It seems there is an elite group that wants to revise our church's bylaws, and constitution. They want to replace deacons with elders, and require every member to sign a covenant in order to be a member. I am assuming that every current member will be relieved of their membership until they sign this covenant, and if they refuse to sign then their membership will be terminated. I'm not sure where this came from, or who instituted this action, but it is reminiscent of our government trying to force health care reform on the American citizen, whether they want it or not. We were supposed to vote on this change in, I think, August, before the bylaws and constitution were even completed. They tried to rush it through without the members knowing what it would contain. Thanks to one member who took the initiative to warn a lot of the members what these documents contained. There was an immediate uproar and the vote was re-scheduled, so changes could be made. We have already lost some members, and I personally know of a lot of members who are not going to sign this covenant in its present form. The covenant contains a lot of language that is not biblical, and you have to make a lot of promises that no earthly being can uphold. I believe it to be a legalistic document, made by man, for man, and will add nothing to the worship of our one, true, living God. There is a video posted on blogger .com which shows those in opposition as members who are against God, and think our church leaders are from outer space planning to control the earth, by starting with these documents. We are all a bunch of hillbilly rednecks who need to be led around like sheep. Link to the bylaws: http://www.fbcthecolony.org
Link to the video: http://2corinthians410.blogspot.com/2009/08/bylaw-review-team-discussion-10.html
Thursday, November 5, 2009
Thursday, April 16, 2009
Our trip to Wales.
Journal to Wales
March 8 to March 20, 2009
Angi, Heather, and Tamra drove us to DFW around noon, on March 3rd. Plane was scheduled to lift off at 1430 hours. Went thru security, checked bags and found that the departure gate had changed to A20.Our flight at 1410 hours was delayed by storms in the Chicago area. Finally boarded the plane at 1610 hours. Arrived in Chicago at 1820 hours, and discovered that our direct flight to Manchester had been cancelled. We had to go to re-booking. First available flight was at 2340 hours to Heathrow, in London. We ate dinner at a food court, walked around, got a couple of crossword puzzle books and waited. Boarded an American Airlines 777 at 2330 hours and the plane was full. We had a crying baby a few seats in front of us. Shortly after takeoff we were served a light dinner. Tried to sleep, but my leg was getting muscle spasms, and the man in front of Carol reclined his seat back so Carol was not able to stand up to get out. She was on an aisle and had to sidle out of the seat. Had a light breakfast about an hour out of Heathrow and landed about noon, London time. Security was VERY strict, but line moved fairly quick. Got our currency exchanged at a Thomas Cook counter. Ate lunch at a court called Giraffe. Carol had “Fish and Chips”. Flight to Manchester was supposed to leave at 1515 hours, but was 20 minutes late. We had a mini coke and cookies(biscuits) snack and landed in Manchester around 1630 hours, local time. Went through another security check and then on to the baggage pickup area. My suitcase was still in Chicago, would arrive the following morning and be brought over to the B&B , in llandudno, by courier. Got a free bus to the train station, got round trip tickets to Llandudno, Wales and left Manchester around 1730 hours. Stopped at Crewe and had to change trains with another wait of an hour. The next train had 10 cars, and the front five were going to Holly Oaks and the last five were going on to Bangor. We got on the last five and had to get off and change again at Llandudno junction, about five minutes from our destination. Carol and ann were texting back and forth and Ann said she would pick us up in Llandudno Junction and take us to the B&B. We had to call the B&B and let then know we were running late. We both recognized Ann immediately, and it was great to see Ann and Carol finally meet after 53 years of letter writing. We arrived at the B&B at about 2140 hours. Said goodnight to Ann and went to our room. We were the only guests. The room was very nice, twin beds, flat screen TV(telly),
bath, with small shower, and free WIFI. Carol hung her clothes up, I threw mine on the sofa, as I would have to wear them again Tuesday until my bag arrived. Went down for breakfast Tuesday morning, Carol had toast and orange juice. I had a full Welsh breakfast consisting of, two slices of ham, a link sausage(banger),
one egg, fried potato wedges, baked beans, fried toast, and half of a baked tomato, coffee, and juice. After breakfast we walked over to the main street, which was only two blocks away. I bought a shirt, and Carol got some Dr. pepper, hair spray, and post cards. Got back to the B&B and were notified that my bag should be there by 1400 hours. Ann arrived the same time as my bag, and after I got my clothes hung up and changed, Ann drove us up to the top of The Great Orme. Llandudno is on an inlet with a high mountain on the left and a smaller one on the right. The big one is called The Great Orme and the smaller one is called The little Orme. Tourist season open officially April 1st and they were testing the tram railcar ride up the Orme. Ann drove us around town, went to the cemetery where her parents are buried, and then to her husbands grave site. Stopped by a store called ASDA, which is owned by Wal-Mart, and got some sandwiches for dinner, more Dr. Pepper, and some souvenirs. Most of the restaurants close at 1600 hours, but the pubs stay open later and serve meals till 2100 hours. We either had to eat early or go to one of the pubs. Went to a Tea House about 1630 hours for tea and scones. Carol had mineral water. Back to the guest house about 1800 hours. Ate our sandwiches, watched TV, checked email, downloaded the cameras to the computer, charged everything up for the next day. Ann has things to do on Wednesday so we will be on our own. The North Wales Pioneer will be out Thursday to interview Ann and Carol and take pictures. They will be co-ordinating with The Colony Courier- Leader on the article. Walked around town, went to the bank, had lunch at Leopold's Restaurant, bought more souvenirs, went back to the B&B to drop off the bags and had a short rest. Went back to town, walked around , went into a lot of different stores, bought more postcards and souvenirs, and had dinner at Tribells Restaurant. I had Fish and Chips, with boiled potatoes, and mashed peas. Went to bed early that night. Thursday morning we walked back to town, went to the bank, back to ASDA's for more Dr. Pepper. Dropped it off at the B&B and then went to the Greenery for lunch. Very nice place to eat. Bill came to ten pounds and some change, and Carol was trying to find the right coins and finally just laid all the coins on the counter and told the clerk to take what she needed. Went back to the B&B, and at 1500 hours the reporter, photographer, and Ann showed up, for the interview. Anna Glover was the reporter, and I think the photographer's name was Kerry. Interview lasted about 45 minutes. I used a camcorder to record the whole thing. Then Ann drove us around town some more and we walked around on the Promenade, and we ate at Tribell's again.
Walked back to the B&B, met some new guests, Nick, Carrie, and baby Charlie. They are only staying a couple of days. They are from England.
Friday morning Ann picked us up at 0930 hours and drove us to Conwy. We toured the castle, walked all over the town, and it rained for the first, and only day we were there. Several elementary school groups were touring the castle too so it was a little noisy. Found the smallest house in Great Britain, and wanted to go to the Butterfly Museum, but it started raining, and then we found out that it was about ½ mile out of town. Had lunch at a coffee house then caught a bus back to Llandudno. Ann picked us up at 1630 hours, and took us out to her house. Most of the houses we saw were duplex's(semi detached), Very small yards. We had tea(dinner) with Ann, met her neighbor, Pat. Pat kept us in stitches with some of the things she and Ann had done. Took a lot of photos, more videos, and Ann got us back to the B&B around 2230 hours. Went down for breakfast Saturday morning and Ann had left us an anniversary card. Nick, Carrie, and Charlie are leaving this morning, but we have another guest. He is from North England in town for a meeting. He told us about how seniors get free bus passes and reduced rates for the train. Sweet. Also had a lady who wasn't very friendly, didn't talk to anyone. When we got back to our room the owners had left us an anniversary card and a box of candy, very nice of them. After breakfast we caught a bus to Caenarfon Castle. Got there around 1100 hours and decided to have lunch before going into the castle. Mailed some postcards off also. Ate at Cofi Roc, a pub, restaurant. Looked like a hangout for the young crowd, rock music playing, big screens on the walls. Had a sandwich and potato chips(crisps). Finally went into the castle. This is the castle where Prince Charles was investured as the Prince of Wales. This is one of the best preserved castles around, and it is huge. Met some people from California in the souvenir shop. Caught the bus back and the trip back was much faster, lady bus driver. Called Ann and asked her if she would join us for our anniversary dinner at The Albert, a pub just up the alley from the B&B. We walked over and had a great meal. The bill was around 30 lb and I was going to leave a 5 lb tip and Ann said that was too much but I managed to slip it in without her noticing. Walked over to town, after dinner, and Ann took us over to meet her sister, and then we walked back to ASDA's, more Dr. Pepper, and then back to the B&B. Ann is going to pick us up at 0730 hours Sunday morning, and we will be attending the 0800 service at The Holy Trinity Church of England. Got back to the B&B in time for breakfast. Rested till lunch time and went back to The Greenery, and Ann and Pat picked us up and drove us over to Rhos on Sea, and we walked all over, had some Welsh ice cream then back to Ann's house for tea and cake. Ann dropped us off at the B&B and we walked back to The Albert for dinner. Monday we had breakfast, walked back to town, got a bus that took us to the last street before starting up The Great Orme. There is a bronze age copper mine about half way up and we decided we could walk that far. Bad decision, the grade is about 60 degrees. We staggered up and the mine was closed, so we had to walk back down to catch a bus. Got back to town, had lunch, and went back to the B&B for a short nap. Went back to ASDA”s for sandwiches. March 17 got up, had breakfast, walked back to town got Mothering Day cards for Ann & Pat, and a plant for Ann to put on David's grave. Went back to B&B to drop our stuff off and then back to town, Walked around by the St. George Hotel, looked through Mark's & Spencer's store, and then Ann called. She picked us up at the B&B and took us to Happy Valley. It is a park, by the pier, and it ain't no valley. They have a miniature stonehenge, Lots of different plantings, a cave, and at the top there is an artificial ski slope, two levels. It is very long . Plus there is a metal bobsled run around it. We watched a couple make the bobsled run and there were some people on the ski slope. Again, this “valley” has a 50 to 60 degree grade. Took some good shots across the bay. March 18 at breakfast we met a new guest from Phoenix who is touring the U.K. For a month, by herself. She works in the Phoenix Zoo. She said she took a six month course of Welsh before coming. Very interesting to talk to. Also met a gentlemen who was performing in a show at the local theater. I think it was an orchestra. After breakfast we walked back to town and picked some North Wales Pioneer newspapers, and Ann and Carol were on the front page. Went back to the B&B to rest a bit and pack, as we leave for Manchester the next morning. Ann came by to say goodbye, she is going to Manchester to see her daughter and grandson tomorrow afternoon. We check out at 1000 hours and catch the train at 1045 hours. Walked to The Albert for dinner and then back to the B&B, last night here. March 19, had our last breakfast, at the B&B, took some pictures of the owners, Dyfrig & Julie Williams, and told them if we ever came back they would be the first to know. Walked to the train station, took more pictures. Train was an express to Manchester, but this time it was daylight and we got to see the scenery. Got to Manchester around noon, and their station is huge. Got a real British taxi to the hotel, which was 3 miles from the airport, and 13 miles from the train station. The taxi was equipped with GPS. Checked in the hotel, ordered the shuttle to the airport, for the next morning, and the girl at the desk called and got our terminal and gate number. Room was very nice, lot of amenities for $65.00. Had lunch in the lounge, and walked around the grounds. Had dinner in hotel dining room. Waiter wore suit and tie and was very formal, but the prices were very reasonable. Went up to the room and got ready for bed, and about 2030 hours Ann called. Seems her daughter lives only about 15 minutes away and they want to come over, as we have never met Janet. So we get dressed again, and go downstairs to wait on them. They stayed about an hour and then said goodbye. March 20, we got up at 0500 hours, went down to the lounge and waited for the shuttle to take us to the airport.
Arrived at 0715 hours, got boarding passes and turned in baggage, which was overweight and had to pay extra. Went through security again, had breakfast, exchanged our British lbs for dollars, and went to gate and waited to board. Had a crying baby in the seat in front of us this time, and when she wasn't sleeping, she was crying. Got to Chicago and had to collect our bags and take them to the next gate for our flight to DFW. Flight to DFW was very smooth, and we arrived 35 minutes early, female pilot. Angi met us at the airport and we stopped at the Texas Steakhouse for dinner. Connor and Devlin met us at the door and we unpacked our souvenirs and gave them their gifts. Carol sent Ann a text and told her we had made it home. This was a fabulous trip. I thank God for setting it up so these two friends could finally meet face to face.
March 8 to March 20, 2009
Angi, Heather, and Tamra drove us to DFW around noon, on March 3rd. Plane was scheduled to lift off at 1430 hours. Went thru security, checked bags and found that the departure gate had changed to A20.Our flight at 1410 hours was delayed by storms in the Chicago area. Finally boarded the plane at 1610 hours. Arrived in Chicago at 1820 hours, and discovered that our direct flight to Manchester had been cancelled. We had to go to re-booking. First available flight was at 2340 hours to Heathrow, in London. We ate dinner at a food court, walked around, got a couple of crossword puzzle books and waited. Boarded an American Airlines 777 at 2330 hours and the plane was full. We had a crying baby a few seats in front of us. Shortly after takeoff we were served a light dinner. Tried to sleep, but my leg was getting muscle spasms, and the man in front of Carol reclined his seat back so Carol was not able to stand up to get out. She was on an aisle and had to sidle out of the seat. Had a light breakfast about an hour out of Heathrow and landed about noon, London time. Security was VERY strict, but line moved fairly quick. Got our currency exchanged at a Thomas Cook counter. Ate lunch at a court called Giraffe. Carol had “Fish and Chips”. Flight to Manchester was supposed to leave at 1515 hours, but was 20 minutes late. We had a mini coke and cookies(biscuits) snack and landed in Manchester around 1630 hours, local time. Went through another security check and then on to the baggage pickup area. My suitcase was still in Chicago, would arrive the following morning and be brought over to the B&B , in llandudno, by courier. Got a free bus to the train station, got round trip tickets to Llandudno, Wales and left Manchester around 1730 hours. Stopped at Crewe and had to change trains with another wait of an hour. The next train had 10 cars, and the front five were going to Holly Oaks and the last five were going on to Bangor. We got on the last five and had to get off and change again at Llandudno junction, about five minutes from our destination. Carol and ann were texting back and forth and Ann said she would pick us up in Llandudno Junction and take us to the B&B. We had to call the B&B and let then know we were running late. We both recognized Ann immediately, and it was great to see Ann and Carol finally meet after 53 years of letter writing. We arrived at the B&B at about 2140 hours. Said goodnight to Ann and went to our room. We were the only guests. The room was very nice, twin beds, flat screen TV(telly),
bath, with small shower, and free WIFI. Carol hung her clothes up, I threw mine on the sofa, as I would have to wear them again Tuesday until my bag arrived. Went down for breakfast Tuesday morning, Carol had toast and orange juice. I had a full Welsh breakfast consisting of, two slices of ham, a link sausage(banger),
one egg, fried potato wedges, baked beans, fried toast, and half of a baked tomato, coffee, and juice. After breakfast we walked over to the main street, which was only two blocks away. I bought a shirt, and Carol got some Dr. pepper, hair spray, and post cards. Got back to the B&B and were notified that my bag should be there by 1400 hours. Ann arrived the same time as my bag, and after I got my clothes hung up and changed, Ann drove us up to the top of The Great Orme. Llandudno is on an inlet with a high mountain on the left and a smaller one on the right. The big one is called The Great Orme and the smaller one is called The little Orme. Tourist season open officially April 1st and they were testing the tram railcar ride up the Orme. Ann drove us around town, went to the cemetery where her parents are buried, and then to her husbands grave site. Stopped by a store called ASDA, which is owned by Wal-Mart, and got some sandwiches for dinner, more Dr. Pepper, and some souvenirs. Most of the restaurants close at 1600 hours, but the pubs stay open later and serve meals till 2100 hours. We either had to eat early or go to one of the pubs. Went to a Tea House about 1630 hours for tea and scones. Carol had mineral water. Back to the guest house about 1800 hours. Ate our sandwiches, watched TV, checked email, downloaded the cameras to the computer, charged everything up for the next day. Ann has things to do on Wednesday so we will be on our own. The North Wales Pioneer will be out Thursday to interview Ann and Carol and take pictures. They will be co-ordinating with The Colony Courier- Leader on the article. Walked around town, went to the bank, had lunch at Leopold's Restaurant, bought more souvenirs, went back to the B&B to drop off the bags and had a short rest. Went back to town, walked around , went into a lot of different stores, bought more postcards and souvenirs, and had dinner at Tribells Restaurant. I had Fish and Chips, with boiled potatoes, and mashed peas. Went to bed early that night. Thursday morning we walked back to town, went to the bank, back to ASDA's for more Dr. Pepper. Dropped it off at the B&B and then went to the Greenery for lunch. Very nice place to eat. Bill came to ten pounds and some change, and Carol was trying to find the right coins and finally just laid all the coins on the counter and told the clerk to take what she needed. Went back to the B&B, and at 1500 hours the reporter, photographer, and Ann showed up, for the interview. Anna Glover was the reporter, and I think the photographer's name was Kerry. Interview lasted about 45 minutes. I used a camcorder to record the whole thing. Then Ann drove us around town some more and we walked around on the Promenade, and we ate at Tribell's again.
Walked back to the B&B, met some new guests, Nick, Carrie, and baby Charlie. They are only staying a couple of days. They are from England.
Friday morning Ann picked us up at 0930 hours and drove us to Conwy. We toured the castle, walked all over the town, and it rained for the first, and only day we were there. Several elementary school groups were touring the castle too so it was a little noisy. Found the smallest house in Great Britain, and wanted to go to the Butterfly Museum, but it started raining, and then we found out that it was about ½ mile out of town. Had lunch at a coffee house then caught a bus back to Llandudno. Ann picked us up at 1630 hours, and took us out to her house. Most of the houses we saw were duplex's(semi detached), Very small yards. We had tea(dinner) with Ann, met her neighbor, Pat. Pat kept us in stitches with some of the things she and Ann had done. Took a lot of photos, more videos, and Ann got us back to the B&B around 2230 hours. Went down for breakfast Saturday morning and Ann had left us an anniversary card. Nick, Carrie, and Charlie are leaving this morning, but we have another guest. He is from North England in town for a meeting. He told us about how seniors get free bus passes and reduced rates for the train. Sweet. Also had a lady who wasn't very friendly, didn't talk to anyone. When we got back to our room the owners had left us an anniversary card and a box of candy, very nice of them. After breakfast we caught a bus to Caenarfon Castle. Got there around 1100 hours and decided to have lunch before going into the castle. Mailed some postcards off also. Ate at Cofi Roc, a pub, restaurant. Looked like a hangout for the young crowd, rock music playing, big screens on the walls. Had a sandwich and potato chips(crisps). Finally went into the castle. This is the castle where Prince Charles was investured as the Prince of Wales. This is one of the best preserved castles around, and it is huge. Met some people from California in the souvenir shop. Caught the bus back and the trip back was much faster, lady bus driver. Called Ann and asked her if she would join us for our anniversary dinner at The Albert, a pub just up the alley from the B&B. We walked over and had a great meal. The bill was around 30 lb and I was going to leave a 5 lb tip and Ann said that was too much but I managed to slip it in without her noticing. Walked over to town, after dinner, and Ann took us over to meet her sister, and then we walked back to ASDA's, more Dr. Pepper, and then back to the B&B. Ann is going to pick us up at 0730 hours Sunday morning, and we will be attending the 0800 service at The Holy Trinity Church of England. Got back to the B&B in time for breakfast. Rested till lunch time and went back to The Greenery, and Ann and Pat picked us up and drove us over to Rhos on Sea, and we walked all over, had some Welsh ice cream then back to Ann's house for tea and cake. Ann dropped us off at the B&B and we walked back to The Albert for dinner. Monday we had breakfast, walked back to town, got a bus that took us to the last street before starting up The Great Orme. There is a bronze age copper mine about half way up and we decided we could walk that far. Bad decision, the grade is about 60 degrees. We staggered up and the mine was closed, so we had to walk back down to catch a bus. Got back to town, had lunch, and went back to the B&B for a short nap. Went back to ASDA”s for sandwiches. March 17 got up, had breakfast, walked back to town got Mothering Day cards for Ann & Pat, and a plant for Ann to put on David's grave. Went back to B&B to drop our stuff off and then back to town, Walked around by the St. George Hotel, looked through Mark's & Spencer's store, and then Ann called. She picked us up at the B&B and took us to Happy Valley. It is a park, by the pier, and it ain't no valley. They have a miniature stonehenge, Lots of different plantings, a cave, and at the top there is an artificial ski slope, two levels. It is very long . Plus there is a metal bobsled run around it. We watched a couple make the bobsled run and there were some people on the ski slope. Again, this “valley” has a 50 to 60 degree grade. Took some good shots across the bay. March 18 at breakfast we met a new guest from Phoenix who is touring the U.K. For a month, by herself. She works in the Phoenix Zoo. She said she took a six month course of Welsh before coming. Very interesting to talk to. Also met a gentlemen who was performing in a show at the local theater. I think it was an orchestra. After breakfast we walked back to town and picked some North Wales Pioneer newspapers, and Ann and Carol were on the front page. Went back to the B&B to rest a bit and pack, as we leave for Manchester the next morning. Ann came by to say goodbye, she is going to Manchester to see her daughter and grandson tomorrow afternoon. We check out at 1000 hours and catch the train at 1045 hours. Walked to The Albert for dinner and then back to the B&B, last night here. March 19, had our last breakfast, at the B&B, took some pictures of the owners, Dyfrig & Julie Williams, and told them if we ever came back they would be the first to know. Walked to the train station, took more pictures. Train was an express to Manchester, but this time it was daylight and we got to see the scenery. Got to Manchester around noon, and their station is huge. Got a real British taxi to the hotel, which was 3 miles from the airport, and 13 miles from the train station. The taxi was equipped with GPS. Checked in the hotel, ordered the shuttle to the airport, for the next morning, and the girl at the desk called and got our terminal and gate number. Room was very nice, lot of amenities for $65.00. Had lunch in the lounge, and walked around the grounds. Had dinner in hotel dining room. Waiter wore suit and tie and was very formal, but the prices were very reasonable. Went up to the room and got ready for bed, and about 2030 hours Ann called. Seems her daughter lives only about 15 minutes away and they want to come over, as we have never met Janet. So we get dressed again, and go downstairs to wait on them. They stayed about an hour and then said goodbye. March 20, we got up at 0500 hours, went down to the lounge and waited for the shuttle to take us to the airport.
Arrived at 0715 hours, got boarding passes and turned in baggage, which was overweight and had to pay extra. Went through security again, had breakfast, exchanged our British lbs for dollars, and went to gate and waited to board. Had a crying baby in the seat in front of us this time, and when she wasn't sleeping, she was crying. Got to Chicago and had to collect our bags and take them to the next gate for our flight to DFW. Flight to DFW was very smooth, and we arrived 35 minutes early, female pilot. Angi met us at the airport and we stopped at the Texas Steakhouse for dinner. Connor and Devlin met us at the door and we unpacked our souvenirs and gave them their gifts. Carol sent Ann a text and told her we had made it home. This was a fabulous trip. I thank God for setting it up so these two friends could finally meet face to face.
Friday, February 27, 2009
Trip to Wales
We will be leaving for Llandudno, Wales on Sunday, March 9th. Plan on staying in Llandudno for 10 days and 1 night in Manchester, England. My wife has had a pen pal in llandudno for the last 53 years, and they have never met. We have Vonage phone service, which allows us to call her for no charge, so carol talks to her every other Saturday. Planning on a lot of sightseeing and shopping. There are about 16 castles within a 2 hour ride, and we hope to see as many as possible. I will be posting the photos on our web site when we get back.
Saturday, August 9, 2008
VISTA Security?
LAS VEGAS -- Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system, an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.
In a presentation at the Black Hat briefings, Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. will discuss the new methods they've found to get around Vista protections such as Address Space Layout Randomization(ASLR), Data Execution Prevention (DEP) and others by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.
By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user's machine.
Researchers who have read the paper that Dowd and Sotirov wrote on the techniques say their work is a major breakthrough and there is little that Microsoft can do to address the problems. The attacks themselves are not based on any new vulnerabilities in IE or Vista, but instead take advantage of Vista's fundamental architecture and the ways in which Microsoft chose to protect it.
"The genius of this is that it's completely reusable," said Dino Dai Zovi, a well-known security researcher and author. "They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over.
"What this means is that almost any vulnerability in the browser is trivially exploitable," Dai Zovi added. "A lot of exploit defenses are rendered useless by browsers. ASLR and hardware DEP are completely useless against these attacks."
Many of the defenses that Microsoft added to Vista and Windows Server 2008 are designed to stop host-based attacks. ASLR, for example, is meant to prevent attackers from predicting target memory addresses by randomly moving things such as a process's stack, heap and libraries. That technique is useful against memory-corruption attacks, but Dai Zovi said that against Dowd's and Sotirov's methods, it would be of no use.
"This stuff just takes a knife to a large part of the security mesh Microsoft built into Vista," Dai Zovi said. "If you think about the fact that .NET loads DLLs into the browser itself and then Microsoft assumes they're safe because they're .NET objects, you see that Microsoft didn't think about the idea that these could be used as stepping stones for other attacks. This is a real tour de force."
Microsoft officials have not responded to Dowd's and Sotirov's findings, but Mike Reavey, group manager of the Microsoft Security Response Center, said Wednesday that the company is aware of the research and is interested to see it once it becomes public.
Dai Zovi stressed that the techniques Dowd and Sotirov use do not rely on specific vulnerabilities. As a result, he said, there may soon be similar techniques applied to other platforms or environments.
"This is not insanely technical. These two guys are capable of the really low-level technical attacks, but this is simple and reusable," Dai Zovi said. "I definitely think this will get reused soon, sort of like heap spraying was."
In a presentation at the Black Hat briefings, Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. will discuss the new methods they've found to get around Vista protections such as Address Space Layout Randomization(ASLR), Data Execution Prevention (DEP) and others by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.
By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user's machine.
Researchers who have read the paper that Dowd and Sotirov wrote on the techniques say their work is a major breakthrough and there is little that Microsoft can do to address the problems. The attacks themselves are not based on any new vulnerabilities in IE or Vista, but instead take advantage of Vista's fundamental architecture and the ways in which Microsoft chose to protect it.
"The genius of this is that it's completely reusable," said Dino Dai Zovi, a well-known security researcher and author. "They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over.
"What this means is that almost any vulnerability in the browser is trivially exploitable," Dai Zovi added. "A lot of exploit defenses are rendered useless by browsers. ASLR and hardware DEP are completely useless against these attacks."
Many of the defenses that Microsoft added to Vista and Windows Server 2008 are designed to stop host-based attacks. ASLR, for example, is meant to prevent attackers from predicting target memory addresses by randomly moving things such as a process's stack, heap and libraries. That technique is useful against memory-corruption attacks, but Dai Zovi said that against Dowd's and Sotirov's methods, it would be of no use.
"This stuff just takes a knife to a large part of the security mesh Microsoft built into Vista," Dai Zovi said. "If you think about the fact that .NET loads DLLs into the browser itself and then Microsoft assumes they're safe because they're .NET objects, you see that Microsoft didn't think about the idea that these could be used as stepping stones for other attacks. This is a real tour de force."
Microsoft officials have not responded to Dowd's and Sotirov's findings, but Mike Reavey, group manager of the Microsoft Security Response Center, said Wednesday that the company is aware of the research and is interested to see it once it becomes public.
Dai Zovi stressed that the techniques Dowd and Sotirov use do not rely on specific vulnerabilities. As a result, he said, there may soon be similar techniques applied to other platforms or environments.
"This is not insanely technical. These two guys are capable of the really low-level technical attacks, but this is simple and reusable," Dai Zovi said. "I definitely think this will get reused soon, sort of like heap spraying was."
Tuesday, July 29, 2008
Vista vs XP
Are vista sales really going as well as Microsoft reports say? I was curious so did a bit of research and found some useful polls and articles that blow their figures out of the water. It appears they are trying to convince themselves that they made the right move, or else they think the consumer is to stupid to know the difference.
Several vendors initiated a Vista to Xp crossgrade. Basically, if a customer ordered a computer and it came with Vista installed, the customer could get an Xp license instead.Microsoft does not count the crossgrade as a sale for Xp. Rather, they count it as a sale for Vista. Now, combine that data with public statements from vendors that Xp is outselling Vista on an average of 3 to 1. Now go take a look at Microsoft's sales statements for Vista and for Xp, and you'll note a startling difference. Microsoft's finance numbers do not add up if one accepts the numbers Microsoft has floated for sales. Care to guess how the numbers appear to be adding up? If you are thinking that Vista is selling worse than Windows ME, you'd probably be close to what appears to be reality. Now, Microsoft reported back in July,of 2007, that 60 million copies of Vista had been sold. Now start subtracting the crossgrades to Xp that are not counted as sales. Microsoft needs to take a hard look at the market and the feedback they’ve received and be honest with themselves. After a ton of time developing Vista, I can imagine that the last thing Microsoft wants to do is publicly admit that it’s not the product it was supposed to be and their sales figures seem to back them up. It’s important to note, though, that new PCs that are shipped with Vista and then downgraded to Windows XP, are counted as Vista sales. Westminster College, last year, purchased around 90 computers with Windows Vista. Every single one was upgraded to XP. Now, I know that 90 computers is a miniscule fraction of PC sales, but they are far from the only organization with a similar policy that purchased computers with Vista.
Change, for change's sake, is never a good idea. And while you can understand Microsoft's desire to refresh the Windows UI (all those Mac OS X screen shots look so much prettier than XP), Vista's designers seem to have cut off their nose to spite their face. Regardless, the usability "improvements" in Vista are unlikely to make IT's list of compelling reasons to move away from XP anytime soon. After all is said and done, I believe the number of people, and businesses running vista are far below the number of licenses sold. I think it accounts for a lot of MAC's moving up the ladder and the Linux uptake has to account for a few cases. I personally know of several individuals, and companies that switched and most went back to XP, some gave Linux a shot. The reasons I heard most often was, “our software won't run correctly on vista.” With windows seven due in 2009, or 2010, it appears Microsoft is starting to get a little concerned about vista. A lot of this information came from InfoWorld, Tech Republic, and various forums, and windows techies.
Several vendors initiated a Vista to Xp crossgrade. Basically, if a customer ordered a computer and it came with Vista installed, the customer could get an Xp license instead.Microsoft does not count the crossgrade as a sale for Xp. Rather, they count it as a sale for Vista. Now, combine that data with public statements from vendors that Xp is outselling Vista on an average of 3 to 1. Now go take a look at Microsoft's sales statements for Vista and for Xp, and you'll note a startling difference. Microsoft's finance numbers do not add up if one accepts the numbers Microsoft has floated for sales. Care to guess how the numbers appear to be adding up? If you are thinking that Vista is selling worse than Windows ME, you'd probably be close to what appears to be reality. Now, Microsoft reported back in July,of 2007, that 60 million copies of Vista had been sold. Now start subtracting the crossgrades to Xp that are not counted as sales. Microsoft needs to take a hard look at the market and the feedback they’ve received and be honest with themselves. After a ton of time developing Vista, I can imagine that the last thing Microsoft wants to do is publicly admit that it’s not the product it was supposed to be and their sales figures seem to back them up. It’s important to note, though, that new PCs that are shipped with Vista and then downgraded to Windows XP, are counted as Vista sales. Westminster College, last year, purchased around 90 computers with Windows Vista. Every single one was upgraded to XP. Now, I know that 90 computers is a miniscule fraction of PC sales, but they are far from the only organization with a similar policy that purchased computers with Vista.
Change, for change's sake, is never a good idea. And while you can understand Microsoft's desire to refresh the Windows UI (all those Mac OS X screen shots look so much prettier than XP), Vista's designers seem to have cut off their nose to spite their face. Regardless, the usability "improvements" in Vista are unlikely to make IT's list of compelling reasons to move away from XP anytime soon. After all is said and done, I believe the number of people, and businesses running vista are far below the number of licenses sold. I think it accounts for a lot of MAC's moving up the ladder and the Linux uptake has to account for a few cases. I personally know of several individuals, and companies that switched and most went back to XP, some gave Linux a shot. The reasons I heard most often was, “our software won't run correctly on vista.” With windows seven due in 2009, or 2010, it appears Microsoft is starting to get a little concerned about vista. A lot of this information came from InfoWorld, Tech Republic, and various forums, and windows techies.
Wednesday, July 23, 2008
Gael Duval, the founder of Mandrake/Mandriva Linux distributions started a new project after his departure, from Mandriva, in 2006. It is called ULTEO, and can be found at http://www.ulteo.com Back in the early nineties, when I first started hearing about the internet, I imagined it to be a place I could connect to, use software onsite, store my data onsite, and not have to have a computer bloated with store bought software. This appears to be the goal of ULTEO. There is an excellent interview with Mr. Duval located here:
http://www.thejemreport.com/content/view/282/1/
I downloaded his project, a virtual desktop, residing on my windows XP partition, signed up as a user, and am now testing everything to see how it works. You sign on to a Linux desktop, use its programs, save the data, which resides onsite, or you can save it locally. It is still in its early stages and there is not every program that you might want, or need. There are different levels of subscriptions, so I can see a use for individuals, and even small business operators. This frees up my windows partition so I can use it for the only thing it is good for, playing games, offline. Maybe Mr. Duval is ahead of his time, but this comes as close as I imagined 15 years ago.
I can look ahead 20 years, and find myself holding a small device, telling it to open, having a laser scan my retina, a holographic screen appearing, another retina scan and my Linux desktop appears. Doing what I need to do, and telling it to close.
Check it out at http://www.ulteo.com/
You could be looking at part of the future of computers.
http://www.thejemreport.com/content/view/282/1/
I downloaded his project, a virtual desktop, residing on my windows XP partition, signed up as a user, and am now testing everything to see how it works. You sign on to a Linux desktop, use its programs, save the data, which resides onsite, or you can save it locally. It is still in its early stages and there is not every program that you might want, or need. There are different levels of subscriptions, so I can see a use for individuals, and even small business operators. This frees up my windows partition so I can use it for the only thing it is good for, playing games, offline. Maybe Mr. Duval is ahead of his time, but this comes as close as I imagined 15 years ago.
I can look ahead 20 years, and find myself holding a small device, telling it to open, having a laser scan my retina, a holographic screen appearing, another retina scan and my Linux desktop appears. Doing what I need to do, and telling it to close.
Check it out at http://www.ulteo.com/
You could be looking at part of the future of computers.
Monday, June 23, 2008
Hosting Company
If anyone is looking for a hosting company, DO NOT USE HOSTONCE.COM! You cannot communicate with them. I have had problems getting mail thru their server, multiple times. Last week,(June 17), I sent an email to support@hostonce.com and told them I was unable to access my mail and my domain. 30 minutes later it worked and I checked my mail and the original was bounced back. Today,(June 23), I sent them another email that I haven't been able to access my mail server for the last 4 days. The message was bounced back and I still can't get my mail. I logged onto the control panel and checked the email heading and it said all accounts were listed on the left and to delete click to the right. There were no accounts listed and I had 4 set up. I proceeded to add an account, using the same setting I had used before. It said the account was ready. I log off and check my mail and I get an error message that a problem occurred. I guess I don't have to mention that they are running windoze 2003 servers. I will be transferring to another company as soon as possible.
UPDATE:
I was unable to access my homepage today, instead a window came up saying this domain had expired. On April 24, 2008 I paid for another year, which will expire in July, 2009. I have their receipt of the payment, and their email, and a hard copy of both. I have sent them a copy and am giving them until Monday, July 28 to put the site back up. I will file a complaint with the BBB, and this will be my last association with Hostonce.com. If the site is deleted, then our association will end immediately. BTW, I have not received any notification that the domain would be taken down.
UPDATE:
Monday July, 28. I checked my domain and it is still showing expired, but I clicked on a small button to renew and the following popped up.
This domain has expired
It will be deleted in the next few days. If you are the owner of this domain, you still have a chance to renew it.
Domain Name Expires
oldator.com 24-JUL-09
It seems that the domain listed above has already been renewed. The domain should be reactivated shortly. You do not need to renew it now. If you still see this message in 72 hours, please contact us.
To renew this domain or to request further information please contact us at debbie@hostonce.com.
I clicked on the email link to debbie@hostonce.com and sent her a message. This is the reply.
X-Account-Key: account2
X-UIDL:
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.82])
by cdptpa-imta05.mail.rr.com with ESMTP
id <20080728171731.TOZF16122.cdptpa-imta05.mail.rr.com@cdptpa-mxlb.mail.rr.com>
for; Mon, 28 Jul 2008 17:17:31 +0000
Return-Path:
X-Cloudmark-Score: 0
X-RR-Connecting-IP: 64.79.50.183
Received: from [64.79.50.183] ([64.79.50.183:4826] helo=mail.hostonce.com)
by cdptpa-iedge02 (envelope-from)
(ecelerity 2.2.2.30 r(24171M)) with ESMTP
id CF/D5-26270-B2FFD884; Mon, 28 Jul 2008 17:17:31 +0000
From:
To:
Subject: Message Delivery Failure
Date: Mon, 28 Jul 2008 13:06:04 -0400
Message-ID:
Precedence: bulk
Message could not be delivered. Error was: The mailbox is not available on this system
The following recipient(s) could not be reached:
[SF:hostonce.com/debbie]
Message contents follow:
Received: from cdptpa-omtalb.mail.rr.com ([75.180.132.123]) by 183.hostonce.com with MailEnable ESMTP; Mon, 28 Jul 2008 13:06:04 -0400
Received: from [192.168.1.100] (really [72.190.53.177])
by cdptpa-omta02.mail.rr.com with ESMTP
id <20080728171725.SSTG15817.cdptpa-omta02.mail.rr.com@[192.168.1.100]>
for; Mon, 28 Jul 2008 17:17:25 +0000
Message-ID: <488DFF3F.3080103@tx.rr.com>
Date: Mon, 28 Jul 2008 12:17:51 -0500
From: Harry
User-Agent: Thunderbird 2.0.0.0 (X11/20070429)
MIME-Version: 1.0
To: debbie@hostonce.com
Subject: oldator.com
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
It was renewed in April, and then shut down with no notification. VERY
POOR WAY TO RUN A BUSINESS!
Their email links don't work, there is no phone number listed, so you can't communicate with them.
Says a lot about what they think of their customers. Sorry I ever signed up with them.
UPDATE:
I was unable to access my homepage today, instead a window came up saying this domain had expired. On April 24, 2008 I paid for another year, which will expire in July, 2009. I have their receipt of the payment, and their email, and a hard copy of both. I have sent them a copy and am giving them until Monday, July 28 to put the site back up. I will file a complaint with the BBB, and this will be my last association with Hostonce.com. If the site is deleted, then our association will end immediately. BTW, I have not received any notification that the domain would be taken down.
UPDATE:
Monday July, 28. I checked my domain and it is still showing expired, but I clicked on a small button to renew and the following popped up.
This domain has expired
It will be deleted in the next few days. If you are the owner of this domain, you still have a chance to renew it.
Domain Name Expires
oldator.com 24-JUL-09
It seems that the domain listed above has already been renewed. The domain should be reactivated shortly. You do not need to renew it now. If you still see this message in 72 hours, please contact us.
To renew this domain or to request further information please contact us at debbie@hostonce.com.
I clicked on the email link to debbie@hostonce.com and sent her a message. This is the reply.
X-Account-Key: account2
X-UIDL:
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.82])
by cdptpa-imta05.mail.rr.com with ESMTP
id <20080728171731.TOZF16122.cdptpa-imta05.mail.rr.com@cdptpa-mxlb.mail.rr.com>
for
Return-Path:
X-Cloudmark-Score: 0
X-RR-Connecting-IP: 64.79.50.183
Received: from [64.79.50.183] ([64.79.50.183:4826] helo=mail.hostonce.com)
by cdptpa-iedge02 (envelope-from
(ecelerity 2.2.2.30 r(24171M)) with ESMTP
id CF/D5-26270-B2FFD884; Mon, 28 Jul 2008 17:17:31 +0000
From:
To:
Subject: Message Delivery Failure
Date: Mon, 28 Jul 2008 13:06:04 -0400
Message-ID:
Precedence: bulk
Message could not be delivered. Error was: The mailbox is not available on this system
The following recipient(s) could not be reached:
[SF:hostonce.com/debbie]
Message contents follow:
Received: from cdptpa-omtalb.mail.rr.com ([75.180.132.123]) by 183.hostonce.com with MailEnable ESMTP; Mon, 28 Jul 2008 13:06:04 -0400
Received: from [192.168.1.100] (really [72.190.53.177])
by cdptpa-omta02.mail.rr.com with ESMTP
id <20080728171725.SSTG15817.cdptpa-omta02.mail.rr.com@[192.168.1.100]>
for
Message-ID: <488DFF3F.3080103@tx.rr.com>
Date: Mon, 28 Jul 2008 12:17:51 -0500
From: Harry
User-Agent: Thunderbird 2.0.0.0 (X11/20070429)
MIME-Version: 1.0
To: debbie@hostonce.com
Subject: oldator.com
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
It was renewed in April, and then shut down with no notification. VERY
POOR WAY TO RUN A BUSINESS!
Their email links don't work, there is no phone number listed, so you can't communicate with them.
Says a lot about what they think of their customers. Sorry I ever signed up with them.
Subscribe to:
Posts (Atom)

