text:
Assume Nothing: new book details alleged abuse by former New York attorney general

  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
Edward Helmore
·6 min read
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.

Amid warnings that domestic abuse has spiked alarmingly during the pandemic, an account published on Tuesday of a year-long relationship between a women’s right’s activist and successful producer Tanya Selvaratnam and the former New York state attorney general Eric Schneiderman, could hardly be more timely.

Selvaratnam went public with accusations of intimate violence against her former boyfriend in the New Yorker in May 2018. Three other women who had been involved with Schneiderman also came forward with disturbing accounts of subjugation.

The attorney general, who had established a political platform as a civil rights advocate, including suing the convicted rapist Harvey Weinstein, stepped down.

The New York governor, Andrew Cuomo, called for a special prosecutor to look into the allegations against Schneiderman, but after a six-month criminal investigation prosecutors concluded that while the accusations of abuse were credible, there were legal hurdles to bringing charges. Schneiderman has denied the allegations.

In Assume Nothing: A Story of Intimate Violence, Selvaratnam describes “a fairytale that became a nightmare” and recounts the relationship in the context of Schneiderman’s “entrapment, isolation, control, demeaning, and abuse”. The account makes for disturbing reading in which alleged physical abuse was but one instrument of subjugation.

Selvaratnam alleges that Schneiderman would “slap me until I agreed to call him ‘Master’ or ‘Daddy’”. He recounted his fantasies of finding me somewhere far away to be his slave, his “brown girl”.

The abuse, she said, increased to the point that Schneiderman spat on her and choked her. “I didn’t realize it at the time, but I was dealing with the kind of abuse that can go on between people in committed relationships: intimate violence.

“But I had convinced myself that he would be my partner, maybe for life. If I wanted to keep him, I felt I had to let him dominate me.” Scared to come forward with her story, Selvaratnam writes that Schneiderman threatened to kill her if they broke up.

In an interview with the Guardian on Tuesday, Selvaratnam, who is also the author of The Big Lie, an examination of the work-family conflict many women face, said she “wrote her way out of the darkness” of that relationship.

She described intimate partner violence (IPV) in committed relationships as the next wave of the #MeToo movement. In recent weeks, Evan Rachel Wood and FKA twigs have come forward with their own accounts of abuse within past relationships, while Justin Timberlake issued an apology to Britney Spears for “missteps” that he said contributed to “a system that condones misogyny and racism”.

In coming forward, Selvaratnam hopes to “shift the perception of what a victim looks like”.

“Even fierce women – strong and independent – get abused. And there are so many people who can’t get out of abusive relationships because they don’t have the support and resources to do so. The pandemic has heightened the urgency of a domestic violence crisis because victims have been in lockdown with their abusers.”

On average, one in four women and one in nine men experience intimate partner violence. A recent New England Journal of Medicine paper, A Pandemic within a Pandemic, warned of a surge in this type of violence, though calls to helplines had dropped by more than 50%.

“Experts in the field knew that rates of IPV had not decreased, but rather that victims were unable to safely connect with services,” the report warned.

According to the American Journal of Emergency Medicine and the United Nations entity UN Women, incidents of domestic violence have increased by as much as 300% in Hubei, China; 25% in Argentina, 30% in Cyprus, 33% in Singapore and 50% in Brazil during the pandemic.

Meanwhile, Selvaratnam said it was important in her account to excavate why she had stayed in the relationship with Schneiderman as long as she did. “I had to explore how I got into the relationship in the first place,” she said. In part, she said, she discovered echoes of her parents’ relationship.

“I wasn’t prepared for my path to intersect with an abuser, and I wasn’t prepared for the grooming, gaslighting and manipulation.”

In her case, Selvaratnam said, her abuser was shielded by “powerful allies including his ex-wife, meditators, feminists. He fooled a lot of people, not just me. And a lot of people encouraged me to be in the relationship.”

Schneiderman was at the time rumored to be steering toward a run for New York governor had Hillary Clinton, as anticipated, won the 2016 presidential election and the current governor, Cuomo, received a call to serve in the administration. Neither scenario transpired.

Still, Selvaratnam said she was aware of the dangers she faced exposing a powerful politician, and was prepared to do so without the support of other women who, it would turn out, had been in the same predicament.

In the book, Selvaratnam recounts that she and Schneiderman were introduced in July 2016 at the Democratic national convention in Philadelphia where they exchanged phone numbers. He began emailing her with articles about his battles with Exxon and Trump. “Good fantasy reading before bed …” he wrote. He sent a photo with himself and the spiritual teacher Ram Dass.

At a fundraiser for Hillary Clinton’s presidential campaign, the candidate complimented Schneiderman on the work he was doing. At a second, Harvey Weinstein approached with offers of raising money. Bill Clinton, too, was seated nearby.

Five years on, Selvaratnam has developed a different impression of the “fairytale” she was seduced by. “The cults of personality that form around rich people, powerful people, talented people who are abusers are damaging to those who are in the cult and damaging to society. There’s a whole ecosystem and power-structure that needs to be dismantled so abusers are no longer shielded.”

Selvaratnam said that while accumulation of power was not her motive, she was “swept up in the spotlight that was around Eric but that also made it difficult to come forward. There were many people who hoped he’d save us. He had a public-facing feminism and spirituality, but privately he abused me.

“No powerful person who is an abuser is indispensable,” she states plainly, “and we now have Letitia James as state attorney general. I’m proud of that. It feels right. So I know I did the right thing, and that gives me strength.”

  • Assume Nothing: A Story of Intimate Violence by Tanya Selvaratnam was published on Tuesday, 23 February by Henry Holt.


Content-Type: application/http; msgtype=response

WARC-Identified-Payload-Type: text/html

WARC-Type: response

text:
7-Zip: From Uninitialized Memory to Remote Code Execution (landave.io)
342 points by landave on May 3, 2018 | hide | past | favorite | 114 comments

There were some misunderstandings that I want to clear up (maybe I will add them in an update to the blog post):

1. Some people mentioned that this would "only affect RAR files" and it would be safe to extract 7z files with 7-Zip prior to version 18.05. This is wrong, because 7-Zip detects the file type from the magic numbers at the beginning of the file. So the exploit can be renamed to 'exploit.7z' and it works just as well.

On /r/sysadmin, someone even mentioned that a temporary solution might be to block RAR files. By the same argument, this is unlikely to be effective.

2. Almost all versions prior to 18.05 are affected. I manually checked version 15.05 and 17.01, and they are definitely affected.

3. Not only 7-Zip itself is affected, but essentially all software that uses 7z.dll as library to extract files. This includes various anti-virus software. However, exploitation may be more difficult (though not impossible) if ASLR&DEP is properly enabled (on all modules).

This includes various anti-virus software.

It's fascinating that this category of equipment, which searches for viruses by running untrusted code, is still regularly installed in all corners of valuable networks.

As far as I understand the bug, this is not about running untrusted code (but: a parsing error resulting in state corruption). Unless you refer to the 3rd party lib (7z), used by virus scanners, to analyse rar files. But typically "untrusted code" means code that was supplied "at runtime", not at compile time (like a lib), so e.g. if a virus scanner would actually execute a .exe to evaluate its effects, or run javascript found in a webpage.

To be fair to virus scanner vendors, the only way to mitigate this kind of bug is NIH: don't use 3rd party libs, implement everything yourself. But then, of course, without bugs yourself, as well :)

> To be fair to virus scanner vendors, the only way to mitigate this kind of bug is NIH: don't use 3rd party libs, implement everything yourself. But then, of course, without bugs yourself, as well :)

That is not the only way to mitigate such vulnerabilities. AV vendors have had plenty of time to work on sandboxing parts of their scan engines that have repeatedly been found to have vulnerabilities like this one. Somehow we've arrived at a point where no one would recommend using a browser that doesn't utilize sandboxing to some degree, but when it comes to security products, you can count yourself lucky if they don't just run that code as SYSTEM. That should really tell you all you need to know about the state of the AV industry.

> no one

Plenty of people recommend Firefox despite it sharing processes between tabs. More than 10 years after MS sandboxed IE.

> the only way to mitigate this kind of bug is NIH

Or, you know, conduct audits of open source libraries they use and contribute fixes back.

It is a very blurry line between running strange code and running library code against strange data. Mostly though, I'm trying to say that AV boxes should be outside the firewall.

They are not intentionally running untrusted code. But yes, anti-virus software can reduce security.

What AVs use this? I keep hearing horrible things about AVs but little proof. I know Tavis from Google finds bugs and AV in rare cases can reduce security, but that's a far cry from them embedding FOSS projects to save time. For AV companies writing a rar parser is a single-day activity, its hard to believe they need this app.

The few places I've seen 7z used is in installers where the input is known (installer archive in 7z format) and I'm assuming signed in many cases so you can't feed it random inputs. I find it hard to believe Sophos and Symantec and Trend are copying and pasting 7zip.dll into their apps.

I don't know about 7-Zip specifically, but AV vendors use plenty of FOSS code. Here's some findings just from Google's P0 showing that Symantec[1], Bitdefender[2], Microsoft[3] and Avast[4] all use unrar in their products. It wouldn't be far-fetched to assume some might use 7-Zip for other archive formats.

[1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=81...

[2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

[4]: https://bugs.chromium.org/p/project-zero/issues/detail?id=57...

Maybe I'm just way overestimating how complex RAR archives are (I admit, I have not looked into this), but I think you're out of your mind if you think that someone could write a parser to analyze RAR archives in a day. That it would be better tested, debugged, and more secure than a tool that has probably seen more widespread use than any single AV.

I have previously read that for some reason the author disables most of the compiler options for things like ASLR and DEP

I never managed to find out why

edit: just found this: https://sourceforge.net/p/sevenzip/feature-requests/1270/ -- seems rather questionable considering MS give away the latest compilers for free

DEP was previously disabled because Igor used to compile 7-Zip with VC6, which doesn't support the /NXCOMPAT flag. I convinced him back in January to enable it for 7-Zip 18.01. Note, however, that 64-bit versions of Windows enforce DEP even if the /NXCOMPAT flag is missing. Since Windows 10, the 32-bit version does this as well.

ASLR was primarily disabled because Igor wanted to strip the relocation from the binaries in order to save about 0.5-1% in file size. I have discussed this with him, and convinced him to enabled full ASLR for 7-Zip 18.05.

So now we have 7-Zip 18.05 with full ASLR and DEP. Stack canaries (/GS) are still disabled though.

If you can convince him to use Control Flow Guard, Stack Canaries, and HE-ALSR then you should be nominated for for whatever the security community has as an equivalent to a Nobel prize.

If you can convince him to get rid of his custom garbage Stdlib replacements and use ISO C++ then you're a hero to maintainability (and would probably improve the performance because the stdlib has move support).

HE-ASLR I am discussing with him right now, and I think we will get this.

But honestly, I don't think we will ever see a 7-Zip with /GS or CFG. Not only would this cost about 1% in binary size, it would cost an additional 1% in runtime performance loss. Additionally, it would require compiling 7-Zip with a modern compiler like VS2017. You're just asking for too much.

Like blibble says, this is an absurd tradeoff given that 7zip's primary use case is unarchiving files downloaded from the public internet. Between that, the willful ignorance and dismissiveness of security measures displayed https://sourceforge.net/p/sevenzip/feature-requests/1270/, and the apparent need for you to keep pressuring him to enable each countermeasure one-by-one, I question the prudence of using 7zip at all. He is clearly a great developer, and I have no reason to suspect ulterior motives, but his actions don't engender trust.

> You're just asking for too much.

I know it's not you saying this, but it's very strange given almost all files 7-zip will ever see are untrusted files downloaded from the internet

I'd rather have it be 1% slower than be compromised!

I know this probably isn't the answer you're looking for, but it might be worthwhile to maintain a parallel fork to enable these options for yourself/others. That way, folks that feel the same way you do can have their cake and eat it too. I realize that it's not an ideal solution though.

For virtually everybody even 500% slower would be acceptable. 1% is 10 second, one-time cost, which is objectively a fool's bargain.

Why am I getting downvoted? I sincerely wonder what is so objectionable in my comment. Most uses of 7-zip are one-off events that last around a minute long. Most users aren't decompressing terabyte-range files. It makes no fracking difference to users if they have to wait 5 minutes or 1 minute. But it makes a difference if they receive 7z archive and get their bank account cleaned because the author prematurely optimized his program on a 20 year old compiler. If there was ever a reasonable situation where security flags could be disable then client-side decompression utilities aren't one. Anyone who needs that 5% performance improvement can compile the library themselves. This is what is wrong with this industry.

Consider that it was misplaced to suggest a 500% performance drop. It's used to extract large archives, backups, videos, documents. Folks don't want it to take half an hour instead of a few minutes.

Thanks for replying, this explains things. I guess I extrapolated from my needs too much, I didn't consider users who do daily 10+ GB compressed backups.

I still wonder if there's an ethical dilemma that lies underneath this - is it fair to prioritize needs of users who use your tool in a different way (for backup jobs) over users that use your tool only occasionally, perhaps not even out of their own initiative (they were sent 7z file from a ostensibly trusted source).

> Additionally, it would require compiling 7-Zip with a modern compiler like VS2017

Ahhh, but does say VS2017 produce a smaller executable file, or a faster executable?

I am pleased Igor cares about individual 1% improvements - they stack up to significant savings. However I agree for our work usage security is more important.

> does say VS2017 produce a smaller executable file, or a faster executable?

If I recall correctly, Igor once said that he tested the new VS compiler and it produced neither smaller nor faster executables. I believe there was almost no difference.

Given what I've seen of his code, I'm not surprised. When I mentioned the stdlib I wasn't joking. His code is unable to use modern compiler optimizations such as move, RVO, and constexpr because he's using idioms that prohibit it. It would be nice if he would at least release a solution that others can use to build with VS2017.

Why is that asking too much? I realize paying for software is not something everyone wants, but doesnt the free versions of VS work for compiling 7-zip?

> Why is that asking too much?

Dunno, just as with FB/CA, users have agreed to what befell them. Relevant extract from LGPL 2.1: "THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU."

EDIT: /s, ...

Interesting insight -- thanks!

I agree with others here on the security vs. performance and security vs. binary size trade-offs. As a thought experiment I wondered at what point it would become a hard decision if I were in his shoes. I think a 10% performance hit would make it a harder decision for me, but at that point I would probably still err on the side of caution and prioritize security.

Of course it's possible this is exactly one of the reasons Igor owns something like 7-Zip, and I don't :-)

Why is this such an uphill battle?

Developer cares about efficiency. It seems strange in today's world of Electron apps and text editors that take up a GB of ram and have hundreds of ms of latency, but that's clearly where his priorities lie and I, for one, can respect that.

If people are so up in arms about the security problems of 7-Zip, they're free to fork it.

Comparing javascript to ASLR is nonsensical.

> Some people mentioned that this would "only affect RAR files" and it would be safe to extract 7z files with 7-Zip prior to version 18.05. This is wrong, because 7-Zip detects the file type from the magic numbers at the beginning of the file. So the exploit can be renamed to 'exploit.7z' and it works just as well.

But the contents of a file is what really determines the actual file type, though.

So if you decide to block RAR files, you should do that by looking at the magic number. Then you are good to go. And it's not like you have to write a lot of code or anything to do this. The standard 'file' utility in Unix is able to determine the type of a file -- often by looking exactly at the magic number.

Just like you would inspect the actual contents of a file if you were running an image hosting site -- and not trust whatever arbitrary filename the uploader told you that the file had.

Of course, but I would still strongly advise against this.

If you really cannot avoid implementing something like this, you should inspect the 7-Zip code in order to be 100% sure that the magic number detection in your filter is identical (or matches a superset) to the one from 7-Zip.

> you should inspect the 7-Zip code in order to be 100% sure that the magic number detection in your filter is identical (or matches a superset) to the one from 7-Zip

    #define SIGNATURE { 0x52 , 0x61, 0x72, 0x21, 0x1a, 0x07, 0x00 }

    const Byte kRarHeader[] = { 0x52 , 0x61, 0x72, 0x21, 0x1a, 0x07, 0x00 };

    #define SIGNATURE { 0x52 , 0x61, 0x72, 0x21, 0x1a, 0x07, 0x01, 0 }
Those are the two magic numbers for RAR archive version 1.50 onwards and RAR archive version 5.0 onwards respectively, and those are the places they are referenced in the 7-zip source code. I looked at the source archive of the 18.05 version, downloaded from https://www.7-zip.org/a/7z1805-src.7z. I guess if you wanted to be really rigorous you'd look at previous versions as well. If the 7-zip project makes use of a version control system and that vcs supports the equivalent of git blame then that should not be too difficult of a task for whoever wanted to go to that extent of investigation.

And here is where one copy of the 'file' command identifies the same magic numbers as RAR archives:

    0 string Rar!\x1a\7\0 RAR archive data

    0 string Rar!\x1a\7\1\0 RAR archive data, v5

You missed my point. It is trivial to find out what the magic number is. What is more important though: How exactly is the magic number matched? From what you have written, one might be tempted to simply check whether a file begins with this magic number. And this would be wrong. If you take a look at the matching in CPP/7zip/Archive/Rar/RarHandler.cpp:

    Byte marker[NHeader::kMarkerSize];
    RINOK(ReadStream_FALSE(stream, marker, NHeader::kMarkerSize));
    if (memcmp(marker, kMarker, NHeader::kMarkerSize) == 0)
      m_Position += NHeader::kMarkerSize;
      if (searchHeaderSizeLimit && *searchHeaderSizeLimit == 0)
        return S_FALSE;
      RINOK(stream->Seek(m_StreamStartPosition, STREAM_SEEK_SET, NULL));
      RINOK(FindSignatureInStream(stream, kMarker, NHeader::kMarkerSize,
          searchHeaderSizeLimit, arcStartPos));
      m_Position = arcStartPos + NHeader::kMarkerSize;
      RINOK(stream->Seek(m_Position, STREAM_SEEK_SET, NULL));
7-Zip finds the magic number if it appears within some searchHeaderSizeLimit, i.e., the file does not need to start (at offset 0) with the magic number. For example, 7-Zip will extract a RAR file which begins with [00 52 61 72 21 1A 07 00] (instead of [52 61 72 21 1A 07 00]) just fine.

Oh, I did not expect that. Yes you are right, one must be careful about these things.

hmmm is there any way for a end user to know what version of the dll is a problem?

The enterprise deployment of Trend Micro Officescan I have has the 7z.dll (7za.dll) version 4.57

To me that looks like quite an old version... Probably open to this exploit.

7-Zip needs to start a Go Fund Me or similar for a Code Signing certificate. They're like $69-89/year, which is expensive, but for such a popular piece of software it would be a nice safety net in case of site compromise.

Too bad none of the big CAs have an Open Source/Charity program that would provide a Authenticode Certificate for use with that software.

> Go Fund Me

I second it. The thing with donations is many people assume that someone is gonna donate (including me) and click "not now or later", where as in gofundme we would see how much they raised out of total goal and many people will then put the money.

IIRC 7-Zip has explicitly decided not go get signed. It doesn’t help all that much anyway, SmartScreen still catches your application and nags the user.

Unfortunately, I cannot seem to find any reference, so I might remember it wrong or it wasn’t about 7-Zip or whatever. The thing with SmartScreen is (unfortunately) still true.

EV Code signing certs get you immediate trust with Smart Screen. Recently discussed over on the bootstrapped forum: http://discuss.bootstrapped.fm/t/code-signing-certificate-re...

Regular, non-EV code-signing certs, aren't as useful as they were when Vista / Windows 7 were the main Windows OSes.

I wonder what do you mean by "not useful"? They just have to participate in the reputation system, but that's an issue only when the certificate is young.

Here's an excerpt from MSDN:

> Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with standard code signing certificates and even unsigned files continue to build reputation as they have since Application Reputation was introduced in IE9 last year. However, the presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs.

Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

I didn’t say “not useful”. Clearly they’re useful. I said non-EV certs “aren’t as useful”. Which is just a fact (as evidenced by the Smart Screen “reputation boost” that EV certs get).

I already read that blog post. I’m person that linked to it in the forum post.

Interesting, I wasn’t aware of that.

However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization. Not exactly suitable for small-scale Open Source development.

>However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization

no? random example:

signer is: "Open Source Developer, Dominik Reichl"

edit: another example

signer is: "Daniel Lo Nigro"

KeePass: This isn’t an EV certificate (has only OID Certum also clearly states, topmost on the description of how to get an EV Code Signing certificate:

> We do not issue EV Code Signing certificates to natural persons!

Yarn: Not an EV certificate either: "Organizationally validated certificates used to sign standard objects." (2.16.840.1.114412.3.1 in addition to

> It doesn’t help all that much anyway, SmartScreen still catches your application and nags the user.

Windows 10, in the default configuration, won't let you install unsigned applications at all. It might "nag" early downloaders when a certificate is present but you can override that (and the nagging stops eventually due to popularity).

But more importantly, if the site were ever compromised, it makes it easier to spot if a compromised binary is posted. Since hopefully the bad guy wouldn't have the code signing certificate. Right now the official binary looks like a compromised version.

When I was just installing it now (this post reminded me that I hadn't updated it recently) I was put off by the lack of publisher in the installer and went back to double-check it was the official version. It's really off-putting seeing "publisher: unknown" when installing and my immediate reaction was, "wait, did I install it from the legit site?".

it's even cheaper if it's for an open source project: https://www.certum.eu/certum/cert,offer_en_open_source_cs.xm...

28 eur.

That's surprising. I'd expect they receive more than $70 a year in donation already, so it should not be such a big issue.

AFAIK 7-zip doesn't take donations (feel free to correct me), but you could argue that the donations were going towards the author of the software to thank them for their work and not towards funding the development, so the author has no reason to feel compelled to buy a cert if they don't want to. Of course, that would all depend on the wording of the donation page, which I don't believe exists.

I've never found (recently) how to donate to 7-zip, it seems the author removed the option to do so on the website. Maybe I'm too stupid, so please correct me if I'm wrong and you find a link.

That could be a nice use case for a blockchain.

I can picture this working, actually. Someone could put some smart contracts into the Ethereum blockchain, for example, one per piece of software, with the instruction that if the contract receives more than a certain threshold in total donations, a transaction is sent to a CA asking them to issue a code signing cert to the developer of the relevant piece of software (hardcoded into the smart contract).

The CA would have to be in on this, by having an Ethereum address to receive the crowd-funded amount at, and they would have to make contact with the developer and verify them using their normal methods, but there would be a strong financial incentive for them persuade the developer to accept their certificate. Perhaps if the developer declines, then the funds controlled by the smart contract can expire and be sent back to the unsuccessful crowd-funders.

My guess: Because 7zip is not a good auto update software (does it even warn if there is a new version?) this security bug is HUGE!

Just give you an example: Many Germans think that http://www.7-zip.de/ is the official site and you still download 16.04 there.

Well, it says „official website“. If it isn‘t the author should send a C&D, this is really unfair.

Yeah, there is no question about it. This website clearly says that it's the legit source for 7zip. There is even a red box on the right side of the page. This needs to be taken down if this is not an official source.

The left side has a navigation to different translations of the page. All but the English version link to the German page as well.

I'm guessing it was once part of the build pipeline but has since been abandoned.

So yeah, it is an official source. It's just outdated

Or you know, the author of 7-zip could pay for a digital certificate and sign the executable. Fake websites and "Trojans" are a known problem, with a known solution.

Unfortunately, 7-zip barely has any security involved. No digital signatures, no ASLR, no NX bit, no stack canaries, no nothing.

Hopefully these security concerns wake up Ivor. Its not the 90s anymore: developers have to participate to get a proper security posture. That's why Windows tried so hard to get everyone to use sandboxed Win10 Apps / Metro Sandbox by default, because these problems require the developers to care about security.

> So yeah, it is an official source. It's just outdated

`whois 7-zip.de` resolves to a private person in Germany. This does not look official to me. More like a crowdsourced effort of providing translated websites with a dangerous effect in case of security vulnerabilities.

The versions provided are (as of 2018-05-04T10:20:00Z): en 18.05, de 16.04, zh 16.04/18.05, eo 18.01, fr 18.01, ja 18.05, pt 18.01, es 18.01, th 18.05, vi 18.01

I just checked and I was on v9 from 8 years ago on my work pc. Why bother fixing security bugs etc if you're not going to roll them out? With other Windows software I get told about updates when I load them (winscp, Virtualbox) or they check and update themselves (Firefox).

Because there are multiple conflicting priorities here. On the one hand, it is good to keep software updated, and therefore software should check for updates. On the other hand, software should restrict itself to solving one problem domain. Interacting with the internet is something wholly distinct from decompressing files, and so the software should not branch off into a new domain. Choosing between these priorities is not necessarily straightforward.

I could also argue that automatic updates are themselves a security hole. They are a way for new code to be downloaded and run, without notifying the user. As a result, it means that your security depends on the security of a machine not under your control. Not too much of a risk for Firefox, but imagine having a program that auto-updated from SourceForge during its experimental fling as a malware distributor.

A real-life example of the risk of automatic updates: about a decade ago, the maintainers of the Shareaza multi-protocol p2p client lost control of their domain, and the new owners of the domain pushed their own (sleazy, commercial) software to unsuspecting Shareaza users via its update mechanism.

(IIRC the maintainers learned the right lesson from that, and started signing their updates so it can't happen again)

Windows is special here because Microsoft never properly solved the distribution problem for software.

If you want the typical user on Windows to run updated software, your software has to at least entice updating if not auto-update straight away.

Not solving this whole distribution mess is by far the worst downside of Windows as a platform. Not getting malware when installing software on your Windows PC is hard.

Assuming I agree with you, what's the reason for not telling me about updates when I run the app? What's the advantage of the decision they've taken which is to not announce this?

Because even determining that there is an update available requires checking against an outside source to see if an update is available. This requires internet access, which requires handling network protocols, network security and encryption, none of which have anything to do with file compression. Increasing the scope of a project introduces additional failure modes, and a larger security risk.

If a project already performs telemetry, or if they have developer announcements, then the project has already increased its scope, and checking for updates is a relatively minor addition. If it is a well-behaved stand-alone application that doesn't make unwarranted external connections, then checking for updates is a large increase of scope.

Old thread, but I'd like to point at http://scoop.sh [1] which provides a command line package manager for Windows - and allows easy update of packages.

Chocolatey is similar in some ways, but scoop works hard to isolate installed apps from each others, and from other users (which can be good and bad). It's a little like an apt-like wrapper for binary-only (x)stow.

[1] scoop is hosted on github - the download url is on proper ssl, the bare scoop.sh domain presents a github-cert.

> Because 7zip is not a good auto update software

Updates should be handled by the OS anyway IMO

Can’t see that happening on Windows soon, if ever.

The Microsoft Store correctly auto-updates apps from the store.

Great, p7zip is also affected according to an earlier article [1] and the last version 16.02 is from 2016 [2]

This open source libraries are used everywhere :(

[1]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions...

[2]: https://sourceforge.net/projects/p7zip/files/p7zip/

Note that the standard 'p7zip' package from Debian/Ubuntu doesn't support RAR. However, they have an additional package 'p7zip-full' or 'p7zip-rar' for RAR support. I didn't check explicitly, but I assume these are affected.

I checked the versions in buster (p7zip-full 16.02+dfsg-6, p7zip-rar 16.02-2) and they look unaffected to me. Turns out that the Debian maintainers patch upstream sources to include hardening flags, e.g. -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro. You can use hardening-check to check the binaries on your system.

Okay, so these packages come with more mitigations than 7-Zip on Windows. However, looking at the source code, I am pretty sure they are affected by the same bug.

"Unaffected" was probably the wrong word to use. What I meant is that one of the mitigations (making the executables position-independent) should prevent the bug from being exploitable for remote code execution on Debian.

thanks for the inside information about p7zip! That's really good to know!

Is there software running on Linux which is derived from the same source and is also vulnerable?

Is this package vulnerable:

Just looked at both the packages source, and it looks like they are affected. At least all the vulnerable code is in the source package.

Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104

That's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969.

[0]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions...

The Debian security team doesn’t patch packages from the non-free repository, like the 7-Zip RAR support:

That would have to wait for the maintainer to upload a new version and get it into a stable release.

Ubuntu doesn't get these patches, unless some non-Canonical volunteer puts in the effort to prepare a package and get a sponsor from Canonical. Future version of ubuntu will eventually get the fix because Ubuntu it will be forked off from a sufficiently new version of Debian.

here's the status of your DSA's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2...

Here's the status of the post's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2...

Yes, they are. I just removed p7zip from my arch box for now. Looking at the project, I think it may take a while to get up to 18.05

Has anyone definitively confirmed that this vulnerability exists in 7-Zip v9.20 (release) through v9.35 (beta)?

I have always used 7-Zip on Windows. Having done some reading now, the author's general attitude towards the tradeoff between security and executable size/speed have convinced me to try and not use it in the future. Thankfully I rarely have to use Windows these days.

Hi all, In 18.01 Igor had fixed CVE-2018-5996 with adding some variable like _errorMode or m_TablesOK. And in 18.05 I don't see this variables. Igor was replace it by _solidAllowed to fix CVE-2018-10115. Does it fix for both CVE-2018-5996 and CVE-2018-10115? Thank you

I think this is correct. Since _solidAllowed is set to false at the beginning of Code(), it will remain false if an exception occurs in the middle of decoding (CVE-2018-5996). This will enforce PpmError being set to true for the next item, which in turn will enforce the (possibly broken) PPMD state to be reinitialized. In some sense, this means that the new bug fix is a generalization of the first one, fixing both CVE-2018-5996 and CVE-2018-10115.

Thank you!

Are there any good alternatives to 7-zip we can use instead?

For extraction, use bsdtar from libarchive. It supports various container and compression formats. I never looked back to GNU tar, bsdtar is vastly superior.

I would never have found out this if it wouldn't for this post in HN. So Thanks you for posting.

This is why Cuckoo Sandbox uses sflock (https://github.com/jbremer/sflock) :)

It sandboxes extraction.

I notice that the submission contains a "?hn" query arg, which I'm pretty sure confuses the dupe detector.

Why does anyone use 7-Zip? Does it have any advantages over the more widely used alternatives (tarball and zip)?

You need 7-zip to read tarball and zip on Windows.

It has convenient windows packages.

For me, it is support for unicode filenames.

There are extensions for tarball and zip file formats that handles the problem, but not many software supports these extensions, whereas every software supporting 7z handles unicode filenames correctly.

Better compression I guess...

Since Ubuntu and Debian are affected,so CentOS is affected too?

Nowadays when that sort of bug is discovered, the question that naturally comes to my mind is "would that have happened if the software were implemented in (safe) Rust"? In that case it looks like the answer is no.

Of course 7-zip is much older than Rust so that's just a thought experiment.

Comments like this hurt the adoption of Rust by making the community seem hopelessly naive. It's just how people make the Go community look bad by acting like Go invented CSP.

Rust is a (very?) good language that I hope will see more adoption but it is not the first memory safe language. Garbage collected languages are perfectly appropriate in many situations. Ada is almost 40 years old.

Why is wondering “could another tool have solved this problem” come across as “hopelessly naïve?”

It didn’t say Rust was the first. It also acknowledged that there’s great reasons it’s currently not used here.

Memes about programming languages (and programming language communities) die hard so it's probably a good idea to avoid reinforcing them when possible. I read this comment as a sort of implicit variant of "RIIR". Judging by the downvotes, I think others did the same.

Rust probably doesn't even deserve the "RIIR" meme as 1) "RIIR" seems to happen way more often on HN/similar than on mailing lists or bug trackers and 2) much of the time the person saying "RIIR" admits to not even being a Rust programmer themselves. I think it's just a side effect of Rust (justifiably) emphasizing safety, and by extension security, in its presentation, and the tendency of some people to conflate the elimination of a certain class of vulnerabilities with the elimination of all vulnerabilities. To be fair, this poster didn't make this mistake.

Edit: Another mistake that some people make after being introduced to Rust is assume that languages that don't explicitly emphasize memory safety in their presentation aren't memory safe. This poster comes across as potentially making this mistake.

Thanks, that makes sense. I’m very interested in these kinds of perceptions, so I appreciate you taking the time.

Of course same is true for modern cpp.

Modern C++ does not mandate that every value be a valid instance of its type wherever it is theoretically accessible, so I'm not sure why you're saying modern C++ fixes this. Actually, the fact that Rust does is something people somewhat regularly complain about. It is a heavy-handed performance / code complexity vs. safety tradeoff that certainly fixes this bug, which I think is a pretty reasonable thing to point out.

D also addresses buffer overflows in a mechanically checkable manner.

If you follow C++14 core guidelines, the defect described would not have occurred. The bug at its core is usage of unsanitized input data. You don't need to "mandate that every value be a valid instance of its type wherever it is theoretically accessible", however that may differ from simple sane C++14 paradigms.

OPINION ALERT: Honestly guys get over rust, it does not offer a single advantage in real-life programming scenarios.

I disagree with people who think Rust is a savior, but it does have plenty of advantages in some areas over C and C++, especially for novices.

So I have to read a 21762 line document just to avoid shooting myself on the foot?

There's a Rust advantage right there.

Who said anything about reading a document?

The guidelines seem like a document to me: https://github.com/isocpp/CppCoreGuidelines/blob/master/CppC...

You don't have to read them. The compiler will enforce them.

The C++ compiler can't enforce many of these rules (and many of the ones it does claim to enforce, it only does heuristically), and the document itself is not shy about admitting that. It also makes quite clear that it expects not just mechanical checking, but things like peer review, to take these guidelines into account--meaning yes, you are expected to know a large portion of the document. Also, a lot of the listed enforcement mechanisms are literally just flagging suspicious code--you would have to disable a tremendous number of such flags to execute many perfectly reasonable programs. Stop misleading people about the contents of this document actually being enforced by the compiler, please.

Oh, ok, I didn't know that, thanks. Enforcing guidelines seems a bit like a contradiction in terms :)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

warcinfo:
isPartOf: CC-MAIN-2021-21
publisher: Common Crawl
description: Wide crawl of the web for May 2021
operator: Common Crawl Admin (info@commoncrawl.org)
hostname: ip-10-67-67-81.ec2.internal
software: Apache Nutch 1.18 (modified, https://github.com/commoncrawl/nutch/)
robots: checked via crawler-commons 1.2-SNAPSHOT (https://github.com/crawler-commons/crawler-commons)
format: WARC File Format 1.1
conformsTo: https://iipc.github.io/warc-specifications/specifications/warc-format/warc-1.1/


text:
Have you been served yet? You will want a lawyer right away, since the time allowed to respond starts ticking at service.

Where are you incorporated, if at all? If you are not incorporated in Delaware, do you have customers in Delaware? If not, did you advertise for customers in Delaware?

I read the filing. The person that filed it is really stretching to get Delaware as the place for all the suits. I don't think that many of these companies will be forced to litigate in Delaware. You are included in that assessment.

I am not a lawyer, but I am a second year law student. If you want more information, post here or feel free to send me an email. I relatively near you in Mass, too.

I got a "courtesy copy" of the complaint this morning (via overnight Fedex). Does that count as service?

I'm not incorporated and haven't thought about Delaware in particular as a place to advertise Voo2do. There are certainly Voo2do users in Delaware (and in most other places in the world).

The only income I've received to date from Voo2do has been donations from people who found it useful. If you consider the cost of the hosting, Voo2do has been a net money loser for me for many years. But it's led to a lot of other great contacts and given me a lot of satisfaction from helping other people.

You should stop talking in public about this case. Anything you say can be used against you by them. Talk to other defendants but most importantly, find a lawyer and talk to them first.

PS: Ask pg to delete your post.

That probably does not count as service. Service of process is governed by Rule 4 of Civil Procedure (in Mass and at the Federal Level). The overnight likely does not meet requirements of either Mass state or federal rules of civil procedure.

Mass. Rule 4: http://www.lawlib.state.ma.us/mrcp4.html Federal Rule 4: http://www.law.cornell.edu/rules/frcp/Rule4.htm

Did you receive a summons or was it just a printout of what we saw in the TC article? Insufficient service is grounds for dismissal. The plaintiff has time to correct, though.

You should see if there are any users in Delaware. If not, I doubt you can be compelled to court there. Even if you do have users in Delaware, it is a stretch.

For everyone on YC News, this is a reason to incorporate in your home state, not Delaware. Incorporate in Delaware if you want VC funding. Otherwise, stay in your home state. If you incorporate in Delaware, or any other state for that matter, courts automatically grant personal jurisdiction in that state. Basically, that means you have to go to court there.

This is also a reason to incorporate. Right now shimon is personally liable for damages, if any.

In retrospect, any limitation on potential liability would be nice. But I didn't originally set out to make Voo2do into a business -- the only way I get money for it at present is through donations. Are you saying anyone who wants to build and offer a web application should form an umbrella corporation for that? What about non-web software? Where do you draw the line between "personal experimental project" and "entity that needs a state-sanctioned organization around it"?

"Personal experimental project" is just that. Only you use it. Once you let an outside person use it you have distributed in the eyes of the law. You are open to suit and are no longer within safe harbors of personal use.

If you are making something for others to use, incorporate. It will cost you a few hundred dollars per year in filing fees, but that is just a type of insurance against times like this.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact


text:
Italian Coast Guard rescues migrants and refugees bound for Italy. © IOM/Francesco Malavolta 2014
Italian Coast Guard rescues migrants and refugees bound for Italy. © IOM/Francesco Malavolta 2014

The United Nations Interim Force in Lebanon (UNIFIL) rescued on Monday a boat with 37 people onboard at sea outside Lebanese territorial waters, a statement by the UNIFIL reported.

One of the 37 people had already passed away, according to the statement.

All the 36 survivors were provided with immediate medical treatment on the UNIFIL Maritime Task Force ship before being transferred to the Lebanese authorities.

“The main priority for our peacekeepers was to rescue the remaining 36 people and ensure their safety by providing immediate assistance,” the UNIFIL said.

UNIFIL’s Maritime Task Force immediately informed the Lebanese authorities.

The MTF ship has then moved towards the Port of Beirut.

The UNIFIL Maritime Task Force has been deployed at the request of the Lebanese government to assist the Lebanese Navy in securing the territorial waters and to help prevent the unauthorized entry of arms or related materiel by sea into Lebanon.

In addition, the Maritime Task Force has been working with the Lebanese Navy to strengthen the latter’s capabilities to secure its maritime borders and assume effective security control over Lebanese territorial waters.

Disclaimer: News Ghana is not responsible for the reportage or opinions of contributors published on the website.

Send your news stories to [email protected] and via WhatsApp on +1-508-812-0505

Previous article2 dead, 16 injured in bus-truck collision
Next articleIran protests against “meddling of German, French embassies in internal affairs”
Xinhua News Agency, Xinhuanet is an important central news service-oriented website, an important information organ of the central government, and an important platform for building up China's online international communication capacity. Established on November 7, 1997, as an online news provider of the Xinhua News Agency, it was officially named Xinhuanet on March 10, 2000 and began around-the-clock news release with leading online public opinion at home and setting a good image of China abroad as its main task.

Please enter your comment!
Please enter your name here


text:
Please wait a moment loading...
Note-taking: The Essential Skill You Need to Maximise the Benefit of Your Online Course

Home » Blog » Note-taking: The Essential Skill You Need to Maximise the Benefit of Your Online Course

ote-taking is commonly associated with academic learning. Mainly, taking notes during college and university lectures. It is just as applicable to your e-learning experience though and here’s the reason why…

Note-taking is a life skill!

  • It helps inspire creative thinking – a vital ingredient for business courses
  • Training for customer facing roles requires listening skills. Taking efficient notes from audio and video included in some e-learning courses helps refine your listening skills.
  • Complex courses such as those relating to Information Technology require students to understand and recall vital pieces of information when applying the new skills in the workplace. Learning to take efficient notes will help fine-tune the information you collect, retain and recall.

Essentially, every course you take will be complemented if you learn to take efficient notes during your course.

Setting yourself up for success with efficient note-taking techniques

Paper notes are better for memory retention

Memory recall is enhanced when you write things down. For that reason, it is better to take your notes on paper rather than using a word processor. Besides, when you’re studying something online, it is going to help you focus more when you aren’t switching between a browser tab to view your course material and a word processor to take the notes down.

Instead, a legal notepad or loose-leaf jotter can be used to jot down the notes you feel are important as you go through the course material. If you plan on only using written notes, leave plenty of space between each note for you to add your comments to it. An alternative is to go through the course module/unit you’re studying and once you reach the end, then open your word processor, (Notepad, MS Word or Open Office, or Pages for Mac users) and expand on the notes you took down.

Type in the notes you took and then add your own comments to them, and format them for easy reference. The advantage of this is you can organise the notes on your computer by making the file name obvious that the notes relate to a particular module or course unit.

Write down your questions

As you go through different parts of the course, there will be questions come up. Some of your questions may be answered and others already answered. Whatever questions spring to mind as you’re studying, take a note of them. That way, once you’ve completed the module, you can then answer the questions you had. If you can’t find answers, you know what questions you need answered from the support.

Look or listen for clues that help you focus more

There will be times when numbers are used, such as in the module objectives it could be describing 7 ways to do something or 3 important things to know about x topic.

These give you a head start for your notes as you can simply write down “3 things” or “7 things” and then put a numbered list below that. Whenever one of the things from the list is mentioned, you will already have created the space in your notes to add them. That also helps keep your notes tidy so you can comprehend them when you go back to them.

Use the organisation method that helps you understand your notes better

Once you have your notes, at the end of the module, you can go further than the course tests by taking the important points you wrote down and pop them into a mind map, chart, or simply list them in bullet-point format.

Your notes are your files and not for review by your tutors. You can refer to them any time so by creating a unique summary of each module, you will be able to reference information easier at a later date.

Write a summary based on your notes

Once you’ve completed any module, to test your note taking abilities, close all other information and work from your notes only. From these, create a summary of what you have learned in the module. For every major point that was covered, you should be able to convey it in a brief summary.

Separate your thoughts and opinions from the facts

The facts are what you need to know. The notes you take will not all be fact. An important part of efficient note taking is revising them after the module is completed. The point of the notes revision is to get all your questions answered and to whittle down the notes you took that turned out to be irrelevant – there will be some.

Use browser extensions for simplicity

There are some browser extensions that simplify note-taking from web pages. An example is, which is a yellow highlighter, which will make your note taking faster. Each highlighted piece of text is also added to a clipboard and retained, however, it does require an account to use it. An alternative that doesn’t involve you sharing your email address to create an account is the Sticky Notes chrome extension. This adds a button to your browser bar that, when clicked, drops down a sticky note for you to type whatever you need to. This would be handy for taking notes from audio and video as it is likely that you can type faster than you can write, and you don’t need a new tab open. It just drops down the side of the webpage you’re on. It has formatting limitations, but for the purposes of recording notes fast, it will do the job.

In Conclusion

While every e-learning course is designed to teach you whatever you’re studying, your higher level of engagement through note-taking will help you recall the important parts that are needed to know, ensuring you have clarity from the lesson covered.

The notes you take during each course module can then be used to describe in your own words an overview of what has been learned in that module.

The more efficient you become at taking notes, the better you will be able to use the information learned in the workplace because you will have a more thorough understanding of lessons learned through enhanced memory recall.

New Skills Academy now have a note taking function built in to your course. Click on the red “Take Notes” button at the bottom of the page and you can write and save your notes and thoughts for future reference.

Blog Categories

Learn with confidence

New Skills Academy we work in association with industry experts including:

approved online courses

Get a Free Guide to Improve your Career Prospects

Subscribe to our weekly newsletter and we will send you our latest news and offers, as well as free copy of our informative guide titled: The Ultimate Guide to Career Intervention

Your information is important to us. We will not pass it on to third parties

Multiple Award Winning Courses

Global Business Awards Hertfordshire sme best business awards Natwest awards british small business awards Hertfordshire business awards National business awards


text:
• By Jay Furst

New Mayo Clinic studies to be presented at American Society of Hematology meeting

December 9, 2019
female researcher pipetting samples

ORLANDO, Fla. — Mayo Clinic researchers will present findings at the American Society of Hematology Annual Meeting Dec. 7–10 in Orlando.

New Mayo Clinic studies to be presented include:

DNA analysis identifies elevated risk factor for myeloma in individuals of African ancestry

Embargoed until Monday, Dec. 9 at 6 p.m. EST

Multiple myeloma is a plasma cell cancer that is more common in patients of African American descent than of European American descent. Genetic research has shown that patients of more than 80% African ancestry are more likely to have a specific subtype of myeloma that features a genetic translocation, which is an exchange of genetic material between chromosomes.

Mayo Clinic researchers conducted DNA genotyping analysis of 898 patients who had evidence of a plasma cell disorder and had confirmed that the risk of a particular genetic translocation — the most common translocation linked to myeloma — is higher in patients of African ancestry.

The study worked with what is believed to be the largest group of African American people with an abnormal plasma cell clone along with uniformly collected information, including genotyping and ancestry data.

"Although our association study does not explain the specific mechanism that gives rise to the translocation, it is at least one step closer to help us understand why African Americans are more likely to develop myeloma, compared with European Americans," says first author Linda Baughn, Ph.D., a Mayo Clinic pathologist. "Perhaps one day we can fully understand all the risk factors for myeloma development and will be able to predict who will get this devastating malignancy."

Study identifies more precise assessment measures for patients newly diagnosed with chronic lymphocytic leukemia

Embargoed until Monday, Dec. 9 at 6 p.m. EST

Chronic lymphocytic leukemia is a type of cancer of the blood, and monoclonal B cell lymphocytosis is a precursor to chronic lymphocytic leukemia. Current practice is to use the chronic lymphocytic leukemia international prognostic index to assess newly diagnosed patients and assign them to four prognostic risk groups.

Mayo Clinic researchers evaluated two genetic scoring processes for their potential to improve on the chronic lymphocytic leukemia international prognostic index. One is the inherited polygenic risk score and the other is the tumor mutational load. The study found that the two genetic scores offer a more precise prognostic assessment.

"We were surprised that the two genetic scores were able to stratify risk beyond the international prognostic index with fewer than 200 cases examined," says first author Geffen Kleinstern, Ph.D., a researcher in the Mayo Clinic Department of Health Sciences Research. "This supports our hypothesis that the scores are significant predictors for CLL prognosis."

Researchers develop method to assess cancer-fighting cell therapy's effectiveness

Embargoed until Saturday, Dec. 7 at 8:30 a.m. EST

Chimeric antigen receptor therapy (CAR-T cell therapy) uses a patient's own immune cells to treat cancer. CAR-T cell therapy has been approved by the Food and Drug Administration for patients with acute leukemia and lymphoma. Clinical trials are underway to investigate treatment of other types of cancer, including solid tumors. But CAR-T cells can't always reach the tumor site and fail to kill cancer cells. And there can be a severe side effect called cytokine release syndrome.

Mayo Clinic researchers have developed a method that enables positron emission tomography (PET) to show CAR-T cell distribution in the body. For the CAR-T cells to be visible on a PET scan, the researchers engineered the cells to express a protein, sodium iodide symporter. When mice with leukemia received these engineered cells, researchers were able to clearly view and track the CAR-T cells with tomography.

"The ability to track CAR-T cells in patients and see where they go would revolutionize the field," says first author Reona Sakemura, M.D., Ph.D., a researcher in Mayo Clinic's T Cell Engineering Laboratory. "We developed this technology to track CAR-T cells and see if they actually reach the tumor sites. With this study, we were able to show that our technology is efficient in accomplishing that."

The process also may help predict severe toxicity resulting from CAR-T therapy, Dr. Sakemura says.

About Mayo Clinic
Mayo Clinic is a nonprofit organization committed to innovation in clinical practice, education and research, and providing compassion, expertise and answers to everyone who needs healing. Visit the Mayo Clinic News Network for additional Mayo Clinic news and An Inside Look at Mayo Clinic for more information about Mayo.

Media contact:


text:
Yes, we can: 25% organic agriculture in 2030!

Some people doubt if the EU can achieve its ambition of 25% organic agriculture by 2030. Even if the demand is there, many farmers are manacled to huge loans and to a system that promotes externalisation. But according to Volkert Engelsman, CEO of Eosta, a real shift can be accomplished with strong fiscal signals. EU-Commissioner Frans Timmermans recently said that financial institutions (like Rabobank) will have to write-off some of their investments in intensive agriculture, because they are basically stranded assets. With fiscal measures and write-offs, it can be done. We can't afford not to.

25% organic in 2030 will be a challenge. For countries like Austria or Sweden the goal is within easy reach, but in most of the EU it seems far away. In the Netherlands, one of the biggest agricultural exporters of the world, less than 4% of the agricultural area is now organic. And the reformed Common European Agricultural Policy (CAP), which regulates the distribution of billions in subsidies, sadly failed to adopt any significant change in 2020.

If farmers are not rewarded for green services, how can they go green? Many farmers are deep in the red. Frans Timmerman, vice-president of the European Commission, has therefore suggested in a Dutch tv-program that financial institutions will have to write off loans to farmers to make a shift to more sustainable agriculture possible. Previous investments in practices that threaten biodiversity and the climate just don’t make sense anymore. “I’m saying to Rabobank what I say to all financial institutions: look at your books. Which loans do still have a future?”

Volkert Engelsman, General Director of Eosta, has advised the European Commission on behalf of OPTA, the European organic trade organisation earlier this year. He suggested taking serious fiscal measures, linked to True Cost Accounting, to create a level playing field in the market between companies that externalise social and environmental costs, and companies that work more sustainably. Some options: taxes on artifical fertilizers, pesticides and imported feed; VAT reductions; or even a fundamental change of the tax system like the Ex’tax Project.

According to Volkert Engelsman (and many in the organic sector) there is no alternative: “The new normal after Corona will be healthy, fair and organic. Where there is a will, there is a way."

“I’m saying to Rabobank what I say to all financial institutions: look at your books. Which loans do still have a future?”
Frans Timmermans, Vice President of the European Commission


text:
Food Services

Quest Logo

The Quest Food Services staff is committed to providing safe and healthy food choices for students during the 2020-21 school year. Students will have a 35 minute lunch period each day.  The cafeteria capacity will be limited, and students will be directed to designated eating areas on each campus so that social distancing can be maintained. To start, we will offer only one brown bag pre-order option each day. For information on setting up a RevTrak account and a separate lunch ordering account, click here . When possible, we suggest students bring their own lunch to school.

More Food Service Options for Students

We are excited to introduce expanded menu options for students. The menu each school day will include up to four of the following selections:

  • Cold sandwich option
  • Non-meat option (may be hot or cold)
  • Warm meal (ex: pizza, pasta, panini )

We strongly encourage students to pre-order their meals using these instructions . Students will use their student ID for payment. Please pre-load IDs via Revtrak , as we are trying to avoid cash handling at this time. The snack cart will also return with limited items like cookies, candy bars and potato chips for purchase with student ID. All food pre-orders and the snack cart will be available on the first floor outside the McGee Theatre and the 2 nd floor south concourse at the Winnetka campus and in the cafeteria at the Northfield campus.

Our Approach

At Quest Food Management Services, we have been providing fresh, high-quality food and intensely personal service for over 30 years. Our Food Philosophy guides our approach to wholesome, scratch- made food, and our culinary leaders deliver tailored dining experiences to the unique needs of each community we serve. Driven by our unparalleled responsiveness to feedback, we crave being challenged to think outside of the box.

These values have made us one of the fastest growing companies in our industry. With a full spectrum of innovative, inspiring experiences to offer, we are a trusted partner to some of the Midwest's most notable institutions and organizations.

To learn more about Quest, please visit our corporate website at

Adding Funds

Revtrak is a user-friendly school food service software system, providing fast, friendly customer service that helps your student get through the line quickly. Revtrak allows you to add funds, receive notifications and purchase history. We encourage you to sign up for Autoreplenish which ensures that your student's account will not reach $0.

Sign up today at

Menus with Culinary Suite

Culinary Suite is a food management software solution that Quest uses to build and display menus. The software provides nutritional analysis and allergen tracking for all items we prepare, ensuring the health and safety of the school community.

Quest Allergen Disclaimer

Due to the handcrafted nature of our menu items, our kitchens which share cooking and preparation areas, and our reliance on suppliers for accurate information, we cannot eliminate the risk of cross-contact or guarantee that any item is free of any allergen. There is a possibility that suppliers of the commercial foods we use can change the formulation or substitute ingredients at any time, without notice. To that end, we make every attempt to identify ingredients and menu items that contain the 8 major allergens (milk, eggs, soybeans, fish, crustacean shellfish, wheat, peanuts, tree nuts). The allergen information provided is up-to-date to the best of our knowledge and is based entirely on the information provided by our suppliers. We also make every effort to instruct our food production staff on the severity of food allergies.

New Trier consults individually with customers whom have food allergies to minimize allergic reactions. Prior to consuming menu items, individuals with life-threatening food allergies should confirm the ingredient information on the actual label of the product. If a customer decides that the menu item is safe on any given day, that decision is entirely their responsibility. New Trier will not assume any liability for adverse reactions to foods consumed, or items one may come in contact with while eating at New Trier. No allergen information should ever be considered a guarantee, but simply a best faith effort to serve our customers.

Customers with food allergies are encouraged to contact Food Service Director, Dennis Karim at or 847-784-2285 for additional information and/or support.

Wholesome Meals

Quest is committed to offering a variety of healthful options. All of our meals feature lean proteins, whole grains, healthy fats, and a wide variety of fruits and vegetables.

Sourcing Locally

We utilize programs that help us source from farmers and artisans within 250 miles of your school. These programs provide access to the highest-quality produce and specialty foods that we get to offer in our dining hall.

Our Food Philosophy

We are passionate about food and we believe in wholesome, nutritious ingredients. That is why we are committed to using items healthier for both our bodies and the planet. By purchasing with the following standards in mind and preparing items so that they are as fresh as possible when served, we support local agriculture, increase nutrition, and intensify flavor.

  1. Never using artificial trans-fats for any items prepared in house.
  2. Never using MSG.
  3. Serving produce that is fresh, fresh frozen or packed in 100% juice or water.
  4. Sourcing milk that is local and free of added growth hormones.
  5. Serving 100% cage-free eggs.
  6. Offering 100% produced at origin, hand harvested, mountain grown, custom-blended coffees. Supporting partnerships with the Colombia Coffee Growers Association, Rainforest Trust, and numerous charities through Fundraising 365.
    1. Serving proteins that are USDA certified.
    2. Purchasing sustainable seafood that follows the Marine Stewardship Council's guidelines and recommendations.
    3. Writing menus that feature seasonal and regional products we source from local farmers and small producers.
    4. Accommodating nutritional and dietary requests.
    5. Offering a wide variety of vegetarian, vegan and gluten-free options.
    6. Serving an array of whole grain breads, pastas and cereals.

    Our Mission, Vision, and Values

    • Mission: Quest provides the communities we serve with fresh, high-quality food, exceptional responsiveness and intensely personal service.
    • Vision: We are committed to creating the most enduring relationships in the industry by what we do and how we do it.
    • Values: Integrity, Responsiveness, Accountability, Respect, Excellence

    Lunch Program Service Modifications: Quest's Safety Plan  during COVID-19

    Quest is ready to welcome you back to the cafeteria!  We have spent the summer preparing for safe openings that ensure the safety of our guests and our employees.  For more information surrounding the safety measures we are implementing in all our kitchens and dining halls please link directly to:


WARC-Identified-Payload-Type: application/xhtml+xml

text:
204 958 Mcmillan Avenue

204 958 Mcmillan Avenue

Winnipeg, Manitoba, R3N0V6, Canada

This property can be sold, please contact us to verify.
Please do not visit without confirmation.

Building type: Apartment
Storeys: 1
Floor Space: 1192 sqft
Bathrooms: 2
Bedrooms: 2
Parking Type: Other
Cooling: Central air conditioning
Heating Type / Fuel: Forced air (Electric), Forced air (Natural gas)
Water: Municipal water

Property Description

LAST UNIT LEFT!'The McMillan' delivers you with unsurpassed quality and elegance, never before found in Crescentwood/River Heights area. Concrete and steel construction with true 9' ceilings (no bulkheads), huge custom triple pane windows, and 8 sliding patio doors boasting an abundance of natural light. This energy efficient building complete with luxury finishes has an open concept Living Room/Dining Room and large kitchen with extra tall, soft-close cabinetry, artisan tile backsplash, and 10' island with quartz counters, gas range, and counter depth stainless steel fridge. The thoughtfully designed space begins with a welcoming foyer complete with large walk-in closet and large laundry room, master bedroom with custom walk-in closet, and ensuite bathroom with oversized vanity and custom shower with rain shower head. Relax on oversized private balcony with natural gas hook up for BBQ, and convenience of secure heated parking, PLUS 2nd outside covered parking stall included.

Tell Me More About This Property

(Do not visit real estate objects without first agreeing on a visit)

Property on Map


text:
Air Duct Replacement Service

Complete Air Duct Replacement

See All Offers

Why Choose Nexgen?

Family Owned & Operated Business
Available 24/7 for Emergencies
Trusted Name in Home Repair
Available 24/7 for Emergencies
Fully Licensed & Insured Technicians
Commercial & Residential Experts
Nexgen specializes in ductwork replacement, which can improve the performance, reliability, and efficiency of heating and cooling systems. All the air that leaves/returns through the vents passes through air ducts. A blockage can restrict airflow and strain your air conditioning system. Duct damage, contamination, and leaks can severely impact indoor air and make it unhealthy to breathe. Fortunately, Nexgen can help with ductwork installation, replacement, and cleaning so you can live free of air duct problems.

Signs of Duct Damage and Poor Condition

Air ducts must be completely intact to allow your HVAC system to function as designed. Signs of damage or poor conditions inside your ducts include:
  • Reduced HVAC Efficiency: Small holes, collapsed ducts, and leaks can make your AC system work harder to maintain set temperatures. This in turn can reduce efficiency, increase your energy bills, and accelerate wear.
  • Restricted Airflow: If less air is blowing from the vents, there may be a blockage in the ducts. The ductwork may be damaged or improperly designed.
  • Dampness/Mold: Air duct issues can lead to dampness. Any moisture accumulation can allow mold to grow, causing odors, additional damage, and potentially health problems.
  • Air Quality Issues: Dust, dirt, pollen, hair, and dandruff can accumulate inside ducts, releasing particles into the air. Rodent droppings may bring odors, bacteria, and viruses into your home. Another concern is asbestos and other potentially harmful materials sometimes found in older ducts.
  • Scratch Marks: Always consult a professional if you notice visible damage to your air ducts. It can signal underlying problems that will get worse if not addressed.
  • Respiratory Discomfort/Illnesses: In addition to increased allergies, contaminated ductwork can contribute to or worsen asthma, lead to infections, and increase the risk of various diseases.

Benefits of New Ductwork

New ductwork can rid your home of bad air. You can live dust-free and newly installed ducts will be sealed and sanitized to prevent allergens and pathogens from entering your home. We use eco-friendly designs and techniques for air duct installation while your new ducts will benefit the environment—indoors and outdoors. With your air safely contained within the system, your HVAC system will run more efficiently, which can lower your monthly energy bills. Our engineering experts make sure your ductwork is properly sized for your home, which helps maximize efficiency, reduce the likelihood of repairs, and lower operating noise.

Other Duct / Indoor Air Quality Services

In addition to air duct replacement, Nexgen provides a range of other duct services, including:

Contact Us Today

Nexgen is a family owned and operated business trusted for many types of home repair, including air duct replacement. Our Anaheim technicians are licensed, insured, and trained to address any residential or commercial air duct issue. We are available 24/7 for emergencies. Save with our featured deals and offers, which are updated regularly online. For an extended parts and labor warranty, join our X Protection Plan. It includes annual AC, heater, and duct services; discounts on indoor air quality products and future repairs; and priority HVAC/air duct installation. To receive assistance, schedule service, or get a free quote, fill out our contact form or call 833-729-9735.

Book an Appointment

Select the time, date and service that you would like to set up an appointment with Nexgen
Book an appointment

Featured Offers

See All Offers

Learn More From Our Users

Not only did his team deliver promptly and on time, they were friendly and left with a professional install of my new A/C unit. I can’t mention the AWESOME price I got, but needless to say they can beat any deal, and will give you the fastest 1st-rate service available.
Wayne B.
Yesterday I had Nexgen install a new furnace and a/c system to replace my 30-year-old system. Their representative Jeff met with me the day before to go over the system that would work best for my home, and presented me with a price I couldn’t turn down. Incidentally, Nexgen’s price was over $3,000 cheaper than all other competitors.
Jack W.
My call was promptly returned by Jeff and an appointment was scheduled for the next day. Jeff presented an offer that I couldn’t refuse! A crew was available that day and came, saw and conquered. I had A/C that evening at a very fair price. Highly recommend Nexgen.
Lisa S.

$88 X Protect Complete System Tune Up

As the next generation of home comfort, Nexgen is always after the next big thing to revolutionize the HVAC industry
See the video icon-video


text:
Molecule based quantum science and technology

molQueST Conference is postponed to to 8–12 September 2021

Fondazione Monte Verità
Strada Collina 84
6612 Ascona

ˮQuantum Science Emerging from Atoms and Molecules at Surfaces“ builds upon breakthroughs in the art of making atomic and molecular architectures. Electronic and nuclear quantum states can now be manipulated at the single atom level in a controlled surface environment by using either local probes or global electric and magneAc fields. These advances raise expectaAons for using quantum and spin states in atoms and molecules at surfaces for sensing, informaAon storage, and informaAon processing (logic) devices.

Image: molQuesT

Key topics and focus of the conference

  • Quantum coherent systems at surfaces and interfaces
  • Novel systems, comprising embedded spins in nonmetallic or topological environments
  • Controlling and addressing electronic and spin states in quantum systems architectures
  • Modular architectures for molecular quantum-bits and supramolecular integration

Further information and program

  • Atoms
  • Cheminformatics
  • Molecules

Dr. Thomas A. Jung
Paul Scherrer Institut
Labor für Mikro- und Nanotechnologie (Laboratory for Micro- and Nanotechnology)
5232 Villigen

+41 56 310 45 18

Languages: English


text:
martha speaks
Puppy Skits/Dinosaurs In Trouble!

Puppy Skits - Can a dog break through the space-time continuum? T.D. thinks so. As Martha recounts the tale of how T.D. first found Skits, we learn that innocent, easy-going Skits may in fact have been a time-traveling puppy! Vocabulary: (E) paleontologist, expedition, past, era, age, museum. Dinosaurs in Trouble! - Due to a lack of funds, the museum's fossil exhibit is closing and Milo and Truman are devastated. What's more fun than fossils? Can the Mesozoic enthusiasts find a way to save the dinos? Vocabulary: (E) museum, fossil, funds, exhibit, archaeologist.

Episode Duration: 28 minutes and 55 seconds

Episode Number: 501

Future Broadcast times for "Martha Speaks": (show all)

Sat, May 8 1:00 P.M. Tomato, You Say/Martha Questions     NHPBS KIDS
Sun, May 9 1:00 P.M. Martha's Sweater/The Mystery of the Missing Dinosaur     NHPBS KIDS
Sat, May 15 1:00 P.M. Martha's Holiday Surprise/We're Powerless!     NHPBS KIDS
Sun, May 16 1:00 P.M. Bookbots 3: Fit Fights Fat/Grandpa Bernie Cleans     NHPBS KIDS
Sat, May 22 1:00 P.M. T.D. Gives A Report/Martha's Canine Cleaners     NHPBS KIDS
Sun, May 23 1:00 P.M. Thou Callest Me A Dog/Martha's Paper Chase     NHPBS KIDS
Sat, May 29 1:00 P.M. Martha Runs The Store, Part 1 & Part 2     NHPBS KIDS
Sun, May 30 1:00 P.M. April Fools/Bully for You!     NHPBS KIDS
Sat, Jun 5 1:00 P.M. Itchy Martha/Martha and the Thief of Hearts     NHPBS KIDS
Sun, Jun 6 1:00 P.M. Martha Sings/Td Makes The Band     NHPBS KIDS
Sat, Jun 12 1:00 P.M. There Goes The Neighborhood/I Scream     NHPBS KIDS
Sun, Jun 13 1:00 P.M. Skits under the Weather/Martha the Weather Dog     NHPBS KIDS

NHPBS Over-the-Air Broadcast

WENH-TV Ch. 11 Durham

WLED-TV Ch. 48 Littleton

WEKW-TV Ch. 18 Keene

W50DP-D Ch. 50 Hanover

W34DQ-D Ch. 34 Pittsburg

Cable and Satellite Channels

NHPBS Spring Auction


text:
Breaking News

TradeDirect365 is a trading name of Finsa Pty Limited. It was founded in 2014 and is authorized and licensed by the Australian Securities and Investments Commission (ASIC) under license number 422661. Client’s funds are held by Finsa Pty Limited in a segregated client account with a top-tier Australian bank (Westpac Bank).

TD365 is an Australian CFD broker that provides a transparent pricing approach, with low commissions and tight, fixed spreads on a simple-to-use, intuitive CFD trading platform, the company presents itself on its website. It also notes that the leverage can be up to 1:200 and the stop loss orders are guaranteed.

The company portfolio includes currency pairs (major FX, minor FX, and exotic FX), commodities (Gold, Silver, Brent Oil and WTI Oil), global indices, global stocks, and cryptocurrencies. The spreads of all instruments in the CloudTrader platform are fixed and the one for the EUR/USD pair is 0.8 pips and the one for Bitcoin is USD70. However, the spreads are variable when you use the MetaTader terminal and the one for the EUR/USD pair starts at 0.5 pips.

Customers have a choice of two platforms for CFDs trading – the popular MetaTrader 4 (MT4) terminal and the company’s own-developed CloudTrade platform. MT4 is the world’s most popular platform that automates client strategies by using expert advisors. CloudTrade is a web-based terminal and is also available as a mobile app. The company represents it like that: “CloudTrade is our version of what we believe most CFD traders want from an online trading platform. A simple, clutter-free, reliable trading interface that facilitates trades with razor sharp execution.” It also explains that The TradeDirect365 platform runs on Chrome, Firefox, Safari, and Internet Explorer 10+ web browsers by using a combination of AJAX, HTML5 and CSS3 to create it. Customers have access to all available instruments through the CloudTrade platform and to all instruments, except for stocks through the MT4 terminal.

There are two types of trading accounts depending on the platform – the CloudTrade CFDs platform and the MetaTrader 4 terminal. There is no minimum deposit to open an account, however your trading account will need to be funded before you can trade.

TradeDirect365 provides Negative Balance Protection to its retail clients. The company explains that the negative balance protection is a precautionary measure that brokerage firms take to safeguard their clients. Negative balance protection policy ensures that traders will not lose more money than deposited if their account goes into negative because of their trading activity. This means you will not owe money to the firm. The Client Agreement document shows that TD365 will accept all Orders and enter into all CFD Transactions as principal and not as your agent. This means the company is a market maker and a conflict of interest arises. The same document informs that TradeDirect365 offers another useful feature. The platform allows you to use a Guaranteed Stop Loss Order (GS Order). You can nominate to use the GS Order when you open a trade. The company explains that the GS Order is a form of risk management that may assist you in limiting your losses if the market goes against your position. There is a minimum charge to use a GS Order and a set distance where you select your Stop Loss level. A GS Order is an instruction by you to close a CFD position at the exact price that you set, even if our quote goes through that price. It is effectively a form of insurance that guarantees your exit price even when a market is experiencing high volatility and the market gaps. Keep in mind that if you do not mark the stop loss order as a guaranteed it is the regular one and is subject to slippage and gapping – it is not guaranteed. It is written that unless otherwise stipulated, the execution of an Order is not guaranteed and is subject to Gapping. In such instances, the Order will be executed at the first available market price.

In general, TradeDirect365 is an Australian company that acts as a market maker and provides protection against a negative balance. You can trade many instruments through the company’s own terminal, as well as through MT4. This is one of the few companies that still offers fixed spread instruments, so trading on the news remains an option.

Leave a Reply

Your email address will not be published. Required fields are marked *


text:
Vendor Spotlight – Blushing Blooms Event Florist

Hello all! As we prepare to enter into wedding season I’ll be showcasing a few of my favorite vendors and their work! I’ve had the privilege of meeting some truly incredible and talented humans over my last 6 years of shooting weddings and I feel that it’s important to showcase not only the pictures but the talent that goes behind making every single wedding so incredible! Today I would like to introduce Jamie of Blushing Blooms Event Florist! Not only is Jamie a super freaking talented florist but she is also so very hardworking, dependable, and truly one of my favorite people! You absolutely could not go wrong having Jamie as your florist for your big day! She will create magic beyond your expectations! BUT don’t just take my word for it… I’ll show you!

Now, to put a face to the name… Meet the beautiful Jamie!

Blushing Blooms Event Florist

Leave a Reply

Your email address will not be published. Required fields are marked *


text:
Nieco. The taste you can count on.

Contact Nieco

Please fill out the sales form for more information or to request a product demonstration.

7950 Cameron Drive
Windsor, CA 95492

Toll Free: (800) 643-2656

Phone: (707) 284-7100

Fax: (707) 284-7430

Submit the form below with any questions you may have.

Fields marked with * are required.
  • This field is for validation purposes and should be left unchanged.


text:
Finding Bats in the Spring Wood at Twilight

Finding Bats in the Spring Wood at Twilight

Barbara A Meier

Inspired by “Finding the Cat in a Spring Night at Midnight” by Pattiann Rogers

It takes a certain hearing, to discern the bat from the bird
in a late afternoon, when the light diminishes Woodrat Mountain.
I hear the swoop of wings beating the soft air
of twilight, humming in the down-sweep
of a dusky afternoon breeze

An aerial battlefield of nectar and mosquito,
with the feeding buzz of the fringed myotis,
and the whir of the dive-bombing male rufous hummingbird.

Bright Venus comes out to play
with the silver fishing hook moon,
Pacific tree frogs bellow their desire in her cold light,
cicadas hammering away at their legs:
a symphony of sound crescendoing
then pianissimo
when they discern my steps into the night.

I lose sight of the magical creatures living in the night.
Pausing the recording of my life in their silence
of fear,
waiting for the confidence to come back;
first, one whir,
a solitary croak,
then joining in an adagio of night wings born at the
of the forest
up to the meadow
sliding gray to brown to black.

Barbara A. Meier


text:
Author Interview – Janice Spina

I would like to welcome Janice Spina (J.E. Spina), novelist and children’s author, to my blog today.

She is the author of the recently released novel Hunting Mariah!

author photo

  • What is your name and where do you call home?

My name is Janice Spina and home is beautiful, live free or die, New Hampshire, USA.

  • Do you have a pen name?

For my children’s books I write under Janice Spina but for my novels I write under J.E. Spina.

  • What is the name of your most recent book and if you could sum it up in 20 words or less, what would that be?

My first novel, Hunting Mariah, I recently published. Here is a quick synopsis:  An insane killer, obsessed with blood and death, seeks revenge with those he perceives wronged him.

  • What or who inspired you to start writing? And how long have you been writing?

I have always loved writing and started at the age of nine writing poetry in the form of cards for my mother’s birthday and Mother’s Day. Because of all the praise my mother gave me I became encouraged to write some more.

  • How did you come up with the cover? Who designed the cover of your book?

My husband designed the cover and came up with the final cover after three different versions. I put the three versions of the cover on my blog and asked readers to vote for the one they thought was the best. The final cover is the result of that poll.

  • How did you come up with the title for your book?

I always have a title for a book before I begin to tell the story. The story comes later as I sit down to type. It seems to flow from my fingertips and the characters just take over.

  • Do you prefer books, e-books, paperbacks, hard covers or audio books?

I used to love paperbacks but over four years ago I bought a 1st Edition Nook and I never looked back. I purchase books for both my Nook and my Kindle app and enjoy reading on both. I love the ease of keeping all my books in one place making it easier to carry them when I travel on vacation or just to the doctor’s office. I have to admit though I sometimes miss the feel and smell of a new book in my hands! Ha!

  • Are you a self-published/indie author?

Yes, I am an indie author.

  • If you’re a self-published/indie author what made you go that route instead of the traditional publishing route?

It was out of sheer frustration due to all the rejection letters I received. It was time-consuming and exhausting to send them out and then just wait for some word. Some of them were encouraging and requested that I resubmit at a future date. Which I did but never received another word. I realized that these publishers were probably inundated with manuscripts and didn’t have time to answer or even read them all. That is when I decided to pursue my dream on my own. I have never been sorry for one day that I did. One of my books won a Silver Medal from Mom’s Choice Awards this year.

Now all my children’s books and my first novel are available online. It is very exciting to be an author. I wanted to get my work out there for all to read and I finally did. I felt I wasted a few years not doing it sooner.

  • What is your favorite film based on a book?

There are so many books that have been made into movies. But I think I would choose an old one, How to Kill a Mockingbird. Now that I say that I need to watch it again. It was a powerful movie with an accomplished actor, Gregory Peck.

  • What book are you reading at the moment? And in what format?

I just started reading Secret Thoughts: A Medical Thriller, by H.S. Clark. It is interesting and gripping. I especially like medical mysteries/thrillers due to my medical background as a medical secretary and assistant.

I sometimes have two books going at the same time. I am also reading in between children’s books for many other indie authors for reviews. Also, I am a copy editor so I read and edit clients’ books too. I don’t know how I find time to do it but I work it all in. I may skip a lunch or two doing it though but my wonderful husband cooks dinner for me. I am blessed to have him or I would forget to eat!

  • Do you have any hobbies that aren’t related to reading and writing?

I love to crochet and have done all kinds of afghans, baby clothes and amigurumis (animals) for my grandchildren.

I also enjoy singing and was a member of a Sweet Adeline’s chorus for several months. It was a cappella chorus (without music). Singing makes me feel happy and relieves tension and stress. Now I only do it as I wash dishes or in the shower or if I get a chance to go to a place that has karaoke. Ha!

Taking long walks with my husband and traveling to some of the places on our bucket lists is something I also enjoy doing.

  • Where can your readers follow you?

I have a blog where I post book reviews, author interviews, and guest posts, news about my books and publishing adventures and travels. I have been fortunate to have followers who are very supportive and have received numerous blogging awards from them.

FB: for my novels

FB: for my children’s books

FB for supporting others

Amazon: Author Page for all books

 An insane killer, obsessed with blood and death, seeks revenge with those he perceives wronged him. He is now on the loose. His next victim may be Mariah. During his rampages he writes macabre poems for each of his victims.

Mariah has lost her memory. Will she remember what has transpired in her past? Can Mariah escape the deadly killer’s grasp? Will she finally be safe? Who will apprehend the killer?

 J.E. Spina’s first novel, Hunting Mariah, is now published to Create Space It is also available on Amazon and Amazon Kindle!

J E. Spina will be offering a giveaway on Goodreads as soon as the Kindle version is available. Please go to her blog for more updates on upcoming links and website

J.E. Spina’s novel has been a long time in coming. She started it over twenty years ago but put it on the back burner until this year when she decided it was time to get it ready for publication.  J.E. Spina is an author of five children’s books, one of which received the Silver Medal from Mom’s Choice Awards. She writes her children’s books under Janice Spina.

J.E. Spina has written three other novels – a spiritual/mystery, historical/drama, and a YA fantasy which she hopes to edit and publish over the next two years. In between she will continue to publish more children’s books under Janice Spina. Besides being an author Janice is also a copy editor, blogger, avid reader, book reviewer and supporter of fellow authors.

It has been a pleasure to have you on my blog, Janice. Thank you so much for sharing your book with us and for letting us take a glimpse into your life as an author.

11 thoughts on “Author Interview – Janice Spina

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


text:
Bravely Default Trailer: Are You Brave?

Nintendo of America has been promoting the upcoming Square Enix RPG Bravely Default in a number of ways recently, and with its impending release—tomorrow, to be exact—the whole world will have finally had a chance to try out this highly rated title.

So, NoA wants to make sure everyone gets a chance to learn about it. They’re doing this through an interesting marketing campaign via YouTube, showing a man walking up to the house where his date lives. He gets to choose between a “Brave” route (going through an alleyway) or the “Default” option (taking the street).

The first video is just an intro to make the choice, which will afterward redirect you to the video reflecting your choice!

Make your choice here:

Interesting, but does it make you want to buy the game?

  • Facebook
  • Twitter
  • Reddit
  • Digg
Author: Micah View all posts by
Micah has been playing games since his first pong machine, and has been writing for as long as he could grip a pencil and not drool on the paper. So, for about a week.

Leave A Response