{{template config_path="design/email/header_template"}}
|
{{trans "%name," name=$customer.getName()}} {{trans "Some of your points will expire soon!"}} |
{{trans "Hurry up and use your points before expiry date."}} |
|
{{trans "Some of your points (%points points) will expire soon." points=$points |raw}} {{trans "You have %days day(s) to use your points, otherwise you will loose them." days=$days |raw}} {{trans "Visit us on our store in order to use your points."}} |


On 28th November 2014 I walked from my parent’s house in north London in a direct line due north for one mile or so. Following this transect, I noticed it cross right through a churchyard, and in fact right through the heart of a massive ancient oak tree. This is known as the Minchenden Oak. Minchenden, I believe, is the old name of the area, derived from an old estate/family–the local school I attended as a child used also to be called Minchenden. The oak has stood on this site for hundreds of years and is considered holy by some (I included, not least due to the exact northern alignment with my childhood home).
After this, I continued north along the transect. This took me up into Trent Park, where I found a few sodden mushrooms, including these delicious shaggy-caps, and a throne.


MassMedia v0.3beta1 documentation
Recognized extensions for image files. It should be a list or tuple of strings without the leading period. Default:
MMEDIA_IMAGE_EXTS = ('bmp','gif','ico','cur','jpg','jpeg','pcx',
'png','psd','tga','tiff','wmf','xcf','bmp',
'wmf','apm','emf')
Recognized extensions for video files. It should be a list or tuple of strings without the leading period. Default:
MMEDIA_VIDEO_EXTS = ('asf','wmv','flv','mov','mpeg','mpg','mpe','vob',
'qt','mp4','m4v','rm','avi','ogm')
Recognized extensions for audio files. It should be a list or tuple of strings without the leading period. Default:
MMEDIA_AUDIO_EXTS = ('asf','aif','aiff','aifc','flac','au','snd','mid',
'midi','mpa','m4a','mp1','mp2','mp3','ra','xm',
'wav','ogg')
Recognized extensions for SWF files. It should be a list or tuple of strings without the leading period. Default:
MMEDIA_FLASH_EXTS = ('swf',)
Recognized extensions for generic document files. It should be a list or tuple of strings without the leading period. Default:
MMEDIA_DOC_EXTS = ('pdf','xls','doc')
The hachoir_metadata library allows you to specify how it parses metadata, from 0.0 (fastest) to 1.0 (best quality). Default:
MMEDIA_INFO_QUALITY = 1.0
The size of automatically generated thumbnails for images. It is a two integer tuple for width and height. The default is 100px wide by 80px high. Default:
MMEDIA_THUMB_SIZE = (100, 80)
The Python standard library includes a MIME types map of file extensions to MIME type. However, this map may be incomplete. This setting extends the default mapping. It is a dict of dot-extensions mapped to MIME type. Default:
MMEDIA_EXTRA_MIME_TYPES = {'.flv':'video/x-flv',}
There are two ways to manage the templates used to render content: via the admin or through files on the computer’s file system. If this setting is False, there will be a MediaTemplate model for managing the templates by MIME type. By default, this setting is True and templates are managed through the path massmedia/. Massmedia looks in a hierarchy for the correct template. For example, an image with a MIME type of image/jpeg
/massmedia/image/jpeg.html
/massmedia/image/generic.html
/massmedia/generic.html
Where it first looks for the most specific template, and then falls back to more generic templates. Default:
MMEDIA_FS_TEMPLATES = True
TODO
In order to import items from Grab Network, you need an API key.
In order to import items from Grab Network, you’ll also need an API URL.


Hello User
Recent Items
Overview
Card
Overview
Card
Overview
Card
Overview
Card
Overview
Card
Card
Card
Card


|
Unpacks and interleaves the high-order data elements (bytes, words, doublewords, or quadwords) of the destination operand (first operand) and source operand (second operand) into the destination operand. The low-order data elements are ignored.
The source operand can be an MMX technology register or a 64-bit memory location, or it can be an XMM register or a 128-bit memory location. The destination operand can be an MMX technology register or an XMM register. When the source data comes from a 64-bit memory operand, the full 64-bit operand is accessed from memory, but the instruction uses only the highorder 32 bits. When the source data comes from a 128-bit memory operand, an implementation may fetch only the appropriate 64 bits; however, alignment to a 16-byte boundary and normal segment checking will still be enforced.
The PUNPCKHBW instruction interleaves the high-order bytes of the source and destination operands, the PUNPCKHWD instruction interleaves the high-order words of the source and destination operands, the PUNPCKHDQ instruction interleaves the high-order doubleword (or doublewords) of the source and destination operands, and the PUNPCKHQDQ instruction interleaves the high-order quadwords of the source and destination operands.
These instructions can be used to convert bytes to words, words to doublewords, doublewords to quadwords, and quadwords to double quadwords, respectively, by placing all 0s in the source operand. Here, if the source operand contains all 0s, the result (stored in the destination operand) contains zero extensions of the high-order data elements from the original value in the destination operand. For example, with the PUNPCKHBW instruction the high-order bytes are zero extended (that is, unpacked into unsigned word integers), and with the PUNPCKHWD instruction, the high-order words are zero extended (unpacked into unsigned doubleword integers).
|


The last week or so has been pretty interesting (see this reddit post for some details). The first few days showed how bad assumptions can quickly become blockers and then how other assumptions can manifest themselves in more subtle ways.
I talked about the first blocker in the previous post but this is more about the latter. I had assumed that the Dexcom’s internal time was standard. That is, I assumed that two receivers would have different display times but the same system time at any given point in time. That proved to be a bad assumption to make. ChickenBeard again helped with this bug by testing my numerous builds and being patient with my varied attemps at finding a more robust solution.
I’m happy to say that it looks like my new approach is now working. The bad news is that previously uploaded data is bad and locally stored archives of your data (a copy that Glukloader keeps for you and for resending data in case of disasters) is also faulty (potentially). The result is bad times (it looks like bad timezone handling). It’s not necessarily dramatic but I’d like to sanitize the data at some point. More to come as I think about this and talk to a few more of you to understand the impact.
Since Glukloader has proven to be very important to the whole interaction with Glukit, I decided to follow edwhittle’s suggestion and add some user feedback with it.
Here’s the link to the new build with both of those: Glukloader 1.0-rc20.
Again, talk to me if there’s anything on your mind.
Peace,


The GenSVM classifier is a generalized multiclass support vector machine (SVM). This classifier aims to find decision boundaries that separate the classes with as wide a margin as possible. In GenSVM, the loss function is very flexible in the way that misclassifications are penalized. This allows the user to tune the classifier to the dataset at hand and potentially obtain higher classification accuracy than alternative multiclass SVMs. Moreover, this flexibility means that GenSVM has a number of other multiclass SVMs as special cases. One of the other advantages of GenSVM is that it is trained in the primal space, allowing the use of warm starts during optimization. This means that for common tasks such as cross validation or repeated model fitting, GenSVM can be trained very quickly. Based on: G.J.J. van den Burg and P.J.F. Groenen (2018) <http://www.jmlr.org/papers/v17/14-526.html>.
| Version: | 0.1.1 |
| Depends: | R (≥ 3.0.0) |
| Published: | 2018-04-25 |
| Author: | Gertjan van den Burg [aut, cre], Patrick Groenen [ctb] |
| Maintainer: | Gertjan van den Burg <gertjanvandenburg at gmail.com> |
| BugReports: | https://github.com/GjjvdBurg/RGenSVM |
| License: | GPL-2 | GPL-3 [expanded from: GPL (≥ 2)] |
| URL: | https://github.com/GjjvdBurg/RGenSVM http://jmlr.org/papers/v17/14-526.html |
| NeedsCompilation: | yes |
| Classification/MSC: | 62H30, 68T10 |
| Citation: | gensvm citation info |
| Materials: | README |
| CRAN checks: | gensvm results |
| Reference manual: | gensvm.pdf |
| Package source: | gensvm_0.1.1.tar.gz |
| Windows binaries: | r-devel: gensvm_0.1.1.zip, r-release: gensvm_0.1.1.zip, r-oldrel: gensvm_0.1.1.zip |
| OS X binaries: | r-release: gensvm_0.1.1.tgz, r-oldrel: gensvm_0.1.1.tgz |
| Old sources: | gensvm archive |
Please use the canonical form https://CRAN.R-project.org/package=gensvm to link to this page.


TOI-Search Quad RI - 300x130
The World's Largest Matrimonial Service
Looking for
Bride
Groom
Age
18 - 24
25 - 30
31 - 35
36 - 40
41+
Best Matches | Most Responses | Fully Secure


December, 1 99
"But I must explain to you how all this mistaken idea of denouncing pleasure and praising pain was born and I will give you a complete account of the system, and expound the actual teachings of the great explorer of the truth, the master-builder of human happiness. No one rejects, dislikes, or avoids pleasure itself, because it is pleasure, but because those who do not know how to pursue pleasure rationally encounter consequences that are extremely painful. Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain, but because occasionally circumstances occur in which toil and pain can procure him some great pleasure. To take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain some advantage from it? But who has any right to find fault with a man who chooses to enjoy a pleasure that has no annoying consequences, or one who avoids a pain that produces no resultant pleasure?"
Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain, but because occasionally circumstances occur in which toil and pain can procure him some great pleasure. To take a trivial example, which of us ever undertakes laborious physical exercise
Lorem Ipsum
Lorem Ipsum
Lorem Ipsum
Lorem Ipsum
Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain, but because occasionally circumstances occur in which toil and pain can procure him some great pleasure. To take a trivial example, which of us ever undertakes laborious physical exercise
99 99 Reply 5 February 17


ALLERGY INFORMATION: Unless otherwise noted, products contain milk, wheat, soy and egg, and were produced on equipment that processes peanuts, almonds, hazelnuts, pecans, walnuts. Our facility is not Gluten Free.
Butter, brown sugar, cocoa, vegetable oil, sugar, eggs, raising agents, natural flavourings, Madagascar vanilla bean paste, dark chocolate, white chocolate, toasted walnuts and marshmallows.
For more flavours here is a link to our main page Home Page.
Thank you so much, for stopping by! Our hope is that you always experience life’s sweet treats!
If you have more questions, please Email Us! or call us to any of the following phone numbers.


The Coming Judgment on Judah
2 "I will utterly sweep away everything
from the face of the earth," declares the LORD.
3 "I will sweep away man and beast;
I will sweep away the birds of the heavens
and the fish of the sea,
and the rubble with the wicked.
I will cut off mankind
from the face of the earth," declares the LORD.
4 "I will stretch out my hand against Judah
and against all the inhabitants of Jerusalem;
and I will cut off from this place the remnant of Baal
and the name of the idolatrous priests along with the priests,
5 those who bow down on the roofs
to the host of the heavens,
those who bow down and swear to the LORD
and yet swear by Milcom,
6 those who have turned back from following the LORD,
who do not seek the LORD or inquire of him."
The Day of the LORD Is Near
7 Be silent before the Lord GOD!
For the day of the LORD is near;
the LORD has prepared a sacrifice
and consecrated his guests.
8 And on the day of the LORD's sacrifice-
"I will punish the officials and the king's sons
and all who array themselves in foreign attire.
9 On that day I will punish
everyone who leaps over the threshold,
and those who fill their master's house
with violence and fraud.
10 "On that day," declares the LORD,
"a cry will be heard from the Fish Gate,
a wail from the Second Quarter,
a loud crash from the hills.
11 Wail, O inhabitants of the Mortar!
For all the traders are no more;
all who weigh out silver are cut off.
12 At that time I will search Jerusalem with lamps,
and I will punish the men
who are complacent,
those who say in their hearts,
'The LORD will not do good,
nor will he do ill.'
13 Their goods shall be plundered,
and their houses laid waste.
Though they build houses,
they shall not inhabit them;
though they plant vineyards,
they shall not drink wine from them."
14 The great day of the LORD is near,
near and hastening fast;
the sound of the day of the LORD is bitter;
the mighty man cries aloud there.
15 A day of wrath is that day,
a day of distress and anguish,
a day of ruin and devastation,
a day of darkness and gloom,
a day of clouds and thick darkness,
16 a day of trumpet blast and battle cry
against the fortified cities
and against the lofty battlements.
17 I will bring distress on mankind,
so that they shall walk like the blind,
because they have sinned against the LORD;
their blood shall be poured out like dust,
and their flesh like dung.
18 Neither their silver nor their gold
shall be able to deliver them
on the day of the wrath of the LORD.
In the fire of his jealousy,
all the earth shall be consumed;
for a full and sudden end
he will make of all the inhabitants of the earth.
Judgment on Judah's Enemies
ZEPHANIAH 2 Gather together, yes, gather,
O shameless nation,
2 before the decree takes effect
-before the day passes away like chaff-
before there comes upon you
the burning anger of the LORD,
before there comes upon you
the day of the anger of the LORD.
3 Seek the LORD, all you humble of the land,
who do his just commands;
seek righteousness; seek humility;
perhaps you may be hidden
on the day of the anger of the LORD.
4 For Gaza shall be deserted,
and Ashkelon shall become a desolation;
Ashdod's people shall be driven out at noon,
and Ekron shall be uprooted.
5 Woe to you inhabitants of the seacoast,
you nation of the Cherethites!
The word of the LORD is against you,
O Canaan, land of the Philistines;
and I will destroy you until no inhabitant is left.
6 And you, O seacoast, shall be pastures,
with meadows for shepherds
and folds for flocks.
7 The seacoast shall become the possession
of the remnant of the house of Judah,
on which they shall graze,
and in the houses of Ashkelon
they shall lie down at evening.
For the LORD their God will be mindful of them
and restore their fortunes.
8 "I have heard the taunts of Moab
and the revilings of the Ammonites,
how they have taunted my people
and made boasts against their territory.
9 Therefore, as I live," declares the LORD of hosts,
the God of Israel,
"Moab shall become like Sodom,
and the Ammonites like Gomorrah,
a land possessed by nettles and salt pits,
and a waste forever.
The remnant of my people shall plunder them,
and the survivors of my nation shall possess them."
10 This shall be their lot in return for their pride,
because they taunted and boasted
against the people of the LORD of hosts.
11 The LORD will be awesome against them;
for he will famish all the gods of the earth,
and to him shall bow down,
each in its place,
all the lands of the nations.
12 You also, O Cushites,
shall be slain by my sword.
13 And he will stretch out his hand against the north
and destroy Assyria,
and he will make Nineveh a desolation,
a dry waste like the desert.
14 Herds shall lie down in her midst,
all kinds of beasts;
even the owl and the hedgehog
shall lodge in her capitals;
a voice shall hoot in the window;
devastation will be on the threshold;
for her cedar work will be laid bare.
15 This is the exultant city
that lived securely,
that said in her heart,
"I am, and there is no one else."
What a desolation she has become,
a lair for wild beasts!
Everyone who passes by her
hisses and shakes his fist.
Judgment on Jerusalem and the Nations
ZEPHANIAH 3 Woe to her who is rebellious and defiled,
the oppressing city!
2 She listens to no voice;
she accepts no correction.
She does not trust in the LORD;
she does not draw near to her God.
3 Her officials within her
are roaring lions;
her judges are evening wolves
that leave nothing till the morning.
4 Her prophets are fickle, treacherous men;
her priests profane what is holy;
they do violence to the law.
5 The LORD within her is righteous;
he does no injustice;
every morning he shows forth his justice;
each dawn he does not fail;
but the unjust knows no shame.
6 "I have cut off nations;
their battlements are in ruins;
I have laid waste their streets
so that no one walks in them;
their cities have been made desolate,
without a man, without an inhabitant.
7 I said, 'Surely you will fear me;
you will accept correction.
Then your dwelling would not be cut off
according to all that I have appointed against you.'
But all the more they were eager
to make all their deeds corrupt.
8 "Therefore wait for me," declares the LORD,
"for the day when I rise up to seize the prey.
For my decision is to gather nations,
to assemble kingdoms,
to pour out upon them my indignation,
all my burning anger;
for in the fire of my jealousy
all the earth shall be consumed.
The Conversion of the Nations
9 "For at that time I will change the speech of the peoples
to a pure speech,
that all of them may call upon the name of the LORD
and serve him with one accord.
10 From beyond the rivers of Cush
my worshipers, the daughter of my dispersed ones,
shall bring my offering.
11 "On that day you shall not be put to shame
because of the deeds by which you have rebelled against me;
for then I will remove from your midst
your proudly exultant ones,
and you shall no longer be haughty
in my holy mountain.
12 But I will leave in your midst
a people humble and lowly.
They shall seek refuge in the name of the LORD,
13 those who are left in Israel;
they shall do no injustice
and speak no lies,
nor shall there be found in their mouth
a deceitful tongue.
For they shall graze and lie down,
and none shall make them afraid."
Israel's Joy and Restoration
14 Sing aloud, O daughter of Zion;
shout, O Israel!
Rejoice and exult with all your heart,
O daughter of Jerusalem!
15 The LORD has taken away the judgments against you;
he has cleared away your enemies.

And I will save the lame
and gather the outcast,
and I will change their shame into praise
and renown in all the earth.
20 At that time I will bring you in,
at the time when I gather you together;
for I will make you renowned and praised
among all the peoples of the earth,
when I restore your fortunes
before your eyes," says the LORD.
[1] 1:3 Or stumbling blocks (that is, idols)
[2] 1:9 Or their Lord's
[3] 1:11 Or all the people of Canaan
[4] 1:12 Hebrew are thickening on the dregs [of their wine]
[1] 2:2 Hebrew gives birth
[2] 2:3 Or who carry out his judgment
[3] 2:6 Or caves
[4] 2:14 Hebrew beasts of every nation
[5] 2:14 The identity of the animals rendered owl and hedgehog is uncertain
[1] 3:7 Hebrew her
[2] 3:7 Hebrew her
[3] 3:18 The meaning of the Hebrew is uncertain


Landing Page
Special Projects
This story is part of a series of specially designed stories that represents some of the best journalism The Post has to offer. Check out the rest of the special projects here.
Provided via Julie Elman
The science behind an adrenaline rush is complex: Adrenaline floods us with a warm feeling, elevating our heart beat like we’re suddenly in need of more oxygen.
What happens if our brain is tricked into thinking the feeling won’t pass, like our bodies are out of control? Our breathing can’t catch up with our lung capacity, and we’ve entered into an inevitable battle that is a panic attack.
We’re bound to have at least one of these in our lifetime, Ashley Howell, a doctoral candidate in clinical psychology at Ohio University, said. And unfortunately, the cause of this physiological process has a lot to do with the anxieties we carry on our backs, also known as fear.
Howell said personal experience plays a large role in what people fear, and irrational fears are based on events that are highly unlikely to occur.
We all have fear, Howell said, but some fears are more well-known than others. Overall, 90 percent of the fears individuals have are considered to be insignificant by the public, said a 2016 study via Statistic Brain, an educational research institute.
“It’s not uncommon to throw around psychological terms very loosely about this,” Howell, who specializes in studying the cognitive risks of anxieties and disorders, said. She also studies how anxiety is portrayed in society. “Saying you’re OCD about something or that you have a phobia sometimes desensitizes what fears and phobias can do.”
The Post conducted an online survey and recorded OU students’ fears. The survey lasted four weeks and had 116 college-aged respondents. The survey featured one write-in response and two multiple choice lists to allow participants to list multiple fears if needed. The answers from OU students are a particular mix of personal fears, fear of illness and death, and economic fears.
Landing Page
This story is part of a series of specially designed stories that represents some of the best journalism The Post has to offer. Check out the rest of the special projects here.


Hello, Code School!
I would like to learn the basics of coding; different strands and softwares.
I am happy to finish this
What is the next project


Salary Calculator
Add Employee:
Submit
Employee Data
First Name
Last Name
ID Number
Job Title
Annual Salary
Monthly Costs: $


from Mrs.Lydia Johnson Liberte Sicap 1, Dakar Senegal. Goodday Dear, I know this mail will come to you as a surprise,nevertheless I am Mrs. Lydia Johnson, aged 59 years, the wife of Major stephen johnson, Chief Security Officer and Aide-de–camp to the exiled president Charles Tailor of Liberia . As a result of the on-going problem in my country, I am saddled with problems of my ill-health of protracted diabetes and high blood pressure which is getting of increase in the recent times, more importantly getting a trust worthy individual abroad to receive the sum of US$7million on our behalf. Due to this war crises presently in my city Monrovia our home town, I managed to sneak myself and my son David 23 years of age and four other of my daughters out of Monrovia to Dakar senegal for safety. We were sneaked into Dakar Senegal through the land boarder by the help of some government militant group. After the killing of my husband by the rebels, we decided to come down here to Dakar senegal to secure the deposit in a finance firm by my husband and to further look for a trust worthy individual abroad to receive these deposit which has being deposited here in Dakar Senegal before he was eventually killed by the heartless rebels. I feel confident therefore to introduce myself to you based on this problem and our present condition as all our foreign contacts and connections got lost during this crises, all properties burnt by the rebels. I am desperately in need to move and re-locate this huge deposit to your country for safe keeping as this is the only wealth remaining for the future survival and well being of my large family. For your percentage for assistance, a negotiable percentage will be discussed as soon as I receive your response based on this plea for your assistance as our lives are highly in danger due to this problem. I pray and plead for your help. You can email me back for further clarifications God bless you as you respond to my plea for assistance. Sincerely yours. Mrs Lydia Johnson.


List of labels
; optional
Files processed or included by this rule. Generally lists files directly, but
may list rule targets (like filegroup
or genrule
) to
include their default outputs.
Language-specific rules often require that the listed files have particular file extensions.


A set of tools, configurations, and instructions to collect and serve election results on election night — the Super Bowl of data news — while still providing an off-season service and focusing on saving resources as much as possible. A project of MinnPost with support by OpenNews.
If you work at a small organization without access to AP or Reuters election data feeds, or are looking for more local results than these organizations provide, the Election Night API is here to help.
The purpose of this software is to make election results published by a state's Secretary of State or Board of Elections on election night available for use on websites or in other applications via an API.
This software will work best in states that publish election results live on election night in somewhat machine-friendly formats, like JSON, text files or maybe even Microsoft Excel, but you can still manually collect data in something like Google Spreassheets and supplement the results.
Detailed setup instructions can be found in the README.
A standard Python install. See the full instructions for more detail.
# Git code
$ git clone https://github.com/MinnPost/election-night-api.git && cd election-night-api
# Instal dependencies
$ pip install -r requirements.txt
Election Night API contains a basic template for scraping election night results files, but because each state and election is pretty different, custom scripts for parsing the results files must be written. You'll need to be able to write some basic Python to build a scraper for your state. For more details, see managing scrapers section and the example code.
# Start with the example
$ cp -r states/example states/xx
Run the scraper tool to save the data locally to the SQLite database. Some more details are available on the README.
# Get some help
$ bin/ena -h
# Get results for VA for the most recent election
$ bin/ena VA results
The API allows for arbitrary SQL selects of the data and returns JSON. Some more details are available on the README.
# Get all the contests
$ curl http://example-api.com/?q=SELECT%20*%20contests
[
{
"precincts_reporting": 4106,
"updated":<PHONE_NUMBER>,
"county_id": "",
"title": "Attorney General",
"district_code": "",
"total_precincts": 4106,
"seats": 1,
"primary": 0,
"precinct_id": "",
"office_id": "0335",
"state": "mn",
"election": "20141104",
"office_name": "Attorney General",
"percent_reporting": 1,
"scope": "state",
"id": "id-MN----0335",
"total_votes": 1928980
},
...
]
You can run a local API for testing, but definitely don't use this for production. Some more details are available on the README.
# Run the basic API. It will be available at: http://localhost:5000/?q=
$ python tests/local_api.py
The API is intended to be deployed on a resourceful server, such as an Ubuntu server on EC2, on election night, to be able to handle high demand for the results. Detailed instructions can be found in the README.
# 1. Install code
# 2. Install Dumptruck
# 3. Install and confgiure FCGIWrap
# 4. Install and confgiure nginx
# 5. Schedule data collection (scraper)
When election night is over, demand is lessened, and results are no longer being updated frequently, it is easy to move the API off of your server and on to ScraperWiki, which has a free tier for journalists and free tier for everyone. See the full instructions on the README.


Work From Home
Part Time / Full Time - Extra Income
An Opportunity that Rocks !!!
BE YOUR OWN BOSS
- Work 1-4 Hours / Day
- Training / Support Provided
- No Experience / No Qualification
- Who Can Work - 18 Years & Above
- Housewives
- Retired Persons
- Students
- Professionals
- Businessman
- Employees


Copyright (c) Pedro Sena 1996. All Rights Reserved.
FILM TITLE: MIGHTY APHRODITE DIRECTOR: WOODY ALLEN COUNTRY: USA 1995 CINEMATOGRAPHY: CARLO DI PALMA MUSIC: VARIOUS 50'S JAZZ ARTISTS ( played by Woody, too. ) CAST: F. Murray Abraham, Myra Sorvino, Peter Weller, Helena Bonham Carter, Woody Allen, David Ogden Stiers SUPER FEATURES: Sorvino for sure.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Woody Allen has always been around with some eccentric stories. This is probably as good a film as he has ever done, at least it is better centered as a story, than he usually is.
And it almost is not the story that attracts us to this film, but the way that his characters carry themselves. It is difficult not to consider this an excellent film, in the way it is done, with its ludicrous Greek chorus and all, which is just perfect, though the people I saw it with, do not understand this stuff, and did not find it funny to see the chorus break into a musical number, while also editorializing everything, which Woody Allen has always done on his own character and we got bored with it.
The story is simple, though it has its intricate turns.   And she is a bit on the bird brain mentality, but she does have feelings. And Woody tries to help her along, but never tells her that it is her lost child that he has adopted. But in the middle of it all, in a lark, they get together, finally, and have an evening of fun, which the story suggests has her get pregnant, and she is feeling better about having lost her first child. And on the way out of town, she meets another man, and lo and behold everyone is happy ever after... well, the marriage of Woody and his wife, is probably dead too, as she has done her side thing also.
Well, if anything, this is typical Woody Allen, in that the stories are totally intricate, and intermixed so much that it is off the wall. On the other hand, it is the "innocent" side that makes this an intricate story, and Woody refuses to condemn that part of things. There are plenty of moments when we could easily get disgusted with the young girl's lifestyle, and living. But somehow, we take some pity on her, and do not spend our time judging her wrongs, or her next movie. And we definitely know that Woody's marriage in the story, is in trouble, as its fires have gone out.
Were it not for the funny stuff, this film could easily be considered styled a bit after the Godard method of filming, where a suggestion as to right and wrong is never made, and the audience has to choose, something that the Hollywood viewer can never appreciate, where all the characters have to be separated by either colors, or obvious deeds. In this film, people are just that, people. And this style, creates a lot of funny, weird moments, that are enjoyable for the discriminating seer, although terribly boring for others. In so many ways, Woody lets the camera talk, or keeps it running so that the characters have to live a bit longer, and do not become a shadow of themselves, an idea, a mere representation of who they are. And thus we never really find the girl unattractive, Woody boring, or any of the other characters in the film out of place.
But the funniest thing in this film is not even Woody, but Myra Sorvino, who ended up getting the Oscar for her portrayal, of what starts out being a blonde bimbo, and becomes a rather nice woman in the film. And it is hard to let go of F. Murray Abraham, as Woody's friend, and alter ego, as the leader of the chorus, whose staging, is what separates this film apart from others. Unfortunately one has to have known the Greek chorus in the boring Greek plays, to appreciate the style that Woody has designed for this production, which is immediately off the wall, specially when it breaks its commentary into a song and dance routine. But it never stops to make its point. It's the modern chorus for the 20th century, used in the only way that we will ever understand, or probably ever appreciate.
Magnificent film, if you want to appreciate one of America's truly great writers and directors, the Capra of the 80's and 90's. It's a shame that while he has critical success, his films rarely go beyond that. He deserves so much more than that, and he will be forever remembered for his writing and directing, never his acting, the character of which we are basically tired of. But what is around him, makes for an excellent film.
4.5 GIBLOONS out of 5
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


|
The actions are Java classes used by the Web Editor Framework to receive information from the web forms produced using the framework and update the topic map. Each action operates on an object, and may take a number of positional parameters. This document provides a reference to all actions included with the framework.
The Web Editor Framework consists of some more actions than those documented here, and we are aware that this library of actions is unlikely to satisfy all needs. If you cannot find the action you need or cannot make one of the actions do what you want them to do, please send an email to the mailing list and let us know.
These are actions that require no particular object, and which do not fall into any of the other categories. The package name is net.ontopia.topicmaps.webed.impl.actions.
This action does nothing, and is used as a dummy action in situations where the framework requires an action, but none is really wanted.
Used to dynamically set the page the user is to be forwarded to when form processing is complete.
| Name | Required | Value | Description |
|---|---|---|---|
| uri | no | string | The URI the user will be forwarded to. Defaults to the value of the HTTP request if not given. If neither is given nothing happens. |
| parameter | no, repeatable | string | The name of a parameter whose value in the form is to be passed on to the forward page. This parameter can be repeated any number of times. |
HTTP request parameter
Used as the fallback value for the uri parameter if given. Not required.
Sets the page the user will be forwarded to, overriding the configuration in actions.xml, and allows parameters from the form being submitted to be passed on to the next page.
These are actions at the topic map level. The package name is net.ontopia.topicmaps.webed.impl.actions.topicmap.
Used to create an association, and, optionally, set its type.
| Name | Required | Value | Description |
|---|---|---|---|
| topicmap | yes | topic map | The topic map in which the association will be created. |
| assoctype | no | topic | The association type of the new association. |
| player | no | topic | A topic participating in the association. |
Will always create a new association within the current topic map. If the assoctype parameter is set the association will get that topic as its association type. If the player parameter is set an association role with that topic as its player will be created.
Used to create a topic, and, optionally, set its type.
| Name | Required | Value | Description |
|---|---|---|---|
| topicmap | yes | topic map | The topic map within which the topic will be created. |
| type | no | topic | The topic type of the new topic. |
Will always create a new topic within the current topic map. If the type parameter is set the topic will get that topic as its topic type. If the type parameter is not provided the tag will see if the action value can be used to find a topic to use as the type.
These are actions that apply equally to all kinds of topic map objects. The package name is net.ontopia.topicmaps.webed.impl.actions.tmobject.
Adds a item identifier to a topic map object.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | topic map object | The topic map object to which the item identifier will be added. |
HTTP request parameter
A URI. Added as the new item identifier. Required.
A URI locator is created from the given string value and added as the item identifier of the object in the object parameter. An error will be thrown if the string value is not a syntactically valid URI.
Adds a topic to the object's scope.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | a topic name, variant name, occurrence, or association | The object whose scope will be increased. |
HTTP request parameter
A topic ID. The topic is added as the new theme. Required.
The topic selected is added to the scope of the topic map object. If the topic is already part of the scope nothing happens.
Deletes the topic map object from the topic map.
| Name | Required | Value | Description |
|---|---|---|---|
| objects | yes | topic map object collection | The object(s) to be deleted. |
| next | no | topic map object | The object that is to be considered the current object on the forward page. Effectively sets the id request parameter. |
HTTP request parameter
Topic map object ID(s). Used as fallback value for the objects parameter.
The topic map objects being acted on will be deleted from the topic map using the DeletionUtils. If the objects parameter is not given the action will try to use the request parameter value.
Evaluates an LTM fragment to add content to the topic map.
| Name | Required | Value | Description |
|---|---|---|---|
| topicmap | yes | a topic map object | The topic map to read the LTM fragment into. |
| fragment | yes | string | The LTM fragment. |
HTTP request parameter
A string, a URI, or a topic map object ID. Used to produce the value for the %value% and %topic% tokens.
The LTM fragment is imported into the topic map, in such a way that the IDs in the fragment can refer to topics already in the topic map. The token %new% will, if present in the fragment, be replaced with a unique topic map ID, which will create a new topic. If present, %value% will be replaced by the string value of the request parameter that triggered the action.
The action can also be used with one or more topic map objects as the values of the triggering form control, in which case the fragment will be evaluated once for each topic map object with the %topic% token will replaced by the symbolic ID of the current topic map object.
Validates modified objects against an OSL schema to ensure that the data has not been incorrectly modified.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | a set of topic maps, associations, and topics | The objects to validate. |
HTTP request parameter
The HTTP request parameter, if any, will be ignored.
The objects in the object parameter will be validated against the OSL schema registered for the current topic map. If errors are found, or if there is no schema, a critical error is thrown. If no errors are found nothing happens.
Removes an item identifier from the topic map object.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | topic map object | The topic map object which is to lose an item identifier. |
| locator | URI string | yes | locator | The locator that is to be removed. |
Removes the locator in the locator parameter from the topic map object in the object parameter.
Removes a topic from the topic map object's scope.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | a topic name, variant name, occurrence, or association | The object whose scope should be shrunk. |
HTTP request parameter
A topic ID. Removed from the scope. Required.
The topic selected is removed from the scope of the topic map object. If the topic is not already part of the scope nothing happens.
Removes the type of the topic map object (occurrence, association, or association role).
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | topic map object | The topic map object which will lose its type. |
The type of the object in the object parameter is set to nothing, whether or not it already had a type.
Replaces the object's scope.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | a topic name, variant name, occurrence, or association | The object whose scope will be set. |
| scope | yes | a collection of topics | The scoping topics. |
The topics given in the second parameter will be used to replace the scope object in the first parameter.
Sets one of the item identifier of a topic map object to a new value.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | topic map object | The topic map object whose item identifier is to be changed. |
| locator | URI string | yes | locator | The item identifier to modify. |
HTTP request parameter
A URI. Added as the new item identifier of the object. Required.
Removes the locator from the item identifiers of the topic map object in the object parameter. A new item identifier created from the request parameter's string value is then added to the topic map object.
Sets the type of the topic map object (occurrence, association, or association role) to the chosen topic.
| Name | Required | Value | Description |
|---|---|---|---|
| object | yes | topic map object | The object whose type is to be set. |
HTTP request parameter
A topic object ID. The new type of the object. Required.
The type of the topic map object in the object parameter is set to the chosen topic, regardless of whether the object already had a type.
Runs a tolog query to select the objects that are going to be deleted from the topic map.
| Name | Required | Value | Description |
|---|---|---|---|
| query | yes | string(s) | The tolog query or queries. |
HTTP request parameter
Topic map object ID(s). The query will be run once for each, with the %topic% parameter set to the topic map object. Note that any kind of topic map object can be passed in. The parameter is called %topic% only for reasons of backwards compatibility. Required.
For every topic map object in the triggering request parameter the query will be run once for each value, and the value can then be accessed in the query using the %topic% parameter. If there are no topic map object values the query will not be run at all. The objects are deleted using the DeletionUtils.
This action is generally used when deleting one topic map object requires many other objects to be deleted with it. An example of this might be deleting a composer in the Italian Opera topic map; when doing this one might want the composer's operas to be deleted, as well as the characters and arias in those operas. This tag would make it possible to do that by using a query selecting all the topics to be deleted.
These are actions that apply to associations. The package name is net.ontopia.topicmaps.webed.impl.actions.association.
Used to create, delete, or change an association from one topic to another.
| Name | Required | Value | Description |
|---|---|---|---|
| association | yes | association | The association itself. This parameter may be empty. |
| assoctype | yes | topic | The type of the association. Used when a new association is created. |
| fixedplayer | yes | topic | Topic on near side of the association. Used when a new association is created. |
| fixedrole | yes | topic | Type of role played by the topic on near side of the association. Used when a new association is created. |
| otherrole | yes | topic | Type of role played by topic being assigned as player on remote side of association. |
| othertopic | no | topic | If specified, changes the behaviour of the action to use this topic as the topic at the other side of the association, in order to make the action work with checkboxes. |
HTTP request parameter
A topic object ID. The topic set as the other player in the association. Required if the othertopic parameter is not given.
If the association parameter is empty a new association will be created using the information in the other parameters, and the chosen topic will be assigned as the player of the remote role.
If the association already exists the chosen topic will be assigned as the player of the remote role (this assumes that there is only one role of the remote type). If no topic is chosen the association will be deleted.
Specifying the othertopic parameter changes the behaviour of the action. If given, this topic is the topic on the other side of the association, and if the request parameter has a value (any value) the association will be created (unless it already exists, in which case nothing happens), whereas if it does not have a value the association will be deleted. The purpose of this is to make it possible to use the action with a checkbox where the user can create/delete the association by checking/unchecking the box.
These are actions that apply to association roles. The package name is net.ontopia.topicmaps.webed.impl.actions.assocrole.
Sets the player of an association role.
| Name | Required | Value | Description |
|---|---|---|---|
| role | yes | association role | The association role whose player is to be set. |
| player | yes | topic | The topic to set as the player. |
HTTP request parameter
A topic object ID. The topic to set as the player, if the player parameter is not given. Required if the player parameter is not given.
The action will set the player of the association role in the role parameter to the topic in the player parameter if that parameter is given. If the player parameter is not given the action uses the object value of the request parameter that triggered the action.
The role must have a value, otherwise an error will occur.
These are actions that apply to topics. The package name is net.ontopia.topicmaps.webed.impl.actions.topic.
Adds a new subject identifier to a topic.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic that is to get a new subject identifier. |
A new URI locator will be created from the string value passed to the action and added as a subject identifier of the topic in the topic parameter. If some topic already has that subject identifier or item identifier an error will be thrown.
Add a new type to a topic, in addition to any types it may already have.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic to add the new type to. |
The selected topic will be added as a new type of the topic in the topic parameter, regardless of what types it may already have.
Removes a subject identifier from a topic.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic to remove the subject identifier from. |
| locator | yes | locator | URI string | The locator that is to be removed. |
Removes the locator in the locator parameter from the subject identifiers of the topic in the topic parameter. If the topic does not already have the subject identifier nothing happens.
Removes a type from a topic.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic to remove the type from. |
| type | yes | topic | The type to be removed. |
Removes the topic in the type parameter from the types of the topic in the topic parameter. If the topic does not already have the given type nothing happens.
Sets a subject identifier of a topic to a specific value.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic whose subject identifier is to be modified. |
| locator | yes | locator | URI string | The subject identifier to modify. |
The locator in the locator parameter is removed from the topic in the topic parameter. A new locator is then constructed from the string value passed to the action and added as a subject identifier of the topic, thus effectively replacing the original locator.
If the string value is not a syntactically valid URI the action will fail with an error. If the string is empty this will be considered an invalid URI. The SetSubjectIndicator2 action (SetSubjectIndicator2) will in this case delete the subject identifier.
Sets a subject identifier of a topic to a specific value.
This action is identical to the SetSubjectIndicator action (SetSubjectIndicator), except that when given an empty string it will delete the subject identifier.
Sets the subject locator of a topic to a specific value.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic whose subject locator is to be modified. |
| locator | yes | locator | URI string | The new subject locator for the given topic. |
The subject locator of the topic is set to the value given by the user, regardless of whether the topic had any subject locator from before. Any previous subject locator will be overwritten. It is an error if the string value is not a valid URI; if it is empty any already existing subject locator will be deleted.
Sets the type of a topic to a given topic.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic whose type will be set. |
The topic in the topic parameter will get the selected topic as its type, replacing all previous types.
These are actions that apply to topic names. The package name is net.ontopia.topicmaps.webed.impl.actions.basename.
Creates a new topic name and sets its string value.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic to which the new topic name will be attached. |
| scope | no | topic(s) | The scope of the new topic name. |
| type | no | topic | The type of the new topic name. |
Creates a new topic name, attaches it to the topic in the topic parameter, and sets its string value to the given value. If the type parameter is set the topic in it will be set as the type of the new topic name. If the scope parameter is set all the topics in it are added to the scope of the new basename.
Sets the string value of a topic name from a text field.
| Name | Required | Value | Description |
|---|---|---|---|
| topicname | yes | topic name | The topic name whose string value will be set. May be empty. |
| topic | no | topic | The topic containing the topic name; used if a new topic name must be created. |
| scope | no | topic(s) | Scoping topics added to the topic name if one has to be created. |
| type | no | topic | The type given to the new topic name, if one has to be created. |
HTTP request parameter
The string value of the topic name is set to this.
If the basename parameter is empty a new base name attached to the topic in the topic parameter will be created. If the type parameter is provided the topic there given is set as the topic name type. If the scope parameter is given all the topics in it will be added to the scope of the topic name.
If the basename parameter contains a topic name its string value will be set, unless the HTTP request parameter is empty or null, in which case the topic name is removed.
These are actions that apply to occurrences. The package name is net.ontopia.topicmaps.webed.impl.actions.occurrence.
Adds an external occurrence to the topic with the string value provided by the user as the URI.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic the occurrence is to be attached to. |
| type | yes | topic | The type of the new occurrence. |
| scope | no | topic(s) | The scope of the new occurrence. |
Adds a new external occurrence to the topic being acted on. The string value provided by the user is set as the URI of the occurrence, and if the type parameter is provided the topic there given is set as the occurrence type. If the string given by the user is not a valid URI the action will fail with an error message. If the scope parameter is set, every topic in it is added to the scope of the new occurrence.
Adds an internal occurrence to the topic with the string value provided by the user.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic the occurrence is to be attached to. |
| type | yes | topic | The type of the new occurrence. |
| scope | no | topic(s) | The scope of the new occurrence. |
Adds a new internal occurrence to the topic in the topic parameter. The string value provided by the user is set as the occurrence value, and if the type parameter is provided the topic there given is set as the occurrence type. If the scope parameter is set, all the topics there are added to the scope of the new occurrence.
Timestamps the topic passed to it with an occurrence containing the time and date of the topic's last modification.
| Name | Required | Value | Description |
|---|---|---|---|
| topic | yes | topic | The topic to be timestamped. |
After execution the topic will have an occurrence of type last-modified-at that contains a time stamp in the format "2003-11-05 1800" set to the time when the action was executed. If the topic didn't have this occurrence already it will be created, and if the last-modified-at topic did not exist it will also be created. The last-modified-at topic is identified by the subject identifier http://psi.ontopia.net/xtm/occurrence-type/last-modified-at.
Sets the locator of an external occurrence to the given string value.
| Name | Required | Value | Description |
|---|---|---|---|
| occurrence | yes | occurrence | The occurrence being modified; may be empty. |
| topic | no | topic | The topic the occurrence is to be attached to. |
| type | no | topic | The type given to the new occurrence, if one has to be created. |
If the occurrence parameter is not empty the locator of that occurrence is set to the string provided by the user.
If the occurrence parameter is empty a new occurrence attached to the topic in the topic parameter is created and its locator set to the value provided by the user. If the type parameter is set the topic in it will be set as the type of the new occurrence.
In either case, if the string provided by the user is not a syntactically valid URI the action will fail with an error message. This includes the case where the string is empty. The SetLocator2 action (SetLocator2) behaves identically to this action, except that when the string is empty it will delete the occurrence from the parent topic.
Sets the locator of an external occurrence to the given string value.
This action is identical to SetLocator action (SetLocator), except that when given an empty string it will delete the occurrence.
Sets the string value of an internal occurrence to the given string value.
| Name | Required | Value | Description |
|---|---|---|---|
| occurrence | yes | occurrence | The occurrence being modified; may be empty. |
| topic | no | topic | The topic the occurrence is to be attached to. |
| type | no | topic | The type given to the new occurrence, if one has to be created. |
If the occurrence parameter is not empty the string value of that occurrence is set to the string provided by the user.
If the occurrence parameter is empty a new occurrence attached to the topic in the topic parameter is created and its string value set to the value provided by the user. If the type parameter is set the topic in it will be set as the type of the new occurrence.
Note that if the string value given by the user is empty the string value of the occurrence will be set to the empty string. The SetValue2 action (SetValue2) would in this case delete the occurrence.
Sets the string value of an internal occurrence to the given string value.
This action is identical to SetValue action (SetValue), except that when given an empty string it will delete the occurrence.
These are actions that apply to variant names. The package name is net.ontopia.topicmaps.webed.impl.actions.variant.
Adds an external variant to the topic name with the string value provided by the user as the URI.
| Name | Required | Value | Description |
|---|---|---|---|
| basename | yes | topic name | The topic name the variant is to be attached to. |
| scope | no | topic(s) | The scope of the new variant. |
Adds a new external variant to the topic name in the base name parameter. The string value provided by the user is set as the URI of the variant, and if the scope parameter is set, every topic in it is added to the scope of the new variant. If the string given by the user is not a valid URI the action will fail with an error message.
Adds an internal variant to the topic name with the string value provided by the user.
| Name | Required | Value | Description |
|---|---|---|---|
| basename | yes | topic name | The topic name the variant is to be attached to. |
| scope | no | topic(s) | The scope of the new variant. |
Adds a new internal variant to the topic name in the topic name parameter. The string value provided by the user is set as the variant value, and if the scope parameter is set, all the topics there are added to the scope of the new variant.
Sets the locator of an external variant to the given string value.
| Name | Required | Value | Description |
|---|---|---|---|
| variant | yes | variant | The variant being modified; may be empty. |
| topicname | no | topic name | The topic name the variant is to be attached to. |
If the variant parameter is not empty the locator of that variant is set to the string provided by the user.
If the variant parameter is empty a new variant attached to the topic name in the basename parameter is created and its locator set to the value provided by the user.
In either case, if the string provided by the user is not a syntactically valid URI the action will fail with an error message.
Sets the string value of an internal variant to the given string value.
| Name | Required | Value | Description |
|---|---|---|---|
| variant | yes | variant | The variant being modified; may be empty. |
| basename | no | topic name | The topic name the variant is to be attached to if one has to be created. |
If the variant parameter is not empty the string value of that variant is set to the string provided by the user.
If the variant parameter is empty a new variant attached to the topic name in the basename parameter is created and its string value set to the value provided by the user.


Investing wisely will help you grow your wealth and protect it against inflation.
Our experts can guide you in choosing from our broad range of funds, to build the best portfolio for you.
An investment is a way of putting money away, with the hope that the amount will increase over time. For most people, investments are made in the stock market (buying shares in companies) but some of the other most common investments include:
Investing is more risky than saving.
With savings, you have the security of earning steady returns - through interest payments - but with investments, you take a risk on whether you make a profit or loss.
A person should only invest if they are prepared to take the risk that their investments could go down, as well as up, in value.
The stock market is where different company shares (very small percentages of ownership) are listed, sold and bought.
Companies sell shares in a bid to boost funds available to invest, by offering investors the chance to back them financially.
The shareholder then gains returns on the business profits (via dividend and changes in the share value) - but if the company makes losses, the shareholder potentially will as well.
Share prices continually rise and fall. This can be dictated by a number of factors, including the company’s financial performance and the general economic position in any one country or globally.
Stocks and shares individual saving accounts (ISAs) are also known as equity ISAs.
They are a tax-efficient way of investing in a range of stock market related assets and offer the possibility of higher returns than a cash ISA.
Your plan might be to travel the world, live by the sea or enjoy your forever home.
Whatever you do, it's important to get the right advice about your pension.
We know how to help you make the most of retirement, whether you're an individual or a business.

You and your employer make regular payments (most often monthly) into your pension and when you retire, the money is repaid to you in installments.
After retirement, most people are reliant on their pension as a regular source of income.
A pension is highly recommended as it takes pressure off you to save for later life while you’re working.
We are specialists in providing effective solutions to meet the insurance and protection needs of our clients.
Whether you require life cover or advice on Inheritance Tax, Exchequer Wealth Management will offer you the right products and services to suit you and your family.
Income protection insurance is a long-term insurance policy designed to help if you are unwell or injured over a long-term basis.
Such policies ensure that you will still receive a regular income until you retire or are able to return to work.
Mortgages are a long-term financial commitment, and for many people, account for the single largest purchase they will ever make.
With this in mind, it is important to consider how you would maintain future mortgage payments, should you suffer a loss of income or in the event of your death.
Income protection, critical illness or life insurance can provide peace of mind that could prevent you or your family from losing a property.
Exchequer Wealth Management provide clear guidance to help you secure your family’s financial future.
We advise on a range of solutions to ensure your loved ones are financially provided for after your death.
Your estate is the total of everything you own, from large assets including your home to your small personal possessions.
It is also known as your net worth.
If you die without creating a will, your estate is automatically passed on to the appropriate person according to the Laws of Intestacy.
There are a number of ways to ensure your estate is distributed in line with your wishes after your death, but having the right estate plan in place will also help ensure the correct beneficiaries inherit your estate.
It can also help you reduce the amount paid in taxes and legal fees.
Our financial advisers have, on average, over a decade worth of experience in their field and include some of the most experienced and able professionals working in wealth management today.
Please contact us with the form below and tell us how we can help


--- layout: default permalink: /blog/ --- Blog where I occasionally write about things I do, learn, and see
where I occasionally write about things I do, learn, and see
There isn't anything to look at here today, but there surely will be something here soon..
subscribe via RSS


Staff pick
-
Sin City: A Dame To Kill For
Action, Crime
-
Transcendence
Action, Drama
-
Need For Speed
Action, Crime
-
The Amazing Spiderman
Action, Adventure
-
Pompeii
Action, Adventure
-
Divergent
Action, Sci-Fi
-
Guardians of the Galaxy
Action, Adventure
-
X-Men: Days of Fury
Action, Adventure
-
Captain America: The Winter Soilder
Action, Adventure
-
Divergent
Action, Sci-Fi
-
RoboCop (2014)
Action, Crime
-
Transcendence
Action, Drama
-
Need For Speed
Action, Crime
-
Pompeii
Action, Adventure
-
Sin City: A Dame To Kill For
Action, Crime
-
X-Men: Days of Fury
Action, Adventure
-
The Amazing Spiderman
Action, Adventure
-
Divergent
Action, Sci-Fi


#assign version = "true">
Mapping for a property that provides optimistic locking. The version property can either be
a number type like long
or a timestamp type like Instant
.
The recommendation is to map @Version
to a property of type long
and
then additionally map a property using @WhenModified
.


#include <stdint.h>
Go to the source code of this file.
|
| enum | __invokeStatus_t {
INVOKE_STATUS_NOT_INITIALIZED = -255,
INVOKE_IN_INVALID_STATE = -254,
INVOKE_INVALID_INSIDE_CALLBACK = -253,
INVOKE_STATUS_BAD_PROMISE_ID = -252,
INVOKE_STATUS_TIMEOUT = -2,
INVOKE_STATUS_FALSE = -1,
INVOKE_STATUS_TRUE = 0
} |
| |
| enum | __logLevel_t {
NO_LOG = 0x00,
ERROR_LEVEL = 0x01,
INFO_LEVEL = 0x02,
WARN_LEVEL = 0x04,
DEBUG_LEVEL = 0x06,
ALL_LEVEL = 0xffff
} |
| |
| enum | __option_t { USER_OWNS_MEMORY = 0x0000,
HELIX_OWNS_MEMORY = 0x0001
} |
| |
| enum | __promiseStatusAndFlags_t {
PROMISE_INVALID = -254,
PROMISE_INFINITE = -1,
PROMISE_COMPLETE = 0x0001,
PROMISE_DESTROY = 0x0002,
PROMISE_DATA_AVAILABLE = 0x0004,
PROMISE_EVENT = 0x0008,
PROMISE_USER_EVENT = 0x0010,
PROMISE_RESULT_ERROR = 0x0020,
PROMISE_MEMORY_ALLOCATED = 0x0040,
PROMISE_MEMORY_RELEASING = 0x0080,
PROMISE_MEMORY_POST_RELEASED_ID = 0x0100,
PROMISE_ALLOW_RECURSIVE_EVENTS = 0x1000,
PROMISE_NO_STATUS = 0x2000,
PROMISE_WAIT_STATUS = 0x4000,
PROMISE_ERROR_UNDEFINED = 0x8000
} |
| |
| enum | __serverResponseCode_t { SERVER_SUCCESS = 0,
SERVER_FAIL = -1
} |
| |
Collection of codes indicating possible conditions as result of function invocation.
Collection of log-level modes Helix module has.
Collection of codes indicating memory ownership model Helix caller will be using.
Collection of codes indicating state of a promise (result of computation to be completed in the future).
Collection of code values key-server could respond with after various requests.
Collection of codes indicating possible conditions as result of function invocation.
| Enumerator |
|---|
| INVOKE_STATUS_NOT_INITIALIZED |
Status code indicating invoked module is not initialized.
|
| INVOKE_IN_INVALID_STATE |
Status code indicating invoked module is not ready – not initialized or shutting down.
|
| INVOKE_INVALID_INSIDE_CALLBACK |
Status code indicating provided callback is invalid.
|
| INVOKE_STATUS_BAD_PROMISE_ID |
Status code indicating provided promise id is not valid.
|
| INVOKE_STATUS_TIMEOUT |
Status code indicating invocation has timeout.
|
| INVOKE_STATUS_FALSE |
Status code indicating invocation has failed.
|
| INVOKE_STATUS_TRUE |
Status code indicating invocation completed successfully.
|
Collection of log-level modes Helix module has.
| Enumerator |
|---|
| NO_LOG |
Disable all logging inside Helix module.
|
| ERROR_LEVEL |
Enable logging of serious error conditions.
|
| INFO_LEVEL |
Enable logging of information-level messages.
|
| WARN_LEVEL |
Enable logging of warning messages.
|
| DEBUG_LEVEL |
Enable logging of debug-level messages.
|
| ALL_LEVEL |
Enable logging of all possible messages.
|
Collection of codes indicating memory ownership model Helix caller will be using.
| Enumerator |
|---|
| USER_OWNS_MEMORY |
Helix should not take copy of the supplied (decryption) buffer and use exclusively user supplied one. User takes on responsibility for ensuring the memory remains valid and accessible for the duration of all Helix operations to complete its work involving that memory location. In case of encryption, caller is responsible to deallocate returned memory buffer with encrypted data.
|
| HELIX_OWNS_MEMORY |
Helix should take a copy of the supplied (decryption) buffer and will manage its life-cycle internally. Caller is free to destroy original (decryption) inputs at any time. In case of encryption, Helix will own memory used to return (encrypted) outputs - user is responsible to signal to Helix when the contents are eligible for destruction by calling ConcludeEncryption with promise-id corresponding to original encryption request.
|
Collection of codes indicating state of a promise (result of computation to be completed in the future).
| Enumerator |
|---|
| PROMISE_INVALID |
Promise state is invalid (either corrupted, or one of internal operations exited with code invokeStatus_t::INVOKE_IN_INVALID_STATE.
|
| PROMISE_INFINITE |
Promised work has no timeout for its completion - promise will remain active until task signals completion (ex: daemon services)
|
| PROMISE_COMPLETE |
Indicated promised computation has been completed.
|
| PROMISE_DESTROY |
Request destruction of the specified promise (release of resources once promise is complete)
|
| PROMISE_DATA_AVAILABLE |
There is data available for extraction as result of completion of promised work.
|
| PROMISE_EVENT |
N/A.
|
| PROMISE_USER_EVENT |
N/A.
|
| PROMISE_RESULT_ERROR |
Promised work completed with an error.
|
| PROMISE_MEMORY_ALLOCATED |
N/A.
|
| PROMISE_MEMORY_RELEASING |
N/A.
|
| PROMISE_MEMORY_POST_RELEASED_ID |
N/A.
|
| PROMISE_ALLOW_RECURSIVE_EVENTS |
N/A.
|
| PROMISE_NO_STATUS |
Status of promised work is unknown (most likely work is in progress)
|
| PROMISE_WAIT_STATUS |
Promised work is in wait status (most likely task is waiting for completion is another sub-task)
|
| PROMISE_ERROR_UNDEFINED |
Unknown error condition has been detected.
|
Collection of code values key-server could respond with after various requests.
| Enumerator |
|---|
| SERVER_SUCCESS |
Server successfully completed requested action by the client.
|
| SERVER_FAIL |
Server failed to complete requested action by the client.
|


Getting Started: Standard MCollective Deployment
Summary
This getting started guide will help you deploy a standard MCollective environment. Jump to the first step, or keep reading for some context.
Note: If you’ve never used MCollective before, start with the Vagrant-based demo toolkit instead. This guide is meant for production-grade deployments, and requires a bit of building before you can do a simple
mco ping
command.
What is an MCollective Deployment?
See the MCollective components overview for an introduction to the parts that make up an MCollective deployment.
Why “Standard?”
MCollective is very pluggable, but the developers and community have settled on some common conventions for the most important configuration options. These defaults work very well for most new users, and create a good foundation for future expansion and reconfiguration.
The Standard MCollective Deployment
Architecture and Configuration
In summary, these are the architecture and configuration conventions that make up the standard MCollective deployment:
- Middleware and connector: ActiveMQ
- One ActiveMQ server (expandable later)
- CA-verified TLS
- No extra subcollectives
- One ActiveMQ user account/password for all MCollective traffic
- Security plugin: SSL (authentication only)
- Credentials:
- Certificate/key pair for each client user (for both connector and security plugins)
- One shared certificate/key pair for all servers (for security plugin)
- Pre-existing Puppet certificate/key pair on each server (for connector plugin)
- Alternately, you can use the shared server certificate/key for both the connector and security plugins; unique certificates aren’t strictly necessary.
- Authorization: ActionPolicy plugin
Security Model
In brief, this is what MCollective’s security model looks like with these conventions in place:
Transport Level
- The TLS between MCollective servers/clients and the ActiveMQ server encrypts traffic, preventing passive sniffing of sensitive data in requests and replies.
- Since the TLS is CA-verified, it also prevents man-in-the-middle attacks targeting the middleware.
- Requiring both a password and a signed certificate to connect to the middleware helps prevent unauthorized access to decrypted text. The password is easier to change, the certificate is harder to steal, and together they offer reasonable security. (For these credentials to be secure, we expect that you’ve made it reasonably difficult for attackers to gain root on your systems.)
- The middleware connection does not identify clients; this happens at the application level.
Application Level
With the SSL security plugin, each client user has a unique key pair and all servers share a single key pair. Each server node holds a collection of all authorized client public keys.
- When clients issue requests, they sign the payload and TTL with their private key; servers do the same when they send replies. This strongly identifies individual clients and identifies servers as a group. (An authorized server could theoretically impersonate another authorized server; in the common use cases for MCollective, this isn’t a significant concern.)
- Servers will reject requests signed by any key that isn’t in their collection of authorized clients. This acts as coarse-grained client authorization. (Note especially that the shared server key pair cannot be used to send requests, which is an advantage over the weaker PSK security plugin.)
- The ActionPolicy plugin allows fine-grained client authorization at the per-action level. (This relies on the client authentication provided by the SSL security plugin.)
- Servers also check the signature of the request payload and TTL, which protects against message tampering and replay attacks.
Summary
These measures focus mainly on strict control over who can command your infrastructure and protection of sensitive information in transit. They assume that authorized servers and clients are both sufficiently trusted to view all sensitive information passing through the middleware.
This is suitable for most use cases. If some authorized servers are untrustworthy, there are opportunities for them to send misleading replies and bogus traffic, but they can’t command other nodes.
Future Expansion
Later, you may need to expand to a cluster of ActiveMQ servers; at that point, you might also:
- Divide your nodes into subcollectives
- Filter traffic between datacenters
- Do per-user ActiveMQ authorization
If you have already used modular Puppet code to set up a standard deployment, these changes can be incremental instead of a complete overhaul.
Steps to Deploy
You need to do the following to deploy MCollective:
- Create and collect credentials
- Deploy and configure middleware
- Install MCollective (on both servers and admin workstations)
- Configure servers
- Configure clients
- Deploy plugins
This process isn’t 100% linear, but that’s the general order in which these tasks should be approached.
Best Practices
Use Puppet or some other form of configuration management to deploy MCollective. See the deployment overview for why this is important.
We don’t currently have drop-in Puppet code for a standard MCollective deployment, so you’ll have to do some building.
Step 1: Create and Collect Credentials
Credentials are the biggest area of shared global configuration in MCollective. Get them sorted before doing much else.
A standard deployment uses the following credentials:
| Credential | Used By: |
|---|---|
| ActiveMQ username/password | Middleware, servers, clients |
| CA certificate | Middleware, servers, clients |
| Signed certificate and private key for ActiveMQ | Middleware |
| Signed certificate and private key for each server | Servers |
| Signed certificate and private key for each user | Clients (both parts), servers (certificate only) |
| Shared server public and private key | Servers (both parts), clients (public key only) |
What Are These?
- ActiveMQ ↔ MCollective traffic uses CA-signed X.509 certificates for encryption and verification. These are just like the certs Puppet uses.
- Unlike Puppet, we aren’t using the certificate DN/CN for authentication — the CA verification is solely to make man-in-the-middle attacks more difficult.
- The SSL security plugin (on servers and clients) uses RSA public/private key pairs (or anything else readable by openssl) to do authentication, coarse-grained authorization, and message signing. The public portion is flexible: it can be either a raw RSA key, or a signed SSL certificate. The plugin identifies keys by filename.
- If you’re using Puppet, you can re-use its certificate authority, and use it to sign certificates.
- On MCollective nodes, all credentials should be in .pem format; on the middleware, some extra conversion is needed.
Walkthrough / Checklist
Make sure you’ve covered each of the following credentials, and keep track of the credentials for use in future steps. This guide assumes you’re using Puppet as your certificate authority. If you aren’t, you’ll need to generate each credential some other way.
Directories: Below, we refer to directories called
$certdir
and$privatekeydir
— these are defined by Puppet settings of the same names. Their locations may vary by platform, so you can locate them withsudo puppet agent --configprint certdir,privatekeydir
(on an agent node) orsudo puppet master --configprint certdir,privatekeydir
(on the CA master).
- PASSWORD: Do: Decide on a username for connecting to ActiveMQ; we suggest
mcollective
. Create a strong arbitrary password for this user. - CA: Already done: Every node already has a local copy of the Puppet CA; you can use it directly. It’s always located at
$certdir/ca.pem
. - ACTIVEMQ CERT: Decide: You can either re-use the ActiveMQ server’s existing puppet agent certificate, or generate a new certificate on the CA puppet master with
sudo puppet cert generate activemq.example.com
(this name cannot conflict with an existing certificate name). In either case, find the certificate and private key at$certdir/<NAME>.pem
and$privatekeydir/<NAME>.pem
. - SHARED SERVER KEYS: Do: On the CA puppet master, generate a new certificate with
sudo puppet cert generate mcollective-servers
. (If you use a different name, substitute it for “mcollective-servers” everywhere we mention it below. Note that the name can only use letters, numbers, periods, and hyphens.) Retrieve the certificate and private key from$certdir/mcollective-servers.pem
and$privatekeydir/mcollective-servers.pem
. - SERVER CERTS: Already done: Every server node already has its own puppet agent certificate. You can re-use it. The certificate and key are located at
$certdir/<NAME>.pem
and$privatekeydir/<NAME>.pem
. - CLIENT CERTS: Do: You will need to continually create client credentials as you add new admin users.
- For the first admin user — yourself — you can generate a certificate on the CA puppet master with
sudo puppet cert generate <NAME>
(letters, numbers, periods, and hyphens only) and retrieve the cert and key from$certdir/<NAME>.pem
and$privatekeydir/<NAME>.pem
; delete the CA’s copy of the private key once you’ve retrieved it. - For future admin users, you need to build a process for issuing and distributing credentials. See “Managing Client Credentials” below for notes about this.
- For the first admin user — yourself — you can generate a certificate on the CA puppet master with
Deployment status: Nothing has happened yet.
Step 2: Deploy and Configure Middleware
As ever, note that you’ll have an easier time later if you perform these steps with Puppet or something like it. We suggest using a template for the activemq.xml file and using the java_ks
resource type for the keystores.
- Install ActiveMQ 5.5 or higher on your ActiveMQ server. If you are using Fedora or a relative of Red Hat Enterprise Linux, enable the Puppet Labs package repos and install the
activemq
package. The most recent versions of Debian and Ubuntu have ActiveMQ packages, and you may be able to installactivemq
without enabling any extra repos. For other systems, adapt the instructions from the ActiveMQ documentation, or roll your own packages. - Locate the activemq.xml file. Replace it with the example config file from the MCollective source. You will be editing this example activemq.xml file to suit your deployment in the next four steps.
- Change the passwords for the admin user and the
mcollective
user. For the MCollective user, use the password from the list of credentials above. - Change the port and protocol on the stomp transport connector to
stomp+nio+ssl://<IP_ADDRESS>:61614?needClientAuth=true
, since we’ll be using CA-verified TLS. (If you are running ActiveMQ 5.5.x or 5.6.x, set it tostomp+ssl://<IP_ADDRESS>:61614?needClientAuth=true
instead; the stomp+nio+ssl protocol had a bug on 5.6 and didn’t exist in 5.5.) - Follow the ActiveMQ keystores guide, using the CA certificate and the ActiveMQ certificate/key. (See list of credentials above.)
- Write an
sslContext
element in the activemq.xml file to use the keystores you created. (If you are using ActiveMQ 5.5, make sure you are arranging elements alphabetically to work around the XML validation bug.) - Start or restart the ActiveMQ service.
- Ensure that the server’s firewall allows inbound traffic on port 61614.
For more details about configuring ActiveMQ, see the ActiveMQ config reference for MCollective users. It’s fairly exhaustive, and is mostly for users doing things like networks of brokers and traffic filtering; for a standard deployment, you just need to change the passwords and configure TLS.
Deployment status: The middleware is fully ready, but nothing is using it yet.
Step 3: Install MCollective
See the “Install MCollective” page for complete instructions. In summary:
- Install the
mcollective
package on your server nodes. - Install the
mcollective-client
package on your admin workstations. - If you don’t have official packages for your OS, you may need to run from source.
- Make sure you install the same version everywhere.
Deployment status: MCollective is installed, but isn’t ready to do anything at this point. The
mcollective
service will probably refuse to start since it lacks a connector and security plugin.
Step 4: Configure Servers
To configure servers, you’ll need to:
- Locate and place the credentials
- Populate the fact file
- Write the server config file, with appropriate settings
Locate and Place Credentials
As mentioned above in Step 1, servers need the CA, an individual certificate and key, the shared server keypair, and every authorized client certificate.
- If you’re using Puppet, the CA, individual cert, and individual key are already present.
- Put a copy of the shared public key at
/etc/mcollective/server_public.pem
. - Put a copy of the shared private key at
/etc/mcollective/server_private.pem
. - Create a
/etc/mcollective/clients
directory and put a copy of every client certificate in it. You will need to maintain this directory centrally, and keep it up to date on every server as you add and delete admin users. (E.g. as a file resource withensure => directory, recurse => true
.)
Populate the Fact File
Every MCollective server will need to populate the /etc/mcollective/facts.yaml
file with a cache of its facts. (You can get by without this file, but doing so will limit your ability to filter requests.)
Make sure you include a resource like the following in the Puppet code you’re using to deploy MCollective:
file{"/etc/mcollective/facts.yaml":
owner => root,
group => root,
mode => 400,
loglevel => debug, # reduce noise in Puppet reports
content => inline_template("<%= scope.to_hash.reject { |k,v| k.to_s =~ /(uptime_seconds|timestamp|free)/ }.to_yaml %>"), # exclude rapidly changing facts
}
Write the Server Config File
The server config file is located at /etc/mcollective/server.cfg
.
See the server configuration reference for complete details about the server’s config file, including its format and available settings.
This config file has many settings that should be identical across the deployment, and several settings that must be unique per server, which is why we suggest managing it with Puppet. If your site uses only a few agent plugins and they don’t require a lot of configuration, you can use a template; otherwise, we recommend managing each setting as a resource.
Be sure to always restart the mcollective
service after editing the config file. In your Puppet code, you can do this with a notification relationship.
Server Settings for a Standard Deployment
This example template snippet shows the settings you need to use in a standard deployment. Converting it to settings-as-resources would be fairly straightforward.
(Note that it assumes an $ssldir
of /var/lib/puppet/ssl
, which might differ in your Puppet setup. This template also requires variables named $activemq_server
and $activemq_mcollective_password
.)
<% ssldir = '/var/lib/puppet/ssl' %>
# /etc/mcollective/server.cfg
# ActiveMQ connector settings:
connector = activemq
direct_addressing = 1
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.host = <%= @activemq_server %>
plugin.activemq.pool.1.port = 61614
plugin.activemq.pool.1.user = mcollective
plugin.activemq.pool.1.password = <%= @activemq_mcollective_password %>
plugin.activemq.pool.1.ssl = 1
plugin.activemq.pool.1.ssl.ca = <%= ssldir %>/certs/ca.pem
plugin.activemq.pool.1.ssl.cert = <%= ssldir %>/certs/<%= scope.lookupvar('::clientcert') %>.pem
plugin.activemq.pool.1.ssl.key = <%= ssldir %>/private_keys/<%= scope.lookupvar('::clientcert') %>.pem
plugin.activemq.pool.1.ssl.fallback = 0
# SSL security plugin settings:
securityprovider = ssl
plugin.ssl_client_cert_dir = /etc/mcollective/clients
plugin.ssl_server_private = /etc/mcollective/server_private.pem
plugin.ssl_server_public = /etc/mcollective/server_public.pem
# Facts, identity, and classes:
identity = <%= scope.lookupvar('::fqdn') %>
factsource = yaml
plugin.yaml = /etc/mcollective/facts.yaml
classesfile = /var/lib/puppet/state/classes.txt
# No additional subcollectives:
collectives = mcollective
main_collective = mcollective
# Registration:
# We don't configure a listener, and only send these messages to keep the
# Stomp connection alive. This will use the default "agentlist" registration
# plugin.
registerinterval = 600
# Auditing (optional):
# If you turn this on, you must arrange to rotate the log file it creates.
rpcaudit = 1
rpcauditprovider = logfile
plugin.rpcaudit.logfile = /var/log/mcollective-audit.log
# Authorization:
# If you turn this on now, you won't be able to issue most MCollective
# commands, although `mco ping` will work. You should deploy the
# ActionPolicy plugin before uncommenting this; see "Deploy Plugins" below.
# rpcauthorization = 1
# rpcauthprovider = action_policy
# plugin.actionpolicy.allow_unconfigured = 1
# Logging:
logger_type = file
loglevel = info
logfile = /var/log/mcollective.log
keeplogs = 5
max_log_size = 2097152
logfacility = user
# Platform defaults:
# These settings differ based on platform; the default config file created by
# the package should include correct values. If you are managing settings as
# resources, you can ignore them, but with a template you'll have to account
# for the differences.
<% if scope.lookupvar('::osfamily') == 'RedHat' -%>
libdir = /usr/libexec/mcollective
daemonize = 1
<% elsif scope.lookupvar('::osfamily') == 'Debian' -%>
libdir = /usr/share/mcollective/plugins
daemonize = 1
<% else -%>
# INSERT PLATFORM-APPROPRIATE VALUES FOR LIBDIR AND DAEMONIZE
<% end %>
Deployment status: The servers are ready, connected to the middleware, and will accept and process requests from authorized clients. The authorized clients don’t exist yet.
Step 5: Configure Clients
Unlike servers, clients will probably run with per-user configs on admin workstations, and will have to be configured partially by hand. (If you are running any automated clients, you’ll want to deploy those with config management; most of the principles covered below will still apply.)
To configure clients, each new admin user will need to:
- Request, retrieve, and place their credentials
- Write the client config file, with appropriate sitewide and per-user settings
Unless the client will be run by root or a system user, we recommend putting the client config file at ~/.mcollective
and supporting files like credentials in ~/.mcollective.d
.
Managing Client Credentials
For your first admin user, you can manually generate a certificate (as suggested in Step 1) and add it to the authorized clients directory that you’re syncing to servers with Puppet. However, this does not scale beyond one or two users.
When a new admin user joins your team, you need a documented process that does ALL of the following:
- Issues the user a signed SSL certificate, while assuring the user that no one else has ever had custody of their private key.
- Adds a copy of the user’s certificate to every MCollective server.
- Gives the user a copy of the shared server public key, the CA cert, and the ActiveMQ username/password.
Note: The filename of the public key must be identical on both the client and the servers. The client uses the filename to set the caller ID in its requests, and the servers use the request’s caller ID to choose which public key file to validate it with.
This will have to be at least partially manual, but if you’ve used the Puppet CA to issue certificates, you can pretty easily patch together and document a process using the existing Puppet tools.
Below, we outline a suggested process. It assumes a flat hierarchy of admins where everyone can command all servers, with any additional restrictions being handled by the ActionPolicy plugin (see “Step 6: Deploy Plugins” below) rather than the certificate distribution process.
Example Client Onboarding Process
- The new user should have Puppet installed on their workstation (or the server from which they will be issuing mco commands). It does not need to be managing their workstation, it just needs to be present.
-
The new user should run the following commands on their workstation — note that the name can only use letters, numbers, periods, and hyphens:
$ mkdir -p ~/.mcollective.d/credentials $ puppet certificate generate <NAME> --ssldir ~/.mcollective.d/credentials --ca-location remote --ca_server <CA PUPPET MASTER>
(Note the use of the
puppet certificate
command, which isn’t the same thing as thepuppet cert
command. This specific invocation will send a certificate signing request to the CA while safeguarding the private key.) - The new user should tell the MCollective admins which name they used, and optionally the fingerprint of the CSR they submitted.
- The MCollective admins should run
sudo puppet cert sign <NAME>
on the CA puppet master, then copy the certificate from$certdir/<NAME>.pem
into the directory of authorized client keys that is being synced to the MCollective servers; each server will recognize the new user after its next Puppet run. - The MCollective admins should tell the new user that they have signed the certificate request, and give them the ActiveMQ password and a partially filled-out client config file containing the relevant hostnames and ports. (See “Write the Client Config File” below.)
-
The new user should run the following commands on their workstation:
$ puppet certificate find <NAME> --ssldir ~/.mcollective.d/credentials --ca-location remote --ca_server <CA PUPPET MASTER> $ puppet certificate find mcollective-servers --ssldir ~/.mcollective.d/credentials --ca-location remote --ca_server <CA PUPPET MASTER> $ puppet certificate find ca --ssldir ~/.mcollective.d/credentials --ca-location remote --ca_server <CA PUPPET MASTER>
- The new user should copy the partial client config file they were provided to
~/.mcollective
on their workstation, and finish filling it out as described below.
After all these steps, and following a Puppet run on each MCollective server, the new user should be able to issue valid mco commands.
Write the Client Config File
For admin users running commands on a workstation, the client config file is located at ~/.mcollective
. For system users (e.g. for use in automated scripts), it is located at /etc/mcollective/client.cfg
.
See the client configuration reference for complete details about the client config file, including its format and available settings.
This config file has many settings that should be identical across the deployment, and several settings that must be unique per user. To save your new users time, we recommend giving them a partial config file with settings like the ActiveMQ hostname/port/password already entered; this way, they only have to fill in the paths to their unique credentials. The settings that must be modified by each user are:
plugin.activemq.pool.1.ssl.ca
plugin.activemq.pool.1.ssl.cert
plugin.activemq.pool.1.ssl.key
plugin.ssl_server_public
plugin.ssl_client_private
plugin.ssl_client_public
Client Settings for a Standard Deployment
After receiving this partial config file, a new user should fill out the credential paths, substituting <HOME>
for the fully qualified path to their home directory and <NAME>
for the name of the certificate they requested. (Note that MCollective cannot expand shorthand paths to the home directory — ~/.mcollective.d/credentials...
— so you must use fully qualified paths.)
# ~/.mcollective
# or
# /etc/mcollective/client.cfg
# ActiveMQ connector settings:
connector = activemq
direct_addressing = 1
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.host = <ActiveMQ SERVER HOSTNAME>
plugin.activemq.pool.1.port = 61614
plugin.activemq.pool.1.user = mcollective
plugin.activemq.pool.1.password = <ActiveMQ PASSWORD>
plugin.activemq.pool.1.ssl = 1
plugin.activemq.pool.1.ssl.ca = <HOME>/.mcollective.d/credentials/certs/ca.pem
plugin.activemq.pool.1.ssl.cert = <HOME>/.mcollective.d/credentials/certs/<NAME>.pem
plugin.activemq.pool.1.ssl.key = <HOME>/.mcollective.d/credentials/private_keys/<NAME>.pem
plugin.activemq.pool.1.ssl.fallback = 0
# SSL security plugin settings:
securityprovider = ssl
plugin.ssl_server_public = <HOME>/.mcollective.d/credentials/certs/mcollective-servers.pem
plugin.ssl_client_private = <HOME>/.mcollective.d/credentials/private_keys/<NAME>.pem
plugin.ssl_client_public = <HOME>/.mcollective.d/credentials/certs/<NAME>.pem
# Interface settings:
default_discovery_method = mc
direct_addressing_threshold = 10
ttl = 60
color = 1
rpclimitmethod = first
# No additional subcollectives:
collectives = mcollective
main_collective = mcollective
# Platform defaults:
# These settings differ based on platform; the default config file created
# by the package should include correct values or omit the setting if the
# default value is fine.
libdir = /usr/libexec/mcollective
helptemplatedir = /etc/mcollective
# Logging:
logger_type = console
loglevel = warn
Deployment status: MCollective is fully functional. Any configured admin user can run
mco ping
to discover nodes, use themco inventory
command to search for more detailed information, and use themco rpc
command to trigger actions from installed agents (currently only therpcutil
agent). See the mco command-line interface documentation for more detailed information on filtering and addressing commands.However, it can’t yet do much other than collect inventory info. To perform more useful functions, you must install agent plugins on each server and admin workstation. Additionally, if you want to do per-action authorization for certain dangerous commands, you will need to install and configure the ActionPolicy plugin.
Step 6: Deploy plugins
To let MCollective do anything beyond retrieving inventory data, you must deploy various plugins to all of your server and client nodes. You will usually also want to write custom agent plugins to serve business purposes in your infrastructure.
Install ActionPolicy
For a long-lived standard deployment, we recommend that you deploy the ActionPolicy authorization plugin to all servers.
By default, the standard deployment allows all authorized clients to execute all actions on all servers. This is reasonable as long as MCollective’s capabilities are limited, but as you hire more admin staff and deploy agent plugins that can cause significant changes to production servers, you may wish to begin limiting who can execute what. ActionPolicy allows you to distribute policy files for specific agents, which will restrict the set of users able to run a given action.
- Download the ActionPolicy plugin at its GitHub repo.
- Install it on all servers using the libdir copy install method.
- Uncomment the
rpcauthorization
,rpcauthprovider
, andplugin.actionpolicy.allow_unconfigured
settings in the server config file. - As needed, write per-agent policy files and distribute them to servers. See the ActionPolicy documentation for details on how to write policies.
Notes
- The SSL security plugin sets the message caller ID to
cert=<NAME>
, where<NAME>
is the filename of the client’s public key file without the.pem
extension. This string (including thecert=
) can be used as the second field of a policy line. (The ActionPolicy documentation usesuid=
for its examples, which is a caller ID set by the PSK security plugin.) - With the configuration shown above in the server config file, ActionPolicy is opt-in per agent. If you don’t distribute any policy files, MCollective will continue to work as before, with no additional authorization.
- Since policy files define which servers their rules apply to (based on facts and other metadata), they can safely be distributed to all servers.
Install Agent Plugins
Agent plugins do all of MCollective’s heavy lifting. All parts of an agent need to be installed on servers, and the DDL file needs to be installed on clients.
You can:
- Install any number of pre-existing agents. See the mcollective-plugins wiki for a list of the most common ones. You will probably want to install at least the
puppet
,package
, andservice
agents. - Develop your own agent plugins to serve site-specific purposes. These can help with application deployments, automate routine tasks like retrying mail queues, collect complex inventory information in real time, and more. See the documentation on writing agent plugins for more info.
For more information on how to install these agents, see “Installing and Packaging MCollective Plugins.” Specifically: * Installing plugins with packages * Installing plugins by copying into the libdir
Learn MCollective’s Command Line Interface
- See here for general info on using MCollective’s
mco
CLI client. - See here for additional info about filtering requests.
Deployment status: MCollective can do anything you’ve written or downloaded plugins for, on any number of servers, filtered and grouped by arbitrary metadata.


What is EyesFirst?
EyesFirst is an open source research project that is applying image processing and data analysis techniques to retinal images to detect early signs of multiple diseases. Key aspects of this project include:
- Establishing an open community standard for retinal image and health metadata.
- Developing an open source information sharing platform to improve public access to de-identified clinical and research datasets.
- Promoting the development of open source image processing algorithms and data analysis tools.
- Providing a basis for future longitudinal studies to investigate novel predictors for multiple diseases.
Why should you care?
The expected benefits of EyesFirst are two-fold:
- From a research perspective, to improve sharing of longitudinal datasets of retinal images and structured health metadata, leading to accelerated development of automated diagnostics and discovery of novel disease predictors.
- From a clinical perspective, to enable diagnosis of certain diseases earlier in their course. Earlier diagnosis may mitigate some of the most serious impacts of disease to include an improved quality of life as well as decreased cost of disease management.
How can you participate?
EyesFirst is actively seeking collaborators to define a standard retinal image metadata specification and prototype the image registration and image usage process for the database of retinal images. If interested, please contact us.