing more time to capture evidence/understand their behavior). All of these activities are dynamically generated in responsive to predicted and/or observed activities/behaviors of the intruder.
[0025] Each machine that is spawned responsive to the intruder's behavior is itself a honey pot. While the intruder is interacting with these sandboxed devices, the intruder is being recorded, and alerts triggered; or, if an intruder is observed running grep or find commands on a server for specific data elements, files containing these elements could be automatically created and/or copied from a library and/or spawned such that it leads the intruder to falsely believe that the intruder has found something of interest.
[0026] There are several advantages of the exemplary embodiments over the known solutions. First, the exemplary embodiments provide a method wherein a "live" intrusion is copied to a dynamically generated sandbox. By "live intrusion", we mean an in-flight intrusion wherein the intruder is actively logged onto or probing the compromised server/device. It doesn't happen after the fact but in "real time". By doing so, the risk of harm to production data and environments is mitigated while simultaneously addressing the need to continue to monitor the intrusion to gain knowledge of the attack vector and also trace the intruder and build a legal case.
[0027] Second, the controlled environment around this sandboxed node is dynamically generated based on the intruder's own behavior. By doing so, the intruder will continue to keep interacting with it and, if the intruder is searching for specific data, the intruder may continue to believe that this data is within their grasp.
[0028] Third, the intruder continues to interact with the sandboxed cloned machine in the controlled environment while the intruder is tracked. The intruder is unaware that they are interacting with a clone of the production server that was originally attacked by the intruder.
[0029] Referring to the Figures in more detail, and particularly referring to FIG. 1, there is disclosed an intruder 10 who via the internet 12 is attempting to gain illicit access to a server or computer machine. The server or computer machine may be a physical computer (as might be the case for individuals or small businesses) or a virtual machine (as might be the case for larger businesses and organizations). Virtual machines of many types are well known and are considered to be an emulation of a particular computer system. The present discussion of the exemplary embodiments focuses on virtual machines but it should be understood that the exemplary embodiments are equally applicable to physical computers without virtual machines.
[0030] The virtual machine under attack in FIG. 1 is virtual machine 14. A physical computer device such as a server 16 may be hosting virtual machine 14.
[0031] Illicit access in the present context means unauthorized access to a computer, whether a virtual machine or a physical computer device. The intruder 10 may gain illicit access to the virtual machine 14 through a number of ways, such as via SQL injection, brute-force hacking of a password, or some other method. The intruder's network traffic 18 flows through a security device 20, such as a firewall or IPS, that is monitoring the network traffic flow and the intruder's interactions with the virtual machine 14.
[0032] Once the intrusion is detected, the virtual machine 14 may be cloned and moved to a controlled environment. The controlled environment in FIG. 1 is a separate physical environment, such as another physical server 24. Cloned virtual machine 26 is shown hosted on physical server 24.
[0033] While FIG. 1 shows the cloned virtual machine 26 hosted on physical server 24 so as to be physically separate from physical server 16, this physical separation is not always necessary. The "controlled environment" where the cloning occurs need not be another physical environment but may be an environment where there are sufficient "barriers"--logical or physical--such that the intruder cannot become aware of what has happened or somehow re-compromise the original server. That is, in one exemplary embodiment, the controlled environment may be a virtual machine on the same physical computer, such as server 16, as the compromised virtual machine, such as virtual machine 14, so long as there are sufficient logical barriers between the virtual machine 14 and the cloned virtual machine.
[0034] Depending on the policies associated with the physical server 24 (hereafter the "target machine"), not all content (such as content flagged as sensitive) may be copied to the cloned virtual machine 26. By removing the sensitive content, the intruder's ability to impact production data is removed yet they are unaware that they are now contained within a dynamically generated honeypot/sandbox. The sensitive content may be removed before or after cloning.
[0035] The process for cloning the virtual machine 14 may be as follows. Virtual machine 26 may be created in the controlled environment, in this case on physical server 24. Each memory page from virtual machine 14 is copied across to virtual machine 26 via a network connection 22. In order for the cloning to occur in a timely enough manner, there should be enough bandwidth and sufficiently low latency between the compromised machine (source) and the target/clone virtual machine. Upon completion of the copying of the memory pages, the memory on virtual machine 14 is again checked and any pages that changed since the last iteration are also moved over to virtual machine 26. This process of copying memory pages continues until the now cloned virtual machine 26 is in synchronization with virtual machine 14. If the intruder 10 has altered any content in the virtual machine 14, the altered files or other content may be reverted back to a snapshot that was taken prior to the intrusion occurring.
[0036] The cloning process may take minutes but the time for the cloning process depends on the size of data being cloned and speed of network. During this time, the intruder continues to access the compromised machine. The point at which the intrusion is detected is a checkpoint that can then be rolled back to once the intruder has been moved to the cloned machine. Any changes they may have made would therefore be reversed once they are moved to the cloned machine. For example, an intruder hacks into a website; they are detected; a checkpoint is taken; they proceed to deface the website; the virtual machine may be cloned to a new instance; the intruder is then directed to that new instance; the original virtual machine may be reversed to the checkpoint such that the defacement is now no longer there.
[0037] All traffic from the intruder 10 is now redirected 28 through security device 30 to the cloned virtual machine 26 via a network device that maps the source IP (or some other distinguishing characteristic of the intruder) to the target IP of the sandboxed target machine 24. There are a number of mechanisms by which the traffic from the intruder 10 can be rerouted to the target machine 24 but one mechanism could be via a network load balancer that receives incoming requests on a VIP (Virtual IP) but routes those that originated from the intruder 10 to the IP of the targeted machine 24. VIP is an IP address that all requests would access and would then be farmed out to backend systems with their own IP addresses based on load balancing rules/heuristics.
[0038] Meanwhile, the virtual machine 14 is continuing to run and other users will find themselves accessing and interacting with this virtual machine 14 which is uncompromised by the intruder 10.
[0039] While the intruder 10 is interacting with the cloned virtual machine 26, the intruder's intent is being observed/predicted which may occur through the application of a set of rules/heuristics and attempts to place the intruder initially within one of a number of categories based on assumed intent. For example, for purposes of illustration and not limitation, the categories could be: a) defacer/vandal who is looking to modify externally facing web pages and might be detected as the intruder 10 looks for the Apache HTTP document directory or similar; b) theft might be assumed if the intruder 10 is looking for specific file types where such file types might ordinarily be linked to data of commercial value, such as documents, spreadsheets, database tables or similar.
[0040] Based on these initial assessments, different types of behaviors may be injected into the cloned virtual machine 26. In the case of an intruder 10 who is probing the network, random virtual machines may be spawned (hereafter spawned virtual machine(s) 32) using a subset of the host names that were the subject of the scan/probe by the intruder 10, created from a template, and may then attract the intruder 10 to execute further attacks. In the case of an intruder 10 who is searching for a specific file, a rule might be triggered to create a file of this type or pull a file from a library of fake files and plant it on the cloned virtual machine 26 or on the spawned virtual machines 32. For example, if the intruder 10 was scanning for seismology data in a mining company, the cloned virtual machine 26 might deploy some large files of the requested type with very enticing names. It is also within the scope of the exemplary embodiments that the files that are created/generated themselves contain agents or code that, when the intruder 10 downloads and executes these files, capture further information about the intruder's environment, location, etc. All of these behaviors may be defined by rules.
[0041] While all of the interactions with the intruder 10 have been going on, alerts have been raised and all of the interactions between the intruder 10 and the cloned virtual machine 26 are recorded, including low level function calls and similar. These recorded interactions allow investigators to gather evidence but also allow security analysts to learn about how the intrusion was executed and gain valuable information about vulnerabilities and attack vectors that might ordinarily be unknown to them.
[0042] Referring now to FIG. 2, there is illustrated one exemplary embodiment of the target machine 24. For purposes of illustration and not limitation, all of the components shown in FIG. 2 are located on target machine 24. As explained hereafter, all of the components shown in FIG. 2 may be distributed among several machines, virtual or physical.
[0043] FIG. 2 illustrates a virtual sandbox environment within the target machine 24 and may include a hypervisor 34 or similar component running a virtual network(s) 36 and multiple virtual environments running on the hypervisor 34. One of these virtual environments is the cloned virtual machine 26 and others of the virtual environments may be the spawned virtual machines 32 which may have been dynamically generated in response to predicted/observed activities and behaviors of the intruder. It should be understood that the exemplary embodiments should not be limited to the virtual machine and hypervisor components illustrated in FIG. 2 as other virtual machine implementations should work as well.
[0044] There may be a controller component 38 that interfaces with the hypervisor 34 in order to create new virtual machines, configure them, create and configure VLANs (virtual local area networks) on the virtual network 36, and also inject components/files/data into running virtual machines (among other things). The controller 38 may be administered directly via an administrative portal 42.
[0045] The administrative portal 42 may be a component that is responsible for orchestrating/managing the creation of the cloned environments.
[0046] A user may access the administrative portal 42 through physical computer 44. Alternatively, the controller 38 may have environments and features auto-created based on pre-defined rules. These rules may be persisted and orchestrated via the rules engine 40. Rules may be created manually or may be based on observed behavior in the environment. The activities that the intruder 10 performs may be monitored by the observer component 46.
[0047] The observer component 46 may interface with the spawned VM at an operating system level or hypervisor level. It receives events from these environments that describe what the user is doing and what is occurring on the target machine 24 at the time. The observer component may then generate rules or actions based on what has been observed and what it has been configured initially to do. For example, if the intruder is "pinging" various host names then the observer component 46 may observe this, conclude the intent was to seek out other hosts to penetrate, and may be configured to autogenerate hosts that have the name of one or more of the host names that the intruder was pinging. This would `trick` the intruder into believing they have hit upon a legitimate host and would ensnare them further as they try to then compromise this generated host. Another example might be if an intruder is observed searching a filesystem for files containing a certain text string then the observer component 46 might autogenerate files that contain this string to further confuse or distract the intruder.
[0048] The observer component 46 uses these observed behaviors to create rules in the rules engine 40 but the observer component 46 may also interface with a recorder component 48 that records all of the intruder's interactions in a secure storage environment such that the intruder's recorded actions may be used for evidentiary purposes later on.
[0049] The recorder component 48 may have hooks into the operating system of the virtual machine, either directly into the OS or via the hypervisor, and may record:
[0050] System calls. This would essentially capture all activities that the system performed, including those initiated by the user or by files uploaded and executed by the intruder. For example, it could capture the installation of viruses, deletion of files, etc.
[0051] User actions. This would capture all commands entered on the system, user actions undertaken while logged in, etc. For example, if it is a UNIX system, and the user accessed a shell, all of the commands they execute in this shell would be stored.
[0052] Screenshots. Screenshots or recordings of screen interactions could also be stored.
[0053] Data transfers. This would capture all data moved in/out via the network. This would, for example, capture the exfiltration of files.
[0054] All of these events may be timestamped and digitally signed to ensure their integrity for use for evidentiary purposes. The system may also send data or retrieve data from other logging or security devices, such as firewalls, security event log managers and so on, so that a complete view can be constructed of all actions taken by the intruder.
[0055] The recordings may be played back via the administrative portal 42.
[0056] The exemplary embodiments may further include additional features.
[0057] In one exemplary embodiment, a cloud-based service may be offered to third parties in which the virtual machine and associated sandbox may be hosted in a cloud-based service that is physically removed from the target.
[0058] The target machine 24 may be entirely on customer premises or the target machine 24 could be hosted in the cloud "as a service" so that the cloned virtual machine is then in a third party cloud service. In one variation, all of the components are in the cloud and, in another variation, just the target cloned virtual machine is in the cloud. In this latter scenario, a customer would procure the observer components and associated components shown in FIG. 2 and install them locally along with a subscription to the cloud-based service that is hosting the cloned virtual machine. In this regard, FIG. 2 has been redrawn to delete the limitation of all components being on the same target machine. Thus, FIG. 3 illustrates that the various components may be distributed so that some of the components may be installed locally while others of the components may be installed remotely.
[0059] In another variation, the spawned virtual machines could be containers running within an already running instance of the operating system. In this case, the attacker would continue to interact with the same physical server/OS instance but they start interacting with a virtual container--containing the same content--that is running on top of the original OS. In this embodiment, the container might not necessarily replicate the OS exactly but could instead just store the changes and act as intermediary layer between the OS/filesystem and the attacker so that when the attacker edits a file, the changes are stored in this container and not the actual file; and when the file is again requested by the attacker, the delta, in terms of bytes, is applied to the source file and the edited file is presented Shown in FIG. 4A is an exemplary embodiment of a virtual machine (hypervisor-based virtualization) and FIG. 4B is an example of an exemplary embodiment of a container (container-based virtualization). Docker (Docker, Inc.) and Linux containers are examples of container-based virtulaization. In container-based virtualization, the operating system is abstracted such that multiple instances of an application/kernel run on a single operating system instance; whereas, in hypervisor-based virtualization, the hardware is abstracted and so multiple instances of an operating system run on a single hardware instance. In both cases, it can be generalized to virtualization or virtual machines. Thus, the exemplary embodiments may utilize virtual machines--regardless of whether they are running as a container or whether they are running directly within a hypervisor.
[0060] In one exemplary embodiment, the target machine 24 may not need to be a stand-alone physical computer and may instead be embedded within security device 30 or other in-line network device.
[0061] In one exemplary embodiment, the intrusion(s) executed by the intruder 10 may be recorded and reverse engineered to either OS calls or function calls within the OS or the targeted application. The recorded and reverse engineered intrusions may then be used to develop signatures that may be used to either detect and/or block the use of this attack vector.
[0062] In one exemplary embodiment, the sandboxed cloned virtual machine 26 may be dynamically moved to law enforcement itself. Upon detection, a migration of the cloned virtual machine 26 may be executed from the sandbox hypervisor 34 to a target law enforcement environment. Alternatively, rather than move the compromised running virtual machine 14 to a contained environment such as target machine 26, the running virtual machine 14 may be moved directly to law enforcement via a "virtual 911" call. Law enforcement may then record the interactions and execute more advanced techniques/technologies to trace the origin of the intrusion.
[0063] In one exemplary embodiment, the intrusion protection as described herein may be provided as a service by an internet service provider, telecom service or other entity that is in-line between the intruder 10 and the attacked. For example, using variations of Deep Packet Inspection (DPI), the service could detect that an intrusion has occurred and execute the diversion to a dynamically generated sandbox which may be hosted in the cloud.
[0064] Referring now to FIG. 5, there is illustrated a security sandboxing method according to the exemplary embodiments. In the method, an illicit intrusion to a computer on a first computer system is detected, box 60. The intruded computer is cloned, box 62, and preferably moved to a secure, computer environment that is separate (physically or logically) from the computer environment that is hosting the intruded computer. All traffic from the illicit intrusion is directed to the cloned computer, box 64. Activities of the illicit intrusion interacting with the cloned computer are then observed, box 66. Lastly, the cloned computer is dynamically adapted to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion, box 68.
[0065] The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
[0066] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
[0067] Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
[0068] Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
[0069] Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
[0070] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
[0071] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
[0072] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
[0073] It will be apparent to those skilled in the art having regard to this disclosure that other modifications of the exemplary embodiments beyond those embodiments specifically described here may be made without departing from the spirit of the invention. Accordingly, such modifications are considered within the scope of the invention as limited solely by the appended claims.
2016-01-07 Deploying a security policy based on domain names
2016-04-28 Device security using user interaction anomaly detection
2016-03-24 Method and system for managing security compatibility of electronic content
2016-05-05 Verifying a user's identity based on adaptive identity assurance levels
2016-05-26 Secure data redaction and masking in intercepted data interactions
2016-05-26 Secure transmission method and system
2016-02-25 Secure connection certificate verification
2015-05-14 Executing electronic contract on nfc enabled mobile devices


At present there is much debate on the shape and direction of fiscal policy. The governments of the three biggest European countries have recently presented their draft budgets, while Parliamentary debate has started and will lead, with different degrees of difficulty and speed, to the final approval. Just to give a snapshot on timing, draft budgets were issued on 4th July by the German government, 29th September by the Italian government, and 26th September by the French government. Final approval should be given before the end of November in Germany, and before the end of the year in the other two countries. All three have been subject to excessive deficit procedures in the recent past. ED procedure was launched in January 2003 and cancelled in early summer 2007 in Germany, while in France it began in June 2003, and was cancelled in January 2007. In Italy the procedure began in July 2005, although it would have been launched earlier had the actual data been known in due time (there was a significant upward revision of deficit data in 2006). The ED procedure here is likely to be cancelled towards mid-2008, if everything goes well. The graph below shows the three countries' current situation and the prospects envisaged by their draft budgets. A quick look at the picture below suggests that Germany is proceeding much more decisively towards balancing its budget (within reach already in 2007), while Italy and France have taken a more relaxed stance. However, the trends are similar on the whole. Nonetheless, if we scrape the surface, a lot of questions emerge.
Obviously, recent economic performance has a lot to do with 2006-2007 results in Germany: higher than expected growth with healthy corporate profits and a huge reduction in unemployment played a big role in easing pressure on public accounts. Also there some observers are concerned that fiscal policy is turning pro-cyclical again (expanding in good times and restricting in bad times). In general, the elasticity of revenues to GDP growth has been remarkably high in all these countries in recent years, but particularly in Germany, thanks to the huge increase in revenues from corporate taxes, and in Italy thanks (probably) to the increase in tax compliance following government efforts to combat the country's historically huge degree of tax evasion.
While an external observer would tend to consider the German budget as an orthodox one (banking on good times to balance the budget), the main criticism of the Italian budget is that it does not introduce enough measures to reduce current spending, and that it could have been more aggressive on reducing the deficit, given higher than expected tax revenues. Some observers have also said that the French budget is not rigorous enough. Looking at the macroeconomic forecasts behind these public targets, we see that Germany's draft budget is based on a 1.75% per year growth projection, Italy's on a cautious 1.5% in 2008, slightly improving thereafter, and France's on a regular path of growth in the 2-2.5% range.
Looking at details there are considerable similarities, for example in the reform of corporate tax in Germany and Italy, both effective from 2008. Nominal tax rates have been sharply reduced (especially in Germany) in exchange for a widening of the tax base, including a reduction in the deductibility of interest payments. Obviously there is a relevant issue here in terms of harmonization of taxation at European level.
Nonetheless, and despite the first impression from the graph, the relative positions in late 2008 when deciding the budget for 2009 will be fairly different. Italy and France will have to look for other resources, given some political constraints on available measures in terms of the breakdown of expenditure cuts or tax hikes.
Let's make a purely hypothetical scenario in which an unexpected crisis occurs and world growth slows heavily. Let's say that each of the three countries' growth rate in 2008 is one full percentage point below the consensus forecasts. The final outcome will be that Italy and France, given the elasticity of their budgets to growth (see OECD WP 434) and the distance from growth level projected for planning purposes, will likely post deficit/GDP ratios of around (the former) or above (the latter) the 3% limit, while Germany could well stay on course. And policy reactions will be different once again, contradicting the idea that in a monetary union fiscal policy should be used to counteract local one-off shocks and should become more regional than national. There is an interesting EU Commission paper (economicpapers287) which suggests that synchronization in the Euro area has increased, but that it still tends to diminish after the business cycle has hit a trough. Varying fiscal policy approaches will therefore emphasize this tendency in such a situation, making the ECB's job more difficult.
Conversely, let's assume that the turmoil in the financial markets disappears without any major consequences, and let's adopt a wider perspective. At the end of the process each of the three biggest countries in Europe would have a balanced budget, while their bond issuances would be lower than in 2006 by a total amount of around 140 bln Euros. And let's think again about what happened to the financial system in late summer. One interpretation is that the turmoil was due to the fact that there is too much liquidity with too few real assets to support, causing an almost-rational non-smooth transition from one bubble to another. If this is true, why can't we imagine a European agency taking care of supranational problems (the most obvious being environmental issues such as Kyoto compliance-related expenditures), and coordinating efforts at European level for which each member state would provide funding, issuing bonds for the purpose?
2 Responses to "A wider perspective"
A very good analysis. But i am not sure that issuing EU-wide bonds just for the sake of creating a supply of bonds given the liquidity sloshing around is a good idea. If that issuance of bonds can be justified based on fiscal spending needs at the EU level it would be another story.
That is a brilliant statement. But which political or fiscal institutions explain this differential fiscal policy approach?


Waterfront on Cape Cod Bay! This charming two-bedroom cottage with Cape Cod Bay views is only steps down a sandy path to the water's edge. The cottage has a light, bright living room with water views, a dining room (with split unit, ductless air conditioning), a well-equipped kitchen and two bedrooms, one with a queen bed and the second with two twin beds.
There is another split unit, ductless air conditioner in the queen bedroom as well. There is a full bath with shower.
The property is located along the shuttle route to Provincetown! Hop on the shuttle to enjoy all that Provincetown has to offer - great shops, restaurants, galleries and museums--just to name a few. Short drive to Cape Cod National Seashore beaches, wine and lighthouse tours and other fun activities.
Comfortable stay-like feeling at home. If possible it would be nice to have a dishwasher.
Location, location, location. And orientation of the cottage; facing the dunes and ocean. We love this cottage!
We stayed at this lovely cottage 6/21 -7/5/2014. There were four of us, my husband myself and our 2 kids - 21yo and 24yo It was absolutely charming. Very well equipped, and even though the cottage had AC we had no need for it as the sea breeze blew steadily and kept the cottage cool. All the cottages are situated around a green that really adds as a nice buffer to Shore Road and is great for kids to play on. The wifi worked well. There's a little walk to the beach which we actually enjoyed, as the sandy paths are surrounded by wavy beach grass - quite picturesque!! Provinctown is 10 minutes away and there are a ton of places to shop, ranging from tiny to super stop and shop. We loved a place called 141 Market on Bradford Street - great juices/smoothies and "natural" foods, oh and parking!!
I could go on and on about # 3 Pilgrim Colony Cottage but I'm exhausted from our fantastic vacation there. Oh the only downside was "check out" was at 10am, I would have preferred 12noon.


Power Rangers is a long-running American children's television series adapted from the Japanese tokusatsu Super Sentai Series. A team of five high sch... (more)ool students are selected by Zordon to battle evil. Using martial arts, special weapons, and gigantic robots called "Zords", they protect their city Angel Grove from monsters and witches.
When is Power Rangers back?


How to make a screenshot on an Android device?
- the menu and Home button.
This method works for devices that have a built-in screen capture function. Almost every device with 4.0 version of Android allows you to make screenshots using these shortcuts.
2. There are a lot of Android Screen shot apps available on Google Play. We recommend you to check them because the ability to take screenshots on your Android tablet or Android phone is extremely useful.
How to take a screenshot on Kindle Fire 2, Kindle Fire HD 7 or Kindle Fire HD 8.9?
Как отключить уведомления на устройстве Android?


The low frequency of 1.3GHz has better signal penetration ability than 5.8GHz, and therefore more suited for long range FPV. There are pro's and con's using 1.3GHz vs 5.8Ghz as discussed in this article, so I won't repeat here.
You could certain use higher power VTX, but there is a higher chance causing interference to other components, e.g. your radio receiver and GPS. It's important to use just the right amount of power for what you need. Using more than you need can actually be bad when it comes to VTX.
There are two versions you can pick depends on your region: US and International (for the rest of the world). The only difference I can see in the specs is just the channels they support. Oh, and the color of the case too.
The one I am reviewing is the International version. It's important that you understand which one you are getting, and that your receiver has the matching channels.
Looking for 1.3GHz video receiver? This is a good one: http://bit.ly/rmrc-1-3ghz-receiver.
It takes DC 12V as power (okay to be powered by a 3S LiPo directly), and current consumption is around 0.7A.
The RMRC 1.3GHz 400mW VTX comes with a huge blue heatsink case. It can be removed for a lighter and smaller form factor.
However if you do remove the heatsink/case, make sure you have good airflow to the VTX to avoid overheating.
To remove the case, simply take off the four screws on each side. You will also need to peel off the digit display protector with a slot screw driver. And the VTX slides right out.
The weight saving is massive!
The 1.3GHz dipole antenna is pretty big and heavy, that's why you don't see people using 1.3GHz in Mini Quad.
I tested the RMRC 1.3GHz 400mW VTX with the ImmersionRC RF power meter V2. Every measurement was taken 10 seconds after the VTX was powered on, and the VTX was allowed enough time to cool down before the next measurement.


Finally, No Depression magazine co-editors Peter Blackstock and Grant Alden attempt to answer the big one: what is "alternative country"? A return to traditional roots? Soul music for hillbillies? Country stripped of Nashville gloss? Mountain-folk with punk phlegm? The truth probably lies in its scuppering of lazy stereotype. Far from being a repository for mawkish sentiment and conservatism, true country music is dark, heroic and often unnervingly acute. Not to mention beautiful. In those terms, it's hard to fault this awesome collection, bookended by Johnny Cash's blood'n'granite take on Willie Nelson's "Time Of The Preacher"?aided by Nirvana's Krist Novoselic and Soundgarden's Kim Thayil?and The Carter Family's "No Depression In Heaven". In between, Doug Sahm's "Cowboy Peyton Place" tips a wink to honky-tonk swing; early Whiskeytown nugget "Faithless Street" points the ruinous way to future days; Buddy Miller offers up the driving old-time fare of "Does My Ring Burn Your Finger?" and Allison Moorer bathes in the soft steel of "Is Heaven Good Enough For You?" The collaborations are curiously evocative, too?Lucinda Williams adding bluesy moan to Kevin Gordon's "Down To The Well", Robbie Fulks and Kelly Willis' playful "Parallel Bars", Emmylou Harris adding porcelain to Hayseed's "Farther Along" and Hole Dozen (Mark Olson and Victoria Williams, plus various Gourds and Silos) barrelling through Mickey Newbury's "How I Love Them Old Songs". Brilliant.


text:
Funny Videos - Dianjinwa Video - Free Hot Videos
Funny - Free Funny Videos
Every time a boy buys water, he wins a prize. I didn't think the prize would scare him away. What's the situation?
Boys buy hamburgers and jump in line. Beautiful women pretend to be big money and buy out of stock. Unexpectedly, they only buy two.
The young man thought that Uncle would introduce the cotton jacket to himself. Who knows that the cotton jacket is too funny. It's interesting.
Husband asked the pregnant daughter-in-law what she wanted to eat, but did not think the child in her stomach reported the name of the dish, laughing all the way.
It's so interesting that the two sisters get angry when they say something wrong. The two sisters work together to rectify the little partner.
The young man did his homework, but he wrote a 500-word composition with "do what you want". IQ is really funny.
The young farmer enjoyed his meal and ate a pile of duck necks with the money of a duck neck. It was very talented.
The young man went on a business trip to find a hotel, and instead of navigating, he went to the funeral parlor. The conversation between them was so funny.
It's funny that the young man went out to make up and changed himself after painting.
When the young man arrives, he leaves work and runs away. As a result, the next day he is wretched by his boss.
The young lad hospital sees a doctor, must let the female nurse help oneself to inject, unexpectedly came an intern female nurse.
Beautiful women set up stalls, "rice" plus a stroke, write a word, reward 10,000 yuan, the ending is funny.
The boy sells borax-free mud, nobody buys it. After pomelo tricks, he loses two boxes of mud without earning a penny.
The young man sells borax-free clay without thinking of an acquaintance. His aesthetic is so peculiar that he laughs at the end.
The young man sells walnuts, but he has no business. He thinks of a good way to make six kinds of handicraft products with walnuts and sells 1000 in a twinkling of an eye.
The young man sells 188 bicycles and doesn't want to be cut down to two yuan directly by second-class goods. The end is too funny.
The boy went to KTV to sing, but unexpectedly he had two power cuts in a row. What's the situation?
The young man went to help ask for the bill, but he did it unexpectedly. As a result, he was out of money.
When he went to see a psychiatrist, he always felt that someone was under the bed. He went straight to the carpenter to cut off the legs of the bed.
The boy went to his neighbor's house for a meal, not only picking at the dishes, but also walking along a ham. It was so funny.
Pay tribute to the new era! The story of "Me and My Motherland" was praised, and the audience burst into tears as Ge You cheered.
The young man went to the restaurant to eat without money. He played a mango seed with his calculator. He didn't want his boss to be free of the bill.
The lad changes the magic routine, the beautiful woman gold ring, the beautiful woman looks like a model, the anti-routine lad 3000 yuan
It's so interesting that the boy only eats seafood noodles with shrimp and kelp, and he doesn't want to pay with his exercise vouchers.
The young man ate a bully's meal and was kicked out by the landlady. Unexpectedly, the next day he ate his meal and paid with his butt.
The young man forgot to bring money with him for dinner. In order to escape the bill, he pretended to be a waiter to collect money.
It's interesting for the boy to blow the coal puller into a motor car at the party.
The young man interviewed the beautiful woman, but she did not expect him to be a boyfriend. It was funny.
The young man complained to his mother-in-law. Unexpectedly, it was very interesting for her mother-in-law to persuade her to divorce without saying anything.
Boys and friends bet that whoever is afraid of his wife loses in order to win and play with her.
The young man and the beautiful woman took the coach, but they quarreled one by one. It was funny.
Guys and Beauty Restaurant have dinner, but then add vinegar and salt to it. It's very interesting.
5491 首页 上一页 7 8 9 10 11 12 13 14 15 16 下一页 尾页


text:
Q: react-native-device-info unique ID Is it safe to use a react-native-device-info unique ID? From what I can understand it will always remain unique for both iOS and android no matter how many times the app will be uninstalled.
If not kindly suggest what else we can use to uniquely identify the device since I want to make sure every user login with a separate device.
const uniqueId = DeviceInfo.getUniqueID();

// iOS: "FCDBD8EF-62FC-4ECB-B2F5-92C9E79AC7F9"
// Android: "dd96dec43fb81c97"

Notes
iOS: This is IDFV so it will change if all apps from the current apps
  vendor have been previously uninstalled. android: Prior to Oreo, this
  id (ANDROID_ID) will always be the same once you set up your phone.

A: I was doing SDK for analysts, which generates billions of events every day and I can find the following.

For iOS:
IDFV - changes after user re-install app(if user had only one your app).
I recommend to use next form: currentTimeInMilliseconds_IDFV and save this to KeyChain. KeyChain is updated only after user reset the device to the factory settings.

For Android:
Android don't have a cool version.
I recommend to use form: android.os.Build.SERIAL_Settings.Secure.ANDROID_ID.
Each argument aren't unique and one million devices have about 100 repeats.

But sorry, I don't have example for react native, if you need an example I can search later.

redpajama_set_name: RedPajamaStackExchange


Soccer Legends, tactical turn-based soccer manager!
TBS game mixed with RPG and soccer manager in a world like Captain Tsubasa! Manage your team and reach the glory!
We introduce our first expansion for Soccer Legends, help us to reach our goal!
"Let me see... alright, it would be a great game, Let's do it!"
Welcome to Soccer Legends. Kickoff!!
Welcome to our kickstarter project! We'll daily post updates with all relevant info about Soccer Legends. We hope to like this and thanks for visiting!


The defending champion, Louis-Philippe Dumoulin, was on-track yesterday, on the Kawartha Speedway near Fraserville, Ontario to compete in the final event of the NASCAR Canadian Tire season. Qualified in fifth place, the driver of the #47 Dodge WeatherTech Canada / Groupe Bellemare made his way to third place and fought with determination among the leaders throughout the whole race in order to remain ahead of the pack. This fourth place allows him to end up in fourth in the final championship standings.


The ultimate program for creating ever-increasing, predictable profits year-after-year.
You do not have access to this page. Please visit this page for information.
© 2017 - Managed Marketing, LLC. All Rights Reserved.


text:
HomeBooks by AgeAges 0-3Best Selling Picture Books | August 2018
Best Selling Picture Books | August 2018
Selected as one of the best new picture books in March 2017, Peter H. Reynold's Happy Dreamer is this month's best selling picture book from our affiliate store.
You'll also find our hand selected titles of the most popular picture books from the nationwide best-selling picture books listed by The New York Times.
The Children's Book Review's Best Selling Picture Book
Happy Dreamer
Written and Illustrated by Peter H. Reynolds
Publisher's Synopsis: In his Scholastic debut, picture book and creativity guru Peter Reynolds brings us a universally poignant celebration of the colorful spectrum of what it means to dream and the many ways to find happy!
While the world tells us to sit still, to follow the rules, and to color inside the lines, Happy Dreamer celebrates all those moments in between when the mind and spirit soar and we are free to become our own true dreamer maximus! In Peter's signature voice and style, this empowering picture book reminds children of how much their dreams matter, and while life will have ups and downs, he enlists readers to stay true to who they are, to tap into their most creative inner selves, and to never ever forget to dream big!
With worldwide sales of his previous titles surpasing 2 million copies, Peter Reynolds' latest inspirational book is a perfect gift for graduations, new babies, milestone moments, and any happy occasion throughout the year.
Order a Copy Now: Indiebound | Amazon | Barnes and Noble
Ages 4-8 | Publisher: Orchard Books | March 28, 2017 | ISBN-13: 978-0545865012
Nationwide Best Selling Picture Books
After The Fall: How Humpty Dumpty Got Back Up Again
Written and Illustrated by Dan Santat
Publisher's Synopsis: From the New York Times–bestselling creator of The Adventures of Beekle: The Unimaginary Friend comes the inspiring epilogue to the beloved classic nursery rhyme Humpty Dumpty.
Everyone knows that when Humpty Dumpty sat on a wall, Humpty Dumpty had a great fall. But what happened after?
Caldecott Medalist Dan Santat's poignant tale follows Humpty Dumpty, an avid bird watcher whose favorite place to be is high up on the city wall―that is, until after his famous fall. Now terrified of heights, Humpty can longer do many of the things he loves most.
Will he summon the courage to face his fear?
After the Fall (How Humpty Dumpty Got Back Up Again) is a masterful picture book that will remind readers of all ages that Life begins when you get back up.
Ages 4-8 | Publisher: Roaring Brook Press | Oct. 3, 2017 | ISBN-13: 978-1626726826
Ada Twist, Scientist
Written by Andrea Beaty
Illustrated by David Roberts
Publisher's Synopsis: The creators of the New York Times bestselling picture books Rosie Revere, Engineer and Iggy Peck, Architect are back with a story about the power of curiosity in the hands of a child who is on a mission to use science to understand her world. Ada Twist, Scientist, from powerhouse team Andrea Beaty and David Roberts, is a celebration of STEM, perseverance, and passion.
Like her classmates, builder Iggy and inventor Rosie, scientist Ada, a character of color, has a boundless imagination and has always been hopelessly curious. Why are there pointy things stuck to a rose? Why are there hairs growing inside your nose? When her house fills with a horrific, toe-curling smell, Ada knows it's up to her to find the source. What would you do with a problem like this? Not afraid of failure, Ada embarks on a fact-finding mission and conducts scientific experiments, all in the name of discovery. But, this time, her experiments lead to even more stink and get her into trouble!
Inspired by real-life makers such as Ada Lovelace and Marie Curie, Ada Twist, Scientist champions girl power and women scientists, and brings welcome diversity to picture books about girls in science. Touching on themes of never giving up and problem solving, Ada comes to learn that her questions might not always lead to answers, but rather to more questions. She may never find the source of the stink, but with a supportive family and the space to figure it out, she'll be able to feed her curiosity in the ways a young scientist should.
Iggy Peck and Rosie Revere have earned their places among the most beloved children's characters, and they have inspired countless kids and adults to follow their dreams and passions. Now in her own charming and witty picture book, determined Ada Twist, with her boundless curiosity for science and love of the question "Why?," is destined to join these two favorites. The book is the perfect tool to remind both young girls and women that they have the intelligence and perseverance to achieve their dream.
Ages 5-7 | Publisher: Abrams Books for Young Readers | September 6, 2016 | ISBN-13: 978-1419721373
Llama Llama Loves To Read
Written by Anna Dewdney and Reed Duncan
Publisher's Synopsis: Llama Llama learns at school.
Counting, writing, reading, rules.
Friends and school — there's nothing better.
Llama learning all the letters!
Anna Dewdney's beloved Llama Llama is growing up and learning to read! Throughout the school day,the teacher helps Llama Llama and the other children practice their letters, shows word cards, reads stories, and brings them to the library where they can all choose a favorite book. By the end of the day, Llama Llama is recognizing words and can't wait to show Mama Llama that he's becoming a reader!
Ages 3-5 | Publisher: Viking Books for Young Readers | May 1, 2018 | ISBN-13: 978-0670013975
Dragons Love Tacos
Written by Adam Rubin
Illustrated by Daniel Salmieri
Publisher's synopsis: This scrumptious New York Times bestseller has a whole lot of kick!
Dragons love tacos. They love chicken tacos, beef tacos, great big tacos, and teeny tiny tacos. So if you want to lure a bunch of dragons to your party, you should definitely serve tacos. Buckets and buckets of tacos. Unfortunately, where there are tacos, there is also salsa. And if a dragon accidentally eats spicy salsa . . . oh, boy. You're in red-hot trouble.
The award-winning team behind Those Darn Squirrels! has created an unforgettable, laugh-until-salsa-comes-out-of-your-nose tale of new friends and the perfect snack.
Ages 3-5 | Publisher: Dial | June 14, 2012 | ISBN-13:978-0803736801
The Wonderful Things You Will Be
Written and Illustrated by Emily Winfield Martin
TCBR Review: Every child is unique, and parents can't wait to see what they will one day be!
Emily Winfield Martin's delightful book dreams of what children will someday grow to be.
This is a gorgeous book with warm and playful illustrations featuring a diverse set of children. Little ones will be drawn to the pictures, quickly pointing out which one matches what they themselves want to be. The surprise of a double foldout page at the end is a very exciting treat for children too, and my daughter wanted to look at it over and again. The prose is sweet and rhyming, drawing children in and lulling them (hopefully) to sleep before bedtime. A charming book that I highly recommend for young children. Read the full review …
Ages 3-7 | Publisher: Random House Children's Books | 2015 | ISBN-13: 978-0-385-37671-6
The information for the best-selling picture books was gathered from the New York Times Best Sellers list, which reflects the sales of picture books sold nationwide, including independent and chain stores. It is correct at the time of publication and presented in random order. Visit www.nytimes.com for their most current and up-to-date list.
*Header image from "Happy Dreamer" written and Illustrated by Peter H. Reynolds (Orchard Books, 2017)
The best-selling picture books by Emily Winfield Martin, Adam Rubin, and others, are truly great choices. Follow along with our Picture Book category for more great titles to peruse.
Abrams Books for Young ReadersAdam RubinAndrea BeatyAnna DewdneyBest Selling Books For KidsDan SantatDaniel SalmieriDavid RobertsDialEmily Winfield MartinOrchard BooksPeter H. ReynoldsPicture BooksRandom House Books for Young ReadersReed DuncanRoaring Brook PressThe New York TimesViking Books for Young Readers
8 Coloring Books to Calm, Entertai...
Best New Young Adult Books | May 2...
Jon H
I found this STUNNING new picture book. Maybe review?
"Nature's Friend – The Gwen Frostic Story"
Learn to Be Proud of Who You A...
Bestselling Middle Grade Books...


text:
HOLIDAY HORROR
Two US tourists in their 60s killed in freak pony-and-trap accident at Kerry's Gap of Dunloe after trap overturned as locals express shock at 'terrible tragedy'
The pair from Phoenix, Arizona, were hurtled from the jaunty car they were travelling in
Ann Mooney
TWO US tourists were killed instantly in a pony-and-trap accident at one of Ireland's most scenic beauty spots today.
The pair, in their 60s and from Phoenix, Arizona, were hurtled from the jaunty car they were travelling in.
Emergency services were alerted at 2pm and paramedics arrived a short time laterCredit: Michelle Cooper Galvin
It was coming down from the picturesque Gap of Dunloe, near Killarney, Co Kerry when the incident occurred.
The woman and the man were in a family party of six including the woman's daughter, her husband and their two children who were travelling down the the narrow roadway in a separate carriage.
It is understood the freak accident was seen by the other family members. Gardai said it is unclear what caused the accident but the trap overturned and the pair were flung from into a ravine.
Emergency services were alerted at 2pm and paramedics arrived a short time later. Members of Kerry Mountain Rescue were called in to help to retrieve the bodies.
Members of Kerry Mountain Rescue were called in to helpCredit: Michelle Cooper Galvin
One local said: "This is a terrible tragedy. The horses pulling the traps are very well trained and are very quiet. Our thoughts are with the family trying to come to terms with their terrible loss."
The jarvey, who is in his 40s was not seriously injured in the accident.
He is reported to be traumatised and deeply upset by the tragedy.
The road from Kate Kearney's Cottage was immediately closed and a team of forensic crash investigators were examining the area where the accident happened.
Supt Flor O'Mahony from Killarney Garda Station described the accident as a "terrible tragedy".
The tragedy occurred at the Gap of Dunloe in Co KerryCredit: Flickr RF - Getty
He said "This is a very sad and tragic accident and it will be fully investigated to establish all the facts".
The two bodies were taken to Kerry University Hospital in Tralee where a postmortem examination is expected to be done tomorrow.
The horse was badly injured and had to be put down.
This is the second accident on the road in less than a year. An American woman in her 60s was killed at the entrance of the road to the Gap when her bike was in collision with a jeep towing sheep on May 30 last.
Killarney Chamber of Tourism & Commerce has expressed its sympathy and support the family at the centre of the tragic accident at the Gap of Dunloe.
Chamber President Paul O'Neill said: "We are all shocked and saddened by this most tragic accident.
"The Gap of Dunloe is one Ireland's most popular tourist destinations, a place that brings joy to tourists the world over and we are devastated that a visit to it by this couple would end in such tragic circumstances.
"The people of Killarney extend our heartfelt sympathies to all affected by this tragedy and will do whatever we can to support the family during this very sad time."