Evaluation of Password Hashing Schemes in Open Source Web Platforms

Total Page:16

File Type:pdf, Size:1020Kb

Evaluation of Password Hashing Schemes in Open Source Web Platforms Evaluation of Password Hashing Schemes in Open Source Web Platforms Christoforos Ntantogian, Stefanos Malliaros, Christos Xenakis Department of Digital Systems, University of Piraeus, Piraeus, Greece {dadoyan, stefmal, xenakis}@unipi.gr Abstract: Nowadays, the majority of web platforms in the Internet originate either from CMS to easily deploy websites or by web applications frameworks that allow developers to design and implement web applications. Considering the fact that CMS are intended to be plug and play solutions and their main aim is to allow even non-developers to deploy websites, we argue that the default hashing schemes are not modified when deployed in the Internet. Also, recent studies suggest that even developers do not use appropriate hash functions to protect passwords, since they may not have adequate security expertise. Therefore, the default settings of CMS and web applications frameworks play an important role in the security of password storage. This paper evaluates the default hashing schemes of popular CMS and web application frameworks. First, we formulate the cost time of password guessing attacks and next we investigate the default hashing schemes of popular CMS and web applications frameworks. We then apply our framework to perform a comparative analysis of the cost time of password guessing attacks between the various CMS and web application frameworks. Finally, considering that intensive hash functions consume computational resources, we analyze hashing schemes from a different perspective. That is, we investigate if it is feasible and under what conditions to perform slow rate denial of service attacks from concurrent login attempts. Through our study we have derived a set of critical observations. The conjecture is that that the security status of the hashing schemes calls for changes with new security recommendations and updates to the default security settings. Keywords: Passwords, CMS, Web application frameworks, Guessing attacks, Hashing schemes 1 Introduction Several corporates [1] have become victims of security breaches, resulting in the disclosure of billions of passwords. One of the most significant data breaches during 2016 disclosed a database containing 1 billion users’ authentication details [2], and was put on sale for 300.000 dollars [3], while one of the biggest data breaches during 2017 included 145.5 million users’ details. Hackers take advantage of the computing power of graphics processing units (GPU) and specialized hardware to crack the users’ passwords. Although the price of top tier graphics cards is relatively high (e.g., 2999$ for an NVIDIA TITAN V [4]), hackers can also rent cloud infrastructure including dedicated GPUs for a monthly or pay-as-you-go price (e.g. Google rents a GPU for maximum 2.55$ per hour [5]), making password guessing attacks easier and faster to perform. To counteract the increasing efficiency of such attacks, key derivation functions such as PBKDF2 and BCRYPT use repeated iterations of the employed hash function to slow down the execution time of hashing, and subsequently increase the effort required by an attacker to perform password guessing. Moreover, memory hard functions (MHF), such as SCRYPT, apart from iterations, use the physical memory as much as possible to significantly increase the costs required to crack a password. While there is a significant body of research that analyze the security of hash functions or propose new password cracking techniques, we have pinpointed 1 that the security of the default hashing schemes in Content Management Systems (CMS) and web application frameworks has been neglected. Nowadays, the majority of web platforms originate either from CMS to easily deploy websites or by web applications frameworks that allow developers to design and implement them. WordPress alone stands for 31.3% of all websites in the internet. Considering the fact that CMS are intended to be plug and play solutions and their main aim is to allow even non-developers to deploy websites, we argue that the default settings, including the hash functions, are not modified. Also, recent studies [6] suggest that even developers do not use appropriate hash functions to protect passwords, since they may not have adequate security expertise. Therefore, the default settings of CMS and web applications frameworks play an important role in the security of password storage. This paper evaluates the security of the default hashing schemes of popular CMS and web application frameworks. To this end, we propose a simple framework that allows us to quantify the cost time for password cracking both for brute force and dictionary attacks. To put our framework into a practical context and derive numerical results, we use as input the default hashing schemes of popular CMS and web applications frameworks. For this reason, first we identify and analyze the default hashing schemes of CMS and web applications frameworks. We have discovered that many CMS use outdated hash functions, arbitrary number of hash iterations, while there is a lack of password policies and salt. For example, the popular WordPress still uses MD5 with low number of hash iterations. Subsequently, we apply our cost analysis framework to perform a comparative analysis between the CMS and application frameworks which allows us to deduce a set of critical observations. Next, considering that intensive hash functions consume computational resources, we analyze hashing schemes from a different perspective. That is, we investigate if it is feasible and under what conditions to perform slow rate denial of service attacks from concurrent login attempts. Lastly, we propose security practices and alternative solutions to enhance the overall security of passwords. Overall, the contributions of this paper are the following: • We propose a framework to estimate the cost time of brute force and dictionary password guessing attacks. • We pinpoint the default hashing schemes of the most commonly used CMS and web application frameworks and we derive a set of critical observations. • We apply our framework to the CMS and web application frameworks that allow us to perform a comparative analysis by quantifying the cost time of cracking a password. • We investigate the feasibility of slow rate denial of service attacks based on intensive hash functions. • Finally, we discuss and propose best practices and alternative solutions to improve the security of password storage. The rest of this paper is organized as follows. Section 2 presents the required background knowledge and the related work while section 3 analyzes the various hashing schemes. Section 4 proposes a cost time analysis framework for brute force and dictionary attacks, while section 5 evaluates the default hashing schemes of CMS and web application frameworks. Section 6 performs a comparative analysis of the cost time of CMS and web applications frameworks, while section 7 examines the feasibility of denial of service attacks based on intensive hashing schemes. Section 8 discuss recommendations and possible solutions, and, lastly, section 9 contains the conclusions. 2 2 Background and Related Work 2.1 Password guessing attacks Password guessing (also known as password cracking) is an attack in which an adversary attempts to guess the users’ password. We distinguish two password guessing attacks categories: i) Online and ii) Offline. In online attacks, an attacker can try to login to a website by selecting frequently used passwords. After a number of unsuccessful attempts, the IP address or the username that the attacker is trying to login can be locked. On the other hand, in an offline attack, the scenario is that an attacker has in his possession a database of users’ password hash values and he can attempt to crack each user’s password offline by comparing the hashes of likely password guesses with the stolen hash value. Because the attacker can check each guess offline it is no longer possible to lockout the adversary after several incorrect guesses. In this paper we consider offline attacks. Moreover, we can classify password guessing attacks to three categories: i) brute force ii) dictionary and iii) rainbow tables. In a brute force attack, the adversary tries every possible password combination considering two parameters; a) the password length; and b) the character set. On the other hand, in a dictionary attack, the adversary uses passwords from a list, which are likely to be used as passwords by users. There are four types of dictionary attacks: i) pure ii) Probabilistic Context Free Grammar (PCFG) based [7], iii) Markov model based [8] and iv) mangling rules [9]. In the pure dictionary, the attacker simply uses a set of predefined words as candidate passwords. In the second type, PCFG theories are used to construct a dictionary containing modified passwords with assigned probabilities. In the third type, Markov-based models are applied to create candidate passwords based on the probability distribution over sequences of characters. In the fourth type (i.e., mangling rules), the attacker creates password variations from a dictionary by applying various modifications rules, such as “add the symbol ! at the end of the password”. Finally, the third category of guessing attacks is rainbow tables, in which the attacker uses a precomputed list to reverse the hash value. In this paper, the term password guessing (or cracking), unless stated otherwise, refers specifically to brute force and dictionary attacks but not rainbow tables. Moreover,
Recommended publications
  • The Question of Quality Or Quantity Camping - ~Ill Lou Th Roun
    the e~t sb­ nty >irs :en­ .., ,..,_,....,_ Jr~ lue­ ·ad­ lfO· find bet tatt The Question of Quality or Quantity Camping - ~ill lOU th roun 1 an ~ of ,-er Vacation (7) Camping at Clear Lake 10 Years Ago (Page 6) Pago 2 I 0 W A C 0 N S E R VAT I 0 N I S T Iowa Conservationist Vol. 29 May, 1970 No. 5 Publ1shed monthly by the lowo Conservo tion Com­ miss on, State Office Building 3 0 4tn Street, Des Moines, lowo 50319. Address all mail (subscriphons. NORTHERN PIKE or MUSKY? chonge of oddress, Form 3579. monuscripts, moil .terns} to the obo\le oddress. Subscription price: two years at $1.00 Attention Io,,a anglers can ~ou dif­ and therefore t'allnot alwa\ s be depended Second closs post11ge p11 id ot Des Moines, Iowa ferentiate between a northern pike and upon. Mu skies arc usuall~ olive to dark (No Rights Reserved} a muskellunge? As these t\\O species a re J.!Ta~ "ith tiger-like markings on the side~. Robert D. Ray, Governor quite similar in appearance it is impor tant The northern pike are normally a bluish Fred A. Pnewert, D rect for anglers to know the identifkation dif­ g 1et!n to gra~ on the hack \\ ith irregular MEMBERS OF THE COMMISSION ferences or the} could possible \iolate the rows of light ivory colored spots on the KEITH A M NURLEN Cho rn ,n . Ames Jaw. Correct identification is necessary sides running length'"ise. EARL A. JARV S. Vice Choirman .
    [Show full text]
  • Build It with Nitrogen the Fast-Off-The-Block Erlang Web Framework
    Build it with Nitrogen The fast-off-the-block Erlang web framework Lloyd R. Prentice & Jesse Gumm dedicated to: Laurie, love of my life— Lloyd Jackie, my best half — Jesse and to: Rusty Klophaus and other giants of Open Source— LRP & JG Contents I. Frying Pan to Fire5 1. You want me to build what?7 2. Enter the lion’s den9 2.1. The big picture........................ 10 2.2. Install Nitrogen........................ 11 2.3. Lay of the land........................ 13 II. Projects 19 3. nitroBoard I 21 3.1. Plan of attack......................... 21 3.2. Create a new project..................... 23 3.3. Prototype welcome page................... 27 3.4. Anatomy of a page...................... 30 3.5. Anatomy of a route...................... 33 3.6. Anatomy of a template.................... 34 3.7. Elements............................ 35 3.8. Actions............................. 38 3.9. Triggers and Targets..................... 39 3.10. Enough theory........................ 40 i 3.11. Visitors............................ 44 3.12. Styling............................. 64 3.13. Debugging........................... 66 3.14. What you’ve learned..................... 66 3.15. Think and do......................... 68 4. nitroBoard II 69 4.1. Plan of attack......................... 69 4.2. Associates........................... 70 4.3. I am in/I am out....................... 78 4.4. Styling............................. 81 4.5. What you’ve learned..................... 82 4.6. Think and do......................... 82 5. A Simple Login System 83 5.1. Getting Started........................ 83 5.2. Dependencies......................... 84 5.2.1. Rebar Dependency: erlpass ............. 84 5.3. The index page........................ 85 5.4. Creating an account..................... 87 5.4.1. db_login module................... 89 5.5. The login form........................ 91 5.5.1.
    [Show full text]
  • Modern Web Application Frameworks
    MASARYKOVA UNIVERZITA FAKULTA INFORMATIKY Û¡¢£¤¥¦§¨ª«¬­Æ°±²³´µ·¸¹º»¼½¾¿Ý Modern Web Application Frameworks MASTER’S THESIS Bc. Jan Pater Brno, autumn 2015 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or ex- cerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Bc. Jan Pater Advisor: doc. RNDr. Petr Sojka, Ph.D. i Abstract The aim of this paper was the analysis of major web application frameworks and the design and implementation of applications for website content ma- nagement of Laboratory of Multimedia Electronic Applications and Film festival organized by Faculty of Informatics. The paper introduces readers into web application development problematic and focuses on characte- ristics and specifics of ten selected modern web application frameworks, which were described and compared on the basis of relevant criteria. Practi- cal part of the paper includes the selection of a suitable framework for im- plementation of both applications and describes their design, development process and deployment within the laboratory. ii Keywords Web application, Framework, PHP,Java, Ruby, Python, Laravel, Nette, Phal- con, Rails, Padrino, Django, Flask, Grails, Vaadin, Play, LEMMA, Film fes- tival iii Acknowledgement I would like to show my gratitude to my supervisor doc. RNDr. Petr So- jka, Ph.D. for his advice and comments on this thesis as well as to RNDr. Lukáš Hejtmánek, Ph.D. for his assistance with application deployment and server setup. Many thanks also go to OndˇrejTom for his valuable help and advice during application development.
    [Show full text]
  • Michigan Strategic Fund
    MICHIGAN STRATEGIC FUND MEMORANDUM DATE: March 12, 2021 TO: The Honorable Gretchen Whitmer, Governor of Michigan Members of the Michigan Legislature FROM: Mark Burton, President, Michigan Strategic Fund SUBJECT: FY 2020 MSF/MEDC Annual Report The Michigan Strategic Fund (MSF) is required to submit an annual report to the Governor and the Michigan Legislature summarizing activities and program spending for the previous fiscal year. This requirement is contained within the Michigan Strategic Fund Act (Public Act 270 of 1984) and budget boilerplate. Attached you will find the annual report for the MSF and the Michigan Economic Development Corporation (MEDC) as required in by Section 1004 of Public Act 166 of 2020 as well as the consolidated MSF Act reporting requirements found in Section 125.2009 of the MSF Act. Additionally, you will find an executive summary at the forefront of the report that provides a year-in-review snapshot of activities, including COVID-19 relief programs to support Michigan businesses and communities. To further consolidate legislative reporting, the attachment includes the following budget boilerplate reports: • Michigan Business Development Program and Michigan Community Revitalization Program amendments (Section 1006) • Corporate budget, revenue, expenditures/activities and state vs. corporate FTEs (Section 1007) • Jobs for Michigan Investment Fund (Section 1010) • Michigan Film incentives status (Section 1032) • Michigan Film & Digital Media Office activities ( Section 1033) • Business incubators and accelerators annual report (Section 1034) The following programs are not included in the FY 2020 report: • The Community College Skilled Trades Equipment Program was created in 2015 to provide funding to community colleges to purchase equipment required for educational programs in high-wage, high-skill, and high-demand occupations.
    [Show full text]
  • Making Story from System Logs with Elastic Stack
    SANOG36 18 - 21 January, 2021 Making story from system logs with stack [email protected] https://imtiazrahman.com https://github.com/imtiazrahman Logs syslog Audit SNMP NETFLOW http METRIC DNS ids What is Elastic Stack ? Store, Analyze Ingest User Interface a full-text based, distributed NoSQL database. Written in Java, built on Apache Lucene Commonly used for log analytics, full-text search, security intelligence, business analytics, and operational intelligence use cases. Use REST API (GET, PUT, POST, and DELETE ) for storing and searching data Data is stored as documents (rows in relational database) Data is separated into fields (columns in relational database) Relational Database Elasticsearch Database Index Table Type Row/Record Document Column Name Field Terminology Cluster: A cluster consists of one or more nodes which share the same cluster name. Node: A node is a running instance of elasticsearch which belongs to a cluster. Terminology Index: Collection of documents Shard: An index is split into elements known as shards that are distributed across multiple nodes. There are two types of shard, Primary and replica. By default elasticsearch creates 1 primary shard and 1 replica shard for each index. Terminology Shard 1 Replica 1 Replica 2 Shard 2 Node 1 Node 2 cluster Terminology Documents { • Indices hold documents in "_index": "netflow-2020.10.08", "_type": "_doc", serialized JSON objects "_id": "ZwkiB3UBULotwSOX3Bdb", "_version": 1, • 1 document = 1 log entry "_score": null, "_source": { • Contains "field : value" pairs
    [Show full text]
  • Learning Javascript Design Patterns
    Learning JavaScript Design Patterns Addy Osmani Beijing • Cambridge • Farnham • Köln • Sebastopol • Tokyo Learning JavaScript Design Patterns by Addy Osmani Copyright © 2012 Addy Osmani. All rights reserved. Revision History for the : 2012-05-01 Early release revision 1 See http://oreilly.com/catalog/errata.csp?isbn=9781449331818 for release details. ISBN: 978-1-449-33181-8 1335906805 Table of Contents Preface ..................................................................... ix 1. Introduction ........................................................... 1 2. What is a Pattern? ...................................................... 3 We already use patterns everyday 4 3. 'Pattern'-ity Testing, Proto-Patterns & The Rule Of Three ...................... 7 4. The Structure Of A Design Pattern ......................................... 9 5. Writing Design Patterns ................................................. 11 6. Anti-Patterns ......................................................... 13 7. Categories Of Design Pattern ............................................ 15 Creational Design Patterns 15 Structural Design Patterns 16 Behavioral Design Patterns 16 8. Design Pattern Categorization ........................................... 17 A brief note on classes 17 9. JavaScript Design Patterns .............................................. 21 The Creational Pattern 22 The Constructor Pattern 23 Basic Constructors 23 Constructors With Prototypes 24 The Singleton Pattern 24 The Module Pattern 27 iii Modules 27 Object Literals 27 The Module Pattern
    [Show full text]
  • Zope Documentation Release 5.3
    Zope Documentation Release 5.3 The Zope developer community Jul 31, 2021 Contents 1 What’s new in Zope 3 1.1 What’s new in Zope 5..........................................4 1.2 What’s new in Zope 4..........................................4 2 Installing Zope 11 2.1 Prerequisites............................................... 11 2.2 Installing Zope with zc.buildout .................................. 12 2.3 Installing Zope with pip ........................................ 13 2.4 Building the documentation with Sphinx ............................... 14 3 Configuring and Running Zope 15 3.1 Creating a Zope instance......................................... 16 3.2 Filesystem Permissions......................................... 17 3.3 Configuring Zope............................................. 17 3.4 Running Zope.............................................. 18 3.5 Running Zope (plone.recipe.zope2instance install)........................... 20 3.6 Logging In To Zope........................................... 21 3.7 Special access user accounts....................................... 22 3.8 Troubleshooting............................................. 22 3.9 Using alternative WSGI server software................................. 22 3.10 Debugging Zope applications under WSGI............................... 26 3.11 Zope configuration reference....................................... 27 4 Migrating between Zope versions 37 4.1 From Zope 2 to Zope 4 or 5....................................... 37 4.2 Migration from Zope 4 to Zope 5.0..................................
    [Show full text]
  • Shubham Sali
    SHUBHAM SALI Harrison, New Jersey, 07029|[email protected]|973-438-0289| [LinkedIn] [Portfolio] [GitHub] PROFESSIONAL SUMMARY Junior Web Developer with more than 1-year experience, looking to secure a position in the field of Software/Web Development where I could efficiently learn and develop my skills and build a professional career. WORK EXPERIENCE H. T. Switchgears Pune, India Web Developer Intern March 2015 - May 2015 • Created a website layout for the company using HTML, CSS, JavaScript. • Responsible for maintaining, expanding and scaling of company’s website. H. T. Switchgears Pune, India Junior Web Developer July 2015 - September 2016 • Designed and modified H. T. Switchgears website. • Evaluated the code and implemented best design practices to ensure consistent user experience on any browser, devices or operating system. • Implemented and executed programming projects using Java and Java Swing. • Developed responsive pages using HTML, CSS, JavaScript, PHP, and WordPress. New Jersey Institute of Technology, Newark, NJ Jan 2018 – Dec 2018 Office Assistant and Desk Attendant TECHNICAL SKILLS • Programming Languages: HTML, CSS, PHP, Java, Java Swing, SQL, PL/SQL, MATLAB, C, C++ • Scripting Languages: JavaScript, jQuery, Node.js • Frameworks: Express, Bootstrap, Mongoose, Semantic • Databases: MySQL, Oracle, Aqua Data Studio, MongoDB • Software: Microsoft Office, Eclipse, NetBeans, IntelliJ, Sublime Text, Visual Studio Code, WordPress, Local by Flywheel, AWS Cloud9, Android Studio, Weka • Operating System: Microsoft Windows, Linux, Mac OS • Version Control: GitHub ACADEMIC PROJECTS Chat Application (Android Studio) • Designed a mobile chat application using Android Studio and Firebase. • Implemented for near real-time instant messaging (IM) and contact list maintenance. Online Membership System (Java, SQL, JDBC, Swing) • Developed a Java application for Online Membership using Swing which provides two levels of access, User and Administrator.
    [Show full text]
  • ELK: a Log Files Management Framework
    ELK: a log files management framework Giovanni Bechis <[email protected]> LinuxCon Europe 2016 About Me I sys admin and developer @SNB I OpenBSD developer I Open Source developer in several other projects searching through log files, the old way $ man 1 pflogsumm $ grep [email protected] /var/log/maillog | awk '{print $1 "-" $2 "-" $3;}' $ grep -e 'from=.*@gmail\.com' /var/log/maillog | grep "550" \ | awk {'print $1 "-" $2 "-" $3 " " $7 " " $10 " " $11 " " $13;}' $ vi logparser.sh $ git clone https://github.com/random/parser_that_should_work $ man 1 perltoc $ man 1 python searching through log files, the old way $ cssh -a 'mylogparser.py' host1 host2 host3 host4 | tee -a /tmp/parsedlogs.txt $ man syslogd(8) searching through log files, the new way ELK open source components I Beats: collect, parse and ship I Logstash: collect, enrich and transport data I Elasticsearch: search and analyze data in real time I Kibana: explore and visualize your data ELK closed source components I Watcher: alerting for Elasticsearch I Shield: security for Elasticsearch I Marvel: monitor Elasticsearch I Graph: analyze relationships Elasticsearch I open source search engine based on lucene library I nosql database (document oriented) I queries are based on http/json I APIs for lot of common languages, (or you can write your own framework, is just plain http and json) Elasticsearch: security I not available in open source version, you need Shield I Elasticsearch should not be exposed on the wild, use firewalling to protect your instances I manage security on your
    [Show full text]
  • Our Ln[Ew Churchi Camping Crounds Mr
    > i :^?-K yui^"" hi •-'•--• • u T- •;; .-:-"- / ft yyy 0m^Ji^ yy yrm: ' TV •'• A hyy • ;^.-»_'•: i-?y--y. iyy li;::f BAPTIST • / OKL.A «-0 AA A CITY 1K •I -sMiir * -- ^ - - .' >• ED I T I o ik / OF THE Through the 4th Annual Award of i University Scholarships folr - y-y}^^y4.:^yy}m-§^^^ •y-ym^mMM High School Graduates •/••-y^ymlMm April 1, 1943 For Tuition MAY 3, 1943~JUNE, 1944, at O. i U. on the basis of • ^ j Competitive General Examinations Our lN[ew Churchi Camping Crounds Mr. and Mrs. E. W. Bourne, the pa­ The purpose of the scholarships is to give opportunity to stu­ rents of Mrs. Stella M. Crockett, have : ' - .-y-.:J^'^y:iL-\-y^\ii -^--^f dents with real ability. given our church a site for a camp ^-•:-,mymmm§:< grounds estimated to embrace about The examinations will be conducted by Dr. John W. Raley or seven acres of. land. This is near the Mr. John Hall Jones during April, 1943, in district competitions Bourne Dairy on Grand Boulevard, northwest of Lincoln Park. We are • ^y-'-.'r. at central locations. Applicants meet in the Young People's De­ planning a recognition of this gift at : -y '•-•'^^m^mm'm yyyy^ the evening preaching service Sunday, I -' y. >r-: partments of Baptist churches at 2 P. M. during the Baptist W. M.U. District Meetings as listed below: H evening, April 4. i'yyy_ One week later we plan a dedication service for the camp grounds on the .•' -y- '-'^•'k''^y-'dj:&pty- Place Baptisi Church grounds themselves.
    [Show full text]
  • California Coastal Commission Staff Report and Recommendation Regarding Cease and Desist Orders No CCC-13-CD-06 and CCC-13-CD-07
    STATE OF CALIFORNIA—NATURAL RESOURCES AGENCY EDMUND G. BROWN JR., GOVERNOR CALIFORNIA COASTAL COMMISSION 45 FREMONT, SUITE 2000 SAN FRANCISCO, CA 94105- 2219 VOICE (415) 904- 5200 FAX ( 415) 904- 5400 TDD (415) 597-5885 F 5.1, 5.3, 5.5, and 5.7 ADDENDUM June 13, 2013 TO: Coastal Commissioners and Interested Parties FROM: Lisa Haage, Chief of Enforcement SUBJECT: ADDENDUM TO ITEM NO. F 5.1, 5.3, 5.5, AND 5.7 – CONSENT CEASE AND DESIST AND RESTORATION ORDERS (PARKER AND VENTANA) FOR THE COMMISSION MEETING OF June 14, 2013 I. Errata: A. Changes to Staff Report for Consent Cease and Desist Orders CCC-13-CD-06 and -07 and Consent Restoration Orders CCC-13-RO-06 and -07: Commission staff hereby revises the Staff Report for the Ventana and Parker Consent Orders. Language to be added is shown in italic, bold, and underlined. 1. On Page 21 of the Staff Report, line 16 shall be amended as follows: “The damage includes… the alteration (because of potential sedimentation) of the waterways, as described in the Section V(D)(2)(a-b) above.” B. Changes to Consent Cease and Desist Orders CCC-13-CD-06 and -07 and Consent Restoration Orders CCC-13-RO-06 and -07: 2. Staff notes that Exhibit 1a and b to Appendix B of the Staff Report (CCC-13- CD-07 and CCC-13-RO-07 - Ventana Consent Orders) regarding public access and informational signage will be supplemented as required by and Addendum for June 14, 2013 Page - 2 - consistent with sections 12.0 and 12.2 of those orders.
    [Show full text]
  • Neil C. Northrop | (503)-327-1970 [email protected] |
    Neil C. Northrop http://github.com/neilnorthrop | (503)-327-1970 [email protected] | https://neilnorthrop.github.io Technical Tools Ruby Sentry-Raven VCR Rails/Sinatra/Padrino Whenever Git/Github/Gitlab JSON/XML Rspec/MiniTest Bash scripting Mechanize/Nokogiri Mocha Bootstrap/HTML/CSS Postgresql FactoryGirl RabbitMQ Sequel Capybara JIRA/Confluence Ruby AWS-SDK (S3 and Rubocop Vagrant SQS) VirtualBox Fidelity Life Association Software Engineer 11/2015 – Present • Worked on development of internal systems to pull data from legacy systems and feed internal XML files to downstream sources allowing Agents to be updated in real-time on their Policies. • Developed an internal event driven system that created Policy events from incoming XML, enabling real-time policy updates to business users. • Used Padrino to build out multiple internal web applications for business end- users. • Took over development of a Sinatra web app calling a 3rd party API. Support Engineer/ Developer Apprenticeship 11/2013 - 11/2015 • Supporting multiple application products as Level 2 Support. • Using in house tools to help cases move start to end. • Using JIRA/Confluence tools. • Worked with Rails 1.2.1 and 2.3.2 applications. • Furthered experience with VI and VIM while working on remote servers. • Joined the Software Apprenticeship program to become a Software Engineer. Professional Experience 28dayhug.com E-Commerce Website https://rails-28dayhug.herokuapp.com • Migrating an existing site from Wordpress to a Rails environment. • Implementing the payment processor using Stripe API. ENSearch Music Search Engine https://ensearch.herokuapp.com • Personal project to help better understand Rails and 3rd Party APIs. DotaMeter.com Site for Game Statistics https://dotameter.herokuapp.com • Built from the ground up using Rails, Angular, and Mongo DB.
    [Show full text]