Details of the New Zealand ISM Restricted Regulatory Compliance built-in initiative
The following article details how the Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in New Zealand ISM Restricted. For more information about this compliance standard, see New Zealand ISM Restricted . To understand Ownership , see Azure Policy policy definition and Shared responsibility in the cloud .
The following mappings are to the New Zealand ISM Restricted controls. Use the navigation on the right to jump directly to a specific compliance domain . Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the New Zealand Information Security Manual Regulatory Compliance built-in initiative definition.
Important
Each control below is associated with one or more Azure Policy definitions. These policies may help you assess compliance with the control; however, there often is not a 1:1 or complete match between a control and one or more policies.  In addition, the compliance standard includes controls that aren't addressed by any Azure Policy definitions at this time. Therefore, compliance in Azure Policy is only a partial view of your overall compliance status. The associations between compliance domains, controls, and Azure Policy definitions for this compliance standard may change over time. To view the change history, see the GitHub Commit History .
Information security monitoring
6.2.5 Conducting vulnerability assessments
ID : NZISM Security Benchmark ISM-3 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| A vulnerability assessment solution should be enabled on your virtual machines | Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you. | AuditIfNotExists, Disabled | 3.0.0 |
| Deprecated accounts with owner permissions should be removed from your subscription | Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in. | AuditIfNotExists, Disabled | 3.0.0 |
| Vulnerabilities in container security configurations should be remediated | Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center. | AuditIfNotExists, Disabled | 3.0.0 |
| Vulnerabilities in security configuration on your machines should be remediated | Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations | AuditIfNotExists, Disabled | 3.0.0 |
| Vulnerabilities in security configuration on your virtual machine scale sets should be remediated | Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks. | AuditIfNotExists, Disabled | 3.0.0 |
| Vulnerabilities on your SQL databases should be remediated | Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities. | AuditIfNotExists, Disabled | 4.0.0 |
| Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports | Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers. | AuditIfNotExists, Disabled | 2.0.0 |
| Vulnerability assessment should be enabled on SQL Managed Instance | Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. | AuditIfNotExists, Disabled | 1.0.1 |
| Vulnerability assessment should be enabled on your SQL servers | Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. | AuditIfNotExists, Disabled | 2.0.0 |
Product Security
12.4.4 Patching vulnerabilities in products
ID : NZISM Security Benchmark PRS-5 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deprecated accounts should be removed from your subscription | Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in. | AuditIfNotExists, Disabled | 3.0.0 |
| Deprecated accounts with owner permissions should be removed from your subscription | Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in. | AuditIfNotExists, Disabled | 3.0.0 |
| External accounts with owner permissions should be removed from your subscription | External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access. | AuditIfNotExists, Disabled | 3.0.0 |
| External accounts with write permissions should be removed from your subscription | External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access. | AuditIfNotExists, Disabled | 3.0.0 |
| System updates on virtual machine scale sets should be installed | Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure. | AuditIfNotExists, Disabled | 3.0.0 |
| System updates should be installed on your machines | Missing security system updates on your servers will be monitored by Azure Security Center as recommendations | AuditIfNotExists, Disabled | 3.0.0 |
Software security
14.1.9 Maintaining hardened SOEs
ID : NZISM Security Benchmark SS-2 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deploy Dependency agent for Windows virtual machine scale sets | Deploy Dependency agent for Windows virtual machine scale sets if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all virtual machines in the set by calling upgrade on them. In CLI this would be az vmss update-instances. | deployIfNotExists | 1.3.0 |
| Endpoint protection solution should be installed on virtual machine scale sets | Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities. | AuditIfNotExists, Disabled | 3.0.0 |
| Microsoft IaaSAntimalware extension should be deployed on Windows servers | This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed. | AuditIfNotExists, Disabled | 1.0.0 |
| Monitor missing Endpoint Protection in Azure Security Center | Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations | AuditIfNotExists, Disabled | 3.0.0 |
14.2.4 Application Whitelisting
ID : NZISM Security Benchmark SS-4 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Adaptive application controls for defining safe applications should be enabled on your machines | Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications. | AuditIfNotExists, Disabled | 3.0.0 |
14.5.8 Web applications
ID : NZISM Security Benchmark SS-8 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| API App should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled | 1.0.0 |
| CORS should not allow every resource to access your Web Applications | Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app. | AuditIfNotExists, Disabled | 1.0.0 |
| Function App should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled | 1.0.0 |
| Only secure connections to your Azure Cache for Redis should be enabled | Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking | Audit, Deny, Disabled | 1.0.0 |
| Web Application should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled | 1.0.0 |
Access Control and Passwords
16.1.32 System User Identification
ID : NZISM Security Benchmark AC-2 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| A maximum of 3 owners should be designated for your subscription | It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner. | AuditIfNotExists, Disabled | 3.0.0 |
| Audit Linux machines that allow remote connections from accounts without passwords | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords | AuditIfNotExists, Disabled | 1.0.0 |
| Audit Linux machines that have accounts without passwords | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords | AuditIfNotExists, Disabled | 1.0.0 |
| Audit Windows machines missing any of specified members in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Audit Windows machines that have extra accounts in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Audit Windows machines that have the specified members in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Deploy Dependency agent for Windows virtual machines | Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | deployIfNotExists | 1.3.0 |
| Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs | This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol . | deployIfNotExists | 1.0.0 |
| Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs | This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol . | deployIfNotExists | 1.0.0 |
| Service Fabric clusters should only use Azure Active Directory for client authentication | Audit usage of client authentication only via Azure Active Directory in Service Fabric | Audit, Deny, Disabled | 1.1.0 |
| There should be more than one owner assigned to your subscription | It is recommended to designate more than one subscription owner in order to have administrator access redundancy. | AuditIfNotExists, Disabled | 3.0.0 |
16.1.35 Methods for system user identification and authentication
ID : NZISM Security Benchmark AC-3 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| MFA should be enabled accounts with write permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
| MFA should be enabled on accounts with owner permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
| MFA should be enabled on accounts with read permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
16.1.40 Password selection policy
ID : NZISM Security Benchmark AC-4 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deploy Dependency agent for Windows virtual machines | Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | deployIfNotExists | 1.3.0 |
| Windows machines should meet requirements for 'Security Settings - Account Policies' | Windows machines should have the specified Group Policy settings in the category 'Security Settings - Account Policies' for password history, age, length, complexity, and storing passwords using reversible encryption. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . | AuditIfNotExists, Disabled | 2.0.0 |
16.1.46 Suspension of access
ID : NZISM Security Benchmark AC-5 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deploy Dependency agent for Windows virtual machines | Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | deployIfNotExists | 1.3.0 |
| Deprecated accounts should be removed from your subscription | Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in. | AuditIfNotExists, Disabled | 3.0.0 |
| Deprecated accounts with owner permissions should be removed from your subscription | Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in. | AuditIfNotExists, Disabled | 3.0.0 |
16.2.5 Protecting compartmented information on systems
ID : NZISM Security Benchmark AC-7 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Management ports of virtual machines should be protected with just-in-time network access control | Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations | AuditIfNotExists, Disabled | 3.0.0 |
| Remote debugging should be turned off for API Apps | Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 1.0.0 |
| Remote debugging should be turned off for Function Apps | Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 1.0.0 |
| Remote debugging should be turned off for Web Applications | Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 1.0.0 |
16.3.5 Use of Privileged Accounts
ID : NZISM Security Benchmark AC-9 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Audit Windows machines missing any of specified members in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Audit Windows machines that have extra accounts in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Audit Windows machines that have the specified members in the Administrators group | Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter. | auditIfNotExists | 1.0.0 |
| Deploy Dependency agent for Windows virtual machines | Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | deployIfNotExists | 1.3.0 |
| Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs | This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol . | deployIfNotExists | 1.0.0 |
16.6.6 Maintaining System Management Logs
ID : NZISM Security Benchmark AC-13 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Azure subscriptions should have a log profile for Activity Log | This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub. | AuditIfNotExists, Disabled | 1.0.0 |
16.6.7 Content of system management logs
ID : NZISM Security Benchmark AC-14 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| [Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted | Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | auditIfNotExists | 1.0.0-preview |
| Audit diagnostic setting | Audit diagnostic setting for selected resource types | AuditIfNotExists | 1.0.0 |
| Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted | Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. | auditIfNotExists | 1.0.1 |
| Audit Log Analytics workspace for VM - Report Mismatch | Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment. | audit | 1.0.1 |
16.6.13 Event log archives
ID : NZISM Security Benchmark AC-15 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Activity log should be retained for at least one year | This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0). | AuditIfNotExists, Disabled | 1.0.0 |
16.7.34 System Architecture and Security Controls
ID : NZISM Security Benchmark AC-17 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| MFA should be enabled accounts with write permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
| MFA should be enabled on accounts with owner permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
| MFA should be enabled on accounts with read permissions on your subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources. | AuditIfNotExists, Disabled | 3.0.0 |
Cryptography
17.1.46 Reducing storage and physical transfer requirements
ID : NZISM Security Benchmark CR-2 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Disk encryption should be applied on virtual machines | Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations. | AuditIfNotExists, Disabled | 2.0.0 |
17.4.16 Using TLS
ID : NZISM Security Benchmark CR-6 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs | This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol . | deployIfNotExists | 1.0.0 |
| Latest TLS version should be used in your API App | Upgrade to the latest TLS version | AuditIfNotExists, Disabled | 1.0.0 |
| Latest TLS version should be used in your Function App | Upgrade to the latest TLS version | AuditIfNotExists, Disabled | 1.0.0 |
| Latest TLS version should be used in your Web App | Upgrade to the latest TLS version | AuditIfNotExists, Disabled | 1.0.0 |
| Windows web servers should be configured to use secure communication protocols | To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols. | AuditIfNotExists, Disabled | 2.0.0 |
Network security
18.1.13 Limiting network access
ID : NZISM Security Benchmark NS-2 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Adaptive network hardening recommendations should be applied on internet facing virtual machines | Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface | AuditIfNotExists, Disabled | 3.0.0 |
| Internet-facing virtual machines should be protected with network security groups | Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc | AuditIfNotExists, Disabled | 3.0.0 |
| Storage account public access should be disallowed | Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it. | audit, deny, disabled | 2.0.1-preview |
| Storage accounts should restrict network access | Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges | Audit, Deny, Disabled | 1.1.1 |
18.3.19 Content of a Denial of Service (DoS) response plan
ID : NZISM Security Benchmark NS-5 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Azure DDoS Protection Standard should be enabled | DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP. | AuditIfNotExists, Disabled | 3.0.0 |
18.4.10 Malicious code counter-measures
ID : NZISM Security Benchmark NS-7 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| All Internet traffic should be routed via your deployed Azure Firewall | Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall | AuditIfNotExists, Disabled | 3.0.0-preview |
| Web Application Firewall (WAF) should be enabled for Application Gateway | Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules. | Audit, Deny, Disabled | 1.0.1 |
| Web Application Firewall (WAF) should be enabled for Azure Front Door Service service | Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules. | Audit, Deny, Disabled | 1.0.1 |
| Web Application Firewall (WAF) should use the specified mode for Application Gateway | Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway. | Audit, Deny, Disabled | 1.0.0 |
| Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service | Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service. | Audit, Deny, Disabled | 1.0.0 |
Data management
20.3.10 Antivirus scans
ID : NZISM Security Benchmark DM-4 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Deploy Dependency agent for Windows virtual machine scale sets | Deploy Dependency agent for Windows virtual machine scale sets if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all virtual machines in the set by calling upgrade on them. In CLI this would be az vmss update-instances. | deployIfNotExists | 1.3.0 |
| Endpoint protection solution should be installed on virtual machine scale sets | Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities. | AuditIfNotExists, Disabled | 3.0.0 |
| Monitor missing Endpoint Protection in Azure Security Center | Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations | AuditIfNotExists, Disabled | 3.0.0 |
| Windows Defender Exploit Guard should be enabled on your machines | Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only). | AuditIfNotExists, Disabled | 1.1.1 |
20.4.4 Database files
ID : NZISM Security Benchmark DM-6 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Advanced data security should be enabled on SQL Managed Instance | Audit each SQL Managed Instance without advanced data security. | AuditIfNotExists, Disabled | 1.0.1 |
| Advanced data security should be enabled on your SQL servers | Audit SQL servers without Advanced Data Security | AuditIfNotExists, Disabled | 2.0.0 |
| An Azure Active Directory administrator should be provisioned for SQL servers | Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services | AuditIfNotExists, Disabled | 1.0.0 |
| Audit diagnostic setting | Audit diagnostic setting for selected resource types | AuditIfNotExists | 1.0.0 |
| Disk encryption should be applied on virtual machines | Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations. | AuditIfNotExists, Disabled | 2.0.0 |
| Only secure connections to your Azure Cache for Redis should be enabled | Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking | Audit, Deny, Disabled | 1.0.0 |
| Secure transfer to storage accounts should be enabled | Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking | Audit, Deny, Disabled | 2.0.0 |
| Transparent Data Encryption on SQL databases should be enabled | Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements | AuditIfNotExists, Disabled | 1.0.0 |
| Windows web servers should be configured to use secure communication protocols | To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols. | AuditIfNotExists, Disabled | 2.0.0 |
Enterprise systems security
22.1.22 Offshore Services
ID : NZISM Security Benchmark ESS-2 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Allowed locations | This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements. Excludes resource groups, Microsoft.AzureActiveDirectory/b2cDirectories, and resources that use the 'global' region. | deny | 1.0.0 |
| Allowed locations for resource groups | This policy enables you to restrict the locations your organization can create resource groups in. Use to enforce your geo-compliance requirements. | deny | 1.0.0 |
22.1.26 Backup, Recovery Archiving and Data Remanence
ID : NZISM Security Benchmark ESS-3 Ownership : Customer
|
Name
(Azure portal) |
Description | Effect(s) |
Version
(GitHub) |
|---|---|---|---|
| Audit virtual machines without disaster recovery configured | Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc . | auditIfNotExists | 1.0.0 |
Note
Availability of specific Azure Policy definitions may vary in Azure Government and other national clouds.
Next steps
Additional articles about Azure Policy:
- Regulatory Compliance overview.
- See the initiative definition structure .
- Review other examples at Azure Policy samples .
- Review Understanding policy effects .
- Learn how to remediate non-compliant resources .


AppDecoder
Upload your current design
Add files...
Start upload
Cancel upload
Note: For the current version, you need to upload one UI screenshot, and its semantic annoation.
Revise your design!
Start
Cancel
Delete


About 60 miles (97 km) east of Seoul, South Korea, you will find a gigantic two-story building in the shape of a Rolleiflex, a popular line of medium format twin lens reflex (TLR) cameras.
Inside is a coffee shop with vintage cameras and accessories on display. The Dreamy Camera cafe is the brainchild of a camera enthusiast and ex-helicopter pilot in the Republic of Korea Air Force (ROKAF). The shop is open daily from 11 am and closes at 6pm from Monday – Friday, and 8 pm on Saturday and Sunday.
You can find more information on the shop’s Facebook page and blog. In the information section on Facebook, the address posted is: 341-13, Jung-won-ri, Yongmun-myeon, Yangpyeong-gun, Gyeonggi-do, South Korea and is located about 7km from Yongmun Station.
I think Passion is one of the greatest word in the world.  Sometimes, I asked myself, what do I love the most, so I can give myself the best in the things I do. I do think, I really enjoy taking photos, cafe-hopping and sharing more about the places I love in my blog. And making everything into reality is never easy… and the cafe I went is a mixture of passion and dream. Building a dream to reality – Dreamy Camera Cafe.


Name:Fazil Mohammed
Login:jc479917
The WebSite is developed In such a way for ascenting the business of the Client. This Website Will help the client to attract more Youngsters and School Going Chidren to involve in his Business
A counter is being designed to check the number of people visiting the site everyday.After creating a site for cossieplay,the number of visitors has considerably increased
The main target audience are children and youngsters
...


Hello! My name is Evica Mai and I am nineteen years old. I have live "the City of FLowers" (GuangZhou, China). Since middle school, I fell in love with game playthroughs and game graphics, which introduced me to a program in Fanshawe College involving web development. I hope the skill set and knowledge I earn from the experience will expand the basic foundation I have from a general computer science high school course. To be honest, I hope the experience will help me familiarize myself with digital approaches, as opposed to the usual traditional methods, such as pen and paper.
As the saying goes, "A picture is worth a thousand words." So, here are a few pictures that will help you know more about me. I do not have any recent pictures of myself since I barely go outside, even more so due to the global 'incident'.
This picture was taken around Chinese New Years of the year 2020, before the chaos ensued. I took a selfie with my mother as seen above (I am on the right side in case you think I was swept away by the crowd). I have a love and hate relationship with these kinds of scenes, where the place is packed with people, like sardines in a can. I dislike crowds since it made me feel suffocated, especially with my small stature. I love huge crowds since they make the special events feel truly festive to celebrate and be happy together, as well as wish each other (stranger or not) fortune and good health. Now, this makes me miss these moments and appreciate the freedom we had before empty places became the norm for a period of time.
I recently went to a restaurant called "Small Shell" (literal translation) and their food is always top-notch, as well as their cutsomer service. I tasted a dish, which I am not sure is considered a 'cupcake,' but the cupcake displayed above is sweet with a tint of saltiness and sprinkled with sunflower seeds. If you think the dish is odd, that's alright.  Seeing the picture is instantly reminding me of the heavenly smell and taste.
I love zoos, but my stamina could not handle the walking required since the zoos are huge in GuangZhou. The one I visited for the picture above was so huge I could not bother touring the entire place. Instead, I took a shortcut to the exit. Before leaving, there were a few last displays ranging from parrots to peacocks. One of these displays contained the little colourful guy displayed above. I forgot what type of species he is, but he looks like a combination between a grouse and a peacock. I was about to take a picture and he popped by at the right time!


## Intermediate OOP in Drupal
### Overview
1. Terminology
1. Concepts
1. Useful OOP Patterns
1. Drupal / Symfony
1. Recap
## Terminology - Class Basics
| Term | Definition |
| --- | --- |
| Interface | Template (aka, contract) for a class. Classes "implement" interfaces |
| Class | Template for an object that defines the properties (variables and methods (functions) of an object |
| Object | An instance of a class |
```php
interface PizzaInterface {}
```
```php
class Pizza implements PizzaInterface {}
```
```php
$pizza1 = new Pizza();
$pizza2 = new Pizza();
```
## Terminology - Interfaces
Defines required method signatures of a class
```php
interface PizzaInterface {
/**
* Add a topping to the pizza.
*
* @param string $topping
*/
public function addTopping($topping);
/**
* Get all toppings on the pizza.
*
* @return array
*/
public function getToppings();
}
```
## Terminology - Classes
Provides implementation details of the methods defined in interfaces.
> Classes "implement" interfaces.
```php
class Pizza implements PizzaInterface {
private $toppings = [];
public function addTopping($topping) {
$this->toppings[] = $topping;
}
public function getToppings() {
return $this->toppings;
}
}
```
## Terminology - Objects
Objects are unique instances of a Class
```php
$pizza1 = new Pizza();
$pizza1->addTopping('sauce');
$pizza1->addTopping('cheese');
print_r($pizza1->getToppings());
/*
Array
0 => sauce
1 => cheese
*/
$pizza2 = new Pizza();
$pizza2->addTopping('mustard');
print_r($pizza2->getToppings());
/*
Array
0 => mustard
*/
```
## Terminology - Visibility
What parts of class can be used other parts of the system
| Term | Definition |
| --- | --- |
| Public | Everything can use and modify public properties and run methods |
| Private | Restricted access to only methods within the class |
| Protected | Restricted to the class and its descendents |
## Visibility Example
```php
class Pizza {
// Only this class and its descendents can access this property.
protected $toppings = [];
// Any part of the system can run this method.
public function getToppings() {
return $this->toppings;
}
// Only this class can run this method.
private function removeAllToppings() {
$this->toppings = [];
}
}
```
```php
$pizza = new Pizza();
$pizza->toppings; // Fatal error
$pizza->removeAllToppings(); // Fatal error
$pizza->getToppings(); // This works!
```
## Types & Type Hinting
When creating classes, we are creating new Data Types
```php
// Creating a class defines a new Type - Pizza & PizzaOven
class Pizza {}
```
```php
class PizzaOven {
// Hint that a Pizza object is the required data type
public function cook(Pizza $any_pizza) {}
}
```
```php
$my_pizza = new Pizza();
var_dump(is_a($my_pizza, 'Pizza')); // outputs "bool(true)"
$my_oven = new PizzaOven();
var_dump(is_a($my_oven, 'PizzaOven')); // outputs "bool(true)"
$my_oven->cook($my_pizza); // Works.
$not_a_pizza = 'hello world';
$oven->cook($not_a_pizza); // Fatal error!
```
## Inheritance - Extending Classes
We can create new classes that are based on other classes by "extend"ing a class
```php
class Pizza {
public $toppings = [];
public function addTopping($topping) {
$this->toppings[] = $topping;
}
}
```
```php
class MustardPizza extends Pizza {
public function addMustard() {
$this->toppings[] = 'mustard';
}
}
```
```php
$my_pizza = new MustardPizza();
$my_pizza->addTopping('cheese');
$my_pizza->addMustard();
var_dump(is_a($my_pizza, 'MustardPizza')); // outputs "bool(true)"
var_dump(is_a($my_pizza, 'Pizza')); // outputs "bool(true)"
```
## Inheritance - Interfaces
Implementing interfaces is another form of inheritance
```php
interface PizzaInterface {}
```
```php
class Pizza implements PizzaInterface {}
```
```php
$pizza = new Pizza();
var_dump(is_a($pizza, 'Pizza')); // outputs "bool(true)"
var_dump(is_a($pizza, 'PizzaInterface')); // outputs "bool(true)"
```
## Best Practice Alert!!!
Program to Interfaces
```php
class PizzaOven {
// Don't do this, or we'll never be able to cook our MustardPizza.
public function cook(Pizza $pizza) {}
// Do this. Type hint the interface.
public function cook(PizzaInterface $pizza) {}
}
```
#### Practical Implication?
1. Write interfaces when creating new custom classes
1. Type-hint interfaces when creating new class methods
## Concepts
### Object Design Best Practices
| Concept | Description |
| --- | --- |
| Nouns & Verbs | Two ways to think about what a class should and shouldn't do |
| Dependencies | When objects depend on other parts of the system to operate successfully |
| Composition | An approach to building complex objects that encourages flat object architecture (less inheritance) |


Simple Calculator
Addition
+
=
Caculate
Subtraction
-
=
Caculate
Multiplication
*
=
Caculate
Division
/
=
Caculate


☰
CODING
DESIGN
RESUME
ABOUT
LET’S EAT
app conception & design
THE ILLUMINATI CHALLENGE
maze hat game
PLAYFULL
UI UX design
THE BEST BURGER
board game
WHO’S GOT GAME
UI UX design
DAILY BRUIN GRAPHICS
selected infographics
GHOSTS IN THE GARDEN
board game
BELLA GEMS ORIGINALS
branding
VIDEOS
selected motion graphics
ILLOS & PROMO MATERIAL
misc


This sample shows how to remove child nodes older than 2 hours from a Firebase Database list. This can be useful for removing outdated items from a collection.
See file functions/index.js for the code.
Note that this code only runs when triggered by a write to the list. This means that if nothing gets written for a while, the list may still contain outdated items. If that does not match with your use-case, you should modify the code to trigger based on a time-interval as shown in this sample.
The dependencies are listed in functions/package.json.
The example uses the database structure shown below:
/functions-project-12345
/path
/to
/items
item1: {
timestamp:<PHONE_NUMBER>083
},
item2: {
timestamp:<PHONE_NUMBER>083
}
...
The default cutoff interval is 2 hours, meaning that items older than 2 hours are deleted. You can modify the code to match your database structure and cutoff requirements.


We extend mices!
- iterate viral architectures
- leverage rich content
- e-enable back-end partnerships
- synergize plug-and-play supply-chains
- productize turn-key partnerships
- unleash 24/365 web-readiness
- empower transparent platforms
- utilize real-time infomediaries
- brand enterprise markets
- streamline strategic interfaces
- whiteboard turn-key e-tailers


Fabric points
Every line in the parcel fabric must have two points at each end that it references using the ‘FromPointID’ field and the ‘ToPointID’ field. When points exist in the fabric that do not have associated lines, they are considered “orphan” points. Orphan points may have occurred as a result of problems in the earlier software releases that have since been addressed.
This fabric scan process will first build a list of all the points and their object ids from the fabric points table. The scan will then check the fabric lines table for each line record’s ‘FromPointId’ and ‘ToPointID’ value, and will remove the ids that it finds from the first points list. Any points that remain in the original points list are reported as orphan points and may, optionally, be deleted. The report presents an IN clause SQL statement that may be copy and pasted for use in the fabric points sublayer’s definition query, or for use in the select by attributes command for the points.


RegEx101
Donate
Contact
Bug reports & Suggestions
regular
expressions
101
reg
ex
101
Regex Tester
Regex Library
IRC
General Settings
Display Whitespace
Use minimal view
Theme
Use light theme
Use dark theme
Regex Settings
Colorize syntax
Theme:
Default
Default - Light
Default
Enable smart auto-completion
Wrap long lines
Highlight groups
Show non-participating groups
Max execution time:
ms
Initializing editor, please stand by...
Loading content, please hold...
 Please enable JavaScript to use this service. If you don't know how, try
this
.
You seem to be using an outdated version of your browser which is no longer supported by
regex101.com
. It is highly recommended that you upgrade your browser. Sorry for the inconvenience.
Save & Share
Save Regex (CTRL+S)
Fork Regex
Add to Regex Library
Flavor
PCRE
PCRE (PHP)
JS
JavaScript
PY
Python
Tools
Format Regex (requires free-spacing, /x)
Code Generator
Regex Debugger
n/a
Unit tests
Filter flavors
PCRE
PCRE (PHP)
JS
JavaScript
PY
Python
Filter type
View favorites
View contributions
Consider a donation
Status: Fetching debug info...
Display position in pattern
Disable internal engine optimizations
collapse all
Regular Expression
—
no match
/
/
Test string
Substitution
Create test
Add test
given the string
assert that
Test list
n/a
Explanation
An explanation of your regex will be automatically generated as you type.
Match information
Detailed match information will be displayed here automatically.
Quick reference
Full reference
Most used tokens
All tokens
Categories
General tokens
Anchors
Meta sequences
Quantifiers
Group constructs
Character classes
Flags/Modifiers
Substitution
Search result
/
~
@
;
%
`


It combines maximum likelihood estimation of the parameters of matrix and 3rd-order tensor normal distributions with unstructured factor variance-covariance matrices, two procedures, and unbiased modified likelihood ratio testing of simple and double separability for variance-covariance structures, two procedures.
| Version: | 0.2.1 |
| Depends: | R (≥ 3.3.0) |
| Published: | 2016-07-27 |
| Author: | Ameur Manceur [aut], Timothy Schwinghamer [aut, cre], Pierre Dutilleul [aut, cph] |
| Maintainer: | Timothy Schwinghamer <schwinghamer at hotmail.com> |
| License: | MIT + file LICENSE |
| NeedsCompilation: | no |
| CRAN checks: | sEparaTe results |
| Reference manual: | sEparaTe.pdf |
| Package source: | sEparaTe_0.2.1.tar.gz |
| Windows binaries: | r-devel: sEparaTe_0.2.1.zip, r-release: sEparaTe_0.2.1.zip, r-oldrel: sEparaTe_0.2.1.zip |
| OS X binaries: | r-release: sEparaTe_0.2.1.tgz, r-oldrel: sEparaTe_0.2.1.tgz |
| Old sources: | sEparaTe archive |
Please use the canonical form https://CRAN.R-project.org/package=sEparaTe to link to this page.


Utopia::Controller::Respond
A controller layer which provides a convenient way to respond to different requested content types. The order in which you add converters matters, as it determines how the incoming Accept: header is mapped, e.g. the first converter is also defined as matching the media range /.
Nested
Definitions
def process!(request, path)
Invokes super. If a response is generated, format it based on the Accept: header, unless the content type was already specified.
Implementation
def process!(request, path)
if response = super
headers = response[1]
# Don't try to convert the response if a content type was explicitly specified.
if headers[HTTP::CONTENT_TYPE]
return response
else
return self.response_for(request, response)
end
end
end


Hi!
I am a graduate student at Carnegie Mellon University where I study Electrical and Computer Engineering.
Aside from my interests in Science, Math, Engineering, and Computer Science,
I enjoy composing music, writing literature, painting, and traveling to different places.
Curriculum Vitae
Questions or comments welcomed at: connorrobinsonwalsh@gmail.com


Sync.
Videos, in sync
Watch any HTML5 compatiable video with your friends in sync.
Username
Room ID
Random
Connected Users
Play /
Pause
Sync
Video URL
Change Video


PrimeTime
Settings
Show Battery Indicator:
No
Yes
Show Bluetooth Indicator:
No
Yes
Vibrate on Disconnect:
No
Yes
Screen Color:
Dark
Light
Cancel
Reset
Submit


Firstly, there is no such thing as block scope in JavaScript. It makes JS different from other languages. JavaScript has function scope, i.e. the set of variables, objects, and functions with access to.
Therefore, variables declared within a function become local to the function only and variables with the same names can be used also in other functions. Those local variables are created when a function starts, and are deleted when the function is completed.
Variables declared outside a function, become global. It means that all scripts and functions on a web page can access and change it.
RESOURCES
© Some photos on this blog are linked to iStock Photo NZ and are used for learning purposes. Each photo that belongs to iStock is watermarked. If you'd like to get more amazing photos, please go directly to iStock website.


val compactBlockStore: CompactBlockStore
responsible for persisting the compact blocks that are received
compactBlockStore - responsible for persisting the compact blocks that are received
compactBlockStore


Elizabeth
[2.5/4.0]
Being a monarch during times of prosperity and stability is safe and easy, but when there is discord and dissatisfaction then it can be treacherous. This is the story of the ascent to the throne by Henry VIII's daughter, Elizabeth (Cate Blanchett). Although Henry had broken with the Catholic Church, his daughter, Mary, who followed him reestablished Catholicism as the official faith. She earned the nickname "Bloody Mary" for her relentless persecution of Protestants, usually having them denounced as heretics and burned at the stake. Mary's half sister, Elizabeth, is next in line for the crown, but she is a Protestant and thus a potential threat, so Mary has her imprisoned in the Tower of London, and Elizabeth's survival is placed in doubt. Ultimately Mary's health fails and an almost unprepared Elizabeth becomes the ruling monarch. However, her reign is anything but certain. The country is bankrupt, the military is weak, foreign powers are threatening, and there is internal dissension.
Being a novice at governance, Elizabeth is forced to rely on the opinions of her advisors. The elder Sir William Cecil (Richard Attenborough) is stressing that the safest action Elizabeth can take to stabilize her reign would be to marry a foreign royal to establish a political alliance and to produce an heir. However, Elizabeth's love interest is her longtime friend Robert Dudley (Joseph Fiennes). Beyond that, she does not wish submit herself to another man, and also wants England to remain strong and independent. To help stabilize her authority, Elizabeth has the help of her advisor Sir Francis Walsingham (Geoffrey Rush), who through guile and an intelligence network, seeks to find and destroy all who threaten Elizabeth's reign.
Elizabeth's fate is known through any reading of English history. Not only does she survive the unsteady early days of her rule, she remains fiercely independent, she never marries or produces and heir, and under her reign, England enters a "Golden Age" and once again flourishes. The film ends when an experienced and hardened Elizabeth establishes her power base, and it stops short of her rebuilding of England. And although the manner in which that was accomplished would have been interesting to see, the drama of her ascendence to power is compelling enough to provide enough substance to anchor the story.
One difficulty of telling a historical story is the necessity to condense several different occurrences from a large time period into a story that fits the running length of a film. The result of this is that characters and events can become oversimplified in their presentation. This film has this problem with several characters. Queen Mary is portrayed as nothing more than a repulsive and spiteful boor. In his introductory scene, Walsingham is presented as a ruthless and cold-hearted, and the character never evolves beyond this single dimension. As an advisor, he is conveniently all-knowing and all-powerful. Rush does not even play the character with anything besides a single, stoic facial expression. Elizabeth's royal French suitor, Duc d'Anjou, is presented as an exaggerated, foppish buffoon.
Although the direction of Shekar Kapur is mostly successful, there are times when his directorial flourishes become distracting. The injection of jump cuts when Elizabeth is practicing her speech before Parliament is jarring because it does not fit with the mood of the rest of the film. The washing out to white between the scenes when Elizabeth learns of her inheritance of the crown served no purpose, and only made the direction apparent.
The strength of the film is the well written and well performed role of Elizabeth. Blanchett credibly shows the character's evolution from a strong willed but naive young woman, to the capable and inspired monarch who would lift her country to prominence. Ultimately, the real story of Elizabeth is a fascinating one, and the film successfully translates it to the screen.
Recommended. The film is hampered by exaggerated characters and gaudy direction, but tells the interesting story of a fascinating individual.
(c) 1999 Murali Krishnan The Art House Squatter http://ArtHouseSquatter.com
-----------== Posted via Deja News, The Discussion Network ==---------- http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


An object is derived from Ptrlist, which contains a list of objrefs that the current object is connected to.


BREAKING Darren Till beats Kelvin Gastelum at UFC 244 on middleweight debut
Till was fighting at middleweight for the first time following back-to-back defeats at welterweight
by Martin Domin, https://www.facebook.com/mirrorfightingDarren Till made a winning debut at middleweight with a notable victory over Kelvin Gastelum.
We'll be bringing you the very latest updates, pictures and video on this breaking news story.
For the latest news and breaking news visit Mirror.co.uk/sport . Get all the big headlines, pictures, analysis, opinion and video on the stories that matter to you.
Follow us on Twitter @MirrorFootball - the official Daily Mirror & Mirror Online Twitter account - for breaking football news in real time.
We're also on Facebook/mirrorfootball - your must-see news, features, videos and pictures throughout the day from the Daily Mirror, Sunday Mirror and Mirror Online.


To prevent unnecessary changes to main source functionality implemented with custom control Slick.Controls.HeaderGroups
To make synchronous resize work with header groups apply pull request.
It's the only change to main files
Unfortunately works only with explicitInitialization:true in grid.
Because of that automatically call grid.init() after initialization.
Without this option horizontal scroll in grid disappear.
Demonstrates:
Header groups with colspan and auto resize
Multilevel hierarchy
Column reordering reaction
What needs to be done:
Better stylization
Work without explicitInitialization in grid
Rowspan in addition to colspan
Resize columns with groups, not only groups with columns


An important part of a widget toolkit is being able to write your own widgets. In many widget sets, you are confronted immediately with a quite complex set of unusual-looking functions - paint, draw, refresh and other manipulations. Pyjamas has none of that: in both Pyjamas and Pyjamas-Desktop you're manipulating the DOM model - an HTML page - as if it was an XML document. Better than that: unlike with manipulating an HTML page, you don't have to get involved with Javascript - unless you want to. Pyjamas provides a module which makes the job of controlling the underlying DOM model that much easier, and this tutorial shows step-by-step how to go about creating your own widget.
Missing from the HTML specification, but present in Adobe Flash, is things like sliders and dials. Many Desktop widget sets have them, so it makes a lot of sense to create one. We'll start with a simple Vertical scroller which receives "mouse click" to change the position. (For those people who would like to see the completed source code and the simple application in action, click here and here).
We start off by importing the DOM model and, because the slider will receive mouse (and later keyboard) events, we base it on FocusWidget. FocusWidget has the means to add keyboard and event listeners, set a "tab order" index, and to set and clear focus:
from pyjamas import DOM from pyjamas.ui import FocusWidget
So, we derive our class from FocusWidget. We don't declare a width and height as parameters, because Pyjamas Widgets are based on HTML principles: DOM models. So, you either set the CSS "Class" with setStyleName(), or you use the Pyjamas Widget functions setWidth() and setHeight(). We do however want to pass in the slider's minimum, maximum and default values, and we may also want to keep track of who might be interested to know that the slider's value has changed. This is an important point to emphasise: your widgets should not impose "look" onto users - that should, ideally be defined through CSS: your Widget Class API should be about "function" rather than "form". So - the constructor for the widget has minimum, maximum and default values not width and height.
class VerticalDemoSlider(FocusWidget): def __init__(self, min_value, max_value, start_value=None): element = DOM.createDiv() FocusWidget.__init__(self, element) self.min_value = min_value self.max_value = max_value if start_value is None: start_value = min_value self.value = start_value self.valuechange_listeners = []
Here also is the first actual bit of underlying HTML / DOM model showing through: we're basing the widget on a "div" tag, hence we call DOM.createDiv() and set that as the FocusWidget's element. (Immediately, therefore, you can see that the Pyjamas Widgets are effectively... "guardian" classes that look after and manipulate bits of the underlying DOM model, making the whole process of creating and maintaining your application just that little bit easier to understand). We're also going to copy what AbsolutePanel.__init__() does, making the container DIV free-moving, and we're also going to throw in a second hard-coded "div" for the actual slider handle:
DOM.setStyleAttribute(element, "position", "relative") DOM.setStyleAttribute(element, "overflow", "hidden") self.handle = DOM.createDiv() DOM.appendChild(element, self.handle)
Then, as this is just a demonstration, we're going to hand-code the slider handle with some attributes, making it 10 pixels high, a border of 1 pixel, fixing it to be the same width as the Widget, and making it a grey colour. A much better way to do this would be to set a CSS stylesheet where people could over-ride all these settings. Note that we don't use DOM.setAttribute() to set the border, width and height. You should consult HTML specifications: you will find that "border" is an attribute for DOM tags such as "table". So, if you try to call DOM.setAttribute() on a DIV tag, you'll find that it silently fails in the browser - or if you remember, and examine the Javascript Console, you might be lucky and find a warning. However, if you try the same thing under Pyjamas-Desktop you will be rewarded with a much more useful run-time error. The upshot is: pay attention to the underlying DOM model, and remember to simultaneously develop your app using both Pyjamas and Pyjamas-Desktop, to save yourself a great deal of time. If you want to set a border on a "div" tag, you must set it as a CSS Style attribute:
DOM.setStyleAttribute(self.handle, "border", "1px") DOM.setStyleAttribute(self.handle, "width", "100%") DOM.setStyleAttribute(self.handle, "height", "10px") DOM.setStyleAttribute(self.handle, "backgroundColor", "#808080")
With the basic beginnings, it's enough to test out, to see if we have it working. If all we wanted was a little grey box in our widget, we'd be entirely done.
""" testing our demo slider """ from pyjamas.ui import RootPanel from pyjamas.Controls import VerticalDemoSlider class ControlDemo: def onModuleLoad(self): b = VerticalDemoSlider(0, 100) RootPanel().add(b) b.setWidth("20px") b.setHeight("100px")
One thing I love about Pyjamas: this is enough code to do exactly what you want: create our slider, add it to the root panel, set its width to 20 pixels and the height to 100. Couldn't get any easier. A quick run of this code shows that yes, indeed, we have a little grey box, which is very exciting. Next on the list is to make it move, and for that, we'll add a "click listener".
To receive a click event, we use FocusWidget.addClickListener(). We're going to make the widget itself receive the mouse click event. Looking at FocusWidget.onBrowserEvent(), we can see that we must add a function called onClick() to our VerticalDemoSlider. As we want to know where the mouse was clicked, we will need to add two arguments to the onClick() function, in order to receive the mouse event object as the second. Then, we simply take the mouse event y position, the absolute location of the container, and the "offset height" of the widget, do a little math and, copying some lines of code from AbsolutePanel.setWidgetPosition, we can change the location of the slider handle:
def onClick(self, sender, event): # work out the relative position of cursor mouse_y = DOM.eventGetClientY(event) - \ DOM.getAbsoluteTop(sender.getElement()) self.moveSlider(mouse_y) def moveSlider(self, mouse_y): relative_y = mouse_y - DOM.getAbsoluteTop(self.getElement()) widget_height = self.getOffsetHeight() # limit the position to be in the widget! if relative_y < 0: relative_y = 0 height_range = widget_height - 10 # handle height is hard-coded if relative_y >= height_range: relative_y = height_range # move the handle DOM.setStyleAttribute(self.handle, "top", "%dpx" % relative_y) DOM.setStyleAttribute(self.handle, "position", "absolute")
Okay - let's test it! Save, run... lights, camera, action, aaand... nothing. huh. What have we done wrong? Oh yes, we forgot a very important line. Go back to VerticalDemoSlider.__init__ and add this, at the end, and try again:
self.addClickListener(self)
Amazing! We have a slider widget! A single-click moves the slider to where you clicked the mouse. Notice how the slider centre moves to where your mouse pointer actually points to: this is entirely a fluke, and is probably due to bugs in the CSS style implementation of your browser. Notice also that we haven't actually set the value of the "slider", but there's enough maths to calculate it. We can add these extra lines on to the end of moveSlider():
val_diff = self.max_value - self.min_value new_value = ((val_diff * relative_y) / height_range) + self.min_value self.setValue(new_value)
Then, we also add a setValue() function, which not only records the new value but also notifies any listeners. Copying the style of Label and other widgets' addClickListener() and removeClickListener() functions, we're doing addControlValueListener() and removeControlValueListener() to match.
def setValue(self, new_value): old_value = self.value self.value = new_value for listener in self.valuechange_listeners: listener.onControlValueChanged(self, old_value, new_value) def addControlValueListener(self, listener): self.valuechange_listeners.append(listener) def removeControlValueListener(self, listener): self.valuechange_listeners.remove(listener)
Now we should really see if that works. In the "test code", add these extra lines to ControlDemo.onModuleLoad() and also add the additional function onControlValueChanged:
b.addControlValueListener(self) self.label = Label("Not set yet") RootPanel().add(self.label) def onControlValueChanged(self, slider, old_value, new_value): self.label.setText("Value: %d" % int(new_value))
A quick run of this shows our Control Demo app has a very boring Text Label 200 pixels underneath a grey box, with the words "Not set yet". Clicking anywhere between the box and the words not only moves the slider, but also changes the text to say "Value: 83" or something to that effect. Amazing.
Congratulations, you have a slider, in 70 lines of python code, and a demonstration of its use in 20. You can click on it. Please feel free to resist the urge to press the up and down arrows and to click and hold the mouse: it won't work. Adding that functionality will be for another day's hacking, which you're welcome to send to me<EMAIL_ADDRESS>and I will add it in.
Hints: look at Image.onBrowserEvent() - you will notice that it differs from FocusWidget.onBrowserEvent() in that it also handles mouse move, enter, leave and up. These events all get passed to an instance of MouseListener(), calling its fireMouseEvent() function. Then, look at DialogBox and notice that it does all sorts of strange and wonderful things, including the use of "capture":
def onMouseDown(self, sender, x, y): self.dragging = True DOM.setCapture(self.caption.getElement()) self.dragStartX = x self.dragStartY = y
This is pretty important - to set "capture" of all mouse events. In the case of the Dialog Box, the events are captured by the "caption" at the top of the box, which is the "drag bar". That sounds... very much exactly like what we want, so feel free to cut-and-paste DialogBox's onMouseDown, onMouseUp, onMouseMove, onMouseLeave and onMouseEnter functions; remember to call VerticalDemoSlider.moveSlider() not setPopupPosition(); and remember to take a copy e.g. of Image.onBrowserEvent(), or take a copy of FocusWidget.onBrowserEvent() and extend it with these all-important lines:
elif type == "mouseup" or type == "mousemove" or type == "mouseover" or type == "mouseout": MouseListener().fireMouseEvent(self.mouseListeners, self, event)
That should give you a slider which now accepts mouse drag-move events, making it that little bit much more useful than one which deals in single-clicks. Once you've done that, of course, you might want to remove the onClick() altogether, because of course a single-click is also a mouse-down followed by a mouse-up event, often, in many cases, accompanied by intermediate but very brief mouse-move events. The end-result will be doubling- or possibly tripling- or more of value change notifications, all redundant, and all wasting CPU cycles.
Once you've done that, you might also wish to improve the widget further by detecting whether or not the mouse position was actually changed. Otherwise, you may end up with entirely unnecessary calls to onControlValueChanged(). Don't be tempted to short-cut the process by doing "if new_value != old_value", although this is, strictly speaking, needed as well. Record the old mouse position on mouse-down, and only start sending onControlValueChanged() notifications when the mouse "y" position differs from this recorded value.
As part of a c++ widget set I helped develop and maintain in 1992 we had "ganging" sliders, which were for Stereo Volume control. We created a "container" widget which allowed us to receive value changes from an arbitrary number of "Control" widgets placed within it. The "difference" between the old and new values were very important: we utilised these to make changes to the other volume slider, allowing users to set the Left volume slightly higher or lower than the Right volume, and then, on selecting the "Ganging" switch, both volumes would waggle up and down by the same amount, without mashing up to the same absolute value: an undesirable oversight.
We had quite a lot of fun making test applications with half a dozen sliders and dials, waggling one and watching the rest go bananas. Given that this was running on 386sx 25mhz systems, it was also quite impressive. As it was a real-time (single-process!) application, we had to pay particular attention to ensuring that the priority was on getting the volume values to the DSP as fast as possible, leaving visual changes as the absolute last priority-queued event. Yes, we have a message-event system, like in Windows 3.1, except we added "priority" to it, thus avoiding the need for threading and still giving the application both responsiveness as well as aural and visually accurate representation.
Any good "Control" widget system should keep these principles and lessons in mind.
So, you read this tutorial: you went wow, big deal: my imagination is now unlimited by the wondrous possibilities of being able to manipulate the DOM model of a "page" - a screen - in a quick and easy fashion. However, my requirements are beyond what "DOM model" can handle. I want video. I want 2D graphics. I want 3D graphics. What do I do?
There are two answers. The first one is: if your project requires advanced 2D graphics manipulation, there is always the SVG Canvas, if you have a web browser that can support SVG. The Pyjamas "Canvas" widget has been ported from the GWT Addons, and it works very well. Pyjamas-Desktop does not at the moment support SVG, however it is on the Roadmap.
Your second really "far out" option - given that the underlying technology is web-browser-based - is to use Web Plugins. For Safari, Netscape, Firefox and WebKit (the last in the case of Pyjamas-Desktop), you can write a plugin that conforms to the NPAPI standard, and you're away. I recommend that you start with the Adobe Flash plugin source code.
But, before you go writing your own 3D, Video or other Multimedia plugin, first check to see whether there is an existing NPAPI or existing Web-based plugin that you can place into an iframe or otherwise embed into a page. Can you write the plugin in Java, and run a Java applet in your page? Can you use Adobe Flash? All of these possibilites are open to you, with no extra particularly complex programming.


What to do if you haven't received your license
Once your transaction is complete it will be processed by an automated system and your license code will be sent to you immediately. If you still haven’t received your license code after a few minutes check the following:
Check the registration address
This is especially important if you paid using PayPal; if you set up your PayPal account a long time ago then your license code may have been sent to an old address. Log in to your PayPal account and double-check your email address.
If you paid via Kagi then you should double-check that there are no typographical errors in your email address. You should have received one email from Kagi and one from Wincent. Kagi provides a web interface at info.kagi.com so that you can check the status of your orders.
Check your junk mail folder
Your license notice may have been incorrectly classified as junk mail. Look inside your junk mail folder to see if the license was put there; it will have a subject line like “Hextrapolate license information” and will originate from the wincent.com domain.
Did you pay via eCheck?
If you paid using a PayPal eCheck then the transaction will not be completed until the payment has cleared. eChecks are like real-world checks: PayPal imposes a clearance delay of several days (typically about four business days) before allowing the funds to clear and the transaction to be completed. Immediately upon clearance PayPal’s automated systems will cause your license notice to be sent to you via email. There is no human intervention required so there should be no additional delays.
There is nothing I can do to speed up the clearance as it is determined by PayPal policy. If you wish to avoid the delay please choose a payment method other than eCheck.
Do you use a challenge-response system?
If your email account uses a challenge-response system then your license notice won’t get through (the automated system which sends out license notices cannot respond to such challenges).
Check your quarantined messages folder to see if your license notice has been directed there.
If you would like your license notice to be resent, add wincent.com to your whitelist of allowed senders and then use the lost license codes form on the website to have it immediately redelivered.
If you still cannot find your license notice after trying the above, contact me via email at support@wincent.com.