Monitoring and Access Policies for HTTP Egress Traffic
While Istio's main focus is management of traffic between microservices inside a service mesh, Istio can also manage ingress (from outside into the mesh) and egress (from the mesh outwards) traffic. Istio can uniformly enforce access policies and aggregate telemetry data for mesh-internal, ingress and egress traffic.
In this blog post we show how Istio monitoring and access policies are applied to HTTP egress traffic. The instructions in this blog post are valid for Istio 0.8.0 or later.
Use case
Consider an organization that runs applications that process content from cnn.com. The applications are decomposed into microservices deployed in an Istio service mesh. The applications access pages of various topics from cnn.com: edition.cnn.com/politics, edition.cnn.com/sport and edition.cnn.com/health. The organization configures Istio to allow access to edition.cnn.com and everything works fine. However, at some point in time the organization decides to banish politics. Practically, it means blocking access to edition.cnn.com/politics and allowing access to edition.cnn.com/sport and edition.cnn.com/health only. The organization will grant permissions to individual applications, to applications in particular namespaces and to particular users to access edition.cnn.com/politics, on a case-by-case basis.
To achieve that goal, the organization's operations people will monitor access to the external services and will analyze Istio logs to verify that no unauthorized request was sent to edition.cnn.com/politics. They will also configure Istio to prevent access to edition.cnn.com/politics automatically.
The organization is resolved to prevent any tampering with the new policy. It decides to put mechanisms in place that will prevent any possibility for a malicious application to access the forbidden topic.
Related tasks
The Control Egress Traffic task demonstrates how external (outside the Kubernetes cluster) HTTP and HTTPS services can be accessed by applications inside the mesh. The TLS Origination for Egress Traffic task demonstrates how to allow applications to send HTTP requests to external servers that require HTTPS. The Configure an Egress Gateway task describes how to configure Istio to direct egress traffic through a dedicated gateway service called egress gateway.
The Collecting Metrics and Logs task describes how to configure metrics and logs for services in a mesh. The Visualizing Metrics with Grafana describes the Istio Dashboard to monitor mesh traffic. The Basic Access Control task shows how to control access to in-mesh services. The Secure Access Control task shows how to configure access policies using black or white list checkers. As opposed to the telemetry and security tasks above, this blog post describes Istio's monitoring and access policies applied exclusively to the egress traffic.
Before you begin
Follow the steps in the Configure an Egress Gateway, Perform TLS origination with the egress Gateway task, without
the Cleanup step. After you accomplish this, you will be able
to access edition.cnn.com/politics from an in-mesh container that has curl
installed. In the instructions of this blog post we assume that the SOURCE_POD
environment variable contains the pod
name.
Configure monitoring and access policies
Note that since you want to accomplish your tasks in a secure way, you must direct egress traffic through egress gateway, as described in the Configure an Egress Gateway task. The secure way here means that you want to prevent malicious applications from bypassing Istio monitoring and policy enforcement.
In our scenario, the organization performed the instructions in the Before you begin section. It enabled traffic to edition.cnn.com and configured that traffic to pass through the egress gateway. Now it is ready to configure Istio for monitoring and access policies for the traffic to edition.cnn.com.
Logging
Configure Istio to log access to *.cnn.com. You create a logentry
and two
stdio handlers
, one for logging forbidden access
(error log level) and another one for logging all access to *.cnn.com (info log level). Then you create rules
to
direct your logentry
instances to your handlers
. One rule directs access to *.cnn.com/politics to the handler for
logging forbidden access, another rule directs log entries to the handler that outputs each access to *.cnn.com as an
info log entry. To understand the Istio logentries
, rules
, and handlers
, see
Istio Adapter Model. A diagram with the involved entities and dependencies between them
appears below:
-
Create the
logentry
,rules
andhandlers
:cat <<EOF | istioctl create -f - # Log entry for egress access apiVersion: "config.istio.io/v1alpha2" kind: logentry metadata: name: egress-access namespace: istio-system spec: severity: '"info"' timestamp: request.time variables: destination: request.host | "unknown" path: request.path | "unknown" source: source.labels["app"] | source.service | "unknown" sourceNamespace: source.namespace | "unknown" user: source.user | "unknown" responseCode: response.code | 0 responseSize: response.size | 0 monitored_resource_type: '"UNSPECIFIED"' --- # Handler for error egress access entries apiVersion: "config.istio.io/v1alpha2" kind: stdio metadata: name: egress-error-logger namespace: istio-system spec: severity_levels: info: 2 # output log level as error outputAsJson: true --- # Rule to handle access to *.cnn.com/politics apiVersion: "config.istio.io/v1alpha2" kind: rule metadata: name: handle-politics namespace: istio-system spec: match: request.host.endsWith("cnn.com") && request.path.startsWith("/politics") actions: - handler: egress-error-logger.stdio instances: - egress-access.logentry --- # Handler for info egress access entries apiVersion: "config.istio.io/v1alpha2" kind: stdio metadata: name: egress-access-logger namespace: istio-system spec: severity_levels: info: 0 # output log level as info outputAsJson: true --- # Rule to handle access to *.cnn.com apiVersion: "config.istio.io/v1alpha2" kind: rule metadata: name: handle-cnn-access namespace: istio-system spec: match: request.host.endsWith(".cnn.com") actions: - handler: egress-access-logger.stdio instances: - egress-access.logentry EOF
-
Send three HTTP requests to cnn.com, to edition.cnn.com/politics, edition.cnn.com/sport and edition.cnn.com/health. All three should return 200 OK.
$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 200 200 200
-
Query the Mixer log and see that the information about the requests appears in the log:
$ kubectl -n istio-system logs $(kubectl -n istio-system get pods -l istio-mixer-type=telemetry -o jsonpath='{.items[0].metadata.name}') mixer | grep egress-access | grep cnn | tail -4 {"level":"info","time":"2018-06-18T13:22:58.317448Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":200,"responseSize":150448,"source":"sleep","user":"unknown"} {"level":"error","time":"2018-06-18T13:22:58.317448Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":200,"responseSize":150448,"source":"sleep","user":"unknown"} {"level":"info","time":"2018-06-18T13:22:59.234426Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/sport","responseCode":200,"responseSize":358651,"source":"sleep","user":"unknown"} {"level":"info","time":"2018-06-18T13:22:59.354943Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/health","responseCode":200,"responseSize":332218,"source":"sleep","user":"unknown"}
You see four log entries related to your three requests. Three info entries about the access to edition.cnn.com and one error entry about the access to edition.cnn.com/politics. The service mesh operators can see all the access instances, and can also search the log for error log entries that represent forbidden accesses. This is the first security measure the organization can apply before blocking the forbidden accesses automatically, namely logging all the forbidden access instances as errors. In some settings this can be a sufficient security measure.
Access control by routing
After enabling logging of access to edition.cnn.com, automatically enforce an access policy, namely allow accessing /health and /sport URL paths only. Such a simple policy control can be implemented with Istio routing.
-
Redefine your
VirtualService
for edition.cnn.com:cat <<EOF | istioctl replace -f - apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: direct-through-egress-gateway spec: hosts: - edition.cnn.com gateways: - istio-egressgateway - mesh http: - match: - gateways: - mesh port: 80 route: - destination: host: istio-egressgateway.istio-system.svc.cluster.local port: number: 443 weight: 100 - match: - gateways: - istio-egressgateway port: 443 uri: regex: "/health|/sport" route: - destination: host: edition.cnn.com port: number: 443 weight: 100 EOF
Note that you added a
match
byuri
condition that checks that the URL path is either /health or /sport. Also note that this condition is added to theistio-egressgateway
section of theVirtualService
, since the egress gateway is a hardened component in terms of security (see [egress gateway security considerations] (/docs/tasks/traffic-management/egress-gateway/#additional-security-considerations)). You don't want any tampering with your policies. -
Send the previous three HTTP requests to cnn.com:
$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 404 200 200
The request to edition.cnn.com/politics returned 404 Not Found, while requests to edition.cnn.com/sport and edition.cnn.com/health returned 200 OK, as expected.
You may need to wait several seconds for the update of the
VirtualService
to propagate to the egress gateway. -
Query the Mixer log and see that the information about the requests appears again in the log:
$ kubectl -n istio-system logs $(kubectl -n istio-system get pods -l istio-mixer-type=telemetry -o jsonpath='{.items[0].metadata.name}') mixer | grep egress-access | grep cnn | tail -4 {"level":"info","time":"2018-06-19T12:39:48.050666Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":404,"responseSize":0,"source":"sleep","sourceNamespace":"default","user":"unknown"} {"level":"error","time":"2018-06-19T12:39:48.050666Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":404,"responseSize":0,"source":"sleep","sourceNamespace":"default","user":"unknown"} {"level":"info","time":"2018-06-19T12:39:48.091268Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/health","responseCode":200,"responseSize":334027,"source":"sleep","sourceNamespace":"default","user":"unknown"} {"level":"info","time":"2018-06-19T12:39:48.063812Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/sport","responseCode":200,"responseSize":355267,"source":"sleep","sourceNamespace":"default","user":"unknown"}
You still get info and error messages regarding accesses to edition.cnn.com/politics, however this time the
responseCode
is404
, as expected.
While implementing access control using Istio routing worked for us in this simple case, it would not suffice for more complex cases. For example, the organization may want to allow access to edition.cnn.com/politics under certain conditions, so more complex policy logic than just filtering by URL paths will be required. You may want to apply Istio Mixer Adapters, for example white lists or black lists of allowed/forbidden URL paths, respectively. Policy Rules allow specifying complex conditions, specified in a rich expression language, which includes AND and OR logical operators. The rules can be reused for both logging and policy checks. More advanced users may want to apply Istio Role-Based Access Control.
An additional aspect is integration with remote access policy systems. If the organization in our use case operates some Identity and Access Management system, you may want to configure Istio to use access policy information from such a system. You implement this integration by applying Istio Mixer Adapters.
Cancel the access control by routing you used in this section and implement access control by Mixer policy checks in the next section.
-
Replace the
VirtualService
for edition.cnn.com with your previous version from the Configure an Egress Gateway task:cat <<EOF | istioctl replace -f - apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: direct-through-egress-gateway spec: hosts: - edition.cnn.com gateways: - istio-egressgateway - mesh http: - match: - gateways: - mesh port: 80 route: - destination: host: istio-egressgateway.istio-system.svc.cluster.local port: number: 443 weight: 100 - match: - gateways: - istio-egressgateway port: 443 route: - destination: host: edition.cnn.com port: number: 443 weight: 100 EOF
-
Send the previous three HTTP requests to cnn.com, this time you should get three 200 OK responses as previously:
$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 200 200 200
You may need to wait several seconds for the update of the
VirtualService
to propagate to the egress gateway.
Access control by Mixer policy checks
In this step you use a Mixer
Listchecker adapter, its whitelist
variety. You define a listentry
with the URL path of the request and a listchecker
to check the listentry
using a
static list of allowed URL paths, specified by the overrides
field. For an external Identity and Access Management system, use the providerurl
field instead. The updated
diagram of the instances, rules and handlers appears below. Note that you reuse the same policy rule, handle-cnn-access
both for logging and for access policy checks.
-
Define
path-checker
andrequest-path
:cat <<EOF | istioctl create -f - apiVersion: "config.istio.io/v1alpha2" kind: listchecker metadata: name: path-checker namespace: istio-system spec: overrides: ["/health", "/sport"] # overrides provide a static list blacklist: false --- apiVersion: "config.istio.io/v1alpha2" kind: listentry metadata: name: request-path namespace: istio-system spec: value: request.path EOF
-
Modify the
handle-cnn-access
policy rule to sendrequest-path
instances to thepath-checker
:cat <<EOF | istioctl replace -f - # Rule handle egress access to cnn.com apiVersion: "config.istio.io/v1alpha2" kind: rule metadata: name: handle-cnn-access namespace: istio-system spec: match: request.host.endsWith(".cnn.com") actions: - handler: egress-access-logger.stdio instances: - egress-access.logentry - handler: path-checker.listchecker instances: - request-path.listentry EOF
-
Perform your usual test by sending HTTP requests to edition.cnn.com/politics, edition.cnn.com/sport and edition.cnn.com/health. As expected, the request to edition.cnn.com/politics returns 404.
$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 404 200 200
Access control by Mixer policy checks, part 2
After the organization in our use case managed to configure logging and access control, it decided to extend its access policy by allowing the applications in the politics namespace to access any topic of cnn.com, without being monitored. You'll see how this requirement can be configured in Istio.

If you have enabled automatic sidecar injection, do
$ kubectl apply -n politics -f @samples/sleep/sleep.yaml@
otherwise, you have to manually inject the sidecar before deploying the
sleep
application:$ kubectl apply -n politics -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)
-
Define a shell variable to hold the name of the source pod in the politics namespace for sending requests to external services. If you used the sleep sample, you run:
$ export SOURCE_POD_IN_POLITICS=$(kubectl get pod -n politics -l app=sleep -o jsonpath={.items..metadata.name})
-
Perform your usual test of sending three HTTP requests this time from
$SOURCE_POD_IN_POLITICS
. The request to edition.cnn.com/politics returns 404, since you did not configure the exception for the politics namespace.$ kubectl exec -it $SOURCE_POD_IN_POLITICS -n politics -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 404 200 200
-
Query the Mixer log and see that the information about the requests from the politics namespace appears in the log:
$ kubectl -n istio-system logs $(kubectl -n istio-system get pods -l istio-mixer-type=telemetry -o jsonpath='{.items[0].metadata.name}') mixer | grep egress-access | grep cnn | tail -4 {"level":"info","time":"2018-06-19T17:37:14.639102Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":404,"responseSize":76,"source":"sleep","sourceNamespace":"politics","user":"unknown"} {"level":"error","time":"2018-06-19T17:37:14.639102Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/politics","responseCode":404,"responseSize":76,"source":"sleep","sourceNamespace":"politics","user":"unknown"} {"level":"info","time":"2018-06-19T17:37:14.653225Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/sport","responseCode":200,"responseSize":356349,"source":"sleep","sourceNamespace":"politics","user":"unknown"} {"level":"info","time":"2018-06-19T17:37:14.767923Z","instance":"egress-access.logentry.istio-system","destination":"edition.cnn.com","path":"/health","responseCode":200,"responseSize":334027,"source":"sleep","sourceNamespace":"politics","user":"unknown"}
Note that
sourceNamespace
equalspolitics
in the output above. -
Redefine
handle-cnn-access
andhandle-politics
policy rules, to make the applications in the politics namespace exempt from monitoring and policy enforcement.cat <<EOF | istioctl replace -f - # Rule to handle access to *.cnn.com/politics apiVersion: "config.istio.io/v1alpha2" kind: rule metadata: name: handle-politics namespace: istio-system spec: match: request.host.endsWith("cnn.com") && request.path.startsWith("/politics") && source.namespace != "politics" actions: - handler: egress-error-logger.stdio instances: - egress-access.logentry --- # Rule handle egress access to cnn.com apiVersion: "config.istio.io/v1alpha2" kind: rule metadata: name: handle-cnn-access namespace: istio-system spec: match: request.host.endsWith(".cnn.com") && source.namespace != "politics" actions: - handler: egress-access-logger.stdio instances: - egress-access.logentry - handler: path-checker.listchecker instances: - request-path.listentry EOF
-
Perform your usual test from
$SOURCE_POD
:$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 404 200 200
Since
$SOURCE_POD
is in thedefault
namespace, access to edition.cnn.com/politics is forbidden, as previously. -
Perform the previous test from
$SOURCE_POD_IN_POLITICS
:$ kubectl exec -it $SOURCE_POD_IN_POLITICS -n politics -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 200 200 200
Access to all the topics of edition.cnn.com is allowed.
-
Examine the Mixer log and see that no more requests with
sourceNamespace
equal"politics"
appear in the log.$ kubectl -n istio-system logs $(kubectl -n istio-system get pods -l istio-mixer-type=telemetry -o jsonpath='{.items[0].metadata.name}') mixer | grep egress-access | grep cnn
Dashboard
As an additional security measure, let our organization's operation people visually monitor egress traffic.
-
Follow the steps 1-3 of the Visualizing Metrics with Grafana task.
-
Send requests to cnn.com from
$SOURCE_POD
:$ kubectl exec -it $SOURCE_POD -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 404 200 200
Since
$SOURCE_POD
is in thedefault
namespace, access to edition.cnn.com/politics is forbidden, as previously. -
Send requests to cnn.com from
$SOURCE_POD_IN_POLITICS
:$ kubectl exec -it $SOURCE_POD_IN_POLITICS -n politics -c sleep -- bash -c 'curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/politics; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/sport; curl -sL -o /dev/null -w "%{http_code}\n" http://edition.cnn.com/health' 200 200 200
-
Scroll the dashboard to HTTP services, istio-egressgateway.istio-system.svc.cluster.local section. You should see a graph similar to the following:
You can see the 404 error code received by the sleep application from the default namespace, unknown version, in the Requests by Source, Version and Response Code section on the left. This information can give the operations people a visual clue regarding which application tries to perform forbidden access. You can also see the 200 code received by sleep applications from the default and politics namespaces, so you can know which applications performed valid access to external services.
Comparison with HTTPS egress traffic control
In this use case the applications used HTTP and Istio Egress Gateway performed TLS origination for them. Alternatively, the applications could originate TLS themselves by issuing HTTPS requests to edition.cnn.com. In this section we describe both approaches and their pros and cons.
In the HTTP approach, the requests are sent unencrypted on the local host, intercepted by the Istio sidecar proxy and forwarded to the egress gateway. If Istio is deployed with mutual TLS, the traffic between the sidecar proxy and the egress gateway is encrypted. The egress gateway decrypts the traffic, inspects the URL path, the HTTP method and headers, reports telemetry and performs policy checks. If the request is not blocked by some policy check, the egress gateway performs TLS origination to the external destination (cnn.com in our case), so the request is encrypted again and sent encrypted to the external destination. The diagram below demonstrates the network flow of this approach. The HTTP protocol inside the gateway designates the protocol as seen by the gateway after decryption.
The drawback of this approach is that the requests are sent unencrypted on the localhost, which may be against security policies in some organizations. Also some SDKs have external service URLs hard-coded, including the protocol, so sending HTTP requests could be impossible. The advantage of this approach is the ability to inspect HTTP methods, headers and URL paths, and to apply policies based on them.
In the HTTPS approach, the requests are encrypted end-to-end, from the application to the external destination. The diagram below demonstrates the network flow of this approach. The HTTPS protocol inside the gateway designates the protocol as seen by the gateway.
The end-to-end HTTPS is considered a better approach from the security point of view. However, since the traffic is encrypted the Istio proxies and the egress gateway can only see the source and destination IPs and the SNI of the destination. In case of Istio with mutual TLS, the identity of the source is also known. The gateway is unable to inspect the URL path, the HTTP method and the headers of the requests, so no monitoring and policies based on the HTTP information can be possible. In our use case, the organization would be able to allow access to edition.cnn.com. For Istio with mutual TLS, the organization will be able to specify which applications are allowed to access edition.cnn.com. However, it will not be possible to allow or block access to specific URL paths of edition.cnn.com. Neither blocking access to edition.cnn.com/politics nor monitoring such access are possible with the HTTPS approach.
We guess that each organization will consider the pros and cons of the two approaches and choose the one most appropriate to its needs.
Summary
In this blog post we showed how different monitoring and policy mechanisms of Istio can be applied to HTTP egress
traffic. Monitoring can be implemented by configuring a logging adapter and deploying the Istio dashboard. Access
policies can be implemented by configuring VirtualServices
or by configuring various policy check adapters. We
demonstrated a simple policy that allowed certain URL paths only. We also showed a more complex policy that extended the
simple policy by making an exemption to the applications from a certain namespace. Finally, we compared
HTTP-with-TLS-origination egress traffic with HTTPS egress traffic, in terms of control possibilities by Istio.
Cleanup
-
Perform the instructions in Cleanup section of the Configure an Egress Gateway task.


jekyll-pygments-themes
A set of CSS theme files for Pygments (Python-based code highlighting tool) created from the original built-in Pygments styles, ready for use with Jekyll.
Theme Previews and Custom Theme Builder
Using Themes Without Jekyll
If you want to use the themes with something other than Jekyll, you may need to
remove or change the CSS style prefix of .highlight
.
Links
Hacking
If you want to hack on the site, check out the gh-pages branch.
Acknowledgements
Forked from richleland/pygments-css.


Patience: We are wrapping up the data...
This webpage does not work on IE8 or older... Upgrade your browser if needed
Reset All
Sub_off
District
Nationality
Number of individuals
Gender
Pregnant
Age
Caregiver
Map: Location of the sites
Zoom on the map to filter sites. click on the pinpoint for more information
Interviews per village


This blog is just for ramblings about infosec industry, personal experiences and some of the tips for governance.
A little bit about me, I have over 10 years of experience in different fields of IT and information security. I started as system operator/computer technician, been system and network administrator, IT manager and telecommunication design consultant. Information security responsibilities were always part of my job duties, so in 2010 I was lucky to get a position of information security officer, making my switch from IT to security field an official one. I did clock up many hours studying and doing various projects related to governance, ISMS, standards and compliance as well as risk assessment. I do not do professional penetration tests, it is more of a hobby for me. I have been consultant and full-time employee, freelancing and just passing time in search of inspiration.
The aim of this blog is to help me keep working on my writing skills, professional development and as a by-product share something I know.
Should you like to get in touch, drop me an email or comment, but be nice. I know my style and grammar are far from perfect. I will work on it. Opinions are welcome, obvious trolling is not(if you’d like to troll, please at least make an effort).
A.Sh


Rich Capital JV being sued by main contractor in Batam
by Marissa LeeA JOINT-VENTURE vehicle linked to Rich Capital is being sued by the main contractor of its Oxley Convention City project in Batam, Indonesia.
The contractor, Rich-Link Konstruksi (RLK), commenced a lawsuit against Oxley Karya Indo Batam (OKIB), Indonesian joint venture partner Karya Indo Batam (KIB) and BPN Kota Batam in the Batam District Court on Oct 29, Rich Capital said on Monday night.
Among the remedies sought in the suit, RLK has demanded that OKIB and KIB not carry out any construction works on the project land, pending a final decision by the Court.
RLK also wants OKIB to pay it a claim of 268,776,470,683 rupiah (S$26 million) in cash immediately for losses due to non-performance of OKIB’s payment obligations to RLK as well as for business disruption and reputational loss.
OKIB is currently seeking Indonesian legal advice with a view to vigorously resisting and/or defending the RLK suit, as well as pursuing any counterclaim against RLK, Rich Capital said.
Stay updated with
BT newsletters
Terms & conditions Sign up


The following document contains the results of PMD 6.8.0.
| Violation | Priority | Line |
|---|---|---|
| The method 'recursiveGetJobDetails(JSONObject, String, String, String, JSONParser, Map)' has a NCSS line count of 61. | 3 | 219–306 |
| Violation | Priority | Line |
|---|---|---|
| The enum name 'jobData' doesn't match '[A-Z][a-zA-Z0-9]*' | 1 | 15 |
| Violation | Priority | Line |
|---|---|---|
| This statement should have braces | 3 | 152 |
| This statement should have braces | 3 | 156 |
| This statement should have braces | 3 | 189 |
| This statement should have braces | 3 | 224 |
| This statement should have braces | 3 | 259 |
| This statement should have braces | 3 | 344 |
| This statement should have braces | 3 | 347 |
| This statement should have braces | 3 | 357 |
| This statement should have braces | 3 | 360 |
| Violation | Priority | Line |
|---|---|---|
| The class 'HudsonSettings' is suspected to be a Data Class (WOC=0.000%, NOPA=0, NOAM=24, WMC=25) | 3 | 15–133 |


PyPlotter - A Python/Jython Graph Plotting Package. Manual
|
5.3 Class Simplex.Diagram
Class Simplex.Diagram is a class for drawing simplex diagrams
of population dynamics of populations of three species. For simplex
diagrams dedicated to other purposes it is recommended to use the lower
level class Simplex.Plotter instead.
- __init__
- (self, gfx, function, title=”Simplex Diagram”,
p1=”A”, p2=”B”, p3=”C”, styleFlags
= VECTORS,
raster = RASTER_DEFAULT, density = -1,
color1
= (0.,1.,0.), color2 = (1.,0.,0.),
color3 = (0.,0.,1.), colorFunc
= scaleColor,
titlePen = Gfx.BLACK_PEN, labelPen = Gfx.BLACK_PEN,
simplexPen=Gfx.BLACK_PEN, backgroundPen=Gfx.WHITE_PEN,
section=Graph.REGION_FULLSCREEN)
Initializes the class with the following parameters:
- gfx
- Gfx.Driver: The Gfx drivers used for drawing the simplex diagram.
- function
- f(p)->p*, where p and p' are 3 tuples of floats that add up to 1.0:
Population dynamics function to be displayed in the simplex diagram.
- title, p1, p2, p3
- strings: Strings to mark the title and the three corners of the diagram
with.
- styleFlags
- integer, interpreted as a bitfield of flags: The style or rather flavour
of the simplex diagram. Presently three flavours are possible: VECTORS
for drawing the diagram as a vector field with many little arrows;
TRAJECTORIES for drawing pseudo trajectories; PATCHES
for drawing a patched diagram, where each point in the diagram has
a unique color in the beginning. From generation to generation, however,
colors are adjusted such that every point ("patch") takes the color
of the point it has moved to. This exposes areas of attraction in the
diagram.
- raster
- list of points (3-tuples of floats that add up to 1.0): The point raster
of the simplex diagram. Suitable point rasters of varying density can
be produced with the functions Simplex.GenRaster and Simplex.RandomGrid.
- density
- integer > 2: The density of the points of the simplex diagram. This
is mainly useful in combination with style PATCHES, because
this style does not use a raster.
- color1, color2, color3
- (r,g,b)-tuples, where r,g and b are floats in range of [0.0, 1.0]:
The three color parameters have a different meaning depending on the
diagram style used. For patch diagrams these are the edge colors of
the three edges of the diagram. For trajectory diagrams color1 is the
starting color and color2 is the color towards which later steps of
the trajectory are shaded. For vector fields the range between color1
and color2 is used to indicate the strength of the vector field.
- colorFunc
- f(ca, cb, strength) -> c, where ca and cb are colors and strength is
a float from [0, infinity]: This function produces a color shade from
'ca', 'cb' and 'strength', usually somewhere on the line between 'ca'
and 'cb'. The parameter colorFunc is not used for patches
diagrams.
- titlePen, labelPen, simplexPen, backgroundPen
- Gfx.Pen: Pens for the respective parts of the simplex diagram.
- section
- 4-tuple of floats from then range [0.0, 1.0]: the part of the screen
to be used for the diagram.
- setStyle
- (self, styleFlags=None, titlePen=None,
labelPen=None, simplexPen=None,
backgroundPen=None) - Changes the style of the simplex diagram. It
is not necessary to assign a value to all arguments of the functions.
Those arguments that no value is assigned to will leave the respective
class attributes untouched.
- setFunction
- (self, function) - Changes the population dynamics function that is
visualized by the diagram. The change will only be visible after the
method show has been called.
- setRaster
- (self, raster) - Changes the raster of sample points. The change will
only be visible after the method show has been called.
- setDensity
- (self, density) - Generates a raster of uniformly distributed sample
points (population distributions) with the given density. The change
will only be visible after the method show has been called.
- changeColors
- (self, color1 = (0.,1.,0.), color2 = (1.,0.,0.),
color3 = (0.,0.,1.),
colorFunc=scaleColor) - Changes the colors of diagram, including a
color modifying function. Note: The semantics of these paramters may
differ depending on the visualizer used. The change will only be visible
after the method show has been called.
- show
- (self, steps=-1) - Shows the diagram calculating 'steps' generations
for dynamic diagrams (style TRAJECTORIES or PATCHES).
- showFixedPoints
- (self, color) - Shows candidates(!) for fixed points (only if style
is PATCHES).
- redraw
- (self) - Redraws the diagram.
- resizedGfx
- (self) - Takes notice of a resized graphics context and redraws the
diagram.
|
|
g+
f
@


Jobs¶
A MissionControl job represents a standalone computation. For example, a single run of computational chemistry model.
Job Lifecyle¶
In general the lifecycle of a job is like this:
Define a job in terms of an abstract recipe. Example: a dictionary that specifies a job type and parameters:
{ 'job_type': 'taco', 'job_params': { 'wrapper': 'soft_corn', 'fillings': ['carne', 'salsa', 'lechuga'] } }
Generate a runnable artifact that executes computations based on the recipe. Example: a directory that contains inputs and a set of commands:
taco_job_dir/ inputs/ fillings.txt wrapper.txt entrypoint.sh <contents of entrypoint.sh> #!/bin/bash /bin/taco_maker --fillings="inputs/fillings.txt" wrapper="inputs/wrapper.txt"
Run the artifact locally or on a computing cluster. Example:
slurm sbatch my_taco_job_dir/entrypoint.sh
Store the executed artifact. Example:
mv my_taco_job_dir completed_jobs_archive/
Parse the executed artifact and store the results in a db. Example:
/bin/taco_parser completed_jobs_archive/my_taco_job_dir | /bin/taco_client upload
MissionControl defines conventions and commands to help people manage the job lifecycle.
Defining Jobs¶
MissionControl defines jobs as dictionaries with a few primary components:
- job_type
A string representing a type of job, typically used to dispatch to specific handlers during the job lifecyle.
For example, you could specify a job with a job_type of ‘my_modules.my_taco_module’. Then MissionControl tries to build and parse the job, it would know to use code in a module named ‘my_modules.my_taco_module’.
- job_parameters
A dict of parameters. For example, for our taco job, we could specify a set of taco parameters, like this:
{ 'wrapper': 'soft_corn', 'fillings': ['carne', 'salsa', 'lechuga'] }
- key
- Often you will also want a key to uniquely identify a job. For example, a UUID. This key is useful for tracking job statuses, and for avoiding name collisions when you create and move multiple jobs.
Building Jobs¶
Now we have a convention for defining jobs in terms of job_dicts. But how do we build a runnable artifact for a job_dict?
The MissionControl mc.utils.job_modules.job_dir_builder
module defines a python class that builds a job directory for a given job_dict.
JobDirBuilder builds a directory that contains:
- A work_dir that contains scripts and inputs needed to run the job.
- An entrypoint script to run the work_dir
- job metadata files for tracking the job.
- metadata file(s) that specify what resources or environment variables a job needs to run.
We usually don’t interact directly with the JobDirBuilder. Instead we use the Houston command runner to call the JobDirBuilder. For example:
from mc.houston import Houston
houston = Houston.minimal()
import tempfile
scratch_dir = tempfile.mkdtemp()
from pathlib import Path
job_dir_path = Path(scratch_dir, 'my_job_dir')
build_result = houston.run_command(
'build_job_dir',
job_dict={
'key': 'my_job_key',
'job_type': 'mc.utils.testing.echo_job_module',
'job_params': {'message': 'Tacos are delicious.'},
},
output_dir=str(job_dir_path)
)
built_job_dir = build_result['job_dir']
print(Path(built_job_dir).name)
The above code creates a Houston instance, and then runs the command ‘build_job_dir’. The output of the above example is the path to a job dir:
my_job_dir
Let’s look at the contents of the job_dir:
job_dir_items = [
str(item_path.relative_to(job_dir_path))
for item_path in job_dir_path.glob('**/*')
]
print("\n".join(sorted(job_dir_items)))
Expected output:
JOBMAN__JOB_SPEC.json
MC__JOB_KEY
MC__JOB_META.json
entrypoint.sh
work_dir
work_dir/entrypoint.sh
We see a list of metadata files and the work_dir .
Job Modules¶
How did MissionControl know how to build the job dir in the example abeove? The key is the ‘job_type’ component of the job_dict.
Here is what happend:
#. In our job_dict we specified a job_type of ‘mc.utils.test.echo_job_module’.
- When we ran the ‘build_job_dir’ command, MissionControl looked at the
job_type component, and saw that it should try to dispatch to a module named
‘mc.utils.testing.echo_job_module’. This module is a small utility module
that is included in MissionControl:
mc.utils.testing.echo_job_module
. It contains a functionmc.utils.testing.echo_job_module.build_work_dir
which defines how to build a work_dir. - By convention, MissionControl loaded a function named ‘build_work_dir’ in the python module that has the same name as the job_type. This function received the job_params and an output_dir as kwargs.
- MissionControl executed the ‘build_work_dir’ function
- The ‘build_work_dir’ function created the job directory.
You can also specify a specific builder when you call the ‘build_job_dir’ command. For example:
def my_build_work_dir(*args, params=None, output_dir=None, **kwargs):
from pathlib import Path
Path(output_dir).mkdir(parents=True, exist_ok=True)
entrypoint_name = 'entrypoint.sh'
import textwrap
entrypoint_content = textwrap.dedent(
'''
#!/bin/bash
echo "from my_work_dir_builder"
echo {message}
'''
).lstrip().format(message=params['message'])
entrypoint_path = Path(output_dir, entrypoint_name)
with open(str(entrypoint_path), 'w') as f:
f.write(entrypoint_content)
entrypoint_path.chmod(0x775)
return {'dir': output_dir, 'entrypoint_name': entrypoint_name}
build_result = houston.run_command(
'build_job_dir',
job_dict={
'key': 'my_job_key',
'job_type': 'mc.utils.testing.echo_job_module',
'job_params': {'message': 'Tacos are delicious.'},
},
build_work_dir_fn=my_build_work_dir
)
Running Jobs¶
Once you have built a job how can you run it?
 We outline a few here.
Strategy A: Run Locally¶
In this strategy, you simply execute bash commands to execute a job. Example:
bash my_job_dir/entrypoint.sh
Pros¶
- This is the simplest strategy. It requires no coordination with external systems.
Cons¶
- Your jobs are limited by the resources of your local environment. This may make it difficult to run large numbers of jobs, or to run jobs that require lots of CPUs or special software.
Strategy B: Run on an External Computation Resource¶
In this strategy, you submit jobs directly to an external resource, such as a computing cluster, or an EC2 instance. Example:
scp my_job_dir me@cluster_x:my_jobs ssh me@cluster_x 'cd my_jobs/my_job_dir && sbatch entrypoint.sh'
Pros¶
- You can take advantage of cluster nodes to run large numbers of jobs.
- You can use special hardware and software provided by a cluster.
Cons¶
- You need to coordinate submissions with an external resource.
- You need to monitor job progress.
- It can take time to transfer job files to and from the external resource.
Strategy C: Submit to a meta-scheduler¶
In this strategy, you submit jobs directly to a meta-scheduler, such as jobman. The meta-scheduler runs jobs locally or submits them to external resources, depending on what resources are available. The meta-scheduler can also create batches of jobs and optimize file transfers.
python -m jobman.cli submit_job_dir my_job_dir
Pros¶
- You can use simultaneously use multiple clusters.
- You only have to coordinate with the meta-scheduler, as opposed to coordinating with several different clusters.
- You can run jobs more efficiently if the meta-scheduler can make batches of jobs.
Cons¶
- You need to coordinate with the meta-scheduler.
- You need to configure the meta-scheduler.
Which Strategy To Choose?¶
It depends. In general, choose whichever strategy is easiest to get started with first.
Configuring How Jobs Run¶
Often we want to specify how jobs should run. Common run parameters include:
- How much memory should be allocated for a job?
- How many cores can a job use?
- Can a job be batched with other jobs?
- Which specific executables should a job use?
These parameters are different from job parameters. Job parameters specify what a job should run (‘run model X for three iterations’). Whereas run parameters specify how a job should run (‘run the job using 4 cores’).
MissionControl has a convention for specifying run parameters. When MissionControl builds a job dir, it outputs a ‘run_params’ metadata file. This metadata file is a generic JSON file. Various job runners can read this file and then translate the given run parameters into parameters specific to a given run environment.
For example, a job runner that runs job dirs in a Slurm environment can translate parameters for memory and cores into Slurm-specific parameters.
By default MissionControl generates a run_params file that is compatible with the Jobman meta-scheduler.
Environment-Specific Configurations¶
Let’s think about our echo job from the examples above. It is simple and should run the same in any environment.
But what if want to run jobs that need special configurations. What if these configurations depend on the environment the job runs in?
For example, what if we want to run job that requires a specific version of a quantum chemistry library? What if we want to run this job on two different clusters, cluster X and cluster Y?
There are a few strategies we can use to define environment-specific configurations.
Strategy A: Builder Per Environment¶
In this strategy, we write a builder for each environment in which we expect to run our job.
For example, our code might look something like this:
# <chem_builder_a.py> def build_work_dir_for_cluster_x(...): # define configs for cluster X chem_lib_executable = '/cluster/x/software/my_chem_lib-1.0.1' entrypoint = _write_entrypoint(chem_lib_executable) return {'entrypoint': entrypoint} ... def build_work_dir_cluster_x(...): ... chem_lib_executable = '/cluster/y/bin/my_chem_lib-1.0.1' entrypoint = _write_entrypoint(chem_lib_executable) return {'entrypoint': entrypoint} ... def write_entrypoint(chem_lib_executable): entrypoint_content = textwrap.dedent( ''' #!/bin/bash CHEM_LIB_EXE="{chem_lib_executable}" $CHEM_LIB_EXE my_chem_command ''' ).format(chem_lib_executable=chem_lib_excutable) ...
And then when we build our job directories, we just specify which builder to use:
import my_chem_builder_a # for cluster x houston.run_command( 'build_job_dir', job_dict={...}, build_work_dir_fn=my_chem_builder_a.build_work_dir_for_cluster_x ) # for cluster y houston.run_command( 'build_job_dir', job_dict={...}, build_work_dir_fn=my_chem_builder_a.build_work_dir_for_cluster_y )
Pros¶
- It’s often easier for new users of our code to add new code. “I just copy from the previous example!”
Cons¶
- Maximizing Cluster Use:
- We have to know where our job will run at the time we build it. This means we would have to check cluster availability at job build time, rather than at job run time.
- We can’t make batches of heterogenous jobs ahead of run time, because we would have to check that all the jobs have been built for the same cluster.
- Maintenance:
- If our ‘_generate_common_content’ function signature changes, we will have to find all the places where is called.
- If another type of job uses the same chemstry library, we will have to repeat our configurations in the builder for that type of job.
- Testing: we have to test each of our builders.
Strategy B: One Builder + Config Spec¶
Another strategy is to define one builder, and output a ‘config spec’ along with the job_dir. The config spec describes what things this job needs to run.
- For example:
# <my_chem_builder_b.py> def build_work_dir(...): # define config spec config_spec = { 'chem_lib_executable': { 'required': True, 'env_var': 'CHEM_LIB_EXE' } } return {'entrypoint': entrypoint, 'config_spec': config_spec} def write_entrypoint(): entrypoint_content = textwrap.dedent( ''' #!/bin/bash $CHEM_LIB_EXE my_chem_command ''' ) ...
Pros¶
- Maintenance: all our logic is one place, so it’s easier to maintain.
- We don’t have to know where our job will be run when we build it. So we could send it to any cluster that has available resources. And we can batch together any collection of jobs.
- Testing: we only have one builder to test.
Cons¶
- Whatever runs our job now bears the responsibility for fulfilling the config spec requirements.
- It can be harder for novice users to understand how configs get set.
A vs. B: Which One to Choose?¶
In general, the MissionControl authors recommend strategy B. The advantages in testing and cluster use make up for the slightly higher barrier-to-entry for job module writers.
Parsing Job Dirs¶
Often we want to extract data from executed job dirs.
The MissionControl mc.utils.job_modules.job_dir_parser
module
defines a python class that helps us parses a given job directory.
Typically we don’t interact directly with the JobDirParser. Instead we use the Houston command runner to call the JobDirParser. For example:
from mc.houston import Houston
houston = Houston.minimal()
import tempfile
scratch_dir = tempfile.mkdtemp()
from pathlib import Path
job_dir_path = Path(scratch_dir, 'my_job_dir')
build_result = houston.run_command(
'build_job_dir',
job_dict={
'key': 'my_job_key',
'job_type': 'mc.utils.testing.echo_job_module',
'job_params': {'message': 'Tacos are delicious.'},
},
output_dir=str(job_dir_path)
)
built_job_dir = build_result['job_dir']
# Here we execute a 'fake' run, using prebaked output.
# This often a useful strategy for testing parsers.
houston.run_command(
'run_job_dir',
job_dir=built_job_dir,
fake=True
)
parse_results = houston.run_command(
'parse_job_dir',
job_dir=built_job_dir,
)
print(parse_results)
Expected output:
{'output': 'Tacos are delicious.\n'}
Parser Outputs¶
What should a parser return as outputs? It depends.
MissionControl has no requirements on what a parser must return.
Often what you want a parser to return is some set of update specs that you can pass to a database client, in order to update records in a database.
- The MissionControl EntityDb can help you with this type of parsing. See
- examples.entity_db_parse_and_load.
Testing Job Modules¶
The MissionControl authors strongly recommend writing tests for your job module functions, for several reasons:
- Debugging is easier in the context of small, isolated tests. Debugging is much harder when you have many jobs running in different environments.
- Tests act as a form of documentation for your code.
- Tests let you change your code with confidence.
For examples of how to test job module functions, see the source of
mc.utils.testing.tests.test_echo_job_module
.
Including Prebaked Outputs¶
Something that is often helpful for testing jobs is including prebaked outputs with your job module code. Example: including the output file of a long-running computational chemistry model alongside your job module code.
Prebaked outputs are helpful for several reasons:
- prebaked outputs can help with testing parsers.
- prebaked outputs make it easier to test your jobs in the context of flows and pipelines.
For an example of one way to include prebaked outputs, see the source of
mc.utils.testing.echo_job_module
.
Recommended Practices for Working with Jobs¶
Write small functions in your modules.
This will make your job modules easier to test and understand.
Use constants.py files in your modules.
If your parsers and builders need to refer to common paths or settings, put the settings in a constants.py module that both your parsers and builders can access. Then, if you need to change these settings, you only need to change them in one place.
Write tests for your job modules.
Define a runner with prebaked outputs.
This will make your job modules easier to test, both individually and in the context of flows.
Use the ‘One Builder + Config Spec’ strategy to specify requirements that vary across environments.
Write tests for your job modules.


| Home | Trees | Indices | Help |
|
|---|
|
|
??-96 --+ | S3MultiSelectWidget
This widget will return a table which can have rows added or deleted (not currently edited). This widget can be added to a table using a XXXX_dummy field. This field will only store the ID of the record and serve as a placeholder.
Author: Michael Howden<EMAIL_ADDRESS>|
|||
|
|||
|
|||
|
|
|||
|
|
Constructor
|
|
This widget is not yet complete!
|
|
| Home | Trees | Indices | Help |
|
|---|
| Generated by Epydoc 3.0.1 on Tue Mar 29 14:25:41 2011 | http://epydoc.sourceforge.net |


EpicodusDoctors
Find a Doctor
Enter Medical Issue
Find your Doctor
Summary Results
Medical Issue
Number of Doctors
Doctors
Picture
First Name
Last Name


--- layout: null permalink: /example-simple/ title: description: sitemap: priority: 0.1 exclude: true pageVarTest: "test {{asd}}" ---


2013-08-26
About a month after the 0.3 release (Glebe), we're happy to release 0.4, codename "Oyens". Oyens, Iowa is one of the cutest towns you've never seen and where I did a lot of work on this release. Its population of 102 includes my grandparents, who let me "work" on Camlistore (yes, Grandma, even after 5pm) when they're not busy force-feeding me.
There were 8 contributors to this release (3 of whom are new). Here's what we've been up to:
camtool dumpconfig
sub-commanddev-server
and dev-appengine
scripts are gone. Use the new portable devcam
tool instead. Build with "go get camlistore.org/dev/devcam"We welcome feedback, feature requests, bug reports, and code contributions!
Feel free to email us on our mailing list, and/or file a bug (or see existing bugs).
While we welcome user bug reports, we also welcome code contributions. See the Contributing page for details. While most the codebase (the server and command-line tools) are written in Go, there's also a lot of JavaScript which needs love, as well as Java (for Android) and Objective C (for iOS). Or anything useful you'd like to contribute.


 You have obviously been playing this game for quite a while...
Start again


CryptoMiso is a web service ranking cryptocurrencies based on the commit history of their most popular Github repository.
BlockTech19-Nov-18 03:44 PM
For now, Komodo is in the top 25 of the project "dying" the fastest (if we only look at the price) it's one of the biggest looser in top 100 CMC. But i'm not worry for Komodo. The dragon shall be unleashed.
Cryptoon19-Nov-18 03:44 PM
There is somewhat of a trend that commits are slowing down
jl777c19-Nov-18 03:44 PM
that is just looking at the barterDEX core repo and not any of the half a dozen other repo. be careful what info you believe
1
Cryptoon19-Nov-18 03:45 PM
Yeah I'm not talking about kmd commits
I know miso is only tracking one repo
But if you look at the general chart for the top 10
jl777c19-Nov-18 03:45 PM
#feed-github shows at least the commits from several KMD repos
Cryptoon19-Nov-18 03:46 PM
EOS/ADA/TRX/LSK/... all slowing down
GRS last commit in september
PIVX also slowing down hard
Augur slowing down hard
jl777c19-Nov-18 03:48 PM
oh, the whole industry... didnt realize. if anything KMD is getting more activity
Cryptoon19-Nov-18 03:48 PM
blocknet last one somewhere in october (lol)
Yeah kmd one of the few that is keeping active and even hiring more devs
I dont think there are a lot of projects that can say the same
2
snowdamn19-Nov-18 03:49 PM
blocknet is frontrunning on the commits
1
PHBA206119-Nov-18 03:49 PM
@ryman112 you misread that, I said $100 kmd is not impossible
Cryptoon19-Nov-18 03:49 PM
BAT slowing down as well
ETC (lol)
FCT last commit mid october, yet they announced that they were planning to add staking somewhere today I think?
CryptoMiso is a web service ranking cryptocurrencies based on the commit history of their most popular Github repository.
lol siacoin last one in july or so
jl777c19-Nov-18 03:53 PM
cryptomiso maybe is not a reliable info?
2
Lumbi19-Nov-18 04:26 PM
I wonder if they are joshing numbers. How's it tracked?
Cryptoon19-Nov-18 04:44 PM
where
blackjok3r19-Nov-18 04:45 PM
"Bitcoin was an extremely clever idea. Sadly, not every clever idea is a good idea," Coeure said. "In more ways than one, bitcoin is the evil spawn of the financial crisis."
cnbc is saying this
BUY!
2
BlockTech19-Nov-18 04:47 PM
KMD pumping hard ^^ back to 16k sat.(edited)
2
JimD19-Nov-18 04:47 PM
Is this the last FUD cycle before Bull run ?
PHBA206119-Nov-18 04:48 PM
whalebros finally awaken ...

JimD19-Nov-18 04:50 PM
It probably is. When BTC ran out the 6K wedge I think the consensus was broken and their just needed to be a negative catalyst
So, following on from Saturday's Market Outlook, which dealt exclusively with Bitcoin, Ethereum and Monero, this twelfth instalment of the series will be an 'Altcoin Special'.
includes KMD
passcombo.com 🏴☠🏴19-Nov-18 05:40 PM
rumors are BSC succesfully reorged some blocks... their own
Dramas per second are increasing on BSV: they just experienced a multiblock reorg at block 557301.
These nincompoops cannot operate their own network without shooting themselves in the foot. So much for the "small world" of miners that a certain fraud likes to blague abou...
Komodo / Bitcoin (BINANCE:KMDBTC). Get more trading ideas from lastine_. Follow market experts, get opinions and be heard! Join the largest trading & investing community on the planet.
18 block re-org on $BSV is quite serious, exchanges might start increasing confirmations with deposits and potentially consider delisting it.
https://t.co/g3Adfxeuwa
Oops
jl777c19-Nov-18 05:49 PM
maybe they got confused and thought they were attacking ABC chain, but attacked their own SV chain
FishyGuts19-Nov-18 05:50 PM
ZEN sub $10 USD
Hollowman900019-Nov-18 06:01 PM
BTC dedded
Crypto dedded
I retire guys this is my goodbye
6
blubbi19-Nov-18 06:02 PM
Bitcoin’ RSI indicator has hit its lowest level since 2015.
Bitcoin’ is also oversold on the weekly time frame
Cryptoon19-Nov-18 06:02 PM
hollow secretly pulling out his fiat stash
hastrup19-Nov-18 06:02 PM
This cannot be true there's is 1 mil jumblr out there. somone pls sell them to me
Cryptoon19-Nov-18 06:03 PM
I think @Acura was selling something, but it was DEX I believe
blubbi19-Nov-18 06:03 PM
jep he sold dex
hastrup19-Nov-18 06:03 PM
I have bought his dex
Cryptoon19-Nov-18 06:03 PM
depending on how big of an order you want you can ask if jl can sell you some
But I think I only read once that he wanted to do several btc trades
for assetchains
hastrup19-Nov-18 06:04 PM
How much is big 1k 10k?
blubbi19-Nov-18 06:04 PM
last time i asked him he said got not much for sale
Whoops, my bad! Decided to open a large $KMD swing position at 165 aiming at 218-228-248. Tried to be gentle, but the volume was too low. Guess this could turn into something!
Lumbi19-Nov-18 06:16 PM
@Hollowman9000 cashed out....? Is it even rough in that surf?
bpkdasbaum19-Nov-18 06:16 PM
Not sure why ppl panic here: the selloff volume was crazy low. buy volume was way more. Whale accumumlatin in addition to normal peeps. Just a few players who sold the bottom. Wait out the winter. https://www.tradingview.com/x/yqWB4sed/
This has been game for past 2-3 weeks.
also bullish hidden divergence.
on rsi
Lumbi19-Nov-18 06:18 PM
0.19$ ? hack or pack...
FishyGuts19-Nov-18 06:20 PM
!arrrtip @Exile13 99.9001
ARRR TipBotBOT19-Nov-18 06:20 PM
TipBot
Error sending coin. [object Object]
FishyGuts19-Nov-18 06:21 PM
!arrrtip @Exile13 99.91
ARRR TipBotBOT19-Nov-18 06:21 PM
TipBot
@FishyGuts (FishyGuts#5085)
You tipped @Exile1399.9099 ARRR
A network fee of 0.0001 ARRR was deducted from the amount.
This operation is pending. You will be notified when when it has finished.


Hello, Code School!
I'd like to learn how to combine my coding skills to creat something useful.
I'd like to create a personal website with my resume and interactive engineering calculators.


 Dicta veritatis eligendi vitae, natus debitis enim libero officia optio perspiciatis ullam dolorem obcaecati
Funded in 1987 -
Lorem ipsum dolor sit amet, consectetur adipisicing elit. Beatae nam voluptatem dolores ut optio, quisquam illo perspiciatis, this is so much fun I cant argue Deserunt modi asperiores vel dignissimos?
Get To Know About Us ——
There are many variations of passages of Lorem Ipsum is simply free text available, but the majority have suffered alteration in some form, by injected humour words.
Some quick example text to build on the card title and make up the bulk of the card's content.
Some quick example text to build on the card title and make up the bulk of the card's content.
Some quick example text to build on the card title and make up the bulk of the card's content.
Some quick example text to build on the card title and make up the bulk of the card's content.
 Dicta veritatis eligendi vitae, natus debitis enim libero officia optio perspiciatis ullam dolorem obcaecati
Projects Completed Successfully
Cients Get Benefit Every Day
Our Happy and Satisfied Clients
Our Clients Testimonails ——
Lorem ipsum dolor sit amet consectetur, adipisicing elit. Id dolorum, asperiores ex eveniet voluptate modi praesentium rem sequi autem ad ratione.
Happy Client
Lorem ipsum dolor, sit amet consectetur adipisicing elit. Quae rerum sed voluptate et perspiciatis autem sit illo iure eos! Rem esse deserunt.
Happy Client
Lorem ipsum dolor sit amet consectetur, adipisicing elit. Id dolorum, asperiores ex eveniet voluptate modi praesentium rem sequi autem ad ratione.
Happy Client
Lorem, ipsum dolor sit amet consectetur adipisicing elit. Pariatur adipisci, magni quasi quas repudiandae eos, ea esse ex labore eveniet modi.
66 Brooklyn Street New York, United States
<EMAIL_ADDRESS>1-800-235-6789
© Copyright by YourCompany.com


This website was made by Ethan Wiggins, a fourth year Biochemistry Major.
Contact<EMAIL_ADDRESS>References: Slick Carousel OMDb API


Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.
Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature.
Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature.
Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature.
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset.
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley.
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type dummy text of the printing and typesetting industry and scrambled.


--- layout: post title: "Wowcube System Launces A Next Generation Handheld Game" subtitle: "Electronic gaming system comes in the shape of a cube; more advanced than the old Rubik's" date: 2021-01-18 22:14:40 +0530 background: '/img/posts/06.jpg' published: true categories: [ Technology ] tags: [ gaming, games, handheld, rubik, next-generation, playing ] ---
The WOWCube System handheld game will immerse you wherever you go. This electronic gaming system comes in the shape of a cube, but it’s much more advanced than the old Rubik’s.
In fact, this handheld game is great for both playing and learning with its 24 high-resolution screens and eight autonomous modules.
What’s more, it has a built-in CPU and multiple magnetic connectors. Made with an open API and SDK, this gadget even lets you develop new games to play. Get new games through the connected app store and enjoy practicing spatial reasoning by playing in 3D.
With eight processors and no buttons, this fully tangible gadget brings joy to the whole family. It’s a stylish, high-tech device that brings mixed-reality gaming to anyone of any age.


LIBRA
Title:
Author:
Total Pages:
Finished ?
Create Book
+
Title
Author
Pages
Status
There Is No Book. Press "+" Button To Create One!


Arabesque Egypt
About Us
Projects
Latest News
Sign In
Account
Contact Us
About Us
Projects
Latest News
Sign In
Account
Contact Us
menu


Ingredients
- 1 package active dry yeast
- 2-1/2 cups warm water
- 2 cups all-purpose flour
- 1 Tablespoon sugar
Instructions
Dissolve yeast in 1/2 cup of the water, then stir in the rest of the water and the flour and sugar. Using a wooden spoon, beat until smooth. Cover with 100% cheesecloth and let stand at room temperature, stirring the mixture a few times a day, for five to 10 days. You're looking for a smell of fermentation and no more bubbles. Transfer the mixture to a 1-quart container, cover and refrigerate.
Add one teaspoon of sugar every 10 days if you don't use the starter.
To use: Measure out the amount of mixture you need for the recipe and let stand 30 minutes at room temperature. Meanwhile, replenish your starter.
To replenish your starter: For every cup of starter removed, stir in 3/4 cup all-purpose flour, 3/4 cup water and 1 teaspoon sugar. Cover with cheesecloth and let stand one day or until you see bubbles. Cover and refrigerate.


Reports equality expressions which are negated by a prefix expression. For example:
!(i == 1)
New in 12, Powered by InspectionGadgets


MANAGE TEAMS
Team Name:
Team Level:
ID
TEAM NAME
TEAM LEVEL
{{ team._id }}
{{ team.attributes.TeamName }}
{{ team.attributes.TeamLevel }}


--- layout: post title: 'My Week in Review' sourceurl: http://audreywatters.com/2014/10/19/week-of-10-13-2014/ image: imagecredits: ---
Most of the week was spent in Hermosa Beach. Kin and I flew to Stockholm (directly flight from LAX – that was nice) on Friday night. Upcoming week: Stockholm, then back to Hermosa Beach.
Not much to report this week, as I’ve been working on all the talks I have to give in November. I’m not quite in panic mode yet, but close.
I answered a couple of questions for a project by two students at the Education Program at St. Thomas University. And I was the “visiting expert” in the Stanford/edX “Open Knowledges” class.
Worth noting that, at age 21, the kid finally got his learner’s permit this week. I do wonder if all the pronouncements that “kids don’t want to drive; they want iPhones” will change once they reach adulthood and realize that, sadly, a car is still necessary in many places in order to get to and from work.


Directions to the
Kindelberger Stone House
Directions to the
Kindelberger Stone House from Clarington, Ohio:
Clarington, Ohio is
located on Ohio Route # 7 at the intersection of Route # 7 and Route #
78. Proceed northeast on Route # 7 (toward Wheeling, WV) for about 0.7
miles. Turn left onto Route # 556 and drive about 5 miles to the
intersection with German Ridge Road. Look for an electric sub-station and
the Bethel Cemetery at this intersection. Turn right onto German Ridge
Road (this road will take you to Routes # 25, 37, and 81 -- At least one Monroe
County map also identifies the first half mile or so of this road as Boltz
Rd.). Proceed to the junction of County Roads # 25 and # 37. The
Kindelberger Stone House is the second house on the right after your turn off
Route # 556. The house number is 50037.
Directions to the
Kindelberger Stone House from Beallsville, Ohio:
Beallsville, Ohio is located
at the intersection of Routes # 145 and # 556. From Beallsville, follow
Route # 556 east for about 8 miles to the intersection with German Ridge
Road. Look for an electric sub-station and the Bethel Cemetery at this
intersection. Turn left onto German Ridge Road (this road will take
you to Routes # 25, 37, and 81 -- At least one Monroe County map also
identifies the first half mile or so of this road as Boltz Rd.). Proceed
to the junction of County Roads # 25 and # 37. The Kindelberger Stone
House is the second house on the right after your turn off Route # 556.
The house number is 50037.


At the turn of the 20th century, the flow of the river was reversed to protect Lake Michigan, the city’s primary source of drinking water, by sending Chicago’s waste to the Mississippi River. Despite this engineering feat, billions of gallons of untreated sewage, industrial pollution, and stormwater flow from the river into the lake every year. Less than an inch of rain is all it takes to push polluted water out of city and suburban sewers and into the river. To prevent flooding in the city during the biggest storms, officials are forced to open the locks that separate the river from Lake Michigan. When the locks are opened, the Chicago River resumes its original course, and its contaminated waters are flushed directly into the lake.
Between 2007 and 2010, the city’s sanitary district released nearly 19 billion gallons into the lake, in part due to two monsoon-like storms in 2008 and 2010, among the worst in Chicago history.


This is a confirmation that we successfully received your RSVP.
Elisabeth & Rafael
We received your RSVP!
We can't wait to see you at our wedding.
June 25, 2016 - 5 PM
Just so you know, we've moved!
This is our new address in Philadelphia:
230 N 21st St - Unit 611
Philadelphia, PA 19103
El & Raf
230 N 21st St Unit 611
Philadelphia, PA - 19103


The editor below accepts inputs in an ML-like language — you can see the Ohm grammar for
this language by viewing the source of this page. As you type, the input is re-parsed
incrementally, i.e., the parser makes use of the information in its memo table to avoid
doing unnecessary work.
avg parse0 ms
last parse0 ms
0 calls to
MatchResult.getExpectedText() took
0 ms
(0 ms / call)


Megabus with 53 passengers involved in an accident on I-75
by WFTX Digital TeamFORT MYERS, Fla. — Florida Highway Patrol responded to an accident involving a Megabus with 53 passengers and a vehicle on I-75 at Daniels Parkway. The vehicle was traveling north on I-75 in the right lane as it entered I-75 from the entrance ramp of Daniels Parkway. The Megabus was traveling north on I-75 in the center lane.
The vehicle made an improper lane change in front of the bus. The front of the bus struck the rear of the vehicle. The bus came to a final rest in the center lane, unable to be moved due to the damage. Northbound I-75 center lanes were reopened at 2:19 pm.
The Megabus was towed away, and another bus was called in to pick up the 53 passengers. No injuries were reported.


flibs/strings - Handle a list of tokens
The tokenlists module builds on the tokenize module and provides an object-oriented interface to the set of tokens that was found in a string. The object holds a copy of the string, so that parsing is done only once and you can randomly access the tokens.
The module defines a single class, tokenlist and passes on the predefined character classes from the tokenize module.
To import the definitions, use this module.
The derived type with methods for handling a list of tokens.
Initialise the tokenizer characteristics for the tokenlist object. (See tokenize module for details).
The tokenlist object to be configured.
The string of characters that are to be treated as "gaps". They take precedence over the "separators". Use "token_empty" if there are none.
The string of characters that are to be treated as "separators". Use "token_empty" if there are none.
The string of characters that are to be treated as "delimiters". Use "token_empty" if there are none.
Tokenize the string and store the results for later retrieval. A copy of the string is stored in the tokenlist object.
The tokenlist object to be used
The string to be split into tokens.
Get the number of tokens that was found in the string. one.
The tokenlist object to be used
Get the length of the idx'th token.
The tokenlist object to be used
The index of the token you want to know the length of
Get the idx'th token. The returned string is exactly of the length of the token.
The tokenlist object to be used
The index of the token you want returned
Convenient parameters:
token_whitespace - whitespace (a single character)
token_tsv - tab, useful for tab-separated values files
token_csv - comma, useful for comma-separated values files
token_quotes - single and double quotes, commonly used delimiters
token_empty - empty string, useful to suppress any of the arguments in the set_tokenizer routine.
Copyright © 2012 Arjen Markus <arjenmarkus@sourceforge.net>


Simba Paka Safaris is one of the leading tour operators in Kenya, providing comprehensive services for groups and individuals from and to the country. Simba Paka Safaris was first established in the year 2004 by qualified professionals with more than ten years of experience in the tourism industry. Holding places, people and customs through professional guides, modern transportation, quality hotels, fine restaurants and give you the best options and destinations. Located at View Park Towers 18th Floor wing B 5, Utalii Ln, Nairobi, Kenya,our offices are open from 08:00 A.M. to 7:00 P.M., 7 days a week. You can freely call or WhatsApp us 24/7 for any queries, bookings, reservations or any urgent requests.
VISIT OUR WEBSITEEXPRESS TRAVEL GROUP LIMITED is an IATA accredited Travel Management Company (TMC) and has been in business since 1955. We provide a full range of travel management services to a diverse client portfolio comprising local and international corporate organizations, non-governmental organizations, international travel agents and tour operators and individuals.Express Travel Group is the Exclusive Partner for Travel Leaders Network in Kenya and East Africa.Furthermore.
With over 30 years in the Travel Industry, Muthaiga Travel Limited has grown from strength to strength and become the Travel Management Company of choice for various corporate organizations, Diplomatic Missions, NGOs, UN Bodies, as well as individual travellers who benefit from our cost effective and unique travel programs. Our sound financial backing and experience accords us the opportunity to draw from a variety of resources that help us meet customer needs. Through our dedication, we have earned an excellent reputation for the personalized care and attention we offer our clients.At Muthaiga Travel we provide full, prompt, accurate and expert international and domestic travel products and services. Additionally, we have proactively invested in the best practices and processes to ensure excellent service .
VISIT OUR WEBSITEWe make travel and holiday experiences great,stress free and memorable by offering exceptional services and affordable safaris solutions to business and leisure travelers worldwide. Your holiday is a journey what we deliberately make with you from the moment you think about your trip to the time you return home.It one of the one stop ours and travellers company based in Westland Nairobi.We provide cooporate and business travel that includes:air ticketing,train ticketing,hotel booking,airport transfers.
VISIT OUR WEBSITEAt Bountiful Safari & Tours,you are assured of experiencing the African adventure in the finest way possible.With wide range of Kenya safari packages to popular and exciting destination;your dream holiday is sure to be unforgettable one.With tailor-made safaris,we can customize your safari to your specifications,to ensure your maximum comfort,relaxation and thrilling adventures.Kenya is indeed,the home of africa safaris.With very diverse natural and amazing sceneries,wide range of tradition & cultures.
VISIT OUR WEBSITEBaboon Budget Safaris is a tours and travel agency, located at the epicenter of Africa's greatest tourism, with the aim of giving you the best of experience in your traveling and exploring nature's best. With our our knowledgeable and experienced tour guides and drivers, and with a rich fleet of 4x4 tour vans, your dream safari is assured. Our affordable rates for tour packages gives you a wide range of choices to make. We also customize packages specifically for you, to meet your travel dreams. We are specialists in private and group safaris. Book with us today.
VISIT OUR WEBSITEOur ethos involves One Horizon Africa making possible the funding to enable sustainable programs to be actioned and implemented as well as the accountability of the funds invested in initiatives. A key aspect of this is to ensure that there are quantifiable improvements in the lives of the people in the communities who are the recipients of the programs.Welcome for our effecient services
VISIT OUR WEBSITERelaxing on the beach or lounging by the pool might be the definition of an ideal vacation for others. Others, on the other hand, believe that a vacation isn’t complete without a good dose of adventure. If you’re looking for a destination that’s as exciting as it is stunning. The region’s natural beauty, friendly people, and incredible wildlife ensure that there is adventure around every corner.
VISIT OUR WEBSITE


Trillionet Technologies
We lead, others follow.
To Maximize acquired skills and abilities in IT Industry hence contribute to organization by utilizing Professional and educational experience, this will offer Economic growth while being resourceful, innovative and flexible.
Experienced with Windows operating System, Office applications installations and Troubleshooting.
Knowledge of computer and Network assembly, function and Troubleshooting.
Communicates very well both verbally and in writing.
Very well with people from all walks of life.
It's rewarding
It's great to see something you create being used by other people. When a client comes back to me and asks for a bugfix, I know it's because they're using my program, and it's wonderful to know that you've helped someone. It also helps that programming can be pretty lucrative.