WITNESS LIST
Business & Commerce
February 15, 2011 8:00 AM
Power Outages
ON:
Campbell, David Chief Executive Officer (Luminant), Dallas, TX
Doggett, H.B. "Trip" President and Chief Executive Officer (also providing written
testimony) (ERCOT), Austin, TX
Doyle, Scott Division Vice President (Centerpoint Energy), Houston, TX
Erskine, Dick President (also providing written testimony) (Atmos Pipeline Company),
Dallas, TX
Givens, Sheri Public Counsel (Office of Public Utility Counsel), Austin, TX
Hinojosa, Jr., Alex Chief Executive Officer (also providing written testimony) (Hino
Electric Power Company), Harlingen, TX
Lloyd, Brian Executive Director (also providing written testimony) (Public Utility
Commission), Austin, TX
Power, David Deputy Director (Public Citizen), San Antonio, TX
Pulis, Brenda J. Senior Vice President of Operations (also providing written testimony)
(Oncor), Dallas, TX
Ragan, John Regional President (NRG), Houston, TX
Ross, Ned Director (Direct Energy), Austin, TX
Shaw, Bryan Chairman (Texas Commission on Environmental Quality), Austin, TX
Smith, Wade President and Chief Operating Officer (AEP), Corpus Christi, TX
Smitherman, Barry T. (also providing written testimony) (Public Utility Commission),
Austin, TX
Stevens, David Chief Executive Officer (El Paso Electric), El Paso, TX
Turk, Steve Vice President of Operations, Southern Division (Chesapeake Energy),
Oklahoma City, OK
Weis, Larry General Manager (also providing written testimony) (Austin Energy), Austin,
TX
Williams, Michael Commissioner (Railroad Commission), Austin, TX
Providing written testimony:
On:
Lewis Jenkins, Clay Judge (Self), Dallas, TX
Reed, Cyrus (Lone Star Chapter, Sierra Club), Austin, TX
Yao, Joyce (Environmental Advocacy), Austin, TX
1


Happy BoomBox
You can customize the happy boombox by changing or adding additional songs to the userdata on the boombox entity. Click a song title to play a tune!
Stop Music
Song List
Fetching songs...
Default music provided by BenSound (bensound.org)


We can't stop talking about design and front-end development, we write and tweet but we need another outlet for our possibly unhealthy obsession (read: passion). We want to talk to some of the smartest people out there and simplify some of the things we don't understand (like JavaScript MVC apps and hoisting and why we dropped out of school).
We are currently looking for amazing sponspors to partner with to support our show and provide amazing products and services and offers to our listeners


Chemistry Fun Facts
- One bucketful of water contains more atoms than the Atlantic Ocean does bucketfuls of water.
- One inch of rain is equal to 10 inches of snow.
- The only elements that are liquid at room temperature are bromine and mercury.
- The hardest chemical in your body is your tooth enamel.
- The lighter was invented before the match.
- Mosquitoes like the scent of estrogen, thus women get bitten more often than men do.
- The only letter that does not appear on the Periodic Table of Elements is J.
- Lightning strikes produce ozone (O3) and help strengthen the ozone layer.
- You have chemoreceptors (taste buds) on the inside of your cheeks too.


Choose a ROM
Select Save File first if needed!
Import Save File
Use this to replace the current Save File.
Export Save File
Only for Export! Saving is automatic.


| port (optional) - an integer value representing the port to be checked for joystick data |
|
JoyHat returns the state of a joystick 'hat' or 'pov' (point-of-view) control.
If the returned value is -1, the hat is currently centred. Otherwise, the returned value gives the direction as an angle in the range 0 to 360 relative to 'up'. |
|
While Not KeyHit(1)
Print JoyHat() Wend End |


{% extends "global/Page.html" %} {% load otree static %} {% block content %}
Before we proceed, please agree that you will not discuss any details pertaining to this experiment with anyone else. This is important for the experiment to be conducted in a credible way.


For this first visualization we decided to use a dataset from the Spanish national institute of statistics about the population employment in different time spans, additionally we have separated our data in age spans to provide a more insightful analysis. We decided to use this dataset to represent the unemployment situation in our home country which is critical at the moment, more specifically we were interested in evaluating the situation in our age range since we will be finishing college in the next couple of years. According to the type of data that we have, two categorical and one continuous variables, it seemed more fitting to represent it using a grouped stacked bar chart for a more interesting visualization and observation of the evolution of the employment rates.
For the second visualization we selected the Iris dataset which is a commonly used dataset among the machine learning community, it provides insightful information about the flower different species and its characteristics. Another reason why we decided to use this dataset is that we wanted to reflect how we can apply different areas of the data and computer science together, in this case, machine learning and data visualization and representation. In this case, we could have not used this dataset for the bar chart without having to operate on it first to obtain a second categorical variable, since in it we can only find the specie type and then all its continuous characteristics. Regarding the selection of attributes, we studied the different combinations and reached the conclusion that the Sepal length against the Petal width showed the most interesting conclusions as you can see a clear relationship between these variables and its associated species.


Status: Draft Edit
Visibility: Public Edit
Publish: Immediately Edit
Category 1
Category 2
Category 3
Category 4
Category 5
Category 6
Set Featured Image


class: center, middle # Welcome to MC Doubletap > Use scroll wheel to change slide. --- # Installation 1. Download the latest snapshot or compile a jar and place it into your plugins folder. 2. Start or Restart the server. 3. Edit the file located at: ./plugins/Doubletap/config.json (see next slide) 4. Restart the server. 5.


Henselt is a large, broad-shouldered aging man, who, however, has not yet lost his strength and become.  He prefers rich red and burgundy robes with gold embroidery and fur trim, and wears unicorn jewelry and coats of arms.


After Shattering A Million Hearts In That Front Cut-Out Dress, Kareena Kapoor Khan Scoots Back To Shoot Laal Singh Chaddha
19 Nov 2019, 04:48 by Garema Khurana
Kareena Kapoor Khan made a splash at the trailer launch of Good Newwz co-starring Akshay Kumar, Diljit Doshanjh and Kiara Advani, yesterday. Early this morning she was spotted at the Mumbai airport, flying out to resume shooting for the Aamir Khan co-starrer Laal Singh Chaddha
Kareena Kapoor Khan can go from glam to de-glam in a matter of hours (Image Source:- Viral Bhayani)
Kareena Kapoor Khan flies off to join Aamir Khan on the sets of Laal Singh Chaddha (Image Source:- Viral Bhayani)
Yes, this is the same lady, who broke a million hearts wearing that daring front cut-out dress for the trailer launch of Laal Singh Chaddha. Kareena Kapoor Khan, take a bow!


{% extends "base.html" %} {% block head %} {% endblock %} {% block content %}
This leaderboard is also available as a text-only version.


{% extends "nominations_portal.html" %} {% load bootstrap3 crispy_forms_tags django_bootstrap_breadcrumbs %} {% block page_title %}Our Revolution - Nomination Form{% endblock %} {% block breadcrumbs %} {{ block.super }} {% breadcrumb "Nomination Form" request.get_full_path %} {% endblock %} {% block content %} {{ block.super }}
The nomination form should be filled out by your group detailing why you are nominating this candidate, what makes this candidate a progressive champion, and why a national endorsement is necessary.
Fields marked * are required, and each question has a 1000 character limit.
If you are requesting Priority Support then make sure you fill out the Priority Support form first before you proceed.
After that is complete, or for Basic Support only, please fill out the form below.
{{form.instance.response}}
{{form.group_nomination_process.value}}


How to play the game
- The player will have to guess the answer,
- The player will guess with numbers instead of letters.
- you will be given randon numbers
- There will be four crystals displayed as buttons on the page.
- The player will be shown a random number at the start of the game.
- hen the player clicks on a crystal, it will add a specific amount of points to the player's total score.
- your game will hide this amount until the player clicks a crystal.
- When they do click one, update the player's score counter.
- the player wins if their total score matches the random number from the beginning of the game
- The player loses if their score goes above the random number.
- The game restarts whenever the player wins or loses.
- and finally you will see how many time you win or lose the Game
Number To Get:
Wins:
Losses:
your score is:


Food Aid wants to set a new strategic direction. They need to decide how to balance emergency relief against long term development work to alleviate the causes of hunger. How would you advise the executive committee?
Basic Points
Define a spectrum of options for the World Food Program:
- Specialize in logistics and food aid
- Straddle emergency relief and development
- Become a "hunger" organization focusing on food assistance rather than food aid.
Use a framework to help in decision process::
- Corporation (Organization): What are the current capabilities of Food Aid?
- Customers: What is needed by those in hunger? What would happen if Food Aid stopped providing emergency relief services?
- Competition: What services are currently provided by other charity organizations?
- Stakeholders: What are the political interests of the organizations that provide/receive financial support to/from Food Aid? E.g. Recipient countries will prefer that Food Aid does not interfer with national development activities and policies. However, donor organisation may want Food Aid to play a larger role in increasing food and political security in unstable areas of the world.
Advanced Comments
Decision Making Process in a Non-Profit Organization involves many steps to engage all stakeholders:
- Define Values and Beliefs to help guide appropriate strategy
- Conduct research to understand what the focus of Food Aid is currently. Conduct audit of all current activities by: type, geography, cost
- Present broad options to the executive committee
- Conduct workshops with other stakeholders to get feedback. Adjust options based on feedback
- Brief members of the executive committee individually to understand potential push back
- Present again to the executive committee for a decision
Contrast For With For Profit Organizations
- Customers and Competition are likely to be the biggest factors in this decision process. i.e. what is the need and who is currently meeting that need or not? Other stakeholders will play a less significant role.
- Values and Beliefs are extremely important in Non-Profit organizations, where the overarching goals are less obvious (i.e. not just to make money).


You can receive payment from other accounts on the stellar network using the following
You can set a username for your stellar account instead of using the long Account ID. The name will be in this format username*domain.com. For example: jasmine*{{siteURL}} To set a username click here
You can use our plugin to receive payments directly to your account from your websites, and its free
1. Include Saza's "stellar.donate.js" file to your web page.
2. Add the following code snippet to your page.


Meshing Capability# Full mesh Script Usage Problem-specific mesh script Sample Mesh Capabilty What is a sample mesh and why? Let’s look at a figure to understand this How to do all this in pressio-demoapps? Show me an example! (A) Generate full mesh (B) Select subset of cells, and generate sample mesh


| Class | Description |
|---|---|
| CodeScannerActivity |
Activity to Scan barcodes and QR Codes
Code modified from example from: https://github.com/yuriy-budiyev/code-scanner
|
| DiscussionPostsActivity |
This activity controls Q and A posts
|
| ExperimentNewActivity |
Activity used for creating a new experiment.
|
| ExperimentViewActivity |
This is the activity for when an experiment is launched.
|
| InfoHeaderView |
Custom View for the Experiment Info Fragment's header.
|
| MainActivity | |
| MapViewInScroll |
A map view for situations the map is in a scrollable menu
answered Apr 15 '20 at 11:55 by Oleg Bozhko
https://stackoverflow.com/questions/61023565/google-map-viewpager2-swiping-conflict
How to have the map take scrolling priority over the interface
|
| NameView |
Custom view to handle displaying names, and displaying user info on click
|
| ProfileActivity | |
| SearchActivity |
Base code used: https://developer.android.com/training/search
|
| TrialNewActivity |


--- title: How To Buy Tickets layout: concert-banner ---
Red Butte Garden uses an external ticketing system called Ticketfly. You must set up a Ticketfly account BEFORE you can purchase concert tickets online.
Membership Deadline – Friday, April 21
Renew or purchase a Garden-Plus Membership level or above by April 21 in order to participate in the April 24 Member-Only Online presale.
Membership sales will not be available April 22 through April 24
Membership sales will resume on Tuesday, April 25
Please note: Garden Membership does not guarantee concert ticket availability.
Check out the How To Purchase video instructions.
Children age 3 and younger do not need tickets.
Ticketfly offers multiple ticket delivery options, including print-at-home, mail, and Will Call.


This is one seriously bunk magic lamp
by Jason WeisbergerWhile it seems awfully unfair for the rabbit I guess this is how most 'genii in a lamp' interactions go. I thought said rabbit was sufficiently specific in its request and yet it still gets nada.


Some examples of how to use the mcc-timer-picker component
This is a implementation of timer picker for material design.
To use this component, just import the module from
material-community-component
package.
import {{ '{' }} MccTimerPickerModule {{ '}' }} from 'material-community-components/timer-picker';
@NgModule({{ '{' }}
...
imports: [
MccTimerPickerModule
]
...
{{ '}' }})


THE NEGOTIATOR
Reviewed by Harvey Karten, Ph.D. Warner Bros./ Regency Enterprises Director: F. Gary Gray Writer: James Demonaco & Kevin Fox Cast:Samuel L. Jackson, Kevin Spacey, David Morse, Ron Rifkin, John Spencer, J.T. Walsh
When I was seven years old I was certain that doctors never got sick. The thought that a doctor could be treated by another physician simply did not enter my mind. After all: teachers knew everything. Would a teacher have to continue reading books and taking courses? F. Gary Gray's police drama "The Negotiator" raises a similar issue. What happens when a hostage mediator takes a hostage himself? Would he dicker with himself over the terms of surrender? That's silly. But since he knows all the tricks of the trade, would any other arbitrator be able to put one over on him? Not likely. Unless, we see, the negotiator is Chris Sabian (Kevin Spacey), the guy hand-picked by Lt. Danny Roman (Samuel L. Jackson) to be his go-between. Since Roman has now become the victor-victim with a handful of hostages in tow, he can't be fooled by the usual maneuvers like being "talked down." This means that Sabian must improvise for the first time in his life to bring an end to an unbearably tense situation. How he does this--and how Roman deals with his new status--are the concerns of the melodrama, scripted by James DeMonaco and Kevin Fox.
Though "The Negotiator" fits seamlessly into the season of formulaic summer spectacles, two particulars lift it above the commonplace. One is DeMonaco and Fox's series of twists and turns. Some of the guys you'd swear are bad turn out to be just doing their job, while at least one of the angels is not what he seems. The other is the tension-riddled performance of Samuel L. Jackson, who creates a believably taut role as a super cop now suspected of murder and, together with the wonderful Kevin Spacey as his adversary and friend light up the screen with verbal histrionics and sizzling action.
The story opens as do many others of the genre with an action unrelated to the central theme. Roman is negotiating with a crazed man who is holding a small girl hostage, demanding to see his estranged wife. The perp, unfamiliar with the tricks of the trade, falls prey to Roman's banter allowing the girl to escape unharmed. Soon after this, Roman's partner (played by Paul Guilfoyle) is murdered in his car and Roman is charged with the crime. We are thrust into a sometimes convoluted plot involving the theft of two million dollars from a policemen's disability fund with evidence pointing to Roman's guilt. Refusing to be taken into custody (he could not tolerate being away from his beloved wife Karen, played by Regina Taylor), Roman takes Inspector Niebaum (J.T. Walsh) hostage in the latter's office together with the local snitch (Nestor Serrano) and Niebaum's secretary. After making the negotiator on hand look like a stuttering dimwit, he insists on speaking only with master haggler Sabian. The central part of the movie is occupied with the badinage between the two brothers-in-arms, Roman insisting on his innocence while Sabian torments the frightened game almost mercilessly.
The on-and-off exposes of bad cops by the press add resonance to the tale of larceny and murder as we try to figure out which of the cops was in on the embezzlement and the murder. Is the guilty party Commander Frost (Ron Rifkin), known as Frosty, who is himself a hostage of Roman? Could it be Commander Beck (David Morse), the humorless officer who is so insistent on shooting Roman that we wonder what he is himself covering up? Or possibly the sinisted Inspector Niebaum, who sits smirking in his chair, insisting on his innocence but made suspect in our eyes because, well, J.T. Walsh is not often known as the good guy. Or could is be the snitch, who supplies most of the story's comic relief?
Shot on location in the streets of Chicago, "The Negotiator" unfortunately regresses into the usual high-explosive category when it would have been served better had it focused strictly on the verbal chess game between the two principals. For a look at how the movie could have been a true blockbuster rather than one which forces volatilility through chemical explosives, take in the video of "Glengarry Glen Ross," also highlighting the talent of Kevin Spacey, or just as well "The Spanish Prisoner," an intricate, wholly involving story of a scam which forbears smoke-filled scenarios.
Rated R. Running time: 135 minutes. (C) Harvey Karten 1998
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


./komodod -ac_name=KMDICE -ac_supply=10500000 -ac_reward=2500000000 -ac_halving=210000 -ac_cc=2 -addressindex=1 -spentindex=1 -addnode=<IP_ADDRESS> &
https://kmdice.pool-mining.xyz/ <- pool
https://pool.forkwitch.com/ <- another pool
https://minerpond.com <- another pool
100 messages
Before 05-Dec-19 12:00 AM
forkwitch03-Nov-18 01:47 AM
Pool node configured to relay 10kb of free transactions.
ComputerGenie 👴👴👴03-Nov-18 01:48 AM
I had 12 that were ratelimited, but that's a far cry from 1200
forkwitch03-Nov-18 01:48 AM
Just for you @ComputerGenie 👴👴👴
Before it was 1kb.
My bet is dealer node is mess up .
How many dealer nodes it is?
blackjok3r03-Nov-18 01:49 AM
Ill say it again, if theat dealer node has a tx in it mempol that all other nodes see as invlaid
ComputerGenie 👴👴👴03-Nov-18 01:49 AM
blames @blackjok3r and goes back to
blackjok3r03-Nov-18 01:49 AM
the mempools isnt going wnywhere'
These chains, have "mempool forks"
forkwitch03-Nov-18 01:49 AM
Which tx @blackjok3r , why dealer node does not remove from mempool this transaction?
blackjok3r03-Nov-18 01:50 AM
I have no idea... it supposed to clear the mempool on each block then re add it again
ComputerGenie 👴👴👴03-Nov-18 01:50 AM
@blackjok3r if the explorer sees it, then nodes should see it
blackjok3r03-Nov-18 01:50 AM
but maybe that isnt working
Not if the mempools are split in half
explorer might not have the tx that invalidates the txs.. I htink the dealer sent all those atr once
and its proabably 1200 txs that depend on 1
forkwitch03-Nov-18 01:51 AM
Dealer generated and broadcasted 1200 txs at once?
blackjok3r03-Nov-18 01:51 AM
wqhen this happens I usually have killed all node with stuck mempol to reset it
forkwitch03-Nov-18 01:52 AM
I believe there is no thing as 'mempool fork', as it is not always identical on nodes with broadcasting.
blackjok3r03-Nov-18 01:52 AM
There isnt without CC transaction
but these tx are diffrent
forkwitch03-Nov-18 01:52 AM
Always you get relative memory pools.
ComputerGenie 👴👴👴03-Nov-18 01:52 AM
'mempool fork' aka 'P2P'
blackjok3r03-Nov-18 01:53 AM
Im not sure what else to calle it
forkwitch03-Nov-18 01:53 AM
So you think dealer node has a dirty memory pool who is a problem for dealer node.
Can we look into dealer node memory pool now?
blackjok3r03-Nov-18 01:53 AM
Yes I am theorising that its trying to send a mempool out (or has stopepd trying to send it)
If I get a node with bad connectivity and txblast it
all nodes will segment its mempool off
and they tx wont go anywhere
This is repeatable behaviour ... but if you hav a few nodes close together its ok
ComputerGenie 👴👴👴03-Nov-18 01:54 AM
that's simple to figure out, what's the addnode for the dealer node? add that and if you ban it, then something's wrong
blackjok3r03-Nov-18 01:54 AM
Maybe we need to add a exception to addtomempool that just lets in all dicefinish bets
then let the miner invalidate them
that might not be a great idea though, as the DICE contract runs its consensus on the mempool
and could end up with runaway invalid txs
ComputerGenie 👴👴👴03-Nov-18 01:56 AM
you're 1/2 on the right track, that's what I was talking about the other day with the tx "depends" being an issue with only blocking 5-10 txes
blackjok3r03-Nov-18 01:57 AM
Well when siu updated and restarted that node it sent 1500 tx at once(edited)
then they didnt go anywhere
Which I can prove happens on any ndoe
if you send a shit tonne of tx at once, it just wont propagate
so block mempool tx but dont band thenode sending them
ComputerGenie 👴👴👴03-Nov-18 02:02 AM
listbanned
[
]
blackjok3r03-Nov-18 02:03 AM
so its not that either
ComputerGenie 👴👴👴03-Nov-18 02:15 AM
I don't know what changed between then and now, but maxconnections=380 should never yield connections limited to 8 peer limit(edited)
blackjok3r03-Nov-18 02:15 AM
It will only go over 8 if nodes activly connect to you
you need to change MAX_OUTBOUND in net.cpp
to force more
ComputerGenie 👴👴👴03-Nov-18 02:17 AM
outbound != in and out
blackjok3r03-Nov-18 02:18 AM
on my KMD minign node IU forced 50 outbound to get less orphans .. doesnt really work lol
Dealer node is still deaded
Maybe the dealer, utxo selection is also bad
I found that in stressing it out, that it would keep selecting the same utxos
Angel0903-Nov-18 02:19 AM
Sell 3k kmdice. Dm me
1
1
blackjok3r03-Nov-18 02:19 AM
I modified it so that for player its chooses randomly
but maybe the dealer needs soethig similar
ComputerGenie 👴👴👴03-Nov-18 02:20 AM
I love that random people like @Angel09 keep poping into the middle of conversations saying that it's not working at and trying to sell to the people talking about it not working
blackjok3r03-Nov-18 02:20 AM
I said from day one, not to mine this chain
I had to spent money to secure me enough coins to est
Sending dice bet is pointless
The bet tx has a fee
and has and is always confirmed just fine
its the finish tx... so we are back to where we started here, we need to make the dealer handle more threads
Just using 3 or 4 tables over a few diff nodes would have worked just fine ... but oh hwell.
ComputerGenie 👴👴👴03-Nov-18 02:26 AM
i'm thinking that 'over a few diff nodes ' would help even without the extra "tables"
and who dafuq is still running nodes on the dead 9172 fork?
says screw it all and sets MAXOUTBOUND to 800(edited)
TX_PUBKEY invalid pubkey
ExtractDestination failed
TX_PUBKEY invalid pubkey
ExtractDestination failed
any idea what that's about? or is it because I'm on dev and not fsm?
blackjok3r03-Nov-18 02:35 AM
ExtractDestination is a function insode komodod that takes a ScriptPubkey (I htink) and gets the address it was sent from(edited)
I think becuase we have the possibility of orphaned txs a lot of calls are now looking for tx that are not there.
ComputerGenie 👴👴👴03-Nov-18 02:38 AM
all I know for sure is that following
git clone https://github.com/jl777/komodo --branch dev --single-branch
is a bad idea if you ever want anything other than dev (or whatever branch you pick there)
git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*" does fix it though(edited)
blackjok3r03-Nov-18 02:39 AM
You would probably need FSM for this chain tbh ... doubt it would sync properly on master
ComputerGenie 👴👴👴03-Nov-18 02:42 AM
well I was using dev, master is in the readme (as is 'komodoplatform')(edited)
blackjok3r03-Nov-18 02:43 AM
Every reason I said not to lauunch this chain...
But whatever its been productive at least
issues in DICE have been fixed that were not even looked at before
ComputerGenie 👴👴👴03-Nov-18 02:44 AM
yes yes yes yes yes yes yes we get it, you're against this being a live chain
blackjok3r03-Nov-18 02:45 AM
meh dont really care anymore ... just need to fix it
ComputerGenie 👴👴👴03-Nov-18 02:46 AM
meh dont really care anymore
is belied by the fact that you say
Every reason I said not to lauunch this chain...
at least 3 times a day
blackjok3r03-Nov-18 02:47 AM
ComputerGenie 👴👴👴03-Nov-18 03:02 AM
Switched to FSM branch:
computergenie@debian:~/.komodo/KMDICE$ komodo-cli -ac_name=KMDICE getpeerinfo | jq '.|length'
28
computergenie@debian:~/.komodo/KMDICE$ komodo-cli -ac_name=KMDICE getmempoolinfo | jq '.size'
3
OK, I'm giving up for the day on the assumption that no one is broadcasting the stuck txes and there's nothing else I can do
blackjok3r03-Nov-18 03:03 AM
Yes the problem is tha tthey are not sending in the first palce(edited)
I thiught this could be an issue,
its liek less than 10ms they are removed from the mempool for, but maybe thats enough to stop them propagating
jl777c03-Nov-18 04:36 AM
the dealer node was running without the latest FSM branch fixes. we know that gets things into a strange state
resync the dealer node from scratch and it should work
there is no evidence for or against whether things run stable when all nodes are on the current FSM branch. for all we know it is working fine
jorian03-Nov-18 08:24 AM
the dealer node has no transactions in mempool anymore
2
ok, it has 2.
almost 0
should i still resync the complete chain?
jl777c03-Nov-18 08:32 AM
did they all confirm or disappear?
i guess if all the dicefinish are completed, then maybe things are back on track?
i think with new FSM branch, dealer node should be able to keep up with 1 bet per second and fill blocks
ComputerGenie 👴👴👴03-Nov-18 11:38 AM
the dealer node has no transactions in mempool anymore
Then does the explorer need a rescan?


{% extends "base.html" %} {% block main %}
You now submitted your information successfully!
Please check your email for the assessment result!


Created a dictionary with the help of Linked Lists to display the meaning of an input word, delete a certain word and insert a word into the dictionary database.
Check it outCreated a website for an NGO incorporating server side scripting and client side scripting. Numerous functionalities including Form Validation , Animations and Transitions, Scroll Effects, etc., were implemented.
Check it out


openssl-verification-options - generic X.509 certificate verification options
openssl command [ options ... ] [ parameters ... ]
There are many situations where X.509 certificates are verified within the OpenSSL libraries and in various OpenSSL commands.
Certificate verification is implemented by X509_verify_cert(3). It is a complicated process consisting of a number of steps and depending on numerous options. The most important of them are detailed in the following sections.
In a nutshell, a valid chain of certificates needs to be built up and verified starting from the target certificate that is to be verified and ending in a certificate that due to some policy is trusted. Verification is done relative to the given purpose, which is the intended use of the target certificate, such as SSL server, or by default for any purpose.
The details of how each OpenSSL command handles errors are documented on the specific command page.
DANE support is documented in openssl-s_client(1), SSL_CTX_dane_enable(3), SSL_set1_host(3), X509_VERIFY_PARAM_set_flags(3), and X509_check_host(3).
In general, according to RFC 4158 and RFC 5280, a trust anchor is any public key and related subject distinguished name (DN) that for some reason is considered trusted and thus is acceptable as the root of a chain of certificates.
In practice, trust anchors are given in the form of certificates, where their essential fields are the public key and the subject DN. In addition to the requirements in RFC 5280, OpenSSL checks the validity period of such certificates and makes use of some further fields. In particular, the subject key identifier extension, if present, is used for matching trust anchors during chain building.
In the most simple and common case, trust anchors are by default all self-signed "root" CA certificates that are placed in the trust store, which is a collection of certificates that are trusted for certain uses. This is akin to what is used in the trust stores of Mozilla Firefox, or Apple's and Microsoft's certificate stores, ...
From the OpenSSL perspective, a trust anchor is a certificate that should be augmented with an explicit designation for which uses of a target certificate the certificate may serve as a trust anchor. In PEM encoding, this is indicated by the TRUSTED CERTIFICATE
string. Such a designation provides a set of positive trust attributes explicitly stating trust for the listed purposes and/or a set of negative trust attributes explicitly rejecting the use for the listed purposes. The purposes are encoded using the values defined for the extended key usages (EKUs) that may be given in X.509 extensions of end-entity certificates. See also the "Extended Key Usage" section below.
The currently recognized uses are clientAuth (SSL client use), serverAuth (SSL server use), emailProtection (S/MIME email use), codeSigning (object signer use), OCSPSigning (OCSP responder use), OCSP (OCSP request use), timeStamping (TSA server use), and anyExtendedKeyUsage. As of OpenSSL 1.1.0, the last of these blocks all uses when rejected or enables all uses when trusted.
A certificate, which may be CA certificate or an end-entity certificate, is considered a trust anchor for the given use if and only if all the following conditions hold:
It is an an element of the trust store.
It does not have a negative trust attribute rejecting the given use.
It has a positive trust attribute accepting the given use or (by default) one of the following compatibility conditions apply: It is self-signed or the -partial_chain option is given (which corresponds to the X509_V_FLAG_PARTIAL_CHAIN flag being set).
First, a certificate chain is built up starting from the target certificate and ending in a trust anchor.
The chain is built up iteratively, looking up in turn a certificate with suitable key usage that matches as an issuer of the current "subject" certificate as described below. If there is such a certificate, the first one found that is currently valid is taken, otherwise the one that expired most recently of all such certificates. For efficiency, no backtracking is performed, thus any further candidate issuer certificates that would match equally are ignored.
When a self-signed certificate has been added, chain construction stops. In this case it must fully match a trust anchor, otherwise chain building fails.
A candidate issuer certificate matches a subject certificate if all of the following conditions hold:
Its subject name matches the issuer name of the subject certificate.
If the subject certificate has an authority key identifier extension, each of its sub-fields equals the corresponding subject key identifier, serial number, and issuer field of the candidate issuer certificate, as far as the respective fields are present in both certificates.
The certificate signature algorithm used to sign the subject certificate is supported and equals the public key algorithm of the candidate issuer certificate.
The lookup first searches for issuer certificates in the trust store. If it does not find a match there it consults the list of untrusted ("intermediate" CA) certificates, if provided.
When the certificate chain building process was successful the chain components and their links are checked thoroughly.
The first step is to check that each certificate is well-formed. Part of these checks are enabled only if the -x509_strict option is given.
The second step is to check the extensions of every untrusted certificate for consistency with the supplied purpose. If the -purpose option is not given then no such checks are done except for SSL/TLS connection setup, where by default sslserver
or sslclient
, are checked. The target or "leaf" certificate, as well as any other untrusted certificates, must have extensions compatible with the specified purpose. All certificates except the target or "leaf" must also be valid CA certificates. The precise extensions required are described in more detail in "CERTIFICATE EXTENSIONS" in openssl-x509(1).
The third step is to check the trust settings on the last certificate (which typically is a self-signed root CA certificate). It must be trusted for the given use. For compatibility with previous versions of OpenSSL, a self-signed certificate with no trust attributes is considered to be valid for all uses.
The fourth, and final, step is to check the validity of the certificate chain. For each element in the chain, including the root CA certificate, the validity period as specified by the notBefore
and notAfter
fields is checked against the current system time. The -attime flag may be used to use a reference time other than "now." The certificate signature is checked as well (except for the signature of the typically self-signed root CA certificate, which is verified only if the -check_ss_sig option is given). When verifying a certificate signature the keyUsage extension (if present) of the candidate issuer certificate is checked to permit digitalSignature for signing proxy certificates or to permit keyCertSign for signing other certificates, respectively. If all operations complete successfully then certificate is considered valid. If any operation fails then the certificate is not valid.
The following options specify how to supply the certificates that can be used as trust anchors for certain uses. As mentioned, a collection of such certificates is called a trust store.
Note that OpenSSL does not provide a default set of trust anchors. Many Linux distributions include a system default and configure OpenSSL to point to that. Mozilla maintains an influential trust store that can be found at https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/.
The certificates to add to the trust store can be specified using following options.
Load the specified file which contains a certificate or several of them in case the input is in PEM or PKCS#12 format. PEM-encoded certificates may also have trust attributes set.
Do not load the default file of trusted certificates.
Use the specified directory as a collection of trusted certificates, i.e., a trust store. Files should be named with the hash value of the X.509 SubjectName of each certificate. This is so that the library can extract the IssuerName, hash it, and directly lookup the file to get the issuer certificate. See openssl-rehash(1) for information on creating this type of directory.
Do not use the default directory of trusted certificates.
Use uri as a store of CA certificates. The URI may indicate a single certificate, as well as a collection of them. With URIs in the file:
scheme, this acts as -CAfile or -CApath, depending on if the URI indicates a single file or directory. See ossl_store-file(7) for more information on the file:
scheme.
These certificates are also used when building the server certificate chain (for example with openssl-s_server(1)) or client certificate chain (for example with openssl-s_time(1)).
Do not use the default store of trusted CA certificates.
The certificate verification can be fine-tuned with the following flags.
Print extra information about the operations being performed.
Perform validation checks using time specified by timestamp and not current system time. timestamp is the number of seconds since January 1, 1970 (i.e., the Unix Epoch).
This option suppresses checking the validity period of certificates and CRLs against the current time. If option -attime is used to specify a verification time, the check is not suppressed.
This disables non-compliant workarounds for broken certificates. Thus errors are thrown on certificates not compliant with RFC 5280.
When this option is set, among others, the following certificate well-formedness conditions are checked:
The basicConstraints of CA certificates must be marked critical.
CA certificates must explicitly include the keyUsage extension.
If a pathlenConstraint is given the key usage keyCertSign must be allowed.
The pathlenConstraint must not be given for non-CA certificates.
The issuer name of any certificate must not be empty.
The subject name of CA certs, certs with keyUsage crlSign, and certs without subjectAlternativeName must not be empty.
If a subjectAlternativeName extension is given it must not be empty.
The signatureAlgorithm field and the cert signature must be consistent.
Any given authorityKeyIdentifier and any given subjectKeyIdentifier must not be marked critical.
The authorityKeyIdentifier must be given for X.509v3 certs unless they are self-signed.
The subjectKeyIdentifier must be given for all X.509v3 CA certs.
Normally if an unhandled critical extension is present that is not supported by OpenSSL the certificate is rejected (as required by RFC5280). If this option is set critical extensions are ignored.
Ignored.
Checks end entity certificate validity by attempting to look up a valid CRL. If a valid CRL cannot be found an error occurs.
Checks the validity of all certificates in the chain by attempting to look up valid CRLs.
Enable support for delta CRLs.
Enable extended CRL features such as indirect CRLs and alternate CRL signing keys.
Enable the Suite B mode operation at 128 bit Level of Security, 128 bit or 192 bit, or only 192 bit Level of Security respectively. See RFC6460 for details. In particular the supported signature algorithms are reduced to support only ECDSA and SHA256 or SHA384 and only the elliptic curves P-256 and P-384.
Set the certificate chain authentication security level to level. The authentication security level determines the acceptable signature and public key strength when verifying certificate chains. For a certificate chain to validate, the public keys of all the certificates must meet the specified security level. The signature algorithm security level is enforced for all the certificates in the chain except for the chain's trust anchor, which is either directly trusted or validated by means other than its signature. See SSL_CTX_set_security_level(3) for the definitions of the available levels. The default security level is -1, or "not set". At security level 0 or lower all algorithms are acceptable. Security level 1 requires at least 80-bit-equivalent security and is broadly interoperable, though it will, for example, reject MD5 signatures or RSA keys shorter than 1024 bits.
Allow verification to succeed if an incomplete chain can be built. That is, a chain ending in a certificate that normally would not be trusted (because it has no matching positive trust attributes and is not self-signed) but is an element of the trust store. This certificate may be self-issued or belong to an intermediate CA.
Verify the signature of the last certificate in a chain if the certificate is supposedly self-signed. This is prohibited and will result in an error if it is a non-conforming CA certificate with key usage restrictions not including the keyCertSign bit. This verification is disabled by default because it doesn't add any security.
Allow the verification of proxy certificates.
As of OpenSSL 1.1.0 this option is on by default and cannot be disabled.
When constructing the certificate chain, the trusted certificates specified via -CAfile, -CApath, -CAstore or -trusted are always used before any certificates specified via -untrusted.
As of OpenSSL 1.1.0, since -trusted_first always on, this option has no effect.
Parse file as a set of one or more certificates. Each of them qualifies as trusted if has a suitable positive trust attribute or it is self-signed or the -partial_chain option is specified. This option implies the -no-CAfile, -no-CApath, and -no-CAstore options and it cannot be used with the -CAfile, -CApath or -CAstore options, so only certificates specified using the -trusted option are trust anchors. This option may be used multiple times.
Parse file as a set of one or more certificates. All certificates (typically of intermediate CAs) are considered untrusted and may be used to construct a certificate chain from the target certificate to a trust anchor. This option may be used multiple times.
Enable policy processing and add arg to the user-initial-policy-set (see RFC5280). The policy arg can be an object name an OID in numeric form. This argument can appear more than once.
Set policy variable require-explicit-policy (see RFC5280).
Enables certificate policy processing.
Print out diagnostics related to policy processing.
Set policy variable inhibit-any-policy (see RFC5280).
Set policy variable inhibit-policy-mapping (see RFC5280).
The intended use for the certificate. Currently defined purposes are sslclient
, sslserver
, nssslserver
, smimesign
, smimeencrypt
, crlsign
, ocsphelper
, timestampsign
, codesign
and any
. If peer certificate verification is enabled, by default the TLS implementation as well as the commands s_client and s_server check for consistency with TLS server or TLS client use, respectively.
While IETF RFC 5280 says that id-kp-serverAuth and id-kp-clientAuth are only for WWW use, in practice they are used for all kinds of TLS clients and servers, and this is what OpenSSL assumes as well.
Limit the certificate chain to num intermediate CA certificates. A maximal depth chain can have up to num+2 certificates, since neither the end-entity certificate nor the trust-anchor certificate count against the -verify_depth limit.
Verify if email matches the email address in Subject Alternative Name or the email in the subject Distinguished Name.
Verify if hostname matches DNS name in Subject Alternative Name or Common Name in the subject certificate.
Verify if ip matches the IP address in Subject Alternative Name of the subject certificate.
Use default verification policies like trust model and required certificate policies identified by name. The trust model determines which auxiliary trust or reject OIDs are applicable to verifying the given certificate chain. They can be given using the -addtrust and -addreject options for openssl-x509(1). Supported policy names include: default, pkcs7, smime_sign, ssl_client, ssl_server. These mimics the combinations of purpose and trust settings used in SSL, CMS and S/MIME. As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not specified, so the -verify_name options are functionally equivalent to the corresponding -purpose settings.
Sometimes there may be more than one certificate chain leading to an end-entity certificate. This usually happens when a root or intermediate CA signs a certificate for another a CA in other organization. Another reason is when a CA might have intermediates that use two different signature formats, such as a SHA-1 and a SHA-256 digest.
The following options can be used to provide data that will allow the OpenSSL command to generate an alternative chain.
Specify an extra certificate, private key and certificate chain. These behave in the same manner as the -cert, -key and -cert_chain options. When specified, the callback returning the first valid chain will be in use by the client.
Specify whether the application should build the certificate chain to be provided to the server for the extra certificates via the -xkey, -xcert, and -xchain options.
The input format for the extra certificate. This option has no effect and is retained for backward compatibility only.
The input format for the extra key. This option has no effect and is retained for backward compatibility only.
Options like -purpose lead to checking the certificate extensions, which determine what the target certificate and intermediate CA certificates can be used for.
The basicConstraints extension CA flag is used to determine whether the certificate can be used as a CA. If the CA flag is true then it is a CA, if the CA flag is false then it is not a CA. All CAs should have the CA flag set to true.
If the basicConstraints extension is absent, which includes the case that it is an X.509v1 certificate, then the certificate is considered to be a "possible CA" and other extensions are checked according to the intended use of the certificate. The treatment of certificates without basicConstraints as a CA is presently supported, but this could change in the future.
If the keyUsage extension is present then additional restraints are made on the uses of the certificate. A CA certificate must have the keyCertSign bit set if the keyUsage extension is present.
The extKeyUsage (EKU) extension places additional restrictions on the certificate uses. If this extension is present (whether critical or not) the key can only be used for the purposes specified.
A complete description of each check is given below. The comments about basicConstraints and keyUsage and X.509v1 certificates above apply to all CA certificates.
The extended key usage extension must be absent or include the "web client authentication" OID. The keyUsage extension must be absent or it must have the digitalSignature bit set. The Netscape certificate type must be absent or it must have the SSL client bit set.
The extended key usage extension must be absent or include the "web client authentication" OID. The Netscape certificate type must be absent or it must have the SSL CA bit set. This is used as a work around if the basicConstraints extension is absent.
The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. The keyUsage extension must be absent or it must have the digitalSignature, the keyEncipherment set or both bits set. The Netscape certificate type must be absent or have the SSL server bit set.
The extended key usage extension must be absent or include the "web server authentication" and/or one of the SGC OIDs. The Netscape certificate type must be absent or the SSL CA bit must be set. This is used as a work around if the basicConstraints extension is absent.
For Netscape SSL clients to connect to an SSL server it must have the keyEncipherment bit set if the keyUsage extension is present. This isn't always valid because some cipher suites use the key for digital signing. Otherwise it is the same as a normal SSL server.
The extended key usage extension must be absent or include the "email protection" OID. The Netscape certificate type must be absent or should have the S/MIME bit set. If the S/MIME bit is not set in the Netscape certificate type then the SSL client bit is tolerated as an alternative but a warning is shown. This is because some Verisign certificates don't set the S/MIME bit.
In addition to the common S/MIME client tests the digitalSignature bit or the nonRepudiation bit must be set if the keyUsage extension is present.
In addition to the common S/MIME tests the keyEncipherment bit must be set if the keyUsage extension is present.
The extended key usage extension must be absent or include the "email protection" OID. The Netscape certificate type must be absent or must have the S/MIME CA bit set. This is used as a work around if the basicConstraints extension is absent.
The keyUsage extension must be absent or it must have the CRL signing bit set.
The normal CA tests apply. Except in this case the basicConstraints extension must be present.
The issuer checks still suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that trusted certificates with matching subject name must appear in a file (as specified by the -CAfile option), a directory (as specified by -CApath), or a store (as specified by -CAstore). If there are multiple such matches, possibly in multiple locations, only the first one (in the mentioned order of locations) is recognised.
X509_verify_cert(3), openssl-verify(1), openssl-ocsp(1), openssl-ts(1), openssl-s_client(1), openssl-s_server(1), openssl-smime(1), openssl-cmp(1), openssl-cms(1)
The checks enabled by -x509_strict have been extended in OpenSSL 3.0.
Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.


Nic Newman
Story of how they got it wrong and then put it right.
History: 2yrs ago, Weather site was pretty dated and had grand ambitions to update site. - Editorially led site - No product manager - No audience research plan - Drew wrong conclusions from research they did do
[video]
Product took over a year to get out. BBC recorded thousands of complaints. Within 2-3 months it was re-launched, solving most of the problems. Site retested in beta with people who complained the last time around.
In original version did lots of focus groups and used this to decide what to do. eg ppl said they wanted everything on one page, so they did (without checking that it was right). Second thing was beta test was on folks that were weather nuts so they wanted all the detail. Public wanted simplicity.
For version 2, checked people's complaints and coded them so that there was a top ten list of things people didn't like. Then went back out to focus groups. Found people who were really angry and tried to work with these people to improve. Pressure from above (director general et al) meant quick wins were important.
Beta test 2, tested on 1300 people and survey on their views in comparison with old weather site. Some quantitative data made a big difference when talking to DG about whether new site is going to work.
Key learnings: - Have audience insight plan a - Qualitative followed by quantitative test is key - Make it iterative ... Audience research, usability and dev going concurrently - Regular testing to ensure that NetPromoter detractors and promoters both accept changes - Audience insights to inform communication plans of changes
Surveys and click-tracking. Eg of 1300 people, how many get to the forecast page and how many personalize the homepage.
Is it important to build the tracking into the homepage?
Yes, important not only in final site but also in the beta sites etc.
Is there danger that some of the ppl who complain the loudest are not representative?