Applies to
Summary
This How To describes an approach for creating a threat model for a Web application. The threat modeling activity helps you to model your security design so that you can expose potential security design flaws and vulnerabilities before you invest significant time or resources in a flawed design and/or problems become difficult to reverse. This How To provides prioritized vulnerability categories and a threat list to make the threat modeling activity easier.
Contents
- Objectives
- Overview
- Before You Begin
- Input
- Output
- Summary of Steps
- Step 1: Identify Security Objectives
- Step 2: Create an Application Overview
- Step 3: Decompose Your Application
- Step 4: Identify Threats
- Step 5: Identify Vulnerabilities
- What to Do Next
- Agile Considerations
- MSF Agile Considerations
- Additional Resources
Objectives
By performing the steps in this module, you will:
- Identify relevant threats to your particular application scenario.
- Identify key vulnerabilities in your application design.
- Improve your security design.
Overview
Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. This How To presents a question-driven approach to threat modeling that can help you identify security design problems early in the application design process. This approach allows you to quickly create a basic threat model for your application scenario. Then you can use this threat model to help refine your application's design early and for communication among team members.
The threat modeling approach presented here focuses on identifying and addressing vulnerabilities. The security objectives, threats, and attacks that you identify in the early steps of the activity are the scoping mechanisms designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.
Before You Begin
Use this module to quickly create an effective threat model for your application. When using this module, keep the following in mind:
-
Do not get blocked on steps or implementation. Focus on the approach. If you do get blocked on a particular step, skip ahead to step 4, "Identify Threats." The primary objective of the activity is to improve security design, not to model for the sake of modeling.
-
Use scenarios to scope the modeling activity. Identify scenarios that are out of scope to help limit your threat modeling activity. What are you not going to talk about? For example, are operational practices out of scope?
-
Use your existing design documents if you have them. Use items such as documented use cases or user stories, data flow diagrams, architecture diagrams, and other design documentation if you have them.
-
Start with a whiteboard. It can be easier to get started by modeling on a whiteboard before you start capturing information in documents or getting lost in details. A helpful technique is to use a digital camera or whiteboard with print capability to document and distribute the information from the whiteboard.
-
Use an iterative approach. Add more detail and evolve your threat model as you continue design and development. Use ongoing modeling to reduce risk and to inform your design decisions. For example, when early in the design process, you may have only basic use cases, an initial deployment topology, and an idea of how you will layer your application. By using an iterative approach, you become familiar with the modeling process and can evolve your threat model to examine "what if" scenarios as more information becomes available to you. You might choose to adopt a more formal approach and identify milestones for revisiting your model. What is most important is that you revisit the model when you need to make an engineering decision, as you introduce new levels of risk, and when you contemplate significant design choices.
-
Review and use the Template: Web Application Threat Model. Use the companion template while creating your threat model. The template includes exit criteria for each step described in this How To.
-
Use the Cheat Sheet. Use the companion document, "Cheat Sheet: Web Application Security Frame," to help you identify threats and vulnerabilities in step 4, "Identify Threats," and step 5, "Identify Vulnerabilities." The cheat sheet contains sample threats, attacks, vulnerabilities, and countermeasures.
-
Adapt the activity for your situation. If you are new to threat modeling, consider reading this document and then reading the companion walkthrough, "Walkthrough: Creating a Threat Model for a Web Application," to become more familiar with the approach. If you have existing applications, you can use the threat and vulnerability identification approaches in steps 4 and 5. With this information, you can determine where to focus your efforts.
-
Obtain input about host and network constraints from your system and network administrators. To be able to draw and understand your end-to-end deployment scenario, you need to have information about the host configuration, firewall policies, allowed protocols and ports, and so on. Obtain this information by talking to your system and network administrators.
Input
The following input is useful for threat modeling:
- Use cases and usage scenarios
- Data flows
- Data schemas
- Deployment diagrams
Although all of these are useful, none of them are essential. However, you do need to have knowledge of your application's primary function and architecture.
Output
The output of the threat modeling activity is a threat model. The main items captured by the threat model include the following:
- A list of threats
- A list of vulnerabilities
Summary of Steps
The five major threat modeling steps are:
-
Step 1: Identify security objectives. Clear objectives help you to focus the threat modeling activity and determine how much effort to spend on subsequent steps.
-
Step 2: Create an application
overview. Itemizing your application's important characteristics and actors helps you to identify relevant threats during step 4.
-
Step 3: Decompose your application. A detailed understanding of the mechanics of your application makes it easier for you to uncover more relevant and more detailed threats.
-
Step 4: Identify threats. Use details from steps 2 and 3 to identify threats relevant to your application scenario and context.
-
Step 5: Identify vulnerabilities. Review the layers of your application to identify weaknesses related to your threats. Use vulnerability categories to help you focus on those areas where mistakes are most often made.
You add progressively more detail to your threat model as you move through your application development life cycle and discover more details about your application design. Because key resources identified in threat modeling are also likely to be key resources from a performance and functionality perspective, you can expect to revisit and adjust your model as you balance all of your needs. This is normal and is a valuable outcome of the process.
Step 1: Identify Security Objectives
Security objectives are goals and constraints related to the confidentiality, integrity, and availability of your data and application. They include:
-
Confidentiality. This includes protecting against unauthorized information disclosure.
-
Integrity. This includes preventing unauthorized information changes.
-
Availability. This includes providing the required services even while under attack.
 You may find it helpful to think of security objectives in terms of constraints. Consider the question, "What do you not want to happen?" For example, an attacker must not be able to steal user credentials.
By identifying your key security objectives, you can determine where to focus your efforts. Identifying your objectives also helps you to understand the goals of potential attackers and concentrate on those areas of your application that require closer attention. For example, if you identify customer account details as sensitive data that needs protecting, you can examine how securely the data is stored and how access to the data is controlled and audited.
To determine your security objectives, consider the following questions:
-
What client data do you need to protect? For example, does your application use user accounts and passwords, customer account details including personalization information, financial history and transaction records, customer credit card numbers, bank details, or travel itineraries?
-
Do you have compliance requirements? Compliance requirements may include security policy, privacy laws, regulations, and standards.
-
Do you have specific quality of service requirements? Quality of service requirements include availability and performance requirements.
-
Are there intangible assets that you need to protect? Intangible items include your company's reputation, trade secrets, and intellectual property.
The following are examples of some common security objectives:
- Prevent attackers from obtaining sensitive customer data, including passwords and profile information.
- Meet service-level agreements for application availability.
- Protect the company's online business credibility.
Step 2: Create an Application Overview
In this step, you outline what your Web application does. Your goal is to identify your application's key functionality, characteristics, and clients. This will help you to identify relevant threats during step 4.
Note Remember that threat modeling is an iterative process. Do not let this step block your progress. Identify as much detail as you can and then add more detail as your design evolves. For example, if you are in the middle of your design and have not tackled physical deployment, you can still perform this step, although with less data. Itemize what you can as soon as you can.
To create an application overview:
-
Draw the end-to-end deployment scenario.
-
Identify roles.
-
Identify key usage scenarios.
-
Identify technologies.
-
Identify application security mechanisms.
The next sections describe each of these.
Draw the End-to-End Deployment Scenario
Use a whiteboard to draw the end-to-end deployment scenario. First, draw a rough diagram that describes the composition and structure of your application, its subsystems, and its deployment characteristics. Add details about the authentication, authorization, and communication mechanisms as you discover them. Remember that you may not have all of the details early in the design process.
Your deployment diagram should generally include the following:
-
End-to-end deployment topology. Show the layout of the servers and indicate intranet, extranet, or Internet access. Start with logical network topologies, and then refine this to show physical topologies when you have those details. You can add or remove threats depending on your choice of specific physical topologies.
-
Logical layers. Show where the presentation layer, business layer, and data access layers reside. Refine this to include physical server boundaries when you know them.
-
Key components. Show the important components within each logical layer. Refine this to include actual process and component boundaries when you know them.
-
Key services. Identify any important services. Show these as processes when you know them.
-
Communication ports and protocols. Show which servers, components, and services communicate with each other and how they do it. Show the specifics of inbound and outbound information packages when you know them.
-
Identities. Show the main identities used for the application and any relevant service accounts if you have this information.
-
External dependencies. Show the dependencies that your application has on external systems. Later in the modeling process, this will help you identify vulnerabilities that can arise if any assumptions you make about the external systems are false or if the external systems change in any way.
Note As your design evolves, you should regularly revisit the threat model to add more detail. For example, you might not know all of the components initially. Subdivide your application as necessary to get enough detail to find your threats.
Identify Roles
Identify your application's roles: that is, identify who can do what within your application. What can your users do? What higher-privileged groups of users do you have? For example, who can read data, who can update data, who can delete data?
Use role identification to determine both what is supposed to happen and what is not supposed to happen.
Identify Key Usage Scenarios
What are the important features of your application? What does it do? Use your application's use cases to derive this information. Identify the dominant application functionality and usage, and capture the Create, Read, Update, and Delete aspects.
Key features are often explained in the context of use cases. They can help you and others to understand how your application is intended to be used and how it can be misused. Use cases help you identify data flows and provide focus when you identify threats later in the modeling process.
Avoid attempting to list every possible use case. Instead, start by identifying the main use cases that exercise the predominant Create, Read, Update, and Delete functionality of your application. For example, a self-service, employee human resources application might include the following use cases:
- Employee views financial data.
- Employee updates personal data.
- Manager views employee details.
- Manager deletes employee records.
In these cases, you can look at the possibilities of the business rules being misused. For example, consider a user trying to modify personal details of another user. You often need to consider several use cases happening simultaneously to perform a complete analysis.
Also identify what scenarios are out of scope, and use your key scenarios to constrain the discussion. For example, you might decide that operational practices, such as backup and restore, are out of scope for the initial threat modeling exercise.
Identify Technologies
Where you can identify them, list the technologies and key features of the software and technologies that you use. Identify the following:
- Operating systems
- Web server software
- Database server software
- Technologies used in the presentation, business, and data access layers
- Development languages
Identifying technologies helps you to focus on technology-specific threats later in the threat modeling activity. It also helps you determine the correct and most appropriate mitigation techniques.
Identify Application Security Mechanisms
Identify any key points that you know about the following:
- Input and data validation
- Authentication
- Authorization
- Configuration management
- Sensitive data
- Session management
- Cryptography
- Parameter manipulation
- Exception management
- Auditing and logging
The purpose of this effort is to identify interesting details and be able to add detail where necessary, or to identify where you might need to learn more.
For example, you might know how your application is authenticated by the database or how your users are authorized. You might know the other areas where your application performs authentication and authorization. You might also know certain details about how input validation is to be performed. Highlight these and other key elements of your application security mechanisms.
Step 3: Decompose Your Application
In this step, you break down your application to identify trust boundaries, data flows, entry points, and exit points. The more you know about the mechanics of your application, the easier it is to uncover threats and discover vulnerabilities. To decompose your application:
-
Identify trust boundaries.
-
Identify data flows.
-
Identify entry points.
-
Identify exit points.
The next sections describe each of these.
Identify Trust Boundaries
Identify your application's trust boundaries to help focus your analysis on areas of concern. Trust boundaries indicate where trust levels change. You can think of trust from the perspective of confidentiality and integrity. For example, a change in access control levels in your application where a specific role or privilege level is required to access a resource or operation would be a change in trust level. Another example would be at an entry point in your application where you might not fully trust the data passed to the entry point.
To help identify trust boundaries:
- Start by identifying your outer system boundaries. For example, your application can write to files on server X, it can make calls to the database on server Y, and it can call Web service Z. This defines your system boundary.
- Identify access control points or the key places where access requires additional privileges or role membership. For example, a particular page might be restricted to managers. The page requires authenticated access and also requires that the caller is a member of a particular role.
- Identify trust boundaries from a data flow perspective. For each subsystem, consider whether the upstream data flow or user input is trusted, and if it is not, consider how the data flow and input can be authenticated and authorized. Knowing which entry points exist between trust boundaries allows you to focus your threat identification on these key entry points. For example, you are likely to have to perform more validation on data passed through an entry point at a trust boundary.
Some example trust boundaries are:
- A perimeter firewall. The firewall is likely to be the first trust boundary. It moves qualified information from the untrusted Internet to your trusted data center.
- The boundary between the Web server and database server. Your database may or may not be included in your application's trust boundary. Often the Web servers act as a second firewall to the databases. This significantly limits network access to the databases and thereby reduces the attack surface. Describe the network topology within your data center. Do any other applications write to the database? If they do, do you trust those applications? If you trust the applications that write to the database, you may still not want to trust the database—is it protected?
- The entry point into a business component that exposes privileged data (data that should be available to only particular users). In this case, you need an access check to ensure that only the appropriate callers are allowed access. This is a trust boundary.
- The boundary between your application and a third-party service. Do you trust the service's identity? Can you trust the data returned from the service?
Identify Data Flows
Trace your application's data input through the application from entry to exit. You do this to understand how your application interacts with external systems and clients and how internal components interact. Pay particular attention to data flow across trust boundaries and how that data is validated at the trust boundary entry point. Also pay close attention to sensitive data items and how these flow through your system, where they are passed over a network, and where they are persisted.
A good approach is to start at the highest level and then deconstruct the application by analyzing the data flow between individual subsystems. For example, start by analyzing the data flow between your Web application, your middle tier servers, and your database server. Then consider page-to-page and component-to-component data flows.
Identify Entry Points
The entry points of your application also serve as entry points for attacks. Entry points can include the front-end Web application listening for HTTP requests. This entry point is intended to be exposed to clients. Other entry points, such as internal entry points exposed by subcomponents across the layers of your application, may exist only to support internal communication with other components. However, you should know where these are and what types of input they receive in case an attacker manages to bypass the front door of the application and directly attack an internal entry point. Additional levels of checking provides defense in depth but may be costly in terms of money and performance.
Consider the trust levels required to access an entry point and the type of functionality exposed by the entry point. Early in the threat modeling activity, focus your attention on entry points that expose privileged functionality, such as administration interfaces.
Identify Exit Points
Identify the points where your application sends data to the client or to external systems. Prioritize the exit points where your application writes data that includes client input or includes data from untrusted sources, such as shared databases.
Step 4: Identify Threats
In this step, you identify threats and attacks that might affect your application and compromise your security objectives. These threats are the bad effects that could happen to your application. To conduct this identification process, bring members of the development and test teams together to conduct an informed brainstorming session. Use a whiteboard to identify potential threats. Ideally, the team consists of application architects, security professionals, developers, testers, and system administrators.
You can use two basic approaches:
-
Start with common threats and attacks. With this approach, you start with a list of common threats grouped by application vulnerability categories. Next, apply the threat list to your own application architecture. While doing this, use the data you gathered. For example, use the identified scenarios to review data flows, paying particular attention to entry points and where trust boundaries are crossed. You will be able to eliminate some threats immediately because they do not apply to your application and its use cases. Use the "Cheat Sheet: Web Application Security Frame" as a starting point.
-
Use a question-driven approach. A question-driven approach can help you identify relevant threats and attacks. The STRIDE categorization includes broad categories of threats, such as spoofing, tampering, repudiation, information disclosure, and denial of service. You can use the STRIDE model to ask questions related to each aspect of the architecture and design of your application. This is a goal-based approach, where you consider the goals of an attacker. For example, could an attacker spoof an identity to access your server or Web application? Could someone tamper with data over the network or in a data store? Is sensitive information disclosed when you report an error message or log an event? Could someone deny service?
While identifying threats, examine the application tier by tier, layer by layer, and feature by feature. By focusing on vulnerability categories, you focus on the areas where security mistakes are most frequently made. The threats identified at this stage do not necessarily indicate vulnerabilities. Identify potential threats and the actions that an attacker might try to use to exploit the application.
During this step, you perform the following tasks:
-
Identify common threats and attacks.
-
Identify threats along use cases.
-
Identify threats along data flows.
The next sections describe each of these.
Identify Common Threats and Attacks
There are a number of common threats and attacks that rely on common vulnerabilities. As a starting point, use the companion document, "Cheat Sheet: Web Application Security Frame." The cheat sheet will help you identify threats and attacks relevant to your application.
Web Application Security Frame
The following vulnerability categories were developed by security experts who have examined and analyzed the top security issues across many Web applications. They have been refined with input from Microsoft consultants, product support engineers, customers, and Microsoft partners. This section identifies a set of key questions to ask for each category.
Authentication
Review authentication by asking the following:
- How could an attacker spoof identity?
- How could an attacker gain access to the credential store?
- How could an attacker mount a dictionary attack? How are your user's credentials stored and what password policies are enforced?
- How can an attacker modify, intercept, or bypass your user's credential reset mechanism?
Authorization
Review authorization by asking the following:
- How could an attacker influence authorization checks to gain access to privileged operations?
- How could an attacker elevate privileges?
Input and Data Validation
- Review input and data validation by asking the following:
- How could an attacker inject SQL commands?
- How could an attacker perform a cross-site scripting attack?
- How could an attacker bypass input validation?
- How could an attacker send invalid input to influence security logic on the server?
- How could an attacker send malformed input to crash the application?
Configuration Management
Review configuration management by asking the following:
- How could an attacker gain access to administration functionality?
- How could an attacker gain access to your application's configuration data?
Sensitive Data
Review sensitive data by asking the following:
- Where and how does your application store sensitive data?
- When and where is sensitive data passed across a network?
- How could an attacker view sensitive data?
- How could an attacker manipulate sensitive data?
Session Management
Review session management by asking the following:
- Do you use a custom encryption algorithm, and do you trust the algorithm?
- How could an attacker hijack a session?
- How could an attacker view or manipulate another user's session state?
Cryptography
Review cryptography by asking the following:
- What would it take for an attacker to crack your encryption?
- How could an attacker obtain access to encryption keys?
- Which cryptographic standards are you using? What, if any, are the known attacks on these standards?
- Are you creating your own cryptography?

Parameter Manipulation
Review parameter manipulation by asking the following:
- How could an attacker manipulate parameters to influence security logic on the server?
- How could an attacker manipulate sensitive parameter data?
Exception Management
Review exception management by asking the following:
- How could an attacker crash the application?
- How could an attacker gain useful exception details?
Auditing and Logging
Review auditing and logging by asking the following:
- How could an attacker cover his or her tracks?
- How can you prove that an attacker (or legitimate user) performed specific actions?
Identify Threats Along Use Cases
Examine each of your application's key use cases that you identified earlier, and examine ways in which a user could maliciously or unintentionally coerce the application into performing an unauthorized operation or into disclosing sensitive or private data.
Ask questions and try to think as an attacker would. Examples of the types of question you should ask include the following:
- How can a client inject malicious input here?
- Is data being written out based on user input or on unvalidated user input?
- How could an attacker manipulate session data?
- How could an attacker obtain sensitive data as it is passed over the network?
- How could an attacker bypass your authorization checks?
Identify Threats Along Data Flows
Review the key use cases and scenarios, and analyze the data flows. Analyze the data flow between individual components in your architecture. Data flow across trust boundaries is particularly important. A piece of code should assume that any data from outside the code's trust boundary is malicious. The code should perform thorough validation of the data.
When identifying threats associated with data flows, ask the following questions:
- How does data flow from the front end to the back end of your application?
- Which components call which components?
- What does valid data look like?
- Where is validation performed?
- How is the data constrained?
- How is data validated against expected length, range, format, and type?
- What sensitive data is passed between components and across networks, and how is that data secured while in transit?
Note Use existing documentation if you have it. For example, data flow diagrams (DFDs) and Unified Modeling Language (UML) sequence diagrams can help you to analyze your application and identify data flows.
Explore Additional Threats by Using Threat/Attack Trees
The previous activities have helped you to identify the more obvious and pervasive security issues. You can now explore additional threats and attacks. (It is helpful to set a time limit so that you do not become blocked by this activity.)
Attack trees and attack patterns are the primary tools that many security professionals use. They allow you to analyze threats in greater depth, going beyond what you already know to identify other threat possibilities.
The categorized lists of known threats only reveal the common, known threats. Additional approaches, such as using threat/attack trees and attack patterns, can help you identify other potential threats.
An attack tree is a way of identifying and documenting the potential attacks on your system in a structured and hierarchical manner. The tree structure gives you a detailed picture of various attacks that the attacker uses to compromise the system. By creating attack trees, you create a reusable representation of security issues that will help to focus your threat and mitigation efforts. Your test team can use the trees to create test plans that validate security design. Architects or developer leads can use the trees to evaluate the security cost of alternative approaches. Developers can use the trees to make informed coding decisions during implementation.
Attack patterns are a formalized approach to capturing attack information in your enterprise. These patterns can help you identify common attack techniques.
Creating Attack Trees
When creating an attack tree, assume the role of the attacker. Consider what you must do to launch a successful attack and identify goals and sub-goals of the attack. You can use a hierarchical diagram to represent your attack tree, or you can use a simple outline. What is important is that you construct something that portrays the attack profile of your application. Then you can evaluate security risks and use the appropriate countermeasures to mitigate them, such as correcting a design approach, hardening a configuration setting, and other solutions.
Start building an attack tree by creating root nodes that represent the goals of the attacker. Then add the leaf nodes, which are the attack methodologies that represent unique attacks.
You can label leaf nodes with AND and OR labels.
Attack trees have a tendency to become complex quickly. They are also time-consuming to create. An alternative approach is to structure your attack tree using an outline, such as the following.
1. Goal One
1.1 Sub-goal one
1.2 Sub-goal two
2. Goal Two
2.1 Sub-goal one
2.2 Sub-goal two
Note In addition to goals and sub-goals, attack trees include methodologies and required conditions.
The following is a more complete example of the outline approach.
Threat #1 Attacker obtains authentication credentials by monitoring the network
1.1 Clear text credentials sent over the network AND
1.2 Attacker uses network-monitoring tools
1.2.1 Attacker recognizes credential data
Step 5: Identify Vulnerabilities
In this step, you review the Web application security frame and explicitly look for vulnerabilities. Focus on the vulnerability categories as you did while identifying threats in the previous step. However, note that the sample questions presented in this section are designed to help you identify vulnerabilities, not threats. A useful way of proceeding is to examine your application layer by layer, considering each of the vulnerability categories in each layer.
Authentication
Identify authentication vulnerabilities by asking the following:
- Are user names and passwords sent in clear text over an unprotected channel? Is any ad hoc cryptography used for sensitive information?
- Are credentials stored? If they are stored, how are they stored and protected?
- Do you enforce strong passwords? What other password policies are enforced?
- How are credentials verified?
- How is the authenticated user identified after the initial logon?
Review authentication by looking for these common vulnerabilities:
- Passing authentication credentials or authentication cookies over unencrypted network links, which can lead to credential capture or session hijacking
- Using weak password and account policies, which can lead to unauthorized access
- Mixing personalization with authentication
Authorization
Identify authorization vulnerabilities by asking the following:
- What access controls are used at the entry points of the application?
- Does your application use roles? If it uses roles, are they sufficiently granular for access control and auditing purposes?
- Does your authorization code fail securely and grant access only upon successful confirmation of credentials?
- Do you restrict access to system resources?
- Do you restrict database access?
- How is authorization enforced at the database?
Review authorization by looking for these common vulnerabilities:
- Using over-privileged roles and accounts
- Failing to provide sufficient role granularity
- Failing to restrict system resources to particular application identities
Input and Data Validation
- Identify input and data validation vulnerabilities by asking the following:
- Is all input data validated?
- Do you validate for length, range, format, and type?
- Do you rely on client-side validation?
- Could an attacker inject commands or malicious data into the application?
- Do you trust data you write out to Web pages, or do you need to HTML-encode it to help prevent cross-site scripting attacks?
- Do you validate input before using it in SQL statements to help prevent SQL injection?
- Is data validated at the recipient entry point as it is passed between separate trust boundaries?
- Can you trust data in the database?
- Do you accept input file names, URLs, or user names? Have you addressed canonicalization issues?
Review input validation by looking for these common vulnerabilities:
- Relying exclusively on client-side validation
- Using a deny approach instead of allow for filtering input
- Writing data you did not validate out to Web pages
- Using input you did not validate to generate SQL queries
- Using insecure data access coding techniques, which can increase the threat posed by SQL injection
- Using input file names, URLs, or user names for security decisions
Configuration Management
Identify configuration management vulnerabilities by asking the following:
- How do you protect remote administration interfaces?
- Do you protect configuration stores?
- Do you encrypt sensitive configuration data?
- Do you separate administrator privileges?
- Do you use least privileged process and service accounts?
Review configuration management by looking for these common vulnerabilities:
- Storing configuration secrets, such as connection strings and service account credentials, in clear text
- Failing to protect the configuration management aspects of your application, including administration interfaces
- Using over-privileged process accounts and service accounts
Sensitive Data
Identify sensitive data vulnerabilities by asking the following:
- Do you store secrets in persistent stores?
- How do you store sensitive data?
- Do you store secrets in memory?
- Do you pass sensitive data over the network?
- Do you log sensitive data?
Review sensitive data by looking for these common vulnerabilities:
- Storing secrets when you do not need to store them
- Storing secrets in code
- Storing secrets in clear text
- Passing sensitive data in clear text over networks
Session Management
Identify session management vulnerabilities by asking the following:
- How are session cookies generated?
- How are session identifiers exchanged?
- How is session state protected as it crosses the network?
- How is session state protected to prevent session hijacking?
- How is the session state store protected?
- Do you restrict session lifetime?
- How does the application authenticate with the session store?
- Are credentials passed over the network and are they maintained by the application? If they are, how are they protected?
Review session management by looking for these common vulnerabilities:
- Passing session identifiers over unencrypted channels
- Prolonged session lifetime
- Insecure session state stores
- Session identifiers in query strings
Cryptography
Identify cryptography vulnerabilities by asking the following:
- What algorithms and cryptographic techniques are used?
- Do you use custom encryption algorithms?
- Why do you use particular algorithms?
- How long are encryption keys, and how are they protected?
- How often are keys recycled?
- How are encryption keys distributed?
Review cryptography by looking for these common vulnerabilities:
- Using custom cryptography
- Using the wrong algorithm or a key size that is too small
- Failing to protect encryption keys
- Using the same key for a prolonged period of time
Parameter Manipulation
Identify parameter manipulation parameters by asking the following:
- Do you validate all input parameters?
- Do you validate all parameters in form fields, view state, cookie data, and HTTP headers?
- Do you pass sensitive data in parameters?
- Does the application detect tampered parameters?
Review parameter manipulation by looking for these common vulnerabilities:
- Failing to validate all input parameters. This makes your application susceptible to denial of service attacks and code injection attacks, including SQL injection and XSS.
- Including sensitive data in unencrypted cookies. Cookie data can be changed at the client or it can be captured and changed as it is passed over the network.
- Including sensitive data in query strings and form fields. Query strings and form fields are easily changed on the client.
- Trusting HTTP header information. This information is easily changed on the client.
Exception Management
Identify exception management vulnerabilities by asking the following:
- How does the application handle error conditions?
- Are exceptions ever allowed to propagate back to the client?
- What type of data is included in exception messages?
- Do you reveal too much information to the client?
- Where do you log exception details? Are the log files secure?
Review exception management by looking for these common vulnerabilities:
- Failing to validate all input parameters
- Revealing too much information to the client
Auditing and Logging
Identify auditing and logging vulnerabilities by asking the following:
- Have you identified key activities to audit?
- Does your application audit activity across all layers and servers?
- How are log files protected?
Review auditing and logging by looking for these common vulnerabilities:
- Failing to audit failed logons
- Failing to protect audit files
- Failing to audit across application layers and servers
What to Do Next
After you complete the threat modeling activity, do the following:
- If you capture your threat model in a document, keep the document lightweight and avoid over-formatting so you can easily update it.
- Use the vulnerabilities to help shape your security design and implementation. For example, developers should notice anti-patterns related to the identified vulnerabilities and use patterns to address the issues.
- Use the vulnerabilities to plan and scope your system testing. For example, testers should test against the vulnerabilities to verify that the development team fixed or addressed all vulnerabilities.
- Track and prioritize vulnerabilities in your work item tracking system.
- If you have high priority threats and you have no corresponding vulnerabilities, you need to make a decision. Without a vulnerability to track and act on, the threat you identified can be easily overlooked. Will you investigate it further to identify vulnerabilities or rule it out of scope or accept the risk?
- Communicate the information you capture to relevant team members. This may include your application development team, your test team, and your network and system administrators.
Agile Considerations
You should begin the threat modeling exercise early in your project so that the threat model influences the design of your application. To create and update the threat model, develop user stories. A user story describes what the application should do from the point of view of the customer. In this case, you would create stories around the threats, attacks, and security objectives. You should be able to complete a story in a single iteration. You may need to develop new stories as you create and update the threat model.
Consider the following when you plan your stories:
- Early in the project, reduce risk by creating a candidate architecture that supports architecturally significant end-to-end scenarios that exercise all layers of the architecture.
- Create your first threat model for this candidate architecture. This will change, but it is a good starting point.
- Using your threat model to guide you, make changes to your architecture, design, and code to meet your security objectives.
- Create a threat model based on what you know at the time and define a list of questions that need to be addressed in subsequent stories and iterations.
- After you make enough significant changes to the architecture and design, consider creating a story that reflects these changes. Batch together the small changes in the architecture and design and address them together.
- If you need to work with outside security groups, you need to schedule a time to complete the threat model to provide to the external group. These groups tend to provide better input when they understand the entire application.
Adapted from Microsoft patterns & practices guidance.


>
|
Allegro CL version 10.1 |
This document links to all pages which comprise the index to all Allegro CL HTML documentation. Every documented symbol is listed, linked to its description page. Also included are index entries for the ANSICL documentation (if you did not install the ANSICL documentation, those links will not work). Note that CLIM and ORBLink are not indexed here. Each letter has its own page (except X, Y, and Z are all on one page). Two versions are provided for each page: including Common Graphics symbols and without CG symbols. Users on UNIX platforms that do not support Common Graphics may want to use the pages without CG symbols. Common Graphics is available on Windows and certain Linux platforms. Some other modules that are only available on Windows, such as the DDE module, are included in the index without cg symbols.
The following links go to index entry pages beginning with the indicated letter. Other indexes things which are named entirely by non-alphabetic characters. Thus, for example, *all-processes* is indexed under A, ignoring the *.
Copyright (c) 1998-2015, Franz Inc. Oakland, CA., USA. All rights reserved.
Documentation for Allegro CL version 10.1. This is the initial (unrevised) page.
Created 2015.6.15.
|
Allegro CL version 10.1 |


'Priceless' jewels stolen in Germany's Green Vault museum heist
Thieves break into one of the world's oldest museums, making off with three 'priceless' sets of 18th century jewellery.
Robbers have made off with three priceless diamond sets from a state museum in Dresden city, police and museum directors said, in what the German media described as the biggest art heist since the second world war.
The thieves broke into the Green Vault at Dresden's Royal Palace - home to around 4,000 precious objects of ivory, gold, silver and jewels - at dawn on Monday after a power cut deactivated the alarm.
More:
The stolen items included brilliant-cut diamonds that belonged to a collection of jewellery of 18th-century Saxony ruler, Augustus the Strong.
"We are talking here about items of inestimable art-historical and cultural-historical value," director of Dresden's state art collections, Marion Ackermann, told reporters at a news conference on Monday.
"We cannot put an exact value on them because they are priceless," said Ackermann, adding she was "shocked by the brutality of the break-in".
The thieves launched the brazen raid after a fire broke out at an electrical panel near the museum in the early hours of Monday, deactivating its alarm, as well as street lighting, police said.
They added that investigations were ongoing to determine if there was a link between the fire and the robbery.
Despite the power cut, a surveillance camera kept working and filmed two men breaking in.
They smashed a window and cut through a fence before making their way to a display case "in a targeted manner" and destroying it, the head of Dresden police Volker Lange said.
The two remain on the run.
Bild newspaper said the heist was "probably the biggest art theft since World War II".
'World heritage'
Dirk Syndram, director of the Green Vault, said the museum's jewellery sets amounted to "a kind of world heritage," totalling about 100 items.
He explained that the stolen sets were part of a 10-set collection which included not only diamonds, but also sapphires, rubies and emeralds.
Founded by Augustus the Strong, Elector of Saxony in 1723, the Green Vault is one of 12 museums which make up the famous Dresden State Art Collections.
One of the oldest museums in Europe, the Green Vault holds treasures including a 63.8cm (25.1-inch) figure of a Moor studded with emeralds and a 547.71-carat sapphire gifted by Tsar Peter I of Russia.
The museum is now made up of two sections - a historic part and a new section.
Monday's raid targeted the historic section, which contains around three-quarters of the museum's treasures and has a strict limit on the number of daily visitors.
Exhibits are arranged into nine rooms, including an ivory room, a silver-gilt room and the central "Hall of Treasures".
One of its most valuable pieces, the green diamond, is currently on loan to the Metropolitan Museum of Art in New York, where it is a headline attraction in the temporary exhibition, "Making Marvels: Science and Splendor at the Courts of Europe".
After the Royal Palace suffered severe damages in the second world war, the Green Vault remained closed for decades before it was restored and reopened in 2006.
'Hard-earned' treasures
Saxony's state premier said the heist went beyond the value of the artefacts stolen.
"The treasures that are found in the Green Vault and the Dresden Royal Palace were hard-earned by the people of Saxony over many centuries," Michael Kretschmer said.
"One cannot understand the history of our country, our state without the Green Vault and Saxony's State Art Collections."
In 2010, the museum hosted a meeting between Chancellor Angela Merkel and then US President Barack Obama, on the latter's first state visit to Germany.
The museum remained closed and sealed off by the police on Monday.
Monday's theft is the second high-profile heist in Germany in recent years after a 100kg (220-pound), 24-karat giant gold coin was stolen from Berlin's Bode Museum in 2017.
Dresden police said they were in contact with their colleagues in Berlin to examine "if there are any connections and if there are similar patterns in the crimes".
Germany's culture minister Monika Gruetters said that protection of museums and cultural institutions was now of "the highest priority".
"The theft of items which make up our identity as a nation of culture strikes at our hearts," she said.


| Attribute Name | Attribute Value | Sources | Verifiers |
|---|---|---|---|
| User ID: | |||
| Selfie: |
Download Selfie |
||
| Family Name: | |||
| Given Names: | |||
| Full Name: | |||
| Date of Birth: | |||
| Age Verified: | |||
| Gender: | |||
| Postal Address: | |||
| Nationality: | |||
| Phone Number: | |||
| Email Address: |


A new subclass of PropertyChangeEvent
named
IndexedPropertyChangeEvent
has been added to support bound properties that use an index to
identify the part of the bean that changed. Also, three methods,
all named
fireIndexedPropertyChange
, have been added to the
PropertyChangeSupport
utility class to support firing
indexed property change events. You can find an example of using
indexed property change events in IndexedTest.java
.
A new method called
createPropertyEditor
has been added to the
PropertyDescriptor
class.
The two
PropertyEditorSupport
constructors are now public
instead of protected, so that PropertyEditorSupport
objects can be more easily created and used as delegates. Also, the
source object is now exposed by means of new
setSource
and
getSource
methods.


Toggle navigation
The Phillipian
Welcome
General
Drugs/Alcohol
Wellness
Academics
Sex
Social
Topics
General Sex
Sexting
Hookup Culture
Pornography
General Sex
Sexting
Hookup Culture
Pornography


{% load i18n %}
{% blocktrans trimmed %} After the stage 1 review, some proposals that have been accepted or rejected will show in a separate tab along with their reviews (read-only). {% endblocktrans %}
{% blocktrans trimmed %} In review stage 2, you will see scores and comments made by other reviewers anonymously, including the name and background of the submitter. With more information provided, you may want to update your review. Updating or adding review in stage 2 follows the same way as stage 1, but only the last review you made will be disclosed to the submitter (if you choose to do so). {% endblocktrans %}


This year, HackCU will host Local Hack Day on December 2nd, 2017 at the University of Colorado, Boulder! Local Hack Day is a worldwide event aimed at bringing students local to your area together for just 12 hours of building anything you set your mind to.
A hackathon is an event where motivated people come together and use technology and creativity to build something amazing.
Any current student! The hackathon is open to designers, writers, computer scientists or anyone interested in hackathons.
Laptop, chargers, comfortable clothes, and a water bottle. We'll provide you everything else you need.
No, everyone attending Local Hack Day should be local. If you're out of state, check out HackCU IV where we offer reimbursement!
Yes, lots! We will provide three main meals as well as snacks, drinks, and caffeine.
You can have a maximum of 4 members on your team. There will time before the hacking begins where we will help you to find a team.
We always need volunteers and mentors! Email us for more info.
Subject to change.
| Time | Event |
|---|---|
| 08:00 am | Arrival and Check-in |
| 08:30 am | Opening Ceremonies |
| 08:45 am | Team Formation |
| 09:00 am | Hacking Begins! |
| 09:30 am | Breakfast |
| Time | Event |
|---|---|
| 12:30 pm | Lunch |
| 06:00 pm | Dinner |
| 08:00 pm | Dessert Served |
| 09:00 pm | Hacking Ends! |
| 09:15 pm | Closing Ceremonies |
Participants
Awesome Projects
Energy Drinks
Hours of Hacking


| DOSE: |
1 hit |
insufflated |
Heroin |
(powder / crystals) |
After spending my youth staying away from drugs and being generally 'good', I decided that now that I'm 27, I want to try every drug. I love marijuana but I've been searching for something else. I had a friend staying with me ,'S', for the weekend from San Francisco. One night S, my roommate 'G', and me were sitting around thinking of how we would pass the evening together. We had no desire to walk outside on this cold and rainy New York night. We decided that I would go and buy some weed from the dealer on our street. (The old guy accross the street who's been on the block his whole life recommended the dealer to me.) So anyway, I bought 20 bucks of weed off the guy and asked him in passing if he had Heroin. He said he did and it was only 10 bucks a hit.
I ran back to the apartment and told my roommate how cheap it was and how we should buy some and do it that night. He succumbed and we did it. You see, G and I have always wanted to try Heroin, or Opium. We want to have every drug under our belt, partly to say we did them and partly just to experience other sates of consciousness, etc..
I bought two hits, opened one up and poured out the contents on to a CD gem box. I used a Metrocard to chop up the small light brown chunks. I divided the small amount of powder into two lines about an inch and a half long. I sat there for a while saying to my friends 'Oh my god, I can't believe I'm about to snort Heroin.
I finally got the nerve to take the Wendy's straw I had cut into thirds and snort a line. It kinda burned a bit, and smelled like dust,I don't even want to think what it may have been cut with. I only snorted one and waited for like 15 minutes, not much, just a feeling of warmth, like taking a few percocets. I sat on the couch next to my roommate and realized I could probably feel even better than this warm fuzzy feeling. I snorted the rest of the powder and waited. About 20 minutes later I was out of it.
I felt so good, so comfortable, I'm sure it wasn't as high if I had injected it. I felt a bit drunk and unsteady on my feet. But I felt so damn good. I could instantly see why someone could get addicted over time. I thought a while the first hour about how nice it would be to do this once a week, or on special occasions. Then the itching started!!
   My friend S, was getting on my nerves too, she was just sitting there and I hated her. I thought I was coming down and was going through withdrawals or something. I think the problem is that my roommate was just too active. When he snorted his hit and came under the effects, my itching stopped, and I felt better than ever.
G and I layed on my bed and talked about weird things while S was stoned out of her mind and passed out on the couch. G and I eventually stopped talking and went into this strange 'just before sleep state'. We both had really wierd dreamy thoughts that were very vivid. It was so pleasant, it felt like was floating in a dream or something, everything was warm and my bed, blanket and pillows were the most comfortable, wonderful creations made by man.
I didn't want it to end.
After we all laid around in coma-like states for 3 hours, I started to come down/off. It wasn't unpleasant except for the fact I couldn't get warm enough. I caught a chill trying to pee, and began shivering so bad I could barely walk. I jumped into bed fully clothed and snuggled next to my friend S. I fell asleep and woke up every 20-30? minutes, drenched in sweat, completely soaked. This wet on all night. My friend S said that at one point I awoke her because my whole body was kinda lurching back and forth for like a half hour.
In the morning my body was in horrible pain. I went to run some errands in the morning and could barely walk. It felt like every part of my body was arthritic. I could barely negotiate the subway stairs. I got home and went back to bed. I slept the whole day. S came in and woke me up but I could barely move. I thought I was a Heroin addict, even though the thought of it made me feel like puking. The next day wasn't any better and stayed in bed all day. I woke up at aroud 6 pm and my headache was finally gone.  I felt like I had the flu. My oommate G, had no problems at all.
For the next week, everytime I thought about Heroin my stomach would turn. I have never been that debilitated before and was really scared for a while. It's been two weeks since and I've been still feeling sick every now and then. The thought of Heroin still makes e feel ill. Was I junk sick after trying Heroin for the first time? I don't think I'll ever try Heroin ever again. It just isn't a fun drug. All it did was put me out and constipated me for a week. Yeah I'm sure there's nothing like injecting, but no thanks.
Experience Reports are the writings and opinions of the individual authors who submit them.
Some of the activities described are dangerous and/or illegal and none are recommended by Erowid.


#assign n0_docs="active"> <#assign n1_platforms="active"> <#assign n2_hana="active">
To test using SAP Hana set the platform to hana
in
src/test/resources/application-test.yaml
Refer to docs / testing if application-test.yaml doesn't exist yet.
ebean: test: platform: hana # h2, postgres, mysql, oracle, sqlserver ddlMode: dropCreate # none | dropCreate | migrations dbName: test
The above will use the following defaults:
| username: | SYSTEM |
|---|---|
| password: | HXEHana1 |
| databaseName: | HXE |
| port: | 39017 |
| url: | jdbc:sap://localhost:{port}/?databaseName={databaseName} |
| driver: | com.sap.db.jdbc.Driver |
| image: | store/saplabs/hanaexpress:{version} |
We can use the io.ebean:ebean-hana
dependency rather than io.ebean:ebean
if we want to only
bring in the Hana specific platform code. Depending on io.ebean:ebean
will bring in all platforms.
We can programmatically start a docker container version of Hana.
The below uses ebean-test-docker
dependency which already comes with ebean-test
.
If we do not have a dependency on ebean-test
then add io.ebean:ebean-test-docker:5.0
as a dependency.
package main; import io.ebean.docker.commands.HanaContainer; public class Main { public static void main(String[] args) { HanaContainer.Builder builder = HanaContainer.newBuilder("<IP_ADDRESS>.20180925.2"); builder.port(39117); builder.instanceNumber("91"); try { builder.passwordsUrl(new URL("file:///hana/mounts/" + this.passwordsFile.getFileName())); } catch (MalformedURLException e) { fail(e.getMessage()); } builder.mountsDirectory(this.tempDir.toString()); builder.agreeToSapLicense(false); HanaContainer container = builder.build(); container.start(); } }<@next_edit "Sqlite" "/docs/database/sqlite" "/docs/database/hana/index.html"/>


WITNESS LIST Appropriations-S/C on Health & Human Services Committee September 21, 2000-9:00A Frew v. Gilbert On: Boyd, Jeffrey (Office of the Attorney General) Coleman, Gregory (Office of the Attorney General) Gilbert, Don (Health and Human Services Commission) Henderson, Marina (Health and Human Services Commission) Millwee, Billy (Dept. of Health) Strelitz, Peter (Office of the Attorney General)


AMINALANSORI
HOME
(current)
ABOUT
SKILLS
PORTFOLIO
CONTACT
Muhamad Amin Al Anshori
Web Developer
Hire Me
About
Education
2018-2022
Student at Budi Luhur University major Information Technology
Last Work
2015 - 2019
PT. Istana Argo Kencana as IT administration
Skills
Advance
Advance
Basic
Intermediate
Intermediate
Basic
Intermediate
Portfolio
Previous
Next
Contact
Nama Lengkap
Email
Pesan
Kirim


 Yeap, I know this is an extremely selfish and biased opinion, especially given the popularity of this “means of entertainment”.
 I can’t recall something that was super ugly and didn’t have fanatic and passionate friends.
I will try to explain my view.
Bad equipment
Too many podcasts have bad equipment. I find it extremely disrespectful and annoying to hear only half of what is discussed, due to low quality microphones.
I understand and respect, if the podcaster is completely amateur and hobbyist but most of them have 1-2 sponsors per episode. Not sure of the monetary reward, but a decent microphone cost about $100 or so?
Wasting time and mundane subjects
Why should I spend 70 minutes hearing a discussion where the important information is spread here and there if I can read an article of the same topic which will take me less than 15 minutes to read?
For example, I can recall a 70-minute long episode in a podcast, about VS code tips. There are tons of articles in dev.to alone which you can read all in less than 1 hour (all of them).
Be innovative fellas. I can find countless reviews of the newest Django or var vs let and const. Don’t be dull and boring.
I would be happier if the subjects were more unique, subjects that you cannot find easily around.
Enthusiasm
Too many podcasters fail to deliver enthusiasm to their audience. I don’t blame them. I can’t be enthusiastic if I don’t like what I am doing, either.
So the question is, as Steve Jobs would say: Why are you living someone else’s life if it is obvious you don’t like what you are doing?
Chit-chat
So the podcast begins and the host starts doing some predetermined chit-chatting with their guests.
Sadly, if I want to attend dialogs between strangers, I would opt-in for Netflix. :)
I am not saying the podcast should sound like an interrogation, but one certainly need to keep a balance and not try to fill the time with low value small talk.
Lack of transcription or summary
Most podcasts don’t offer some kind of transcription or summary (with “links” to the respective time range).
Why is this a problem? First of all, you might need to skim some parts and no one can blame you for that.
Also, not all listeners are native English/German/Spanish/whatever speakers. Some words might be inaudible. Some phrases might be too much of a slang, only a native could get them. I think you are getting the point.
Blogs suck too
Many blogs don’t offer much quality to their readers (this might be one of those :) )
But in blogs, you can “just skim” or “read the headers” to see if it is worth digging deeper. So you dont have to listen the whole part to get the hint
The outliers
Of course, it would be silly to say that if you are labeled as a podcast, you are doomed to mediocrity.
Some podcasts that are of high quality and are my first choices when I choose it as a mean of information are (random order):
- Kwik Brain (not technical, but totally worth listening)
- Software engineering daily
- JS party. I am impressed with the enthusiasm they deliver
- Python bytes
Of course, the list is only indicative. I am pretty sure there are other high-quality podcasts that I didn’t have to hear till now.
Conclusion
Thank you for taking the time read this article. I hope you enjoyed it. Podcasts could be a great mean of information and entertainment if done right but looks like this is not the case for most of them now. If you feel against my views or have any high-quality podcast to recommend, please let us know.


The DAI token, managed by MakerDAO, was migrated to use another token address at 16:00 UTC on 2019-11-18.
You can read more about the specific details of the migration on MakerDAO's blog, but the gist is that the old "DAI" token (at 0x89d24a6b4ccb1b6faa2625fe562bdd9a23260359) now becomes "SAI" and the new "Multi-Collateral" DAI token is the contract at 0x6b175474e89094c44da98b954eedeac495271d0f.
A migration tool between SAI and DAI is available at migrate.makerdao.com.
For any organizations holding the old SAI token, the Aragon client will begin showing the correct name following a release around 2019-11-25. Until then, it will continue to be referred to as "DAI".
For any organizations holding the new DAI token, the Aragon client will begin showing the new logo following the same release around 2019-11-25.
For organizations holding SAI, there are two recommended paths to upgrade to MCD DAI:
For organizations holding old SAI CDPs, the recommended migration paths are similar if the organization was only holding SAI: transfer the organization's CDP ownership to an external account, multisig, or installed Agent app that you can interact with, and use the migrate.makerdao.com interface. In this scenario, ensure that the account with ownership over the CDP also holds enough MKR to pay back any owed stability fees.
Organizations that want to create new DAI Vaults should interact with the Oasis Trade application using an installed Agent app and Frame.


Our latest project, finished last week, was IdeaBox. As mentioned in a previous post, we started building the project from a tutorial, without tests, and went from there. I added unit tests before the weekend, and then started using Capybara for acceptance tests last. After watching the RailsConf talk on BDD, I realized I’d much rather work from the outside-in approach demonstrated in the talk.*
After building through IdeaBox on our own, we presented the projects on Thursday afternoon. It was great to see everybody’s work, and see how far they got in the project, learn about their “a-ha!” moments, and also hear about pain points. It was great to see a project starting to turn out differently — I’m sure as the course progresses, we will end up with vastly different projects than in the first third of the course.
On Friday, we all left the classroom and Galvanize to have an all-day code retreat. We made our way to the RiNo part of Denver and spent the day inside of The Source, a rehabbed warehouse-turned-young-money-shopping-facility. (I’m probably totally wrong, but that’s the best way I can describe it). We spent the day pairing in 30 minute time blocks, switching partners after every time block, and working on the same problem from scratch in a different way. In the morning, we worked through the Beer Song problem spec, and in the afternoon we worked through the Robot spec. Each was interesting in it’s own way, and both tested fundamentals — working with strings, or working with arrays and hashes.
It was exciting to work with so many different classmates, and come up with so many different solutions, based on different contraints. I learned about how to build a program with no conditional statements (since if
is not object oriented), learned about traversing through an array using modulo math, and various other amazing tidbits. I had a lot of fun, learned a bunch, and left at the end of the day completely exhausted, but mentally invigorated. I hope that I can continue to participate in code retreats beyond gSchool — it seems like an amazing way to keep developers sharp and practice different pairing techniques.
I’m really enjoying being back in web territory. I have a foundational understanding some things already, so I can focus on testing the applications, using Ruby, and building things in a TDD (or BDD) fashion. I definitely like Sinatra, and that it’s lightweight enough that you can choose your own design pattern, your own database ORM, and pretty much everything inbetween. In contrast, I started playing with Rails for the first time last week, and I’m not sure how I feel about how much work it does for the developer. I’m sure I’ll change my mind once I know how to build everything from scratch really well and don’t want to always do it myself, but for now I enjoy learning how to implement all of the pieces.
Side note: * My reason for liking the idea of BDD comes from the various times I’ve been bitten by not having a way to test the entire experience from a user perspective. Our workload at my previous position was so high that often the developers would run through scenarios at a high level, test that things worked on their own machines, and ship the code to production. Often, many things went wrong in this process, sometimes after the client had already seen the problems themselves. We had started out with QA testers, but over time the people in the company that did QA on development projects were eventually reassigned to other things, leaving the developers without dedicated QA resources, and no time to do testing themselves. I would have loved to be able to do BDD back then, but then again, I’m just learning about it now! I think I might give this approach a shot in a future project at gSchool, just to see how it differs from starting with unit tests first.


Classes
The following classes are available globally.
-
Analyze various features of text content at scale. Provide text, raw HTML, or a public URL, and IBM Watson Natural Language Understanding will give you results for the features you request. The service cleans HTML content before analysis by default, so the results can ignore most advertisements and other unwanted content.
Concepts
Identify general concepts that are referenced or alluded to in your content. Concepts that are detected typically have an associated link to a DBpedia resource.
Entities
Detect important people, places, geopolitical entities and other types of entities in your content. Entity detection recognizes consecutive coreferences of each entity. For example, analysis of the following text would count
Barack Obama
andHe
as the same entity:Barack Obama was the 44th President of the United States. He took office in January 2009.
Keywords
Determine the most important keywords in your content. Keyword phrases are organized by relevance in the results.
Categories
Categorize your content into a hierarchical 5-level taxonomy. For example,
Leonardo DiCaprio won an Oscar
returns/art and entertainment/movies and tv/movies
as the most confident classification.Sentiment
Determine whether your content conveys postive or negative sentiment. Sentiment information can be returned for detected entities, keywords, or user-specified target phrases found in the text.
Emotion
Detect anger, disgust, fear, joy, or sadness that is conveyed by your content. Emotion information can be returned for detected entities, keywords, or user-specified target phrases found in the text.
Relations
Recognize when two entities are related, and identify the type of relation. For example, you can identify an
awardedTo
relation between an award and its recipient.Semantic Roles
Parse sentences into subject-action-object form, and identify entities and keywords that are subjects or objects of an action.
Metadata
Get author information, publication date, and the title of your text/HTML content.
See moreDeclaration
Swift
public class NaturalLanguageUnderstanding


Project
30-Day Winter Fitness Challenge
Step #1 -
Update Your Tracker
Step #2 - Plan Your Next Activity
Step #3 -
View Your Progress


I'm a 27 years old Computer Engineer passionate about new technologies. I have extensive knowledge in Java but also I am capable to use other programming languages (Javascript, PHP). I have worked with databases as MySQL, PostgreSQL, MongoDB.
Backend: API Rest, Java, MyBatis, Postgresql, JUnit.
Frontend: NodeJs, Express, Pug, HTML5, Mocha, Chai, Webdriveio.
Other: Swagger, User Story Mapping, Git, Jenkins, Kong, SCRUM.
Backend: Java, SpringBoot, Spring MVC, Spring Secutiry.
Frontend: AngularJS, Bootstrap, Grunt, Gulp, Sass, Angular Material. Other tools: Transbank integration, Git.
Methodology: SCRUM.
Develop REST API with .Net Core(C#), Entity Framework, Identity Framework. Develop Console applications with .NetCore(C#). Front-End WebApp with AngularJS, Bootstrap, Openlayers, MomentJs, Grunt, Sass. Other tools: Git, Jira, Jenkins
Develop AngularJs based applications using Grunt as build system and many third-party libreries as Moment, Google Maps API, Google Chart API, MQTT Protocol, NVD3 charts, etc; following John Papa Angular Style Guide. Collaborate with other teams to define, design and implement new features. Mantain different company's websites. Methodology: SCRUM.
Design and implement solutions based on different open source software like Alfresco, Ephesoft and Bonitasoft. Install and configure Alfresco and Bonitasoft. Design and develop a Bonitasoft custom portal with AngularJS and the Bonita Rest API for a client. Develop Java program to integrate the client's systems with Alfresco through CMIS protocol.
As part of configuration team , I used different EMC products as Documentum, xCP, D2. Design and configure processes with xCP 1.6 and 2.0. Develop Java programs to integrate Documentum with client's software.
GPA: 15/20
Apart from being a developer, I follow a number of sci-fi and fantasy genre movies and television shows, also, I love playing video games.
I spend a large amount of my free time exploring the latest technology advancements in the front-end and back-end web development world.


Please answer the following questions to the best of your ability. Eri relies on the information provided to formulate the appropriate color for achieving your hair goals.


Hue angle. a Mean for 1998–2015, b difference in model 2085–2100 mean and the current day (1998–2015). In b only areas with a statistically significant differences between the two periods ( p < 0.05) and which were ice free for most of the year (i.e. open ocean where R RS was calculated) in the current day are shown


Our Mission
“Empr Medical‘s mission is to provide high-quality clinical patient
care to the people of Louisiana, Mississippi, and Texas.“
Services
Values
- We Bring Heart and Soul
- We're in it together
- We give a little extra
Our Founder
Founded in 2015, Dr. Beverly James belived in her vision to create a health care brand that empowers patients to take the lead in their health care needs. Read more about Dr. James story here.
Our Team
With a team over 1000 employees, we take pride in our ever growing family and love to see new faces. Join our team now!


|
Copyright © 1999-2006 Safai Ma |
ContentsIntroductionRequirements Using Album List Known Issues Uninstall Questions & Answers Contact Information |
IntroductionAlbum List is a Winamp general plugin that takes a directory tree and turns it into a list of albums. This allows easy navigation among albums stored in different directories, and those stored on CDs. Major functionality includes:
|
Requirements |
Using Album ListAfter installing Album List, to setup the search paths that you want Album List to look for your albums, go to the "Media" preferences page (1) by right-clicking on the Album List window. To add search paths, click on the "Add" button (2) and browse to the "top level" directory that you have your music files stored. Repeat this process for each different location. You don't have to add every single directory that you have, only the "top level" directories as Album List will search the sub-directories for you by default. Alternately, you can just drag and drop the directories from Windows Explorer onto Album list. Next you would want to specify what file types (3) you want Album List to scan. By default, Album List will scan all for most of the popular music file types such as MP3, MPC, MP+, MPP, WMA. The list is seperated by commas. And finally, you can customize how Album List does its scanning by changing the options (4) in this properties page. After setting up where to look for your albums, it is now time to tell Album List how you want them displayed, go to the second tab labelled "Title" to set that up. Directory style "auto-detect" should be good for most of the cases. In case it doesn't work for you, you could try the other predefined directory styles To create additional profiles, go to Winamp Preferences, select Album List (1) and press New (2). |
Known IssuesNone at the moment. |
UninstallTo uninstall Album List, follow these steps: (the recommended way)
|
Questions & AnswersIs classic skins supported? Yes, it does support classic skins. Due to architectural differences, it does not use the playlist editor's skin anymore. It uses the new skin bitmap that's defined in Winamp 2.9, namely Gen.bmp & Genex.bmp. The same ones that Media Library uses. How to sort albums? Click on the column header or right-click on the "Name" header. Is multiple sorting levels supported? Yes. For example, if you want to sort by artist, then year, click "sort by year" first then "sort by artist". How to skip a directory?  Is Free Format MP3 supported? Yes, but it is in its preliminary stage. Put Free Format MP3=1 in [Main] of Gen_m3a.ini to enable it. Can I rename a profile? Yes, just not through the UI yet. Put Name=Rock in [Profile 0] of Gen_m3a.ini to change it. |
Contact InformationIf you have any comments, suggestions, or bug reports, please fill out the
online feedback form or send me an e-mail. |


Nintendo Switch Was The Best-Selling Video Game Hardware In The United States Last Month
And it remains the best-selling platform of 2019
by Liam DoolanIn addition to Luigi's Mansion 3 reaching third place on the US software charts in October, Nintendo also experienced another strong month in terms of hardware sales.
While no sales figures were provided, NPD Video Game Industry Analyst Mat Piscatella revealed the Switch was the best-selling hardware platform within this region. It also remains the best-selling platform of 2019 and most-likely experienced a boost in sales due to the release of the Switch Lite during the previous month.
Piscatella noted how the Switch experienced sales gains during October, despite the fact overall hardware spending fell in this month and year-to-date:
October 2019 hardware spending fell 41% vs YA, to $182m. Year-to-date hardware spending has declined 23% vs YA, to $2.1 billion. Nintendo Switch is the only platform with sales gains both in October as well as year to date.
Did you purchase a Switch Lite or perhaps one of the newer standard models during the month of October? Tell us below.
[via twitter.com]


出版商：CENGAGE Learning
语言：英语
本书pdf是 文字版 ，彩图版 ，书签良好 。
相关书籍：
Basic Concepts About Matter
Measurements in Chemistry
Atomic Structure and the Periodic Table
Chemical Bonding: The Ionic Bond Model
Chemical Bonding: The Covalent Bond Model
Chemical Calculations: Formula Masses, Moles, and Chemical Equations
Gases, Liquids and Solids
Solutions
Chemical Reactions
Acids, Bases, and Salts
Nuclear Chemistry
Saturated Hydrocarbons
Unsaturated Hydrocarbons
Alcohols, Phenols, and Ethers
Aldehydes and Ketones
Carboxylic Acids, Esters, and Other Acid Derivatives
Amines and Amides
Carbohydrates
Lipids
Proteins
Enzymes and Vitamins
Nucleic Acids
Biochemical Energy Production
Carbohydrate Metabolism
Lipid Metabolism
Protein Metabolism


--- layout: cs_course --- {% capture class_name %}{{ page.categories[0] }}{% endcapture %} {% if page.categories.size > 2 %} {% capture topic %}{{ page.categories[2] }}{% endcapture %} {% capture semester %}{{ page.categories[1] }}{% endcapture %} {% else %} {% capture topic %}{{ page.categories[1] }}{% endcapture %} {% capture semester %}base{% endcapture %} {% endif %}
Looks like there currently aren't any notes (yet) about {{ page.name }}...if you'd like to see some, let me know.
{% else %}Looks like there currently aren't any practice problems (yet) about {{ page.name }}...if you'd like to see some, let me know.
{% else %}Below are a list of practice problems, test what you've learned!


QuillEditor
ngx-quill is the new angular (>=2) implementation of ngQuill. This project was generated with angular-cli version 1.0.0-beta.24.


At this point we have our DLL in memory and we know the memory address we'd like to start execution at. All that's really left is to tell our process to execute it. There are a couple of ways to do this.
CreateRemoteThread()
The CreateRemoteThread() function is probably the most widely known and used method. It's very reliable and works most times; hwoever, you may want to use another method to avoid detection or if Microsoft changes something to cause CreateRemoteThread() to stop working.
Since CreateRemoteThread() is a very established function, you have a greater flexibility in how you use it. For instance, you can do things like use Python to do DLL injection.
rThread = CreateRemoteThread(hTargetProcHandle, NULL, 0, lpStartExecAddr, lpExecParam, 0, NULL); WaitForSingleObject(rThread, INFINITE);
NtCreateThreadEx()
NtCreateThreadEx() is an undocumented ntdll.dll function. The trouble with undocumented functions is that they may disappear or change at any moment Microsoft decides. That being said, NtCreateThreadEx() came in good handy when Windows Vista+ session separation affected CreateRemoteThread() DLL Injection.
Detailed information about this method described here: SecurityXploded
NtCreateThreadEx() is a bit more complicated to call, we'll need a specific structure to apss to it and another to receive data rfrom it. An example implementation is in the child page.
With the example code, we can call it very much like CreateRemoteThread()
rThread = bCreateRemoteThread(hTargetProcHandle, lpStartExecAddr, lpExecParam); WaitForSingleObject(rThread, INFINITE);
Suspend, Inject, and Resume
SIR is an unofficial term to describe the method of injecting into process by attaching to it, suspending it and all of its threads, targeting a particular thread, saving the current registers, changing the instructino pointer to point to your executing starting point, and resuming the thread. This is a much more intrusive method, but works reliably and does not dpend on additional function calls.
This method is a little more involved to implement. There is a great write up here:
See the child page.


{{custfield.name}}: {{custfield.text_value}}{{custfield.number_value}}{{custfield.enum_value.name}}
Notes:
{{task.info.notes}}
Report Same Isssue
"Please be as descriptive as possible. The more details provided the better we can assist you. Vague responses will delay the process and/or be ignored. Please DO NOT provide ANY HPI"


Man mourned mum's death in 'crowded hospital corridor' after she died 'in A&E'
Steve Crowley says he has been left feeling angered and betrayed after his mum died at Cork University Hospital's A&E
by Dylan O'ConnellA man claims he was forced to mourn his mother's death in a hospital corridor as she died while waiting for a room.
Speaking on Cork's Red FM, Steve Crowley claimed his mum died in the A&E of Cork University Hospital in an area with no privacy.
He said people were 'coming in and out' and claims staff told him they had no room for his mum, Evelyn.
Steve has been left feeling angered and betrayed as he spoke of the overcrowded conditions.
He said when they eventually did get a room, it was so small it was barely big enough for a bed.
"People deserve so much better to have their final moments in that," Steve, from Cork in Ireland, told CorkBeo.
Steve said he cared for his mother for 14 years after coming back from Australia when she was diagnosed with MS.
Two weeks ago, she was rushed to hospital and sadly passed away in just a matter of hours.
He told Neil Prendeville: "The first problem for us was the wait when you get off the ambulance and get into the hospital.
"That took the bones of two and a half hours.
"Once she got in she was put in a corner to do tests on. Thursday morning we were told Sepsis had set in.
"She was gone within ten hours.
"Everything happened so quick it was like a switch going off."
As Steve grappled with the news of his mother's passing, he told of the overcrowding conditions forcing him to mourn in a hospital corridor.
"They left us alone but there was still people coming in and out.
"The main nurse said sorry that they had no where to put my mother, that they had no room for her.
"You are trying to come to terms in your mind with what was happening while you are in something from the wars.
"The curtains were closed but the fella in the bed across from her, he was trying to put a ringtone on his phone. Like that is annoying at the best of times.
"People were sticking their head in looking for people. People were walking in and walking out.
"A priest came in, shook my hand and said a prayer. But while he was saying it, at least four of five people came in.
"The noise of the place was so loud. Between people talking and their ringtones, and all I wanted was to be there alone with my mam."

"A nurse came over and said she held her hand as she passed away and I needed to know that she was not on her own.
"At the time the words felt empty, but the more times goes on the more I feel better.
"The last thing I wanted was her all alone in a A&E with all the noise and lonely."
Eventually him and his mother were taken to a room for more privacy, but this only worsened their situation.
Steve added: "The main nurse took her into a hospital room that was not big enough for a hospital bed.
"They had to take the chairs out. You couldn't open the door without banging on the bed. The room wasn't designed for this.
"Every time someone would come in they would bang the bed. I kept saying to myself is this where we are.
"I will never forgive the system for being like that and I never want to have that memory.
"People deserve so much better to have their final moments in that."
This week, CUH has had the second highest number of people waiting on trolleys in the country with 65 patients looking for beds. At the Mercy 23 people were waiting and five at Bantry General.
A spokesperson for Cork University Hospital told Joe.Ie : "Cork University Hospital does not comment on individual patient cases."
Mirror Online has made attempts to contact Cork University Hospital.


What is it?
The map allows you to see for every country X in the world either the
top ten
providing countries of lifetime migrants to X or the top ten receiving countries of lifetime migrants from
X. On
top of that, when you let your mouse hover over a country, you can see the total population, the GDP per capita,
the HIV and Tuberculosis prevalences and the death rate of children under five.
I (Martin De Wulf) have
been
programming this map to
learn
and have fun with HTML5 technologies. Besides of learning, my only goal is to create a
website that can make people think.
The data
The data for the map is coming from three sources:
-
The Global
Migrant Origin Database
is the main source of the data. As said on the site, it "consists of a 226x226 matrix of
origin-destination stocks by country and economy".
Put differently, this is a matrix showing for each pair of country X and Y "the number of persons born
in a country X and now living in
country Y." Globally, the map is only as good as this data is and it is quite clear, even for a non
specialist like me, that
obtaining accurate numbers on such a topic is really difficult: you have to use many different sources with
different
counting criteria, and for some countries, it would probably be better politically not to give the precise
numbers.
So, take the map with a grain of salt.
- For all the indicators (population size, GDP, HIV and tuberculosis prevalences and mortality for kids under five years old), I
used the World Bank API, with the numbers for 2007.
-
For the countries borders, I used a file found in the examples of the polymaps library, which
originated from thematicmapping.org
The Technology
All the code of the site and the scripts used to produce it are available on
github. Furthermore, the site is hosted on a github page. Thanks to them for this
fantastic free service.
There are probably some bugs lurking around. Do not hesitate to report them to me at<EMAIL_ADDRESS>Here is a non exhaustive list of technologies or tools employed to create this map:
- Raphael.js for the display in SVG the countries borders, the "arrows" and animating everything;
- Color Brewer by Cynthia Brewer for the red hues used to display "migration intensity";
- the font Univers Else. I may have put it to bad use. I am not sure, I am not a type geek;
- Python with the Requests library
to transform all data in a format usable on this site and to access the World Bank API;
- Hasher.js for the url hashes manipulations (so that people can bookmark maps, or use their back button);
- Modernizr for detecting if the current browser supports geolocation;
- JQuery.
What's next?
If you liked the map, you might also like PopulationPyramid.net


Databases and similar systems
SQL, NoSQL, Graph Databases, object stores
- support easy storing and retrieving of data
- offer high level functionality:
- transactions
- data integrity
- performance optimisations (indexing, stored procedures)
- advanced query support
- arbitrary data modification
- more complex to setup, manage and use


Personal Details
Exam Information
Instructions
Exam Information
Subject Name:
APS
Subject Code:
18B11AS0830
Exam Date:
23 September 2021
Exam Time:
9:30 am
Next


In 1977, NASA launched the space probes Voyager 1 and Voyager 2 to explore Jupiter, Saturn, Uranus, and Neptune. This book tells of what was known about those planets and their moons before the Voyager missions, as well as what Voyager discovered about those planets and their moons. This book is written for the middle-grade reader, and can be enjoyed by readers age 12 and up.
I became interested in astronomy in second grade, when my teacher put up a bulletin board about the solar system. I went to the library and checked out every astronomy book I could and read it. When I finished high school, I went on to get a bachelor's degree in physics. After that, I went to the graduate school of astronomy at Indiana University, where I was an associate instructor of astronomy for one year. Even though I did not get my master's degree, I have maintained an interest in astronomy and keep up with the field by reading articles about astronomy on a regular basis.
Joan Marie Verba has written a wonderful tale of the craft that have gone where no one has gone before. . . . Geared toward the intermediate student, the book is well written . . . and brimful of information.
Verba’s account is crammed with information about the moons, rings, atmospheres, temperatures, and orbits of these planets . . . the large quantity of information makes this a worthwhile resource. . . .
Verba gives a concise but fairly thorough description of the Voyager project from conception through the completion of the probes’ photographic mission. ...this is a good account of the flights of Voyager 1 and 2 and what we learned from them.


4 player, 200pt extended, 2 ships exactly.
1st Player determined randomly then player order is clockwise from 1st Player. Alternatively, the player order can be determined randomly, but seating must go clockwise.
Ship spawn range 1 from edge, but within range 3 from your corner in either direction (spawn area is an "L" shape).
Each player brings 2 obstacles, but they are placed in player order until 6 are on the table.
Ships are placed, move and shoot in order of initiative and player order.
Winner is last pilot standing (or if called early, most points left on the table).
Alliances forbidden, but swaying your opponents choice of targets encouraged. If you have a shot, you must take it.


--- layout: post authors: ["Greg Wilson"] title: "Pandoc and Building Pages" date: 2014-10-29 time: "11:30:00" tags: ["Tooling"] ---
Long-time readers of this blog and our discussion list will know that I'm unhappy with the choices we have for formatting our lessons. Thanks to a tweet from Karl Broman, I may have an answer. It's outlined below, and I'd be grateful for comments on usability and feasibility.
Here's a summary of the forces we need to balance:
gh-pages
magic.
And here's the proposal:
gh-pages
branch.
(GitHub will automatically publish the files in that branch as a mini-website.)
README.md
file with a one-liner about the lesson's content and authorship;src
that contains the source files for the lesson;.nojekyll
to tell GitHub that we don't want it to run Jekyll.src
directory contains all the source files for the lesson,
and a simple Makefile
that uses Pandoc instead of Jekyll to compile those files.
Pandoc's output goes in the root directory,
i.e.,
one level above the src
directory,
and the Makefile makes sure that other files (CSS, images, etc.) are copied up as well.
I've created a proof-of-concept repository
to show what this might look like in practice.
It seems to work pretty well,
and I think it satisfies the "authentic workflow" requirement
(though I'd be grateful if others could tell me it doesn't).
The only usability hiccup I can see is that
authors will have to remember to commit the generated files:
my usual workflow of git add -A
followed by git commit -m
only adds files in or below the current working directory,
so I would have to cd ..
up from src
to the root directory of their local copy of the repo first.
One variation on this raised by Trevor King is
to keep the source files in the root directory of the master
branch,
and have the lesson maintainer merge changes into the src
directory of the gh-pages
branch
and do the build.
This frees authors from having to install the build tools—only
the maintainers need that—but on balance,
I think most people will want to preview before uploading,
so the savings will be mostly theoretical.
If you have other thoughts, or can suggest other improvements, please add comments to this post. We'd particularly like to hear from people who aren't Git experts or aren't familiar with HTML templating systems, Makefiles, and the like. Does the workflow described above make sense? If not, what do you think would go wrong where, and why?


Here you can download point cloud and elevation datasets sourced from jurisdictions.
Find out more on our Elevation page.
Data can be downloaded at no charge but note that there is a 15GB limit per request (please check the file size before you download your files).
Click here for Free GIS Tools.
How to use
- Pan and zoom the map to your area of interest,
- Click on one of the "Select area by..." buttons to define your area of interest,
-
Drawing a bounding box. On enabling, click on the map and drag diagonally. There is a limit of roughly 2 square degrees or 200 square km.
-
Drawing a polygon. On enabling, click on the map for each vertex, click on the first vertex to close the polygon.
-
Manually entering the minimum and maximum latitudes and longitudes. The same area restrictions apply to drawing the bounds.
- On drawing complete we will check for data within or very near your area of interest
- If the list is large you can filter:
- Partial text match by typing in the filter field and/or
- You can restrict the display to either elevation (DEM) or point cloud file types
- Check against any file you would like to download. To reiterate, these files can be huge so take note of the file size before downloading
- Review your selected datasets and submit.
- An email will be sent to you with a link to all your data, zipped into a single file.
- These files can be huge so take note of the file size before submitting or downloading
Hints
- Hovering over many items will give you further information about the purpose of the item
- Drawing a polyline allows you to measure distance along the polyline.
- On completion on drawing a line the elevation along that line is plotted.
- While the tool to draw your area of interest is enabled it is easiest to pan the map using the arrow keys.
- There are many areas where there is no data though the coverage is improving all the time.


in Colombia. 15 million in Latin America and 60% of the population of sub-Saharan Africa.
in Colombia. There is up to a 300% difference between farm-gate and store prices.
by 2020 in Colombia, up from 51% in 2018, with significant rural adoption.
Our co-founders met during their PhDs at the University of Cambridge. Brought together by their interest in global food security, they began brainstorming ideas on how technology can enable smallholder farmers to earn more for more. The team further developed the idea and successfully pitched to Pre-Accelerate program at the Cambridge Judge Business School.
We entered the Allia's Serious Impact Accelerator, where we learned about how to manage a social impact venture. This included sales & marketing, operations, and finance.
We won the best Business Plan award, as part of the Agri-Tech East GROW competition. The support we received from our mentors during this competition was fundamental in helping us improve our thinking.
We accelerated our startup's development at the Allia Serious Impact incubator. This included a focus on prototype development so that it would be ready for piloting in our next phase. Our specific aims were to finalise the platform prototype so that it works seamlessly between smartphones and basic SMS phones.
We're getting ready to trial our platform. Whether you're a farmer, buyer, member of a farmers' group, or a data analyst, we're more than happy to hear from you. Join us on our journey by registering your interest below.
CEO & Co-founder
Jacqui coordinates business and product development and oversees partnership engagement. She holds a doctorate in plant pathology (2016) from the University of Cambridge and has a background in cassava post-harvest deterioration (MSc 2012).
CTO & Co-founder
David manages tech development of our platform and develops algorithms for our data analytics. He is a PhD candidate for plant epidemiology at the University of Cambridge, where he models the spread of cassava diseases.
Director & Co-founder
Paul has a background in bacteriology and infectious diseases. He holds a doctorate from the University of Cambridge (2018). He sees that health, food security, and family income are intricately linked, so he believes that giving smallholder farmers the tools and data to reach better markets will greatly improve their quality of life.
Systems engineer
PhD Computer Science
University of Cambridge
Platform developer
PhD Physics
Princeton University
Platform developer
PhD Epidemiology and Modelling
University of Cambridge


Scentless In Seattle
Find Us on Facebook
Home
Places
Music Venues
Blog
Resources
Music Venues that Provide Accomodations
The Mural Amphitheatre
Paramount Theatre


{% extends "admin/base_site.html" %} {% block title %}Send email{% endblock %} {% block content%}
This email is for {{whatfor}}.


All schools in Dubai and the Northern Emirates closed on November 20
Announcement made due to threat of bad weather
Due to impending storms all Dubai schools will be closed on Wednesday November 20.
The Ministry of Education issued an alert on Twitter stating that due to the “unstable weather” schools in Dubai and the Northern Emirates would be closed on Wednesday.
Rain, strong wind and thunder storms are set to hit the UAE in the early hours of Wednesday morning.
The announcement came shortly after the Abu Dhabi government announced that schools in the capital would be closed for the same reasons.
Schools are expected to reopen on Thursday November 21.

Be the first to get all the latest Dubai news, reviews and deals into your inbox by signing up to our free newsletter, click here to sign up.


this website does not support mobile devices yet, if you aren't on a mobile device i screwed up then.