text:
Home » Eye Health » Central retinal vein occlusion (CRVO): Types, causes, symptoms, and treatment
Central retinal vein occlusion (CRVO): Types, causes, symptoms, and treatment
Written by Devon Andre
Central retinal vein occlusion (CRVO) refers to a medical condition of the eye where the main vein of the retina has become blocked. Much like other organs of the human body, our eyes also require a constant supply of oxygenated blood supplied by arteries to maintain its function. When the maximum amount of oxygen has been extracted from the blood, it has to be funneled out in an efficient manner and is done so via our veins, which return deoxygenated blood back to the heart and lungs to be oxygenated once again.
When a vein of the eye becomes blocked or occluded, blood and fluid begin to back up and spill out into the retina. This can lead to macula swelling (a small but important area in the center of the retina needed to see details of objects clearly), affecting central vision. Additionally, without proper blood circulation, nerve cells may begin to die, further compromising proper eye function.
Risk factors and causes of central retinal vein occlusion (CRVO)
The following are some of the most common CRVO causes and CRVO risk factors:
One of the most significant factors leading to the development of central retinal vein occlusion, as over 90 percent of all cases occur in patients over the age of 55.
Poorly controlled high blood pressure may predispose you to the development and also the occurrence of central retinal vein occlusion. It has been found that up to 73 percent of patients over 50 years of age, as well as 25 percent of younger patients with the condition, have high blood pressure.
Having total cholesterol number >6.5mol/L has been associated with the development of central retinal vein occlusion in about 35 percent of patients, no matter their age.
A chronic disease characterized by high blood glucose levels (hyperglycemia). High blood glucose levels are thought to be present in approximately 10 percent of people age 50 and over and is believed to be associated with the higher prevalence of diseases such as high blood pressure, which is present in about 70 percent of all cases of type 2 diabetes.
Oral contraceptive pill
One of the most common types of birth control used in young women and is the most common association with central retinal vein occlusion.
Raised intraocular pressure
Having increased pressure within the eye itself is associated with an increased incidence of central retinal vein occlusion, especially when the site of obstruction is at the edge of the optic disc. A common cause of increased intraocular pressure occurs with open-angle glaucoma.
Also read: Ocular hypertension (higher intraocular pressure) may cause glaucoma and permanent vision loss if left untreated
An increased incidence of central retinal artery occlusion is associated with smoking; however, studies have shown inconsistent results.
Other uncommon predispositions:
Polycythaemia
Abnormal plasma proteins (e.g. myeloma, Waldenström macroglobulinemia).
Acquired hypercoagulable states
Hyperhomocysteinaemia
Lupus anticoagulant and antiphospholipid antibodies
Dysfibrinogenaemia
Inherited hypercoagulable states
Activated protein C resistance (factor V Leiden mutation)
Protein C deficiency
Protein S deficiency
Antithrombin deficiency
Prothrombin gene mutation
Factor Xll deficiency
Inflammatory disease associated with occlusive periphlebitis
Wegener granulomatosis
Causes of secondary hypertension (e.g. Cushing syndrome) or hyperlipidemia (e.g. hypothyroidism)
Orbital disease
Dehydration (particularly in younger patients and in hot countries)
Types of central retinal vein occlusion
There exist two CRVO types that can have very different prognoses and management. They include:
Ischemic CRVO: Can lead to severe damage to the retina and blindness as a result. This is because the central artery and vein are the sole sources of blood supply and drainage for the retina. It is estimated that about 19 percent of patients with CRVO have the ischemic type.
Non-ischemic CRVO: Considered a milder form of the disease but it may progress to an ischemic CRVO. It is estimated that about 81 percent of patients with CRVO have the non-ischemic type.
What are the symptoms of CRVO?
Central retinal vein occlusion symptoms are often sudden and painless. Symptoms of CRVO can become worse over a matter of hours or days. The sooner you are evaluated by a doctor, the more favorable the diagnosis.
Symptoms of CRVO may include:
Cloudy vision
Distorted, warped, or wavy vision
A sudden and complete loss of vision
Floaters (small gray spots floating around in your field of vision. Floaters occur when blood and other fluids leak and then clump up in the fluid inside the eye.)
Also read: Visual snow: Why there is snow or television-like static in your vision?
What are the complications of CRVO?
While recovery from an eye stroke is possible, there can be severe lifelong complications potentially limiting vision or complete vision loss
Macular edema: Also known as inflammation of the macula, the middle part of the retina that helps with making images appear sharp. Swelling of this part of the eye can blur vision or lead to vision loss caused by cystoid macular degeneration and permanent central scotoma.
Neovascularization: This is a condition whereby abnormal vessels develop in the retina. Abnormal vessels can leak into the vitreous (fluid inside the eye) and cause floaters. In severe cases, the retina can become detached. Neovascularization can be associated with ocular ischemia and background diabetic retinopathy.
Neovascular glaucoma: Due to the formation of new blood vessels in the eye causing a painful increase in pressure.
Vitreous hemorrhage: A relatively common cause of acute vision loss that occurs due to the rupture of normal
vessels through mechanical force or the hemorrhage of pathological structures.
Macular degeneration: Characterized by a gradual loss and blurring of a person's vision, typically at advanced ages. Patients may also experience distortions in straight lines appearing wavy.
Blindness: Complete loss of vision
How to diagnose central retinal vein occlusion
If you are unfortunate enough to experience sudden vision loss in one or both eyes, it is imperative to see a doctor right away, preferably an ophthalmologist (eye doctor). While CRVO is a relatively poorly defined condition, there are several symptomatic presentations that will clue your doctor into the diagnosis. Patients with CRVO will often complain of mild, often transient episodes of blurring of vision characteristically worse when waking.
Once the doctor has completed their initial evaluation, the following are other possible tests they may consider necessary.
Fluorescein angiography: Use of a special camera to take a series of photographs of the retina after a small amount fluorescein (yellow dye) is injected into a vein in your arm. The fluorescein travels to the retinal vessels, showing any abnormalities.
Optical coherence tomography (OCT): Used to assess for macular edema and monitoring its course
Intraocular pressure measurement
Reflexes of the pupil
Photos of the retina
Slit-lamp examination
Testing of side vision (visual fields)
Visual acuity test (eye chart)
Additional tests done in all patients include:
Erythrocyte sedimentation rate (ESR)
Full blood count (FBC)
Random blood glucose
Random total and HDL cholesterol
Plasma protein electrophoresis (dysproteinemias such as multiple myeloma)
Urea, electrolytes, and creatinine (renal disease in association with hypertension)
Thyroid function tests (associated with dyslipidemia)
ECG (left ventricular hypertrophy secondary to hypertension)
How to treat CRVO
Unfortunately, there is no particular medical treatment of central retinal vein occlusion. However, some studies have suggested that an oral inhibitor of platelet and erythrocyte aggregation, and hemodilution treatment to lower blood viscosity, may be of some benefit. The treatment method chosen will often depend on the patient's unique situation and health status. The amount of damage done generally dictates which options are available for use. The goal of treatment is to keep vision stable and preventing further swelling of the macula.
The follow-up period is often considered the most significant form of therapy as much of CRVO management is aimed at preventing its progression to complete occlusion. This may include avoiding dehydration and improving intraocular pressure to improve blood perfusion to the affected eye. Patients are often instructed to contact their doctor if their vision deteriorates, as this may indicate the development of significant ischemia. The follow-up period usually lasts 18–24 months, but may depend on a patient's own unique presentation and disease course.
Experiencing a sudden loss of vision can be a scary situation. If you or anyone you know happens to find themselves where CRVO is the most likely cause, seek medical attention immediately. Vigilance and the confidence that your doctor will do everything in their power to help you regain any sense of normalcy will bring you solace in this situation.
Detached retina: Causes, symptoms, treatment, and prevention
Hypertensive retinopathy: Is your blood pressure stealing your vision?
Devon Andre has been involved in the health and dietary supplement industry for a number of years. Devon has written extensively for Bel Marra Health. He has a Bachelor of Forensic Science from the University of Windsor, and went on to complete a Juris Doctor from the University of Pittsburgh. Devon is keenly aware of trends and new developments in the area of health and wellness. He embraces an active lifestyle combining diet, exercise and healthy choices. By working to inform readers of the options available to them, he hopes to improve their health and quality of life.
https://www.healthline.com/health/retinal-vein-occlusion
https://www.aao.org/eye-health/diseases/what-is-central-retinal-vein-occlusion
http://eyerounds.org/article/CRVO/
Glassy eyes: Causes and treatment
Puffy eyes causes, complications, symptoms, and treatment


text:
The Perth leadership outcome model is a leadership model that characterizes leaders by the financial outcome of their leadership. It was developed by E. Ted Prince over a four-year period.

Traditional approaches

The traditional leadership models are based on either a personality or a behavioral/competency approach. The personality approach is rooted in the "Great Man" theories popular in the early 20th century. Research in this tradition sought to identify the personal qualities that distinguished leaders from followers or effective leaders from ineffective leaders.

The behavioral/competency approaches focus on individual managerial competencies.

Concepts

Historical development
The PLOM is related to two intellectual precursors. The work by the German sociologist Max Weber, linked social and economic variables.

The other precursor is psychologist David McClelland.

References and further reading
PLOM and Business Acumen

Prince, E. Ted The Three Financial Styles of Very Successful Leaders: Strategic Approaches to Identifying the Growth Drivers of Every Company, McGraw Hill, New York, August 2005.

Mihaela Popa Chraif, "Review of the Three Financial Styles of Very Successful Leaders", Europe's Journal of Psychology, February 2006,
"The 3 Financial Styles of Very Successful Leaders", Business Book Review,
International Leadership Association Newsletter, September 2005, p. 5.
Harvard Business School Working Knowledge, November 7, 2005
Bass, B. M. (1990). Bass and Stogdill's handbook of leadership (3rd ed.) New York: Free Press.
McCelland, D. C. (1973). Testing for competence rather than for intelligence. American Psychologist, 28, 1–14 .
McClelland, D. C. (1961) The achieving society. Princeton: Van Nostrand.
Schacter, H., "'Financial signature' defines a leader", GlobeandMail.com, September 28, 2005
International Leadership Association, Interview with E. Ted Prince on the Three Financial Styles of Very Successful Leaders, September 28, 2005
Workopolis.com Business Journal, September 28, 2005
Small, V. "What to Look for in an Effective Leader", Regent Recruitment Newsletter, vol. 6, Winter 2005
Jacobs, M. "What is Your Financial Signature". Catalyst Magazine, July, 2005,
Institute of Executive Development, June 23, 2005, Interview with Dr. E. Ted Prince, "The Three Financial Styles of Very Successful Leaders".

Behavioral finance
Leadership

redpajama_set_name: RedPajamaWikipedia


You never know if you have the best deal unless you take the time to shop around like you would do for your motor or household insurance and the same is true for your business insurance. Whether you are a sole trader or a multinational company it does pay to consider alternatives every year.
The insurance market is ever evolving and insurers are forever changing their business appetites, one year they not consider a certain area of businesses to offer insurance to the next they have relooked the risk to exposure and decide that they will "re-enter" the market. As a good example of this one of the largest insurers Aviva have recently announced that they will now not provide Professional Indemnity for small to medium companies.
This is worthwhile considering in your decision to shop around as you may think that you have the best product out there but things change!
Is it a lot of work for potentially no savings! At Trevellyan we take the pain out of the process. Mostly we can utilize your current application form and or schedule of insurance, however there is certain information that is sometimes not readily available in the schedule that are important for us to provide to the alternative insurers in order to get a quotation. In order for us to provide you with the service you deserve one of our brokers can discuss this with you in a short conversation. This information varies for different businesses, but for example in obtaining a quotation for an office policy information about the building, security, location staff numbers, turnover is require (this is not an exhaustive list). Our brokers will be able to obtain all the relevant information that will enable us to cavass our markets on your behalf then come back to you with the quotations for you to consider the options. If those options are not as competitive or does not provide the depth of coverage that you currently have then you will have peace of mind that you do have the best product available.


2005-10-31 Assigned to CISCO TECHNOLOGY, INC. reassignment CISCO TECHNOLOGY, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: AGRAWAL, PAWAN, HUANG, YING, KLOTH, RAYMOND J., MAINO, FABIO R., PARLAN, JONATHAN M.
Methods and apparatus for performing encryption for data at rest at a port of a network device such as a switch are disclosed. Specifically, when data is received from a host during a write to a storage medium such as a disk, the data is encrypted by the port prior to transmitting the encrypted data to the storage medium. Similarly, when a host attempts to read data from the storage medium, the port of the network device receives the encrypted data from the storage medium, decrypts the data, and transmits the decrypted data to the host. In this manner, encryption and decryption of data at rest are supported by the port of the network device.
The present invention relates to network technology. More specifically, this invention relates to mechanisms for performing encryption for data at rest at a port of a network device.
Security of data is typically achieved through encryption of the data. While data is often encrypted to secure the data during its transmission, data may also be encrypted in order to secure the data once it has been stored. Encryption of data that is stored on a storage medium is typically referred to as encryption of data-at-rest (EAR). Specifically, the data that is stored on the storage medium remains encrypted after it has been stored. There are a number of approaches to encrypting data-at-rest.
One approach to performing encryption of data-at-rest that is implemented by a number of products is to encrypt data at a network appliance responsible for encrypting data received from a source network device prior to providing the encrypted data to a storage medium. In a network such as a Storage Area Network (SAN) in which numerous storage devices are supported, the network appliance is typically responsible for the encryption of data received from multiple sources. Within such a network appliance, encryption is often performed by a hardware-accelerated encryptor. Since this single encryptor must service numerous sources, the performance of the network appliance is limited.
Another approach to encrypting data-at-rest that is commonly applied is to perform encryption at the source network device that is generating the data, or at the storage medium that will store the data. In these approaches, encryption is performed in software, since hardware acceleration would significantly impact the cost of the encrypting source network device or storage medium.
While these approaches can provide a viable solution for encryption of data, these approaches afford limited throughput and higher cost. For instance, existing network appliances encrypt data with a throughput of several hundred megabits per second. While these approaches are sufficient to service a limited number of storage media, there is currently no solution for pervasive protection of storage data-at-rest that can afford wire-speed protection to an entire set of storage media in a multi-gigabit SAN.
For those customers who want to encrypt all of their storage, the existing solutions are insufficient to address this requirement. Specifically, existing solutions for performing encryption at a network appliance do not scale to address this requirement, while solutions for performing encryption at the source or destination network devices are not economically feasible.
In view of the above, it would be desirable if a scalable, economical approach to encrypting data at rest could be developed.
Methods and apparatus for performing encryption of data at rest are disclosed. This is accomplished, in part, by performing encryption of data being written to memory at a port of a network device such as a switch. In this manner, encryption of data at rest is supported by a port of a network device.
In the following description, data and commands are described as being transmitted in the form of frames. However, it is important to note that these examples are merely illustrative. Thus, data and commands may also be transmitted in the form of packets. Accordingly, the terms "frame" and "packet" may be used interchangeably.
In accordance with one aspect of the invention, a port of a network device such as a switch performs encryption of data at rest. Specifically, when a network device receives data from a host during a write to a storage medium such as a disk, the data is encrypted by the port of the network device prior to transmitting the encrypted data to the storage medium. More particularly, when a frame including data is received by one of the ports of the network device, the port obtains the data from the frame. The port encrypts the data, generates a modified frame including the encrypted data, and transmits the modified frame to its destination. The destination may be a storage medium such as a disk or tape.
In accordance with another aspect of the invention, a port of a network device such as a switch performs decryption of data at rest. Specifically, when a host attempts to read data from the storage medium, the port of the network device receives the encrypted data from the storage medium, decrypts the data, and transmits the decrypted data to the host. More particularly, when a frame including data is received by one of the ports of the network device, the port obtains the data from the frame. The port decrypts the data, generates a modified frame including the decrypted data, and transmits the modified frame to its destination (e.g., host requesting the data).
In accordance with another aspect of the invention, the invention pertains to a system operable to perform and/or initiate any of the disclosed methods in a port of a network device such as a switch. The system includes one or more processors and one or more memories. At least one of the memories and processors is adapted to provide at least some of the above described method operations. In yet a further embodiment, the invention pertains to a computer program product for performing the disclosed methods. The computer program product has at least one computer readable medium and computer program instructions stored within at least one of the computer readable product configured to perform at least some of the above described method operations.
FIG. 1 is a block diagram illustrating an exemplary conventional storage area network.
FIG. 2 is a block diagram illustrating a system in which encryption or decryption of data at rest may be performed at a port of a network device in accordance with one embodiment of the invention.
FIG. 3 illustrates an exemplary key table that may be maintained in accordance with one embodiment of the invention.
FIG. 4 illustrates an exemplary transaction table that may be maintained in accordance with one embodiment of the invention.
FIG. 5 is a transaction flow diagram illustrating a SCSI write.
FIG. 6 is a process flow diagram illustrating a method of processing a write command in accordance with one embodiment of the invention.
FIG. 7 is a process flow diagram illustrating a method of writing data to a storage medium in accordance with one embodiment of the invention.
FIG. 8 is a transaction flow diagram illustrating a SCSI read.
FIG. 9 is a process flow diagram illustrating a method of processing a read command in accordance with one embodiment of the invention.
FIG. 10 is a process flow diagram illustrating a method of reading data from a storage medium in accordance with one embodiment of the invention.
FIG. 11 is a diagrammatic representation of a router in which embodiments of the present invention may be implemented.
Embodiments of the invention support encryption of data at rest at a port of a network device. In this manner, data may be encrypted prior to storing the encrypted data on a storage medium (e.g., disk, tape) that is separate from the network device. Similarly, the port of the network device also performs decryption of data at rest, thereby enabling encrypted data stored on the storage medium to be retrieved.
The disclosed embodiments of the invention may be implemented in a network device such as a switch. Note that the frames and/or packets being received and transmitted by such a switch possess the frame format specified for a standard protocol such as Ethernet or Fibre Channel. Hence, software and hardware conventionally used to generate such frames may be employed with this invention. Additional hardware and/or software may be employed to modify and/or generate frames compatible with the standard protocol in accordance with this invention. Those of skill in the art will understand how to develop the necessary hardware and software to allow encryption for data at rest as described below.
In addition, the disclosed embodiments of this invention are implemented on a per port basis. In other words, a multi-port network device (e.g., switch) will have the disclosed functionality separately implemented on one or more of its ports. Individual ports have dedicated logic for handing the disclosed functions for packets or frames handled by the individual ports. This allows the processing capacity to be closely matched with the exact needs of the switch on a per port basis.
In order to support encryption of data at rest and decryption of data at rest, a modified frame is generated by a network device such as a switch for transmission to a storage device (in the case of encryption of data at rest) or host (in the case of decryption of data at rest), respectively, as will be described in further detail below. Obviously, the appropriate network devices should be configured with the appropriate software and/or hardware for performing the disclosed functionality. Of course, all network devices within the storage area network need not be configured with the disclosed functionality. Rather, selected switches and/or ports may be configured with or adapted for the disclosed functionality. Similarly, in various embodiments, such functionality may be enabled or disabled through the selection of various modes. Moreover, it may be desirable to configure selected ports of network devices as ports capable of performing the disclosed functionality, either continuously, or only when in an enabled state.
The disclosed embodiments may be implemented in a network in which a server or other host accesses a storage device to read or write data. One type of network in which the disclosed embodiments may be implemented is a storage area network (SAN). Generally, a storage area network is a high-speed special-purpose network that interconnects different data storage devices and associated data hosts on behalf of a larger network of users.
FIG. 1 illustrates an exemplary conventional storage area network. More specifically, within a storage area network 102, it is possible to couple a set of hosts (e.g., servers or workstations) 104, 106, 108 to a pool of storage devices (e.g., disks). In SCSI parlance, the hosts may be viewed as "initiators" and the storage devices may be viewed as "targets." A storage pool may be implemented, for example, through a set of storage arrays or disk arrays 110, 112, 114. Each disk array 110, 112, 114 further corresponds to a set of disks. In this example, first disk array 110 corresponds to disks 116, 118, second disk array 112 corresponds to disk 120, and third disk array 114 corresponds to disks 122, 124. Rather than enabling all hosts 104-108 to access all disks 116-124, it is often desirable to enable the dynamic and invisible allocation of storage (e.g., disks) to each of the hosts 104-108 via the disk arrays 110, 112, 114. In other words, physical memory (e.g., physical disks) may be allocated through the concept of virtual memory (e.g., virtual disks). This allows one to connect heterogeneous initiators to a distributed, heterogeneous set of targets (storage pool) in a manner enabling the dynamic and transparent allocation of storage.
Many storage area networks in commerce run a SCSI protocol to access storage sites. Frequently, the storage area network employs Fibre Channel (FC-PH (ANSI X3.230-1994, Fibre Channel—Physical and Signaling Interface) as a lower level protocol and runs SCSI on top of Fibre Channel. Note that the invention is not limited to any of these protocols. For example, Fibre Channel may be replaced with Ethernet, Infiniband, and the like. Further the higher level protocols need not include SCSI. For example, other protocols may be used by hosts to access storage. In addition, it is important to note that SCSI will be used herein to refer to any implementation of SCSI over FC, iSCSI (SCSI over IP), parallel SCSI (SCSI over a parallel cable), serial SCSI (SCSI over serial cable), and to all the other incarnations of SCSI.
In the following description, the described embodiments are disclosed with reference to SCSI READ and WRITE commands transmitted using the Fibre Channel protocol. However, the disclosed embodiments are merely illustrative. Thus, the disclosed embodiments may also be implemented using other protocols.
When a host writes data to a storage device, encryption of the data is performed prior to storing the data. Similarly, when the host reads the encrypted data from the storage device, the data is decrypted. In the following description, these encryption and decryption functions are performed by the port of a network device such as a switch or router that is separate from the storage device.
FIG. 2 is a block diagram illustrating a system in which encryption or decryption of data at rest may be performed at a port of a network device in accordance with one embodiment of the invention. A host 202 may wish to store data to a storage medium 204 or, alternatively, retrieve data from the storage medium 204. When the host 202 sends the data via its Host Bus Adapter (HBA) 206, it is encrypted by a port 207 of a network device and transmitted to the storage medium 204, where it is received by its HBA 208. Similarly, when the host 202 retrieves data from the storage medium 204, it is transmitted via the HBA 208 of the storage medium 204, decrypted by the port 207 of the network device, and received by the host 202 via its HBA 206.
As shown, when the port 207 of the network device receives a command such as a read or write command from the host 202, the port 207 parses the command via a parser 210 in order to obtain and store information from the command (e.g., from a header) so that the information can be subsequently used to enable the corresponding data that is stored or retrieved to be encrypted or decrypted, as appropriate. This information may be stored in a transaction table such as that described below with reference to FIG. 4. The command is then transmitted unchanged to the storage medium 204.
In case the transaction table is full, the network device (e.g., switch) may reply to the read or write command with an appropriate message (e.g., a SCSI error code) to the host 202. For instance, the message may signal to the host 202 that the device is temporarily unavailable and/or the transaction should be attempted again later.
After the command is sent by the host 202 and assuming that the transaction table is not full, data is either transmitted by the host 202 or retrieved by the host 202. Specifically, after a write command is transmitted by the host 202, the host 202 sends data to be stored by the storage medium 204. For instance, when a write data frame including data is received by the port 207 from the host 202, a parser 210 parses the write data frame to obtain information from the header of the write data frame. This header information may then be used to look up and retrieve the appropriate information corresponding to the write command that has previously been received. This information may indicate that the data is to be encrypted, as well as include an encryption/decryption key and other information that may be provided to an encryption module 212.
Once the data has been encrypted and a modified frame (e.g., write data frame) including the encrypted data has been generated by the port 207, the modified frame may be formatted by a formatter 214 prior to transmitting the modified frame to the storage medium 204. Specifically, a signature such as a cyclic redundancy check (CRC) or checksum value used to verify the integrity of the data may have been appended to the frame that was received by the port 207. However, this signature corresponds to the data received rather than the encrypted data. Thus, the formatter 214 may replace the original signature with one that corresponds to the modified frame, which enables the integrity of the encrypted data to be verified by the storage medium 204.
Similarly, after a read command is transmitted by the host 202, the host 202 receives data from the storage medium 204 (e.g., via a read data frame). This frame including the data may then be parsed to obtain header information to enable information associated with the corresponding read command to be looked up and retrieved. For instance, when a read data frame is received by the port 207 from the storage medium 204, a parser 215 parses the read data frame to obtain header information so that it can look up and retrieve the appropriate information corresponding to the read command. This information may indicate that the data is to be decrypted, as well as include an encryption/decryption key and other information that may be provided to a decryption module 216.
Once the data has been decrypted (e.g., by a decryption module), the port 207 generates a modified frame (e.g., read data frame), which may be formatted by a formatter 218 prior to transmitting the modified read data frame to the host 202. Specifically, if a signature was present in the read data frame received by the port 207, the formatter 218 may replace the original signature with one that corresponds to the read data frame, which enables the integrity of the decrypted data to be verified by the host 202.
It is important to note that although two different parsers and formatters are illustrated, this example is merely illustrative. Thus, a single parser may be used to process frames received from both the host and the disk. Similarly, a single formatter may be used to format read frames, as well as write frames.
In order to encrypt data prior to storing the data and decrypt the stored data, an encryption/decryption key may be associated with each storage medium. For instance, a key table may be used to store keys for a plurality of storage mediums. FIG. 3 illustrates an exemplary key table 302 that may be maintained in accordance with one embodiment of the invention. As shown, each key 304 may be associated with a particular storage medium 306 (e.g., disk). Moreover, a disk may contain any number of LUNs, and may have different keys associated with different LUNs. As will be described in further detail below with reference to FIG. 4, the key that is used to encrypt/decrypt data transmitted during a particular transaction may be recorded in a transaction table, along with a source identifier (S_ID), destination identifier (D_ID) and/or logical unit (LUN) relevant to the transaction. [JMP1] Thus, regions on a storage medium 306 (e.g., disk) may encrypt/decrypt with unique keys. The key table 302 may be maintained by the network device (e.g., switch) or by each port of the network device. Key discovery, creation, and management may be accomplished in a variety of ways, which are outside the scope of this invention.
Once keys are established for each storage medium, it may be desirable to modify the keys periodically to ensure security of the data. This may include the storing of the new key(s) in key and transaction tables, as appropriate. In order to enable the data that is stored on a disk to be decrypted with the old key and encrypted with the new key, both keys should be maintained at the switch until no longer needed. For instance, two different key tables may be maintained, where one of the tables stores the old keys and the other table stores the new keys.
It is important to note that once the new key is configured, the encrypted data that is stored on the disk is preferably encrypted with the new key. In other words, this data may be decrypted with the old key and encrypted with the new key. This may be accomplished while the disk is on-line or off-line.
If the key/data migration is performed while the disk is on-line, a background task may be run to decrypt and encrypt the data on the disk block by block until all of the data is encrypted with the new key for that disk. This may be accomplished, for example, by initiating block replacement at an initial LBA and maintaining a pointer or variable that indicates the LBA separating data that has been encrypted with the old key from data that has been encrypted with the new key.
Alternatively, the disk may be taken off-line to perform key/data migration. For instance, a second disk may be used to store the data that has been encrypted with the new key. More specifically, the data that has already been encrypted with the old key may be retrieved from the first disk, decrypted with the old key, encrypted with the new key, and stored on the second disk. New writes are also performed with the new key to the second disk. The second disk then replaces the first disk. For instance, the encrypted data on the second disk may be copied to the first disk, thereby replacing the data that has been encrypted with the old key.
As described above, when a command such as a read or write command is received by the port of the network device, the command is parsed and information obtained from the command (e.g., command header) is stored to enable the data that follows to be encrypted or decrypted, as appropriate. For instance, this information may be stored in a transaction table.
FIG. 4 is an exemplary transaction table that may be maintained in accordance with one embodiment of the invention. As shown, the transaction table 402 may store a plurality of entries. Each entry may store a host identifier (Host_ID) 404 obtained from a header of the frame, an Original Exchange Identifier (OX_ID) 406 (i.e., exchange or transaction identifier), a logical block address (LBA) 408, a key (K) 410 obtained from a data structure such as the key table 302 shown in FIG. 3, a partial block size 412 obtained from a header of the frame (where a frame includes a partial block), and/or an encryption/decryption indicator 414 indicating that data is to be encrypted for a write command or that data is to be decrypted for a read command. Encryption/decryption is to be performed using the key 410, and may also be performed using the LBA as a nuance. The Host_ID 404 may store a source identifier or destination identifier. For instance, for a write data frame, the Host_ID 404 will store the source identifier obtained from the header of the write data frame. However, for a read data frame, the Host_ID 404 will store the destination identifier obtained from the header of the read data frame. The OX_ID 406 may be obtained from a Fibre Channel header and the LBA 408 may be obtained from the header of a SCSI frame. The partial block size 412 may be used to store the size of data transmitted where the frame includes a partial block. Similarly, the encryption/decryption indicator 414 may be set to indicate whether the command is a read or write command, indicating that data is to be decrypted or encrypted, respectively. Alternatively, entries corresponding to read and write commands may be stored in separate tables. In accordance with one embodiment, a transaction table 402 is maintained by each port of the network device. If the transaction table is full and a new transaction is present, the corresponding read or write command may be intercepted, enabling an error message to be transmitted to the sender of the read or write command. For instance, the error message may indicate that the device is temporarily unavailable, and the transaction should be attempted again later.
In order to illustrate the application of embodiments of the invention during a write, steps performed during a SCSI write are presented in FIG. 5. As shown, steps performed by a host are represented by vertical line 502 and steps performed by a disk are represented by vertical line 504. As shown in FIG. 5, the host transmits a SCSI_WRITE command to the disk at 506. The SCSI_WRITE command specifies the amount of data to be written to the disk. When the disk is ready to receive the data, the disk sends a transfer ready (XFR_RDY) message to the disk at 508. The host then transfers data in one or more write data (WDATA) messages at 510, 512. The disk then sends a response (RSP) to the host at 514 acknowledging that the data was successfully transferred.
FIG. 6 is a process flow diagram illustrating a method of processing a write command in accordance with one embodiment of the invention. When a write command is received by a port of a network device (e.g., switch), it is parsed at 602 to obtain fields identifying the source and destination of the write command, as well as other information. For instance, a source identifier (e.g., S_ID), Original Exchange Identifier (OX_ID), and destination identifier (e.g., D_ID) may obtained from a header such as a Fibre Channel header. In addition, where the command is a SCSI command, a Logical Unit (LUN), and logical block address (LBA) may be obtained from the SCSI header. A key to be used to encrypt data transmitted by the host to be stored at the disk may then be obtained at 604. In accordance with one embodiment, the S_ID, D_ID and LUN are used to index a key table such as that presented in FIG. 3 in order to identify the appropriate key. As described above with reference to FIG. 3, the key table may include previously configured keys and/or new, replacement keys. An entry in a transaction table such as that illustrated in FIG. 4 is then populated at 606. In this example, the entry is populated with the key, host identifier (S_ID), OX_ID, and LBA. In addition, an encryption/decryption (e.g., write/read) indicator may be set to indicate that the key is to be used to encrypt data transmitted during the write. The write command is transmitted to the destination unchanged at 608. The disk (e.g., HBA) receives the write command at 610 and transmits a XFR_RDY message.
After the write command has been processed, data that is subsequently transmitted during the transaction may be encrypted and stored at the storage medium. FIG. 7 is a process flow diagram illustrating a method of writing data to a storage medium in accordance with one embodiment of the invention. When a port of the network device receives data in the form of a SCSI write via a write data (WDATA) frame, the WDATA frame is parsed at 702 in order to identify the corresponding encryption key. For instance, the WDATA frame may be parsed to obtain the host identifier (S_ID) and OX_ID. The corresponding entry in a transaction table such as that illustrated in FIG. 4 is then identified at 704. Specifically, the host identifier (S_ID) and OX_ID may be used to identify the entry in the transaction table. From the entry in the transaction table, the key to be used to encrypt the data may be identified. In addition, the LBA may also be identified.
In accordance with one embodiment, the encryption engine performs per-block encryption. In other words, the encryption engine processes entire blocks (e.g., as defined by a disk operating system). Thus, in order to encrypt the data, the data block and key are provided to the encryption engine at 706. More particularly, an entire block may be gathered (e.g., where a single packet carries a non-integral number of blocks) before it is presented to the encryption engine. In addition, the LBA indicating the start address of the data block may also be provided to the encryption engine, thereby enabling the encryption engine to encrypt the block using the key and LBA. Specifically, the logical position of the block in the disk (e.g., the LBA) may be used as a nuance for the encryption of the data, causing unique encrypted data to be generated even when two blocks contain the same unencrypted data. Each block of data may be encrypted in this manner.
Once the data has been encrypted, the results of the encryption may be provided to a formatter at 708. The formatter may then generate a frame including a header (e.g., Fibre Channel), payload (e.g., SCSI) including the encrypted data, and signature, as appropriate, at 710. Various mechanisms are available for ensuring the integrity of the data without increasing the size of the frame with extra bits. For instance, Extended Codebook (XCB) mode of operation for block ciphers may be implemented to ensure the integrity of the data. The XCB mode of operation enables disc blocks to be encrypted without expanding the size of each block. Various methods and apparatus for implementing the XCB mode of operation for block ciphers are disclosed in U.S. patent application Ser. No. ______ , entitled "Enciphering Method," filed on Aug. 10, 2005, by Mcgrew et al, which is incorporated herein by reference for all purposes. As another example, the Galois/Counter Mode (GCM), disclosed in RFC 4106, entitled "The Use of Galois/Counter Mode (GCM) in IPSec Encapsulating Security Payload (ESP)," J. Viega et al, published June 2005 and incorporated herein by reference for all purposes, may be used to encrypt tapes. The generated frame is then transmitted at 712 to its destination.
As data is written to the storage medium, the address at which data is to be stored is typically incremented as data is stored. In accordance with one embodiment, the address (e.g., LBA) is incremented by the amount of data that has been transmitted and updated in the transaction table at 714.
When a response indicating that all data has been received is transmitted by the disk and received by the port at 716, the transaction table may be updated accordingly. In order to identify the appropriate entry in the transaction table, the host identifier (D_ID) and OX_ID are obtained from the response at 718. The corresponding entry in the transaction table is then identified using the host identifier and OX_ID at 720. The entry may then be deleted or marked as no longer valid at 722.
In order to illustrate the application of embodiments of the invention during a read, steps performed during a SCSI read are presented in FIG. 8. As shown, steps performed by a host are represented by vertical line 802 and steps performed by a disk are represented by vertical line 804. As shown in FIG. 8, the host transmits a SCSI_READ command to the disk at 806. The disk transmits the data in one or more read data (RDATA) frames as shown at 808, 810. When all of the data that has been requested has been transmitted, the disk sends a response (RSP) to the host at 812.
FIG. 9 is a process flow diagram illustrating a method of processing a read command in accordance with one embodiment of the invention. When a port of the network device (e.g., switch) receives a read command, it parses the read command at 902 to obtain fields identifying the source and destination of the read command, as well as other information. For instance, a source identifier (e.g., S_ID), Original Exchange Identifier (OX_ID), and destination identifier (e.g., D_ID) may obtained from a header such as a Fibre Channel header. In addition, where the command is a SCSI command, a Logical Unit (LUN), and logical block address (LBA) may be obtained from the SCSI header. A key to be used to decrypt data stored at the disk may then be obtained at 904. In accordance with one embodiment, the S_ID, D_ID and LUN are used to index a key table such as that presented in FIG. 3 to identify the appropriate key. An entry in a transaction table such as that illustrated in FIG. 4 is then populated at 906. In this example, the entry is populated with the key, host identifier (S_ID), OX_ID, and LBA. In addition, an encryption/decryption (e.g., write/read) indicator may be set to indicate that the key is to be used to decrypt data retrieved during the read. The read command is transmitted to the destination unchanged at 908. The disk (e.g., HBA) receives the read command at 910.
After the read command has been processed and transmitted, data transmitted during the transaction may be read from the storage medium and transmitted to the host. FIG. 10 is a process flow diagram illustrating a method of reading data from a storage medium in accordance with one embodiment of the invention. When a port of the network device receives data in the form of a SCSI read, the read data frame (RDATA) is parsed at 1002 in order to identify the corresponding decryption key. For instance, the RDATA frame may be parsed to obtain the host identifier (D_ID) and OX_ID. The corresponding entry in a transaction table such as that illustrated in FIG. 4 may then identified at 1004. Specifically, the host identifier (D_ID) and OX_ID may be used to identify the entry in the transaction table. From the entry in the transaction table, the key to be used to decrypt the data may be identified. In addition, the LBA may also be identified.
In accordance with one embodiment, the decryption engine performs per-block decryption. In other words, the decryption engine processes entire blocks. Thus, in order to decrypt the data, the data block and key are provided to the decryption engine at 1006. More particularly, an entire block may be gathered (e.g., where a single packet carries a non-integral number of blocks) before it is presented to the decryption engine. In addition, the LBA may also be provided to the decryption engine, thereby enabling the decryption engine to decrypt the block using the key and LBA. Each block of data may be decrypted in this manner.
Once the data has been decrypted, the results of the decryption may be provided to a formatter at 1008. The formatter may then generate a frame including a header (e.g., Fibre Channel), payload (e.g., SCSI) including the decrypted data, and signature, as appropriate, at 1010. Various mechanisms are available for ensuring the integrity of the data without increasing the size of the frame with extra bit, as set forth above with respect to encryption. The generated frame is then transmitted at 1012 to its destination.
As data is retrieved from the storage medium, the address at which data is to be retrieved is typically incremented as data is retrieved. In accordance with one embodiment, the address (e.g., LBA) is incremented by the amount of data that has been retrieved and updated in the transaction table at 1014.
When a response indicating that the requested data has been retrieved has been transmitted by the disk and received by the port at 1016, the transaction table may be updated accordingly. In order to identify the appropriate entry in the transaction table, the host identifier (D_ID) and OX_ID are obtained from the response at 1018. The corresponding entry in the transaction table is then identified using the host identifier and OX_ID at 1020. The entry may then be deleted or marked as no longer valid at 1022.
In accordance with one embodiment, when a read or write command fails, the corresponding entry in the transaction table is deleted or marked as invalid. A new write or read command may then be transmitted in association with a new exchange. Information associated with this new exchange is stored in an entry in the transaction table as set forth above until the read or write is completed.
The above examples are described with reference to the storing or retrieval of an integral number of blocks of data. It is contemplated that a single block may be transmitted in two different frames rather than a single frame. For instance, if a block includes 512 bytes, 256 bytes of the block may be transmitted in one frame, while the remaining 256 bytes may be transmitted in a second frame. A simple example is the transmission of 5 blocks of data in two frames, where 2½ blocks are transmitted in each frame.
In accordance with one embodiment, a temporary buffer may be used to store partial blocks until the correct number of bytes has been received. The number of bytes in a partial block may be indicated in the transaction table entry as set forth above with reference to FIG. 4. When the number of bytes that have been received is greater than or equal to a block, the partial blocks may be concatenated so that an entire block may be encrypted and transmitted. As a result, the switch may transmit a different number of frames than that received by the switch.
In a credit-based system such as a Fibre Channel network, a number of buffers are typically allocated on a per-port basis at some initial time. Fibre Channel credits are then issued according to usage of the assigned buffers. Typically, when a storage medium returns a credit to the switch, the switch passes the credit on to the host. This credit management functionality assumes that the number of frames received by a network device such as a switch is equal to the number of frames transmitted by the switch.
As set forth above, in accordance with various embodiments of the invention, the number of frames received by a network device such as a switch may not be equal to the number of frames transmitted by the switch as a result of generation of new frames by the switch. As a result, the number of credits that have been issued will not correspond to the number of frames transmitted by the switch, and therefore the number of buffers that are consumed. In accordance with one embodiment, the switch may act as a "proxy" to modify the credit management. In other words, the switch may save the credit and pass the credit on to the host when a frame including an entire block is generated from two or more frames including partial blocks by the switch. In this manner, the credit management system may be modified to support the transmission of partial blocks.
Although the network device described above with reference to the disclosed embodiments are described as switches, this network device is merely illustrative. Thus, other network devices such as routers may be implemented to receive, process, modify and/or generate packets or frames with functionality such as that described above for transmission in a storage area network. Therefore other types of network devices may be implemented to perform the disclosed switching functionality.
The apparatus (e.g. switch or router) of this invention may be specially constructed for the required purposes, or may be a general-purpose programmable machine selectively activated or reconfigured by a computer program stored in memory. The processes presented herein are not inherently related to any particular router or other apparatus. In a preferred embodiment, any of the apparatus implementing embodiments of this invention may be specially configured routers such as specially configured router models 1700, 1800, 2500, 2600, 3200, 3600, 4000, 4500, 4700, 7200, 9000, and 7500 available from Cisco Systems, Inc. of San Jose, Calif. A general structure for some of these machines will appear from the description given below.
Generally, the techniques of the present invention may be implemented on software and/or hardware. For example, it can be implemented in an operating system kernel, in a separate user process, in a library package bound into network applications, on a specially constructed machine, or on a network interface card. In a specific embodiment of this invention, the technique of the present invention is implemented in software such as an operating system or in an application running on an operating system.
A software or software/hardware hybrid route optimization system of this invention is preferably implemented on a general-purpose programmable machine selectively activated or reconfigured by a computer program stored in memory. Such programmable machine may be a network device designed to handle network traffic. Such network devices typically have multiple network interfaces including frame relay, ISDN, and wireless interfaces, for example. Specific examples of such network devices include routers and switches. For example, the roaming systems of this invention may be specially configured routers such as specially configured router models 350, 1100, 1200, 1400, 1600, 2500, 2600, 3200, 3600, 4500, 4700, 7200, 7500, 9000, and 12000 available from Cisco Systems, Inc. of San Jose, Calif. A general architecture for some of these machines will appear from the description given below. In an alternative embodiment, the encryption system may be implemented on a general-purpose network host machine such as a personal computer or workstation. Further, the invention may be at least partially implemented on a card (e.g., an interface card) for a network device or a general-purpose computing device.
Referring now to FIG. 11, a router 1110 suitable for implementing the present invention includes a master central processing unit (CPU) 1162, interfaces 1168, and a bus 1115 (e.g., a PCI bus). When acting under the control of appropriate software or firmware, the CPU 1162 is responsible for such router tasks as routing table computations and network management. It may also be responsible for updating mobility binding and visitor tables, etc. It preferably accomplishes all these functions under the control of software including an operating system (e.g., the Internetworking Operating System (IOS®) of Cisco Systems, Inc.) and any appropriate applications software. CPU 1162 may include one or more processors 1163 such as a processor from the Motorola family of microprocessors or the MIPS family of microprocessors. In an alternative embodiment, processor 1163 is specially designed hardware for controlling the operations of router 1110. In a specific embodiment, a memory 1161 (such as non-volatile RAM and/or ROM) also forms part of CPU 1162. However, there are many different ways in which memory could be coupled to the system.
Although the system shown in FIG. 11 is one specific router of the present invention, it is by no means the only router architecture on which the present invention can be implemented. For example, an architecture having a single processor that handles communications as well as routing computations, etc. is often used. Further, other types of interfaces and media could also be used with the router.
Although the foregoing invention has been described in some detail for purposes of clarity of understanding, it will be apparent that certain changes and modifications may be practiced within the scope of the appended claims. Moreover, although the example described refers primarily to Fibre Channel networks, the present invention may be used with other protocols. Therefore, the described embodiments should be taken as illustrative and not restrictive, and the invention should not be limited to the details given herein but should be defined by the following claims and their full scope of equivalents.
transmitting the modified frame including the encrypted data by the one of the plurality of ports to the destination address.
2. The method as recited in claim 1, wherein the network device is a switch.
receiving a write command frame from the host and transmitting the write command frame to the storage medium, wherein receiving the write command frame and transmitting the write command frame are performed prior to receiving the frame including the data.
transmitting the credit to the host when the modified frame is generated and transmitted.
retrieving a key associated with the storage medium from one of a set of key tables, the set of key tables including a first key table storing a first key for each one of a plurality of storage mediums and a second key table storing a second key for each one of the plurality of storage mediums.
6. The method as recited in claim 1, wherein transmitting the modified frame is performed via a transport protocol, wherein the transport protocol is Fibre Channel or iSCSI.
7. The method as recited in claim 1, wherein the frame is a SCSI frame including a set of blocks.
appending a signature to the modified frame, wherein the signature corresponds to the encrypted data.
transmitting the command frame to the destination identifier.
setting an indicator indicating that the command frame includes a write command, thereby indicating that the data is to be encrypted.
encrypting the data using the key and the logical block address to generate the encrypted data.
updating the logical block address in the entry of the transaction table.
deleting the entry from the transaction table when a response is received or when the write command fails.
14. The method as recited in claim 11, wherein the frame including the data is a SCSI frame including a set of blocks, and wherein encrypting the data using the key and the logical block address is performed for one of the set of blocks at a time.
encrypting one of the set of blocks.
transmitting the modified frame including the decrypted data by the one of the plurality of ports to the destination address.
receiving a read command frame from the host and transmitting the read command frame to the storage medium, wherein receiving the read command frame and transmitting the read command frame are performed prior to receiving the frame including the data.
18. The method as recited in claim 16, wherein the network device is a switch.
19. The method as recited in claim 16, wherein transmitting the modified frame is performed via a transport protocol, wherein the transport protocol is Fibre Channel or iSCSI.
20. The method as recited in claim 16, wherein the frame is a SCSI frame including a set of blocks.
appending a signature to the modified frame, wherein the signature corresponds to the decrypted data.
setting an indicator indicating that the command frame includes a read command, thereby indicating that the data is to be decrypted.
decrypting the data using the key and the logical block address to generate the decrypted data.
deleting the entry from the transaction table when a response is received or when the read command fails.
27. The method as recited in claim 24, wherein the frame including the data is a SCSI frame including a set of blocks, and wherein decrypting the data using the key and the logical block address is performed for one of the set of blocks at a time.
decrypting one of the set of blocks.
when a transaction table is full, sending an error message in response to the command frame.
means for transmitting the modified frame including the encrypted data by the one of the plurality of ports to the destination address.


http://www.JewishWorldReview.com | Is Israel a Jewish state?
Nothing about Israel could be more self-evident than its Jewishness. As Poland is the national state of the Polish people and Japan is the national state of the Japanese people, so Israel is the national state of the Jewish people. The UN's 1947 resolution on partitioning Palestine contains no fewer than 30 references to the "Jewish state" whose creation it was authorizing; 25 years earlier, the League of Nations had been similarly straightforward in mandating "the establishment in Palestine of a national home for the Jewish people." When Israel came into existence on May 15, 1948, its Jewish identity was the first detail reported. The New York Times's front-page story began: "The Jewish state, the world's newest sovereignty, to be known as the State of Israel, came into being in Palestine at midnight upon termination of the British mandate."
Today, half the planet's Jews live in that state, many of them refugees from anti-Semitic repression and violence elsewhere. In a world with more than 20 Arab states and 55 Muslim countries, the existence of a single small Jewish state should be unobjectionable. "Israel is a sovereign state, and the historic homeland of the Jewish people," President Barack Obama told the UN General Assembly last month. By now that should be a truism, no more controversial than calling Italy the sovereign homeland of the Italian people.
And yet to Israel's enemies, Jewish sovereignty is as intolerable today as it was in 1948, when five Arab armies invaded the newborn Jewish state, vowing "a war of extermination and a momentous massacre." Endless rounds of talks and countless invocations of the "peace process" have not changed the underlying reality of the Arab-Israeli conflict, which is not about settlements or borders or Jerusalem or the rights of Palestinians. The root of the hostility is the refusal to recognize the immutable right of the Jewish people to a sovereign state in its historic homeland. Until that changes, no lasting peace is possible.
That is why the Israeli government is correct to insist that the Palestinian Authority publicly recognize Israel as the Jewish state. It is the critical litmus test. "Palestinian nationalism was based on driving all Israelis out," Edward Said told an interviewer in 1999, and the best evidence that most Palestinians are still intent on eliminating Israel is the vehemence with which even supposed "moderates" like Mahmoud Abbas will not -- or dare not -- acknowledge Israel's Jewishness as a legitimate fact of life. "What is a 'Jewish state?'" Abbas ranted on Palestinian TV. "You can call yourselves whatever you want, but I will not accept it. . . . You can call yourselves the Zionist Republic, the Hebrew, the National, the Socialist [Republic]. Call it whatever you like. I don't care."
There are those who argue that Israel cannot be both a Jewish state and a democracy. When Israel's parliament decided last week to require new non-Jewish citizens to take an oath of allegiance to Israel as a "Jewish and democratic" state, some people bristled. "The phrase itself is an oxymoron," one reader wrote to the Boston Globe. "How can a state openly favor one ethnic group over all others and declare itself to be democratic?"
But there is no conflict at all between Israel's Jewish identity and its democratic values. Indeed, the UN's 1947 partition resolution not only called for subdividing Palestine into "independent Arab and Jewish states," it explicitly required each of them to "draft a democratic constitution" and to elect a government "by universal suffrage and by secret ballot." The Jews complied. The Arabs launched a war.
Many of the world's democracies have official state religions. Think of Britain, whose monarch is the supreme governor of the Church of England; or of Greece, whose constitution singles out the Eastern Orthodox Church as the country's "prevailing religion." The linking of national character with religion is a commonplace. Israel stands out only because its religion is Judaism, not Christianity, Islam, or Hinduism.
Nor is democracy incompatible with ethnic or national distinctiveness. Ireland waives its usual citizenship requirements for applicants of Irish descent. Bulgaria's constitution grants the right to "acquire Bulgarian citizenship through a facilitated procedure" to any "person of Bulgarian origin." It is not oxymoronic to describe Ireland as "Irish and democratic" or Bulgaria as "Bulgarian and democratic." Israel's flourishing little Jewish democracy is no oxymoron either.
It is something different: a beacon of decency in a dangerous and hate-filled neighborhood. If the enemies of the Jewish state could only shed their malice, what an Eden that neighborhood could become.


text:
Sign up below to receive the latest research, news, and commentary from CEI experts.
About CEI
Julian L. Simon Award Winners
Legacy of Liberty Society
Ways to Support CEI
Request a policy briefing from a CEI expert.
All Policy Areas
Subsidies and Bailouts
Capitalism and Free Enterprise
Consumer Freedom
Trade and International
Chemical Risk
Lands and Wildlife
Water and Air Quality
CEI Litigation
Request a Policy Briefing
In-depth Analysis & Research
Issue Analysis
Profiles in Capitalism
10,000 Commandments
Agenda for Congress
CEI Planet
Cooler Heads Digest
Great Capitalism
Coalition Letters
Regulatory Comments
Support CEI
Dishonest Court Ruling Flouts Law in Dukes v. Wal-Mart
Hans Bader • 02/08/2007
On February 6, a panel of the Ninth Circuit Court of Appeals in San Francisco reinstated a multi-billion dollar class action lawsuit against Wal-Mart in a 2-to-1 vote. As AEI scholar Ted Frank notes, the lawsuit is based on bogus statistical evidence, and the court's decision in Dukes v. Wal-Mart is permeated by intellectual dishonesty.
The class action accuses Wal-Mart of discriminating against a class of more than a million female employees, many of whom have never heard of the lawsuit and few of whom have ever alleged discrimination.
The February 6 decision was written by left-wing ideologue Harry Pregerson. Judge Pregerson is most famous for repeatedly defying the U.S. Supreme Court in the Robert Alton Harris case, in which he repeatedly blocked the execution of a vicious killer who murdered two boys in cold blood and then ate their dinner while they lay dying nearby, even after the Supreme Court had set aside his stays of execution as baseless. (Harvard Law Professor Charles Fried wrote a scholarly analysis of Pregerson's actions aptly titled Impudence). Pregerson had also dissented against life sentences for violent criminals, which he regards as typically being cruel and unusual punishment.
At his own judicial confirmation hearing before the Senate, Judge Pregerson openly boasted that if the law conflicted with his own values, he would choose to apply his own values instead of the law (Professor Fried's law review article quotes Pregerson at length). Pregerson's decision in the Wal-Mart case is a classic example of him ignoring the law when it conflicts with his ideological agenda of enriching trial lawyers and depicting corporate America as sexist.
As Ted Frank notes, in Pregerson's decision, "statistical evidence that the Supreme Court has said was insufficient was held sufficient; class members that the Supreme Court have said have no standing were given standing; [and] a punitive-damages procedure the Supreme Court has said violates due process was considered sufficient." Pregerson's utter disdain for the rights of businesses and their shareholders contrasts sharply with his avid desire to invent freshly-minted rights for criminals.
Whether Wal-Mart will be forced to pay billions for nationwide discrimination will now be decided, not by the courts in the states where most Wal-Mart employees (and supervisors) live, but in the San Francisco court that the plaintiffs' lawyers cleverly filed the case in.
It is no accident that class actions against businesses with headquarters in Middle America tend to be filed in San Francisco, Los Angeles, and New York, which are home to large numbers of ideologically extreme jurors with a chip on their shoulder towards corporations or the white males they perceive as managing them. (The last time I drove around San Francisco, I saw large numbers of bumper stickers that read"I believe you Anita," as well as smaller numbers of stickers saying things like "A woman needs a man like a fish needs a bicycle"). Whether Wal-Mart's managers are sexist will be determined by such people, and not by a jury of their peers.
To justify the class action the court had to find that the plaintiffs' claims were "typical" of all class members and that injunctive relief — not damages –"predominated," as is required by Federal Rule 23(b)(2).
The court's claim that the lawsuit is not primarily about money is patently ridiculous, when the compensatory and punitive damages sought by the lawsuit rise into the hundreds of billions of dollars.
And its claim that the plaintiffs' allegations are "typical" of how Wal-Mart treats female employees is rebutted by the plaintiffs' own allegation against Wal-Mart, which is not that it discriminates against women in any uniform way, but rather than it leaves so much room for "subjective" decisionmaking by individual store managers that they are free to engage in sex discrimination in promotions if they choose.
"Subjective" decisionmaking is not a corporate practice or policy that is properly challengeable in a class action. Indeed, it shows the lack of a policy. Many courts in Middle America do not allow a class action to challenge "subjective decisionmaking," since that shows the absence of a policy, and class actions are supposed about corporate policy and typical behavior, not subjectivity or individual idiosyncracies.
Unfortunately, the federal circuit courts in San Francisco and New York City have ignored this basic rule limiting class actions, and instead allow class action lawsuits to be brought based on the (anti)policy of leaving subjective decisionmaking in the hands of local store employees.
As a result, trial lawyers sue businesses, not in their home state in Middle America, but in San Francisco or New York, where business practices that are legal in the rest of the country (such as decentralized corporate decisionmaking, a.k.a., "subjective decisionmaking"), have become potentially illegal.
The Ninth Circuit ruled that Wal-Mart could be ordered to pay damages to an entire class of more than a million female employees, without even being able to cross-examine individual employees to show whether or not they actually experienced discrimination.
That is directly contrary to the Civil Rights Act. As Judge Andrew Kleinfeld's dissent points out, "The Civil Rights Act expressly prohibits orders requiring the reinstatement, promotion, or payment of back pay to anyone injured 'for any reason other than discrimination.'"
(A different panel of the Ninth Circuit Court of Appeals issued an interesting decision today in another case, dealing with government employees and punitive damages, which I discuss in a separate blog post.)
#NeverNeeded
Ten Thousand Commandments
Antitrust Explained
Terrible Tech 2.0
1310 L Street NW, 7th Floor Washington, DC 20005
©2023 Competitive Enterprise Institute | Privacy Policy

redpajama_set_name: RedPajamaCommonCrawl


text:
USA deltog i de olympiska vinterspelen för ungdomar 2016 i Lillehammer i Norge som avgjordes 12–21 februari 2016. Truppen bestod av 62 aktiva. USA tog 10 guld och sex silver. Ytterligare två medaljer togs i grenar med mixade länder.

Medaljörer

Medaljörer i mixade länder
Följande tog medaljer i lagtävlingar med mixade länder (NOK).

Referenser

2016 i USA
Nationer i olympiska vinterspelen för ungdomar 2016


Lately, I've been feeling as if my physical body is being squeezed through a tight keyhole. I'm both here and there. The past is behind as I get a glimpse forward of a new beginning. Transformation is in the works for us all. Our consciousness is being molded to "unlock"a door into a higher dimension. The pressure is intense as we pare off old unresolved patterns that block our entrance. Embracing these challenges in gratitude quickens the process to ascension.
There is power in the spoken word. "Thou shall decree a thing and it shall be established unto thee" is an ancient maxim that can help us bridge the gap between the material and the spiritual.
"I AM calling the Angels of the Violet Consuming Flame to pour Their Sacred Fire Love in and around me."
"I AM calling forth the Master Power of the Cosmic Violet Flame Angels' Love in and around me. I ask to see the fulfillment of my calls."
You can also call on the Holy Spirit's Violet Flame to dissolve all misqualified energy in and around you. Then visualize a living Violet Flame rising up from your feet, shooting high over your head melting away any resentments, fears, unforgiveness, etc. I think of the Violet Flame as the cool sacred healing fire of God's Mercy, Love, and Forgiveness.


text:
M4 Sherman type A1
Production model "Grizzly" with molded hull from General Steel – USA then assembly of the Sherman in Canada by Montreal Locomotive Works.
188 copies of Grizzly were assembled in Canada from October 1943 to December 1944.
This Sherman has been reconditioned as an A1 "US Army" model with sprocket and tracks from production models to US standards.
It has been partially restored and presents an opportunity to acquire a complete M4 Sherman in good condition with real potential for use.
The interior is very complete and original and will require refreshing, the tanks remained in place as well as the original extinguishing system in the engine compartment.
The front differential block has its original "Iowa Transmission Co" plate dated 1943, the driveshaft is complete and remains at the bottom of the Sherman.
The seats, all operating mechanisms, pedals, coaxial 30 cal support are original and in good condition, the pilot and co pilot hatches have the periscope supports, a pair of model M6 is still in place.
The clutch control mechanism remained in place, the steering and brake controls work perfectly, the electrical harness is also present.
The running gear is in very good condition, the wheel tires had been replaced as new, the suspensions are working properly.
The continental engine not supplied will remain to be fitted.
The turret is the original 75mm model, the gun elevation system and the hydraulic rotation unit are present and in good condition.
The telescope holder, the turret rotation lock are original as well as the shell storage boxes and seats.
The turret hatch is of the correct "double hatch" model, the support of cal. 50, the sights of direct sight are present on the turret, the tools and accessories, machine gun of cal. 50 and cradle are provided with this M4 SHERMAN .
The armament is neutralized with certificate of the french armament of st Etienne.
Price: 330 000€
Transportation & exportation on asking.
Dodge D5 Cabriolet – Sold
Dodge D5 Cabriolet, production 1937. Rare classic from the Dodge Brother company in the USA, production limited to 473 copies....


Apple did not unveil any new hardware during its WWDC 2018 keynote, just as Tim Cook promised at the start of the show. We didn't get any new Macs, a second-generation iPhone SE, or a cheaper HomePod, which means we'll have to wait for Apple's next keynote for some of these devices to be unveiled.
The company isn't expected to host anymore events until mid-September when its iPhone press conference takes place. But we don't have to wait until September to try to answer one of the most critical questions we have about the "iPhone X Plus" coming this year: How big will the phone actually be?
Various reports claimed that the iPhone X Plus coming this year would pack a 6.5-inch OLED screen, and it'll be about as big as the iPhone 8 Plus out now. Of course, we already expect Apple to do that, considering that the iPhone X has approximately the same dimensions as the 4.7-inch iPhone.
While distinct sources say that Apple will have three new iPhone X successors in stores this fall, how do we know that an iPhone X Plus exists, and how can we talk about its actual size? From Apple and its iOS 12 testing that preceded the WWDC event. That's how.
Apple started testing iOS 12 builds in the wild as recently as late February, when Google Analytics first picked up visits to BGR from devices running iOS 12. The number of visits increased as we approached June. It's likely that Apple engineers tested early iOS 12 builds on various devices well ahead of the WWDC event. And while you can safely test iOS 12 out in the wild if you're an Apple engineer since regular users will not immediately spot it, you can't always fool analytics programs.
As such, between late February and late May, BGR received hundreds of visits from devices running iOS 12.
How do we know an iPhone X Plus was used to read BGR posts? Well, this device that Google identifies as an Apple iPhone running iOS 12, had a screen resolution like no other iPhone or iPad: 496 x 896.
In the table above, you can see that the iPhone 8 Plus and iPhone 7 Plus have a 414 x 736 points resolution (1080 x 1920 in pixels), an improvement compared to all the Plus models before. iPhone 6s Plus and iPhone 6 Plus deliver the same Full HD experience as the newer phones, though they feature the same resolution as the regular models when it comes to points, 375 x 667.
The new resolution we've discovered matches the width of the iPhone 8 Plus and 7 Plus in points (414), but the height is significantly bigger, 896 for the iPhone X Plus compared to 736 for the others.
The same thing will apparently happen to the iPhone X Plus. The display will keep the width of the latest Plus model in Pixels, but the height will increase. The iPhone X's aspect ratio is 2.165 (812 divided by 375). And guess what, the iPhone X Plus will have the same exact aspect ratio if that 414 x 896 point resolution is accurate.
What's also interesting about this 414 x 896 device is that it made just two visits to BGR, both in May. This indicates we're looking at a prototype iPhone X Plus. We did not have any earlier visits because there were probably no prototypes being tested before then.


text:
Obama's SCOTUS pick claimed video cause of Benghazi long after disproven
Obama's SCOTUS pick claimed video cause of Benghazi long after disproven
April 1, 2016 | Michael Dorstewitz | Print Article
Want more hot BPR News stories? Sign up for our morning blast HERE
During a Freedom of Information Act (FOIA) hearing held four months after the terrorist attack on the American diplomatic outpost in Benghazi, President Obama's appointee to the U.S. Supreme Court claimed it was the anti-Muslim Internet video that sparked the attack.
Judge Merrick Garland, sitting as a member of the three-judge panel on the U.S. Court of Appeals for the D.C. Circuit, made the remark long after it was proved that the Obama administration lied when it said the incident was the result of a spontaneous demonstration stemming from the video.
Judicial Watch, which brought the lawsuit seeking the release of photographs taken of the late al-Qaeda leader Osama bin Laden after his death, reported on the hearing that took place January 10, 2013:
On that day in Washington, D.C., in a packed courtroom before Garland and judges Harry Edwards and Judith Rogers, JW was appealing the administration's claim that releasing dozens of bin Laden postmortem photos would hurt national security. A Central Intelligence Agency (CIA) official had already testified that some images show the burial and bin Laden's corpse being prepared for the event at sea. It's difficult to imagine how this could possibly hurt national security. JW also argued that withholding the images undermines the president's transparency claims, which his administration is notorious for violating.
Even the left-leaning Huffington Post, which also reported on the January 10, 2013 hearing, scoffed at the suggestion that the YouTube video had anything to do with the Benghazi firefight and dismissed another claim made by Garland.
"Garland, who wrongly stated that U.S. Ambassador to Libya Chris Stevens was killed in Benghazi during spontaneous riots sparked by the release of a YouTube video, pointed to other examples of Americans being killed because of the release of information, including an inaccurate 2005 Newsweek report that suggested a Koran was flushed down a toilet at a detention facility in Guantanamo Bay, Cuba," wrote Ryan J. Reilly for the Post.
On the Sunday after the Benghazi debacle, then Ambassador to the United Nations Susan Rice appeared on the three mainstream networks, plus CNN and Fox News, to pitch the Obama administration's claim that the attack stemmed from the video.
Her claim was immediately met with skepticism, and within two months, it was proven false. Sen. James Inhofe referred to Benghazi as "the biggest cover-up in history" and Ambassador Rice as a part of it.
Controversy over her round of talk show appearances continued to follow Rice to the point where a month later, she withdrew her name from consideration to replace Hillary Clinton as secretary of state.
One month after that, Garland made his patently false claims in support of the court's decision. At that time, few people had heard of him and the incident was soon forgotten. Now that he's been thrust into the public spotlight, perhaps even more egregious statements will be discovered.
Sign up for our morning blast HERE


The 192 Taylor sidewalk steps from Pine to California, Nob Hill, was the starting stairway for today's hike. Randomly around Jones, Leavenworth, and Hyde on Russian Hill where across from Greenwich, 27 steps took me into George Sterling Park. The top of the park's longest stairway (113 or so steps, first two pix) is next to the Alice Marble Tennis Courts. The stairway descends to Larkin. Back up again partway from Larkin onto a park trail and the tiled benches (third pic).
A few wood steps, then some brick-with-wood, then regular concrete stairs took me back down to Larkin again on the north side of the park: 92 steps (fourth pic). George Sterling Park's boundaries are Larkin-Hyde and Greenwich-Lombard.
One more block to Chestnut with the top of the Chestnut stairway to my left. Larkin here is divided. Cars and bicycles can continue to Francisco on the lower part. The upper part is redbricked with the top of the Larkin stairway at its vehicle dead-end: first part 26 steps.
From here, directly ahead across Francisco (2800) is the second part: 59 steps down alongside the covered reservoir (next two pics: the first taken several years ago during the Blue Angels airshow).
The area just above the reservoir is called Russian Hill Open Space; the area below it is Russian Hill Park. The reservoir is covered with rotting wood (holes and No Trespassing signs seen from the stairway: seventh pic).
At the north edge of the reservoir is a trail that will take you out to Hyde (last pic: a view from Hyde and Francisco at the end of this trail).
Continuing down from here are 79 more concrete steps through Russian Hill Park to Bay Street, making this one 159 steps in all.
Top of Sterling Park steps. Alice Marble Tennis Courts to left.
Tony, Great pics. I wasn't able to pull up pics of the Canyon, previous set you posted, probably because I am using a mobile device. That's a beautiful tiled bench in George Sterling Park. Do you remember the name of the ship in the Bay? I believe it's a maritime museum. The weather looks so beautiful there. Thanks for sharing.


It was my first terrifying experience in the real world of journalism. More than 20 people died--most of them were standing around me just seconds earlier. Fire and smoke filled the stadium while blood and screams could be seen and heard all over the place. Panicked people were stepping over dead bodies and the injured, falling and pushing others out of the way to escape. Some were jumping over the walls. I was pushed over and stepped on several times, but managed to get up each time.
"Your mouth and your words are going to kill you. Drop it for good," my mother told me. But I was just a fearless 17-year-old and an amateur journalist with big dreams of reaching the greatest of heights in global journalism. I couldn't abandon such dreams easily.
Yet the death of a great Somali journalist and an award-winning Radio Ergo correspondent--and my friend--Yusuf Ahmed Abukar, better known as "Yusuf Keynan," made me appreciate the warnings my mother gave me a decade ago. Keynan was also an editor of Mustaqbal Radio, one of the most influential stations in the capital. In the past four years, he was a roving correspondent based in Mogadishu for the humanitarian broadcaster Radio Ergo, where I work as a producer.
Just two days before he was killed, Keynan pitched to me an idea for a radio feature that investigated the root causes behind the country's repeated droughts and famines. The feature reflected the fears voiced by aid agencies recently that Somalia is facing another catastrophic famine as witnessed in 2011. Nearly a quarter of a million pastoralists and farmers lost their lives in that famine. His pitch was interesting, so I approved the story. He was meant to brief me over his progress after the weekend.
"How is the city these days? Any new threats?" I asked him as we were about to end our conversation.
"[The people who threatened him] say they will come for me one day. I am still waiting for that day," he replied.
That response didn't shock me. Somalia is the most dangerous country in Africa to practice journalism and has one of the world's worst impunity records in terms of journalist murders. Death threats, assassinations, and systemic violence are part of Somali journalists' daily experience.
"Yes, we are all waiting that day," I told him.
"Let's hope it doesn't come anytime soon," he said. We laughed and called it a day.
But the day came sooner than either of us expected. On Saturday, June 21, 2014, a bomb planted under his car killed Yusuf Keynan, 27, in Mogadishu's Hamarweyne neighbourhood. His second born child was only 20 days old.
Keynan was one of the brightest and most talented humanitarian correspondents working in the country. Upon hearing of his death, I immediately remembered our last conversation as if he were talking to me now. He told me he was a dead man walking. He knew that he would be killed sooner or later for nothing else but his journalistic career. Every journalist working in Somalia shares similar thoughts--morbidly waiting for their day to come--as a routine part of life.
But such risks do not induce us to give up the profession. Even though Keynan's murder represents a huge loss for the local press, my colleagues' resilience to inform the people about the country's political and socioeconomic challenges at this critical stage will only grow. Every time we have suffered such tragedies, Somali journalists only come back more determined. The fight for truth continues because that is what all journalists who died for reporting the truth want us to do.
Muhyadin Ahmed Roble is a producer and presenter at Radio Ergo, a Somali-speaking humanitarian broadcaster based in Nairobi, and a freelance correspondent for Inter Press Services (IPS).
A very nice article and touching, Thanks Muhyadin Ahmed Roble.
Obs! The caption of the photo says (Abdukhader Ahmed), I am the owner of the photo, please change the copy right to my name Abukar Albadri, Abdukhader Ahmed has no right to be in the credit of the photo. For evidence contact me.


You can help Andy Hickie & The Merry Maidens' dream come true by voting for them to open The Greenman Festival which is taking place on 15th, 17th and 17th August in South Wales this year. All you have to do is register on the Greenman Festival website, and you can cast your vote!
"The Merry Maidens are a collaboration of good friends from some of the great Wrexham bands; The Roseville Band, Mother of Six, Camera and Heal The Last Stand. We feel we have worked hard at our music over the years and while this collective exists we believe we deserve a slot at this year's Greenman".
Click on the link below to take you to the voting page.
You can cast a vote once per day, so keep returning to increase the total votes!
You've not sent me anything!
Has Andy been kicked out of this?


text:
;(function ($, window, undefined) {
  'use strict';

  var $doc = $(document),
      Modernizr = window.Modernizr;

  $(document).ready(function() {
    $.fn.foundationAlerts           ? $doc.foundationAlerts() : null;
    $.fn.foundationButtons          ? $doc.foundationButtons() : null;
    $.fn.foundationAccordion        ? $doc.foundationAccordion() : null;
    $.fn.foundationNavigation       ? $doc.foundationNavigation() : null;
    $.fn.foundationTopBar           ? $doc.foundationTopBar() : null;
    $.fn.foundationCustomForms      ? $doc.foundationCustomForms() : null;
    $.fn.foundationMediaQueryViewer ? $doc.foundationMediaQueryViewer() : null;
    $.fn.foundationTabs             ? $doc.foundationTabs({callback : $.foundation.customForms.appendCustomMarkup}) : null;
    $.fn.foundationTooltips         ? $doc.foundationTooltips() : null;
    $.fn.foundationMagellan         ? $doc.foundationMagellan() : null;
    $.fn.foundationClearing         ? $doc.foundationClearing() : null;

    $.fn.placeholder                ? $('input, textarea').placeholder() : null;
  });

  // UNCOMMENT THE LINE YOU WANT BELOW IF YOU WANT IE8 SUPPORT AND ARE USING .block-grids
  // $('.block-grid.two-up>li:nth-child(2n+1)').css({clear: 'both'});
  // $('.block-grid.three-up>li:nth-child(3n+1)').css({clear: 'both'});
  // $('.block-grid.four-up>li:nth-child(4n+1)').css({clear: 'both'});
  // $('.block-grid.five-up>li:nth-child(5n+1)').css({clear: 'both'});

  // Hide address bar on mobile devices (except if #hash present, so we don't mess up deep linking).
  if (Modernizr.touch && !window.location.hash) {
    $(window).load(function () {
      setTimeout(function () {
        window.scrollTo(0, 1);
      }, 0);
    });
  }

})(jQuery, this);

function erreurAjax(xhr, etat, erreur) {
	// avec un message dans l'element #resultat
	// traitement du resultat du chargement via Ajax
	var message = 'Anomalie : ' + (etat?etat+',':'') +
	'HTTP ' + xhr.status + ' ' + xhr.statusText + ' ' + ( ('undefined' != typeof erreur) ?
	    ', ' + erreur.toString() : '' );
	 $('#resultat').append('<p>' + message + '</p>');
}

//ZD fonction clavier du tŽlŽphone
$(function(request,response){
    var $write = $('#write');
    var phone = "";
    var call = false;
    $(document).ready(function() {
        $('button').click(function() {
        	var $this = $(this),
            character = $this.html();
        	var html = $write.html();

        	// Delete
        	if (character == 'Reset' ) {
        	    $write.html(html.substr(0, html.length - 1));
        	    return false;
        	} else if (character == 'Call'){
        		character = "";
        		call = true;
        	}

        	$write.html($write.html() + character);
        	phone = phone + character;

        	if(call){
        		sendRequest(phone);
        	}
        });
    });
});

function sendRequest(phone){
    console.log("phone " + phone);
}

function closeModal() {
  // The popup is powered by the Reveal plugin
  $("#add-quote").trigger("reveal:close");
}

// cette fonction initialise
$(function() {
    // Initialize Parse SDK
	// ZD 26.01.14 From parse.com first one is ApplicationID and the second one is JavaScript ID key
	// You must have a account one parse.com the make work this example application
    Parse.initialize(
        '31JqtMGLuFN0GbrC07UIJXMIE8X1kKBoVvWLXJBB',
        'EgEs2Vnfh6BRSrIeZh0Qc0lA6EcjOb4Sak3VlQsb'
    );

    // initialize app from the given user
    function initFromUser(user) {
        // get latest user data
        user.fetch({
            success: function(user) {
                // Set username
                $('#loggedInUser').html(user.get('username'));

                // Populate availability status
                if (!user.get('available')) {
                    $('input[name=available][value=no]').attr('checked',true);
                }

                // Generate a VoIP capability token
                Parse.Cloud.run('generateToken',null, {
                    success: function(token) {
                        // Configure our soft phone with a capability token which allows
                        // for incoming phone calls.
                        Twilio.Device.setup(token,{ debug: false, rtc: true });
                    },
                    error: function(message) {
                        alert('token generation failed: ' + message);
                    }
                });
            },
            error: function() {
                alert('problem fetching latest user data');
            }
        });
    }

    // Display login if we don't have a logged in user, otherwise display main
    // call center UI
    if (Parse.User.current()) {
        initFromUser(Parse.User.current());
        $('#main').fadeIn();
    } else {
        $('#container').fadeIn();//$('#login').fadeIn();
    }

    // Logic to handle the login form
    var $loginForm = $('#form-signin'); //$('#loginForm');
    $loginForm.submit(function(e) {
        e.preventDefault();
        Parse.User.logIn(
            $loginForm.find('input[type=text]').val(),
            $loginForm.find('input[type=password]').val(),
            {
                success: function(user) {
                    // Set up user name for current user
                    initFromUser(user);

                    // Manipulate UI $('#login').fadeOut(function()
                    $('#container').fadeOut(function() {
                        $('#main').fadeIn();
                        $loginForm.find('input[type=text]').val('');
                        $loginForm.find('input[type=password]').val('');
                    });
                },
                error: function() {
                    alert('sorry, couldn\'t log you in');
                }
            }
        );
    });

    // Logic to handle the call center agent UI
    $('#logout').on('click', function(e) {
        Parse.User.logOut();
        $('#main').fadeOut(function() {
            $('#container').fadeIn(); //$('#login').fadeIn();
        });
    });

    // Handle the current state for the agent of this call center
    $('input[name=available]').change(function() {
        var available = $('input[name=available]:checked').val();
        var currentUser = Parse.User.current();
        currentUser.set('available', available === 'yes');
        currentUser.save(null, {
            success: function(user) {
                if (currentUser.get('available')) {
                    alert('You are now available to take calls.');
                } else {
                    alert('You are now unavailable.');
                }
            },
            error: function() {
                alert('There was an error updating your status.');
            }
        });
    });

    // Handle an inbound call in the browser
    Twilio.Device.incoming(function(connection) {
        // Accept the incoming call automatically
        connection.accept();

        // update status as busy
        var currentUser = Parse.User.current();
        currentUser.set('available', false);
        currentUser.save(null, {
            success: function(user) {
                // nothing for now
            },
            error: function() {
                alert('There was an error updating your status.');
            }
        });
    });
});

redpajama_set_name: RedPajamaGithub