From nobody Thu May 16 08:08:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B53312003E for ; Thu, 16 May 2019 08:08:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FYk3zE0lW6f4 for ; Thu, 16 May 2019 08:08:25 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7F6A1200E0 for ; Thu, 16 May 2019 08:08:25 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id B218624205E6 for ; Thu, 16 May 2019 15:08:22 +0000 (UTC) From: Jim Reid Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Thu, 16 May 2019 16:08:22 +0100 To: ADD Mailing list X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] questions in parliament about DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 15:08:27 -0000 The House of Lords has shown interest in DoH, most probably because of a = recent article in the Sunday Times: = https://hansard.parliament.uk/Lords/2019-05-14/debates/E84CBBAE-E005-46E0-= B7E5-845882DB1ED8/InternetEncryption I expect this won=E2=80=99t be the only time governments and legislators = are going to ask questions. Fun times ahead - for some definition of = fun. From nobody Thu May 16 08:17:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C57411201E7 for ; Thu, 16 May 2019 08:17:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5mVadRI-0x8i for ; Thu, 16 May 2019 08:17:17 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A72812021D for ; Thu, 16 May 2019 08:17:11 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 454Zlm5l2Bz5B9; Thu, 16 May 2019 17:17:08 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1558019828; bh=B/EnEth1IAgXluBmkiCAmJ1lLlfOGa/5a0N+nOQxE1s=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=gOJ7DlFBbzS+WXKvwYd4M3vajF1EIlv6BwgVrF0bp+4tfbhQHCXBMZt+fCoSeajh1 nrTwbVfAUsakQ8/kYx7Jm0XjPXI9NO5VARjsA9dSZZTw/FeWVkeIcr7LJ1kV+Nbjg1 NsjNF6b50qUYB8uRV/OwrtR6XQGEhsSVf7kHMeeM= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id hyEQuOsYQdNg; Thu, 16 May 2019 17:17:06 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 16 May 2019 17:17:05 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 36D423547F3; Thu, 16 May 2019 11:17:04 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 36D423547F3 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 2957541C4C08; Thu, 16 May 2019 11:17:04 -0400 (EDT) Date: Thu, 16 May 2019 11:17:04 -0400 (EDT) From: Paul Wouters To: Jim Reid cc: ADD Mailing list In-Reply-To: Message-ID: References: User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] questions in parliament about DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 15:17:23 -0000 On Thu, 16 May 2019, Jim Reid wrote: > https://hansard.parliament.uk/Lords/2019-05-14/debates/E84CBBAE-E005-46E0-B7E5-845882DB1ED8/InternetEncryption That escalated quickly: Does the Minister agree that there is a fundamental and very concerning lack of accountability when obscure technical groups, peopled largely by the employees of the big internet companies, take decisions that have major public policy implications with enormous consequences for all of us and the safety of our children? Paul, adding "member of obscure technical group" to his LinkedIn profile. From nobody Thu May 16 11:54:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2CA7120160 for ; Thu, 16 May 2019 11:54:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xQSO6ktOnbwU for ; Thu, 16 May 2019 11:54:55 -0700 (PDT) Received: from smarthost1.greenhost.nl (smarthost1.greenhost.nl [195.190.28.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4900312014F for ; Thu, 16 May 2019 11:54:55 -0700 (PDT) Received: from smtp.greenhost.nl ([213.108.110.112]) by smarthost1.greenhost.nl with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1hRLWJ-0005k6-BX for add@ietf.org; Thu, 16 May 2019 20:54:53 +0200 To: add@ietf.org References: Cc: Collin Kurre From: Amelia Andersdotter Openpgp: preference=signencrypt Autocrypt: addr=amelia@article19.org; prefer-encrypt=mutual; keydata= mQINBFjWlnsBEAC+jUN+LJE+mmxEL8lHSrvg47xSBMb9GdtH1Jr8tRSxXiO6R5E+FydsfqkL sjO0dI3x/VnNBi/kgPFFWiAzDEwGTiR/C9b/Muo+xrY+it6e49N56LTPGezrY2dy5yo6VcLl 7UwGz3fIWiNIj7dvuoPMBoO1uacF073E+dqDM5CmNh6o+OrHW8zhUlC9hKgXCq+8XpZJw90H un1zsHF0sRDiurjfYaCcbdAGK9+th9378ed1ZvLVo5uBVQXdydl3eJkNCOELq7VOS7oxSliA uX5/nj9A4LjeeYXgNbwGfKrMjlffP0FcAcgfzg9seqDd1DEk9EVaUMTr32fbWOQHjinXSC7r Lw4xaNfoBebIe1M6z16Xg7+bXXCTdmJYcL9ugmkvT6tGnR12Pfoca1oBwXPvA0VIRi86kCSU D9qvZ3Vl07MKD2hsvFkGZJOQfEaYv5QLpCWv6RCjfDNC05IyMeSW4H18Fr/BoHX8FXHV3+9H LsbJQ/Zrofd/Cm+TKEmXLAtYc7iXvzV+mw3/u0VYqjEy/CRYa62Ah0NNNVIuswfRVIfx3UZo jX4y8j2Kh0jtUV5A4GGf8H3SzQ/cB0I7wTRHU9mCPVCtH6M26nPumL4Zr4D6uGnAmPf9xnlX lokOn2Qxf/mBldsL41PDbEpYhZvvn5kJ/Z9Qh7Fks/hfTbbJowARAQABtEFBbWVsaWEgQW5k ZXJzZG90dGVyIChUZWNobmljYWwgY29uc3VsdGFudCkgPGFtZWxpYUBhcnRpY2xlMTkub3Jn PokCVAQTAQgAPhYhBD1dtsq4UrmIBVpqb/7xwpS06AtVBQJZbJ97AhsjBQkJZgGABQsJCAcC BhUICQoLAgQWAgMBAh4BAheAAAoJEP7xwpS06AtVgrcQAJYg+mhDhui+9xNb9PuRJbelOI7J WlCjSycfaMi+rTJ9FjVKYIE9aug2VV486BZaeqMoOh5wjl61oeRTDHYG6HvhK4w8O/BVPsL0 8MEfYfpFevZmBsInEJypg0r7VJ/SeO9UyaFKUffgvLyiYwk7zJIgx5dHF5Vch0kTtRNc/Wbe 9MGfhl//1Ztl8GjGqzra7MwzaO12ctTDo7LIvXGqrpYm5g7+hRv3+KYVOJvlh4T4deAzNlX1 F/jj4cOYvJJxP2OMPZxoleQZSf63h0hWnKlQWX3UiUZY/M296V6niGDCQHX1q7oz9YWxwUun mNPltaPnTdvE51N98Q+hhrw39XowN0vYhfphaFNrf/crNKTB5Iqx62aAzYwqXQKlh6EtWAri 2rVB9vXxPv+1eL9t/Kga2JyCjmJVtYJxlZWceyW3EKjK+E7qjr1LHDFjV8ZbvN7QRTdjsuzR Ggz3ECba80Ij2/tASE8IXpT/Zb68NeSx3/nDXkIG13inSvGy8yNovzEADXsGO16GSx5Rool/ ECFhTYksMyM73FkvcpvXo6J+neyGEVKDx1Oy213KgTrAOrA+p2hMI2nX9sI5tvWms8XspwQ5 wtmzDribnZNQzpdrb45Chv56LjrKVer9tmraRq8Qe3mL6jXhMPWLim1OeAx6m3qBzKr3QxuG PdADCLHsuQINBFjWlnsBEADFjusaTo9W8VeWluCK/oJqyyyF1wMvou0ldfuoOpUZrOqsY67T M7yBqsv5COPVgAV+xp+axor5oHWxibd283w0Ok4dK6tvtNGwUqyDRlHtQ92DG/u4Tg5eOwrH NUn73/rfeBD9KhKAXcNKKPoccLgR8oQTXpO7eRo+0NI52pXQ6LdZ0wddYeTcHglsNKN1TK+C yYS7xfGolsZXXoBOKcyhfj/ckPFVIHWpGpEtcYWTZWvXgLprzHvpKzkzNyBwejaXE+bqCT2d Rl3omI/e2t3Vq33hFUUSAdxrFF29vMX/YsSnYqsFOIoayna+TRsDFAfZvbvHBOMckeJzvA8y Bdadw7CM08Uw8wqH7n9BA3oq//QpZJekPfrc2E9nM9H0d51T0uStLMbYDWdwxvfPA3p9z8L9 1vobt8bM/Jbhl9h+X2Yq9oBCiTI7b2izYd9FVG4BwBIdeh3bh9R9HExgRjF3XQ6uafT3pcVO PASdv9FRUYH1Va7QWQifoha0B7UXKx1OpX1Z6XR2NQ9KN2MvlwvBKdHtm6tBzUIFzW6D8vUO xiYKBA4fppJt/LJF4jsaCEyI/CVQnkC0yL5DKFOdigxTipwEL9Uc6r7VfR5OAGFd6vzuJFy+ j+/WhzaVT1oVYp6eQXh0bBtqqH2Mq9sAMnIjvaNYIKiQKgMa1Pa3OWQbQQARAQABiQI8BBgB CAAmFiEEPV22yrhSuYgFWmpv/vHClLToC1UFAljWlnsCGwwFCQlmAYAACgkQ/vHClLToC1Xn Rw//W4lzE8FddceKXGRwO/T1u4uzH9EjPCj+3/eHCrLI+h1m7QPyH1DrFAtZBoA6UoaF0+vI AJXM9/HI1FZ09EUdJr5X/+YREErFom4DbE1FK8fpK1/Hw2zI+7Xa8bVkmYrKhMGhi1Gq6Dtk sn/H4USdJL53ZPt10SVNK7H3w93Yp1GC4+0zWjfrsKfsHYZZr2SZyb5/gZlngfgaqiQLhIcP YmiU1GQi9QWkGxWRxk0YQXBwhekewvgltATxlRSCwguAi4uck9fAct9GGdpsshSOgAb9YIAn EV3EqaGnf0PknXp3vNHAZWrfM+RyuNdm2L5TjDU0rIrvyqGP3pR33cREGOAil5Sz2uFArmws Pt8VffbEXlf7qZqRBKaYeKt0qnxKMx1+e1JilVsfb8qtnAWAFDyR0HMlVj/dvGAmq/auPSOA UWRSnDRyT6rv/vXxrbkL4uxWax46qdpDhR15mS5MTng6b5b3Uox7xlveo/Sx71AdNf4goPvB /ntv0DiMuh+fmLGk3zrxs4Xd30Sx+qQwVaXR5xc5rgnF81wvfmuAOb2eP9mpD6DoabkpxC8f Lk17AK7Q1ZTgcZ+8XLRFnavdPrwCa9RU0BF53lJMSTPzyBcMwZ4sqA6Z5IRFVt7rEbSeeD8R Eiawo+FvVt9j0fKdNEBeaJ3WY5hlhNPcUXr4q1U= Organization: ARTICLE19 Message-ID: Date: Thu, 16 May 2019 20:54:20 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US-large X-Virus-Scanned: by clamav at smarthost1.samage.net X-Scan-Signature: 3ced5df4177ef3a93a84b902ce7c160e Archived-At: Subject: Re: [Add] questions in parliament about DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 18:54:58 -0000 On 2019-05-16 17:17, Paul Wouters wrote: > On Thu, 16 May 2019, Jim Reid wrote: > >> https://hansard.parliament.uk/Lords/2019-05-14/debates/E84CBBAE-E005-4= 6E0-B7E5-845882DB1ED8/InternetEncryption >> > > That escalated quickly: > > =C2=A0=C2=A0=C2=A0=C2=A0Does the Minister agree that there is a fundame= ntal and very > concerning > =C2=A0=C2=A0=C2=A0=C2=A0lack of accountability when obscure technical g= roups, peopled > largely by > =C2=A0=C2=A0=C2=A0=C2=A0the employees of the big internet companies, ta= ke decisions that have > =C2=A0=C2=A0=C2=A0=C2=A0major public policy implications with enormous = consequences for > all of > =C2=A0=C2=A0=C2=A0=C2=A0us and the safety of our children? > > Paul, adding "member of obscure technical group" to his LinkedIn profil= e. > Well, immediately preceeding that: "This Question concerns the danger posed to existing internet safety mechanisms by an encryption protocol that, if implemented, would render useless the family filters in millions of homes and the ability to track down illegal content by organisations such as the Internet Watch Foundation." Child safety interest groups are relatively well-funded and well-known for a large number of years. Observations relating to their agenda have been raised in HRPC recently and, of course, in a number of other forums over a large number of years. While a lot of child safety initiatives have in recent years (most notably the Swedish Royal Prince's Foundation at https://www.natforaldrar.se/#english !) been moving stronger towards building confidence in parents that they can be trustworthy supporters of children when children encounter troubling situations online, the momentum for ISP-oriented content control mechanisms is already in full steam since the 1990s. It takes a while for recommendations to be updated, even if better practises for parents are known nowadays. Together with my colleague Collin (in CC) I've been trying to work out whether it's possible to pre-empt increasing tensions around DoH and child safety filtering. In particular, we're happy to collaborate with interested IETF and RIPE people on this, so you can drop us an *offlist message* if you feel like this is something you care about. Thank you for your kind attention, Best regards, --=20 Amelia Andersdotter Technical Consultant, Digital Programme Chair, RCM TIG, IEEE 802.11 ARTICLE19 www.article19.org PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55 From nobody Thu May 16 12:49:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC24812028C for ; Thu, 16 May 2019 12:49:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rnqrqy-xJFWa for ; Thu, 16 May 2019 12:49:45 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7CD5120165 for ; Thu, 16 May 2019 12:49:33 -0700 (PDT) Received: from pps.filterd (m0048207.ppops.net [127.0.0.1]) by m0048207.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4GJXCfZ037418 for ; Thu, 16 May 2019 15:49:29 -0400 Received: from usushmgip001.mail.tfayd.com ([216.178.109.235]) by m0048207.ppops.net-00176a04. with ESMTP id 2sdsncv5xr-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Thu, 16 May 2019 15:49:29 -0400 Received: from unknown (HELO potemwp00031.mail.tfayd.com) ([10.40.33.204]) by usushmgip001.mail.tfayd.com with ESMTP; 16 May 2019 12:49:28 -0700 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00033.mail.tfayd.com (100.124.56.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Thu, 16 May 2019 13:49:27 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00029.mail.tfayd.com (100.124.56.53) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Thu, 16 May 2019 13:49:26 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Thu, 16 May 2019 13:49:26 -0600 From: "Deen, Glenn (NBCUniversal)" To: Amelia Andersdotter , "add@ietf.org" CC: Collin Kurre , "Deen, Glenn (NBCUniversal)" Thread-Topic: [EXTERNAL] Re: [Add] questions in parliament about DoH Thread-Index: AQHVC/p+7ISpknx3Sku5gDJkISZ/56ZufioA//+aC4A= Date: Thu, 16 May 2019 19:49:26 +0000 Message-ID: <15EF37E2-EA6B-4BA2-8DF3-E218A0E6C007@nbcuni.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [100.126.25.33] x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="utf-8" Content-ID: <5F26B69BDABA2D4899F1A0F744EDE898@NBCUNI.COM> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-16_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905160122 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: questions in parliament about DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 19:49:50 -0000 SGkNCg0KT25lIHBvaW50IG9uIHRoaXMgLSBpcyB0aGF0IGEgc2lnbmlmaWNhbnQgZGlmZmVyZW5j ZSB3aXRoIERvSCBvbiBjaGlsZCBzYWZldHkgZmlsdGVycyBpcyB0aGF0IGZvciB1c2VycyB3aG8g aGF2ZSBjaG9zZW4gZm9yIHRoZWlyIG93biBkZXZpY2VzIHRvIHR1cm4gb24gY2hpbGQgc2FmZXR5 IGZpbHRlcnMsIHRoZXkgd2lsbCBzZWUgdGhlbSBlZmZlY3RpdmVseSB0dXJuZWQgb2ZmIGJ5IGEg dGhpcmQgcGFydHkgbWFraW5nIHRoZSBkZWNpc2lvbiBmb3IgdGhlbS4gICAgDQoNClRoYXQncyB3 aGVyZSB0aGUgbGVnYWN5IGRpc2N1c3Npb25zIGRvbid0IGVudGlyZWx5IGFwcGx5IHRvIHRoaXMg Y29udmVyc2F0aW9uIGFzIG11Y2ggb2YgdGhlIGlzc3VlIGhhcyBiZWVuIGFyb3VuZCB3aG8gaXMg bWFraW5nIHRoZSBkZWNpc2lvbi4gIEl0J3MgdmVyeSBtdWNoIHRoZSBxdWVzdGlvbiBvZiB3aG8g aXMgY2hvb3NpbmcgdGhlIGZpbHRlciBiZSB0dXJuZWQgb24sICBhbmQgd2hvIGlzIGNob29zaW5n IHRvIGRpc2FibGUgaXQsIGFuZCBpbiB0aGUgY3VycmVudCBEb0ggcGxhbnMgdGhhdCBkZWNpc2lv biBpcyBiZWluZyB0YWtlbiBhd2F5IGZyb20gdGhlIHVzZXIuDQoNCi1nbGVubg0KDQrvu79PbiA1 LzE2LzE5LCAxMTo1NSBBTSwgIkFkZCBvbiBiZWhhbGYgb2YgQW1lbGlhIEFuZGVyc2RvdHRlciIg PGFkZC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBhbWVsaWFAYXJ0aWNsZTE5Lm9yZz4g d3JvdGU6DQoNCiAgICBPbiAyMDE5LTA1LTE2IDE3OjE3LCBQYXVsIFdvdXRlcnMgd3JvdGU6DQog ICAgPiBPbiBUaHUsIDE2IE1heSAyMDE5LCBKaW0gUmVpZCB3cm90ZToNCiAgICA+DQogICAgPj4g aHR0cHM6Ly9oYW5zYXJkLnBhcmxpYW1lbnQudWsvTG9yZHMvMjAxOS0wNS0xNC9kZWJhdGVzL0U4 NENCQkFFLUUwMDUtNDZFMC1CN0U1LTg0NTg4MkRCMUVEOC9JbnRlcm5ldEVuY3J5cHRpb24NCiAg ICA+Pg0KICAgID4NCiAgICA+IFRoYXQgZXNjYWxhdGVkIHF1aWNrbHk6DQogICAgPg0KICAgID4g ICAgIERvZXMgdGhlIE1pbmlzdGVyIGFncmVlIHRoYXQgdGhlcmUgaXMgYSBmdW5kYW1lbnRhbCBh bmQgdmVyeQ0KICAgID4gY29uY2VybmluZw0KICAgID4gICAgIGxhY2sgb2YgYWNjb3VudGFiaWxp dHkgd2hlbiBvYnNjdXJlIHRlY2huaWNhbCBncm91cHMsIHBlb3BsZWQNCiAgICA+IGxhcmdlbHkg YnkNCiAgICA+ICAgICB0aGUgZW1wbG95ZWVzIG9mIHRoZSBiaWcgaW50ZXJuZXQgY29tcGFuaWVz LCB0YWtlIGRlY2lzaW9ucyB0aGF0IGhhdmUNCiAgICA+ICAgICBtYWpvciBwdWJsaWMgcG9saWN5 IGltcGxpY2F0aW9ucyB3aXRoIGVub3Jtb3VzIGNvbnNlcXVlbmNlcyBmb3INCiAgICA+IGFsbCBv Zg0KICAgID4gICAgIHVzIGFuZCB0aGUgc2FmZXR5IG9mIG91ciBjaGlsZHJlbj8NCiAgICA+DQog ICAgPiBQYXVsLCBhZGRpbmcgIm1lbWJlciBvZiBvYnNjdXJlIHRlY2huaWNhbCBncm91cCIgdG8g aGlzIExpbmtlZEluIHByb2ZpbGUuDQogICAgPg0KICAgIFdlbGwsIGltbWVkaWF0ZWx5IHByZWNl ZWRpbmcgdGhhdDogIlRoaXMgUXVlc3Rpb24gY29uY2VybnMgdGhlIGRhbmdlcg0KICAgIHBvc2Vk IHRvIGV4aXN0aW5nIGludGVybmV0IHNhZmV0eSBtZWNoYW5pc21zIGJ5IGFuIGVuY3J5cHRpb24g cHJvdG9jb2wNCiAgICB0aGF0LCBpZiBpbXBsZW1lbnRlZCwgd291bGQgcmVuZGVyIHVzZWxlc3Mg dGhlIGZhbWlseSBmaWx0ZXJzIGluDQogICAgbWlsbGlvbnMgb2YgaG9tZXMgYW5kIHRoZSBhYmls aXR5IHRvIHRyYWNrIGRvd24gaWxsZWdhbCBjb250ZW50IGJ5DQogICAgb3JnYW5pc2F0aW9ucyBz dWNoIGFzIHRoZSBJbnRlcm5ldCBXYXRjaCBGb3VuZGF0aW9uLiINCiAgICANCiAgICBDaGlsZCBz YWZldHkgaW50ZXJlc3QgZ3JvdXBzIGFyZSByZWxhdGl2ZWx5IHdlbGwtZnVuZGVkIGFuZCB3ZWxs LWtub3duDQogICAgZm9yIGEgbGFyZ2UgbnVtYmVyIG9mIHllYXJzLiBPYnNlcnZhdGlvbnMgcmVs YXRpbmcgdG8gdGhlaXIgYWdlbmRhIGhhdmUNCiAgICBiZWVuIHJhaXNlZCBpbiBIUlBDIHJlY2Vu dGx5IGFuZCwgb2YgY291cnNlLCBpbiBhIG51bWJlciBvZiBvdGhlciBmb3J1bXMNCiAgICBvdmVy IGEgbGFyZ2UgbnVtYmVyIG9mIHllYXJzLg0KICAgIA0KICAgIFdoaWxlIGEgbG90IG9mIGNoaWxk IHNhZmV0eSBpbml0aWF0aXZlcyBoYXZlIGluIHJlY2VudCB5ZWFycyAobW9zdA0KICAgIG5vdGFi bHkgdGhlIFN3ZWRpc2ggUm95YWwgUHJpbmNlJ3MgRm91bmRhdGlvbiBhdA0KICAgIGh0dHBzOi8v d3d3Lm5hdGZvcmFsZHJhci5zZS8jZW5nbGlzaCAhKSBiZWVuIG1vdmluZyBzdHJvbmdlciB0b3dh cmRzDQogICAgYnVpbGRpbmcgY29uZmlkZW5jZSBpbiBwYXJlbnRzIHRoYXQgdGhleSBjYW4gYmUg dHJ1c3R3b3J0aHkgc3VwcG9ydGVycw0KICAgIG9mIGNoaWxkcmVuIHdoZW4gY2hpbGRyZW4gZW5j b3VudGVyIHRyb3VibGluZyBzaXR1YXRpb25zIG9ubGluZSwgdGhlDQogICAgbW9tZW50dW0gZm9y IElTUC1vcmllbnRlZCBjb250ZW50IGNvbnRyb2wgbWVjaGFuaXNtcyBpcyBhbHJlYWR5IGluIGZ1 bGwNCiAgICBzdGVhbSBzaW5jZSB0aGUgMTk5MHMuIEl0IHRha2VzIGEgd2hpbGUgZm9yIHJlY29t bWVuZGF0aW9ucyB0byBiZQ0KICAgIHVwZGF0ZWQsIGV2ZW4gaWYgYmV0dGVyIHByYWN0aXNlcyBm b3IgcGFyZW50cyBhcmUga25vd24gbm93YWRheXMuDQogICAgDQogICAgVG9nZXRoZXIgd2l0aCBt eSBjb2xsZWFndWUgQ29sbGluIChpbiBDQykgSSd2ZSBiZWVuIHRyeWluZyB0byB3b3JrIG91dA0K ICAgIHdoZXRoZXIgaXQncyBwb3NzaWJsZSB0byBwcmUtZW1wdCBpbmNyZWFzaW5nIHRlbnNpb25z IGFyb3VuZCBEb0ggYW5kDQogICAgY2hpbGQgc2FmZXR5IGZpbHRlcmluZy4gSW4gcGFydGljdWxh ciwgd2UncmUgaGFwcHkgdG8gY29sbGFib3JhdGUgd2l0aA0KICAgIGludGVyZXN0ZWQgSUVURiBh bmQgUklQRSBwZW9wbGUgb24gdGhpcywgc28geW91IGNhbiBkcm9wIHVzIGFuICpvZmZsaXN0DQog ICAgbWVzc2FnZSogaWYgeW91IGZlZWwgbGlrZSB0aGlzIGlzIHNvbWV0aGluZyB5b3UgY2FyZSBh Ym91dC4NCiAgICANCiAgICBUaGFuayB5b3UgZm9yIHlvdXIga2luZCBhdHRlbnRpb24sDQogICAg DQogICAgQmVzdCByZWdhcmRzLA0KICAgIA0KICAgIC0tIA0KICAgIEFtZWxpYSBBbmRlcnNkb3R0 ZXINCiAgICBUZWNobmljYWwgQ29uc3VsdGFudCwgRGlnaXRhbCBQcm9ncmFtbWUNCiAgICBDaGFp ciwgUkNNIFRJRywgSUVFRSA4MDIuMTENCiAgICANCiAgICBBUlRJQ0xFMTkNCiAgICB3d3cuYXJ0 aWNsZTE5Lm9yZw0KICAgIA0KICAgIFBHUDogM0Q1RCBCNkNBIEI4NTIgQjk4OCAwNTVBIDZBNkYg RkVGMSBDMjk0IEI0RTggMEI1NQ0KICAgIA0KICAgIA0KICAgIC0tIA0KICAgIEFkZCBtYWlsaW5n IGxpc3QNCiAgICBBZGRAaWV0Zi5vcmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2FkZA0KICAgIA0KDQo= From nobody Thu May 16 22:48:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 846FB120168 for ; Thu, 16 May 2019 22:48:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.922 X-Spam-Level: X-Spam-Status: No, score=-0.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=itaoyama.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oFTzHknxgy1T for ; Thu, 16 May 2019 22:48:21 -0700 (PDT) Received: from JPN01-OS2-obe.outbound.protection.outlook.com (mail-eopbgr1410099.outbound.protection.outlook.com [40.107.141.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D48612012B for ; Thu, 16 May 2019 22:48:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itaoyama.onmicrosoft.com; s=selector1-itaoyama-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ey5teg57qvM4uX0mwKFHtbcM1lVJzxYEJVqXRn4ZxXc=; b=UTQfeA2s6/KECBVBycRvjaU421ebEv1rE5gOxyejmf7HnH86P3k7tEL0nXUnZg7NI4omkh6wFTRzOMv4NxarVrttH9S2s8arCTdx3DZxWwhzEbi4CpzGZY5eNkqHqGymO1w0byWIDuvQCz+p1UEmX6clWFpSElqxkJ2BqLThGV4= Received: from OSAPR01MB1683.jpnprd01.prod.outlook.com (52.134.232.142) by OSAPR01MB4691.jpnprd01.prod.outlook.com (20.179.177.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.17; Fri, 17 May 2019 05:48:19 +0000 Received: from OSAPR01MB1683.jpnprd01.prod.outlook.com ([fe80::dc8b:100a:3e3f:b226]) by OSAPR01MB1683.jpnprd01.prod.outlook.com ([fe80::dc8b:100a:3e3f:b226%4]) with mapi id 15.20.1900.010; Fri, 17 May 2019 05:48:18 +0000 From: =?utf-8?B?TWFydGluIEouIETDvHJzdA==?= To: Paul Wouters CC: ADD Mailing list Thread-Topic: [Add] questions in parliament about DoH Thread-Index: AQHVC/k95MOQrU3TEkGTR4KE+JqFXKZt3OMAgADzawA= Date: Fri, 17 May 2019 05:48:18 +0000 Message-ID: <15fc25bc-4ce5-6f7b-e114-5541b0059ab0@it.aoyama.ac.jp> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: TYAPR01CA0231.jpnprd01.prod.outlook.com (2603:1096:404:11e::27) To OSAPR01MB1683.jpnprd01.prod.outlook.com (2603:1096:603:2b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=duerst@it.aoyama.ac.jp; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [133.2.210.64] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 580c46e3-8598-4777-a89a-08d6da8b435e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7025125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:OSAPR01MB4691; x-ms-traffictypediagnostic: OSAPR01MB4691: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0040126723 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39840400004)(376002)(346002)(366004)(396003)(136003)(189003)(199004)(14454004)(71190400001)(2616005)(66066001)(6436002)(66556008)(74482002)(31696002)(11346002)(86362001)(53936002)(508600001)(45080400002)(81166006)(6246003)(4326008)(8676002)(81156014)(71200400001)(6486002)(31686004)(6916009)(446003)(66946007)(66476007)(73956011)(66446008)(64756008)(8936002)(486006)(186003)(5660300002)(53546011)(6306002)(229853002)(966005)(85202003)(26005)(14444005)(476003)(256004)(3846002)(102836004)(25786009)(6116002)(2906002)(66574012)(7736002)(68736007)(386003)(316002)(786003)(76176011)(99286004)(305945005)(6506007)(85182001)(52116002)(6512007); DIR:OUT; SFP:1102; SCL:1; SRVR:OSAPR01MB4691; H:OSAPR01MB1683.jpnprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: it.aoyama.ac.jp does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Z+4azKotjl5ntDET+R/kXIphR/O8UGk6sR5vhW9l64+xi7TjWic/fiqKpBDoOYGBv9J5ark0bincsvQFIvYsmBbVyhTR/VBRrERjk+EfBi/s6vfL0rKTo4FDCMyvhWeEd835bPPIJeeNLAwMgI9vAYWOR4FF8WhhPY1pFrIO8d1OA2EHKqCuyDQ/N3FKextbdxM5uSEjiRmJ55w0EJFVdtyIzLimodSn63XxwoEq7WJftqRZianGA0CSXAV6e3DuGCybjVpv78yxhj6YG0J/DBSfIW6GGtu9tCfOTtsBLdZXXW35FgthtJsqbsB3ub6EPv859x13ZxYTHr6ERoDluU2cf/elK1oJXq1Yo1LoTWfYfTZxhSYhdSmgsO5BOgCvBQ2zEfdEp7Z4DpjBQp9kw3miSKzFpeMVxCWW7JXUIME= Content-Type: text/plain; charset="utf-8" Content-ID: <6047F502C07B6E49A1BC078A4FAB2481@jpnprd01.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: it.aoyama.ac.jp X-MS-Exchange-CrossTenant-Network-Message-Id: 580c46e3-8598-4777-a89a-08d6da8b435e X-MS-Exchange-CrossTenant-originalarrivaltime: 17 May 2019 05:48:18.9137 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: e02030e7-4d45-463e-a968-0290e738c18e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSAPR01MB4691 Archived-At: Subject: Re: [Add] questions in parliament about DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 May 2019 05:48:24 -0000 DQoNCk9uIDIwMTkvMDUvMTcgMDA6MTcsIFBhdWwgV291dGVycyB3cm90ZToNCj4gT24gVGh1LCAx NiBNYXkgMjAxOSwgSmltIFJlaWQgd3JvdGU6DQo+IA0KPj4gaHR0cHM6Ly9oYW5zYXJkLnBhcmxp YW1lbnQudWsvTG9yZHMvMjAxOS0wNS0xNC9kZWJhdGVzL0U4NENCQkFFLUUwMDUtNDZFMC1CN0U1 LTg0NTg4MkRCMUVEOC9JbnRlcm5ldEVuY3J5cHRpb24gDQo+Pg0KPiANCj4gVGhhdCBlc2NhbGF0 ZWQgcXVpY2tseToNCg0KWWVzIGluZGVlZC4NCg0KPiAgwqDCoMKgwqBEb2VzIHRoZSBNaW5pc3Rl ciBhZ3JlZSB0aGF0IHRoZXJlIGlzIGEgZnVuZGFtZW50YWwgYW5kIHZlcnkgDQo+IGNvbmNlcm5p bmcNCj4gIMKgwqDCoMKgbGFjayBvZiBhY2NvdW50YWJpbGl0eSB3aGVuIG9ic2N1cmUgdGVjaG5p Y2FsIGdyb3VwcywgcGVvcGxlZCANCj4gbGFyZ2VseSBieQ0KPiAgwqDCoMKgwqB0aGUgZW1wbG95 ZWVzIG9mIHRoZSBiaWcgaW50ZXJuZXQgY29tcGFuaWVzLCB0YWtlIGRlY2lzaW9ucyB0aGF0IGhh dmUNCj4gIMKgwqDCoMKgbWFqb3IgcHVibGljIHBvbGljeSBpbXBsaWNhdGlvbnMgd2l0aCBlbm9y bW91cyBjb25zZXF1ZW5jZXMgZm9yIGFsbCBvZg0KPiAgwqDCoMKgwqB1cyBhbmQgdGhlIHNhZmV0 eSBvZiBvdXIgY2hpbGRyZW4/DQo+IA0KPiBQYXVsLCBhZGRpbmcgIm1lbWJlciBvZiBvYnNjdXJl IHRlY2huaWNhbCBncm91cCIgdG8gaGlzIExpbmtlZEluIHByb2ZpbGUuDQoNCkJ1dCB0aGVuIHlv dXIgZXhjaXRlbWVudCBmb3IgYSBuZXcgYWRkaXRpb24gdG8geW91ciBwcm9maWxlIGdvdCBhIGJp dCANCmRhbXBlZDoNCg0KTXkgTG9yZHMsIEkgdGhhbmsgdGhlIG5vYmxlIEJhcm9uZXNzIGZvciBk aXNjdXNzaW5nIHRoaXMgd2l0aCBtZSANCmJlZm9yZWhhbmQsIHdoaWNoIHdhcyB2ZXJ5IHdlbGNv bWUuIEkgYWdyZWUgdGhhdCB0aGVyZSBtYXkgYmUgc2VyaW91cyANCmNvbnNlcXVlbmNlcyBmcm9t IERvSC4gVGhlIERvSCBwcm90b2NvbCBoYXMgYmVlbiBkZWZpbmVkIGJ5IHRoZSBJbnRlcm5ldCAN CkVuZ2luZWVyaW5nIFRhc2sgRm9yY2UuIFdoZXJlIEkgZG8gbm90IGFncmVlIHdpdGggdGhlIG5v YmxlIEJhcm9uZXNzIGlzIA0KdGhhdCB0aGlzIGlzIG5vdCBhbiBvYnNjdXJlIG9yZ2FuaXNhdGlv bjsgaXQgaGFzIGJlZW4gdGhlIGRvbWluYW50IA0KaW50ZXJuZXQgdGVjaG5pY2FsIHN0YW5kYXJk cyBvcmdhbmlzYXRpb24gZm9yIDMwLXBsdXMgeWVhcnMgYW5kIGhhcyANCmF0dGVuZGFudHMgZnJv bSBjaXZpbCBzb2NpZXR5LCBhY2FkZW1pYSBhbmQgdGhlIFVLIEdvdmVybm1lbnQgYXMgd2VsbCBh cyANCnRoZSBpbmR1c3RyeS4gVGhlIHByb2NlZWRpbmdzIGFyZSBhdmFpbGFibGUgb25saW5lIGFu ZCBhcmUgbm90IA0KcmVzdHJpY3RlZC4gSXQgaXMgaW1wb3J0YW50IHRvIGtub3cgdGhhdCBEb0gg aGFzIG5vdCBiZWVuIHJvbGxlZCBvdXQgeWV0IA0KYW5kIHRoZSBwaWN0dXJlIGluIGl0IGlzIGNv bXBsZXjigJR0aGVyZSBhcmUgcHJvcyB0byBEb0ggYXMgd2VsbCBhcyBjb25zLiANCldlIHdpbGwg Y29udGludWUgdG8gYmUgcGFydCBvZiB0aGVzZSBkaXNjdXNzaW9uczsgaW5kZWVkLCB0aGVyZSB3 YXMgYSANCm1lZXRpbmcgbGFzdCB3ZWVrLCBjb252ZW5lZCBieSB0aGUgTkNTQywgd2l0aCBEQ01T IGFuZCBpbmR1c3RyeSANCnN0YWtlaG9sZGVycyBwcmVzZW50Lg0KDQpTbyBtYXliZSB5b3UgY2Fu IGFkZCAibWVtYmVyIG9mIGRvbWluYW50IGludGVybmV0IHRlY2huaWNhbCBzdGFuZGFyZHMgDQpv cmdhbml6YXRpb24iIHRvIHlvdXIgcHJvZmlsZSwgdG9vPw0KDQpSZWdhcmRzLCAgICBNYXJ0aW4u DQo= From nobody Fri May 17 05:53:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 508F3120151 for ; Fri, 17 May 2019 05:53:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_MIME_MALF=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j60fuUd9dDq1 for ; Fri, 17 May 2019 05:53:01 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80071.outbound.protection.outlook.com [40.107.8.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D358A1200B9 for ; Fri, 17 May 2019 05:53:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hg+OV9lA10J/lIuNNXwP8nWzQ6a7nDcq8CahkJk/MXs=; b=LTIjk9PpBlLOtMChfzkK7krDkk+hha+3Eb7M7loeaHuD8gsTtmLXLs5xQOehcvfU0WJJ0+yIaNdbSulWzSSOLMDysEArtjQbhWYJUL3Rz0KXgzTm7uluHIFpUlmcGrvMhZErnaumNND2UjsNj78gW3mISinubzGdl4i9/ZKpnfc= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2199.eurprd06.prod.outlook.com (10.168.57.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.17; Fri, 17 May 2019 12:52:57 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::883b:b573:ea6d:2d54]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::883b:b573:ea6d:2d54%3]) with mapi id 15.20.1878.024; Fri, 17 May 2019 12:52:57 +0000 From: "Winfield, Alister" To: "add@ietf.org" Thread-Topic: Googles Experimental DoH Endpoint Thread-Index: AQHVDK9zlKm7FRHk8k+XgZodozev6A== Date: Fri, 17 May 2019 12:52:56 +0000 Message-ID: <3BD0C1E6-A937-4F51-AB17-8D449D6C7036@sky.uk> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e2db:2400:5019:566b:5d28:7212] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8bc998a5-ee6e-4c69-e272-08d6dac695df x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6PR0601MB2199; x-ms-traffictypediagnostic: DB6PR0601MB2199: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-forefront-prvs: 0040126723 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(396003)(136003)(366004)(39860400002)(189003)(199004)(6916009)(2501003)(2351001)(2906002)(73956011)(66946007)(66476007)(66556008)(72206003)(6116002)(6506007)(36756003)(66446008)(64756008)(91956017)(99286004)(76116006)(54896002)(6306002)(478600001)(14454004)(6486002)(33656002)(316002)(102836004)(5640700003)(74482002)(6436002)(256004)(7736002)(6512007)(14444005)(5024004)(15974865002)(2616005)(46003)(476003)(486006)(71200400001)(83716004)(82746002)(71190400001)(3480700005)(86362001)(68736007)(58126008)(8936002)(8676002)(1730700003)(81166006)(81156014)(186003)(53936002)(66574012)(5660300002)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2199; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 57YqZkuf2Ad+rb2VZ8MjZ97kIQAcxexFrZ9pQHYmNENEqP0XPCL+RJopGIxSvmcDzUrMjzMkBOHHgB06kCeoj6gZBHk+0rkfsKXeuU+gVodcwNAV7creBub1p6Xi1aQhJMCowfkrPWyOkVLzZUllFrYlNJdcTEqeoAwP1IR4TdY8fikgMHbWUPT0QTqM9LMbHcmkkHIAV4yrs7n83h/VCJqGLeb8wtmYEz/t/uF0QVdrfL9l7mQ10Ax3iLM+9GGv+qbLaMVtrSY/6bLEVt8juyUSroPeO2rbfGZPP6dNXAQDNaTBljD2kRFRY/ZUSzUPcTuZLiip5dDtqUi6jms6Ulr9GbqG2g4rVN26B4Obh2jH9T9VZY0xHZjGciimcEhI7hEVJsJjGbIxfdAhYZHGakJWmWaicpsXO+Ft6c18xeg= Content-Type: multipart/alternative; boundary="_000_3BD0C1E6A9374F51AB178D449D6C7036skyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 8bc998a5-ee6e-4c69-e272-08d6dac695df X-MS-Exchange-CrossTenant-originalarrivaltime: 17 May 2019 12:52:57.1260 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2199 Archived-At: Subject: [Add] Googles Experimental DoH Endpoint X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 May 2019 12:53:05 -0000 --_000_3BD0C1E6A9374F51AB178D449D6C7036skyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KipSZXBvc3RpbmcgdGhpcyBoZXJlIHNlZW1zIG9uIHRvcGljIGZvciBib3RoIGRvaCBhbmQgYWRk ICoqDQoNCk9oIGJ5IHRoZSB3YXkgSSBub3RpY2VkIHRoaXMgYW5kIGl0IHNlZW1zIGNvdW50ZXIg dG8gdGhlIGNsYWltIG9mIERvSCBvbmx5IHJ1bm5pbmcgb24gOC44LjguOC4NCg0KDQpUbyBrZWVw IGl0IHNob3J0IEnigJl2ZSByZW1vdmVkIHRoZSBTU0wgc2V0dXAgc3RlcCBmcm9tIHRoZSBleGFt cGxlLg0KDQoNCiQgb3BlbnNzbCBzX2NsaWVudCAtY29ubmVjdCBzZWFyY2guZ29vZ2xlLmNvbTo0 NDMgLXNlcnZlcm5hbWUgc2VhcmNoLmdvb2dsZS5jb20NCuKApg0KLS0tDQoNCkdFVCAvZXhwZXJp bWVudGFsP2Rucz1BQUFCQUFBQkFBQUFBQUFBQTNkM2R3ZGxlR0Z0Y0d4bEEyTnZiUUFBQVFBQiBI VFRQLzEuMQ0KaG9zdDogZG5zLmdvb2dsZS5jb20NCg0KSFRUUC8xLjEgMjAwIE9LDQpTdHJpY3Qt VHJhbnNwb3J0LVNlY3VyaXR5OiBtYXgtYWdlPTMxNTM2MDAwOyBpbmNsdWRlU3ViRG9tYWluczsg cHJlbG9hZA0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctT3JpZ2luOiAqDQpEYXRlOiBUdWUsIDE0IE1h eSAyMDE5IDEzOjQ5OjUzIEdNVA0KRXhwaXJlczogVHVlLCAxNCBNYXkgMjAxOSAxMzo0OTo1MyBH TVQNCkNhY2hlLUNvbnRyb2w6IHByaXZhdGUsIG1heC1hZ2U9MjA1OTUNCkNvbnRlbnQtVHlwZTog YXBwbGljYXRpb24vZG5zLW1lc3NhZ2UNClNlcnZlcjogSFRUUCBzZXJ2ZXIgKHVua25vd24pDQpD b250ZW50LUxlbmd0aDogNDkNClgtWFNTLVByb3RlY3Rpb246IDANClgtRnJhbWUtT3B0aW9uczog U0FNRU9SSUdJTg0KQWx0LVN2YzogcXVpYz0iOjQ0MyI7IG1hPTI1OTIwMDA7IHY9IjQ2LDQ0LDQz LDM5Ig0KDQo/P3d3d2V4YW1wbGVjb20/DQogICAgICAgICAgICAgICAgUHNdPz8iXkMNCiQNCg0K DQpUcmllZCBhIGZldyBtb3JlIGdtYWlsLmdvb2dsZS5jb20sIHd3dy55b3V0dWJlLmNvbSwgbmV3 cy5nb29nbGUuY29tDQoNClNvIEkgZ3Vlc3MgaXTigJlzIHRoZWlyIGVudGlyZSB3ZWIgZXN0YXRl DQoNCkFzIHRoZSBvYnZpb3VzIHRoaW5nIHRvIHRlc3QgRmlyZWZveCBzZWVtcyB0byBoYXZlIG5v IG9mZmljaWFsIHdheSB0byBkbyB0aGlzIGJ1dCBJIHN1c3BlY3QgaXQgd291bGQgYmUgdHJpdmlh bCB0byBhbGxvdyBpdC4gUGx1cyBtYWxpY2lvdXMgYXBwbGljYXRpb25zIC8gbWFsd2FyZSBldGMg ZG9u4oCZdCBjYXJlIGFib3V0IHJ1bGVzIHNvIGV4cGVjdCB0aGVtIHRvIGJlIHVzaW5nIHRoaXMg ZmFjdCBhbHJlYWR5Lg0KDQotLQ0KQWxpc3RlciBXaW5maWVsZC4NCg0KSW5mb3JtYXRpb24gaW4g dGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBj b25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2Vl LiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhl IHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBp dCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5k IGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRp c3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRz IHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBh bGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kIGV4dGVybmFs IG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFya3Mgb2YgU2t5IExp bWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNl Lg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhv bWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2Ny aWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5 IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRp cmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjI0Nzcz NSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUg aW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdp c3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQN Cg== --_000_3BD0C1E6A9374F51AB178D449D6C7036skyuk_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OiJcQE1hbGd1biBHb3RoaWMiO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6TWVubG87DQoJcGFub3NlLTE6MiAxMSA2IDkgMyA4IDQgMiAyIDQ7fQ0KLyogU3R5bGUgRGVm aW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7 bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlw ZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxv d2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCnAucDEsIGxpLnAxLCBkaXYucDENCgl7bXNvLXN0eWxlLW5hbWU6 cDE7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLnMxDQoJe21z by1zdHlsZS1uYW1lOnMxO30NCnAucDIsIGxpLnAyLCBkaXYucDINCgl7bXNvLXN0eWxlLW5hbWU6 cDI7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLmFwcGxlLWNv bnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0K Lk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEy LjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2 LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+KipSZXBvc3RpbmcgdGhpcyBoZXJlIHNl ZW1zIG9uIHRvcGljIGZvciBib3RoIGRvaCBhbmQgYWRkICoqPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29s b3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj5PaCBieSB0aGUg d2F5IEkgbm90aWNlZCB0aGlzIGFuZCBpdCBzZWVtcyBjb3VudGVyIHRvIHRoZSBjbGFpbSBvZiBE b0ggb25seSBydW5uaW5nIG9uIDguOC44LjguPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3Nw YW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+VG8ga2VlcCBpdCBzaG9ydCBJ4oCZdmUgcmVtb3ZlZCB0aGUgU1NMIHNldHVwIHN0ZXAgZnJv bSB0aGUgZXhhbXBsZS48L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6TWVubG87Y29sb3I6 YmxhY2siPiQgb3BlbnNzbCBzX2NsaWVudCAtY29ubmVjdCBzZWFyY2guZ29vZ2xlLmNvbTo0NDMg LXNlcnZlcm5hbWUgc2VhcmNoLmdvb2dsZS5jb208bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5 Ok1lbmxvO2NvbG9yOmJsYWNrIj7igKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxv O2NvbG9yOmJsYWNrIj4tLS08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxvO2NvbG9y OmJsYWNrIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxvO2NvbG9yOmJs YWNrIj5HRVQgL2V4cGVyaW1lbnRhbD9kbnM9QUFBQkFBQUJBQUFBQUFBQUEzZDNkd2RsZUdGdGNH eGxBMk52YlFBQUFRQUIgSFRUUC8xLjE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxv O2NvbG9yOmJsYWNrIj5ob3N0OiBkbnMuZ29vZ2xlLmNvbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1m YW1pbHk6TWVubG87Y29sb3I6YmxhY2siPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1p bHk6TWVubG87Y29sb3I6YmxhY2siPkhUVFAvMS4xIDIwMCBPSzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9u dC1mYW1pbHk6TWVubG87Y29sb3I6YmxhY2siPlN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1h eC1hZ2U9MzE1MzYwMDA7IGluY2x1ZGVTdWJEb21haW5zOyBwcmVsb2FkPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVw dDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+QWNjZXNzLUNvbnRyb2wtQWxsb3ctT3Jp Z2luOiAqPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+RGF0 ZTogVHVlLCAxNCBNYXkgMjAxOSAxMzo0OTo1MyBHTVQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFt aWx5Ok1lbmxvO2NvbG9yOmJsYWNrIj5FeHBpcmVzOiBUdWUsIDE0IE1heSAyMDE5IDEzOjQ5OjUz IEdNVDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6TWVubG87Y29sb3I6YmxhY2siPkNhY2hl LUNvbnRyb2w6IHByaXZhdGUsIG1heC1hZ2U9MjA1OTU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFt aWx5Ok1lbmxvO2NvbG9yOmJsYWNrIj5Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2Rucy1tZXNz YWdlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+U2VydmVy OiBIVFRQIHNlcnZlciAodW5rbm93bik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxv O2NvbG9yOmJsYWNrIj5Db250ZW50LUxlbmd0aDogNDk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFt aWx5Ok1lbmxvO2NvbG9yOmJsYWNrIj5YLVhTUy1Qcm90ZWN0aW9uOiAwPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVw dDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+WC1GcmFtZS1PcHRpb25zOiBTQU1FT1JJ R0lOPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+QWx0LVN2 YzogcXVpYz0mcXVvdDs6NDQzJnF1b3Q7OyBtYT0yNTkyMDAwOyB2PSZxdW90OzQ2LDQ0LDQzLDM5 JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjpibGFjayI+Pz93d3dl eGFtcGxlY29tPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6TWVubG87Y29sb3I6YmxhY2si PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsm bmJzcDtQc10/PyZxdW90O15DPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xv cjpibGFjayI+JCZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3Nw YW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Y29sb3I6YmxhY2siPlRyaWVkIGEgZmV3IG1vcmUmbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj5nbWFpbC5nb29nbGUuY29tLCB3d3cueW91dHViZS5jb20sIG5ld3MuZ29v Z2xlLmNvbSZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+ U28gSSBndWVzcyBpdOKAmXMgdGhlaXIgZW50aXJlIHdlYiBlc3RhdGU8L3NwYW4+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPkFzIHRoZSBvYnZpb3VzIHRoaW5nIHRvIHRlc3Qg RmlyZWZveCBzZWVtcyB0byBoYXZlIG5vIG9mZmljaWFsIHdheSB0byBkbyB0aGlzIGJ1dCBJIHN1 c3BlY3QgaXQgd291bGQgYmUgdHJpdmlhbCB0byBhbGxvdyBpdC4gUGx1cyBtYWxpY2lvdXMgYXBw bGljYXRpb25zIC8gbWFsd2FyZSBldGMgZG9u4oCZdCBjYXJlIGFib3V0IHJ1bGVzIHNvDQogZXhw ZWN0IHRoZW0gdG8gYmUgdXNpbmcgdGhpcyBmYWN0IGFscmVhZHkuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj4tLTwvc3Bh bj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNr Ij5BbGlzdGVyIFdpbmZpZWxkLjwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCkluZm9y bWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJp dmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhl IGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGlj eSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUg cmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZQ0KIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVy biBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCBy ZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2Ug aXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQg dG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwg YW5kDQogZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVt YXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2Vk IHVuZGVyIGxpY2VuY2UuDQo8YnI+DQo8YnI+DQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0 aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUx MzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQg KFJlZ2lzdHJhdGlvbg0KIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlv bmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2Fs ZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNs ZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_3BD0C1E6A9374F51AB178D449D6C7036skyuk_-- From nobody Fri May 17 06:50:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A587120137 for ; Fri, 17 May 2019 06:50:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.99 X-Spam-Level: X-Spam-Status: No, score=-1.99 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_MIME_MALF=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=scramworks.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6eMIGDgxs_kf for ; Fri, 17 May 2019 06:50:26 -0700 (PDT) Received: from knid.scramworks.net (knid.scramworks.net [IPv6:2a01:4f8:c17:50eb::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 952341200CC for ; Fri, 17 May 2019 06:50:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=scramworks.net; s=bofh; h=References:In-Reply-To:To:From:Subject:Message-ID :Date:MIME-Version:Content-Type; bh=ZolB1/gxfAt1562Q6W/vCvgai+d8XN0WOCgVNep/nGo=; b=IFvv+4uE/vd+nRJ4Dt+1jJ+R8r OPMy+hEBnh8DWzo2weX6WHD2DQMq7OGEGi6qQQwyfa34tskOXSx/EeOLgy7xSNfrg7GVylYRl6tuL NjTaehknzFRyp9Hd2/TA1Yc82jp3yfOzG0AaSxKDg0re1AAemhMZbLb/30GIOtzQSCc4=; Received: from [90.240.166.166] (helo=[192.168.1.6]) by knid.scramworks.net with esmtpsa (TLS1.1:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.86_2) (envelope-from ) id 1hRdFe-0003iP-RX for add@ietf.org; Fri, 17 May 2019 14:50:23 +0100 Content-Type: multipart/alternative; boundary="----=_NextPart_15337942.773723218557" MIME-Version: 1.0 Date: Fri, 17 May 2019 14:49:23 +0100 Message-ID: <0fa1c85a-d967-499a-87a9-d1d56675f2cd@getmailbird.com> From: "Robert Mortimer" To: "" In-Reply-To: <3BD0C1E6-A937-4F51-AB17-8D449D6C7036@sky.uk> References: <3BD0C1E6-A937-4F51-AB17-8D449D6C7036@sky.uk> User-Agent: Mailbird/2.5.45.0 X-Mailbird-ID: 0fa1c85a-d967-499a-87a9-d1d56675f2cd@getmailbird.com X-Spam-Score-SW: -1.0 (-) X-SW-Scan: 799e08117f3b13cec5b607bfa6d663a4 X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Add] Googles Experimental DoH Endpoint X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 May 2019 13:50:30 -0000 ------=_NextPart_15337942.773723218557 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Google have said that they'll stop this behaviour and that in future DoH wi= ll only be via the 8.8.8.8 address I've not seen any announcement saying th= at they've actually made this restriction yet. Just that they plan to. --=C2=A0 Robm 873 =C2=A0 "Ask not what I can do for the stupid,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but what the stupid can do for me" - Grae= me Garden On 17/05/2019 13:54:15, Winfield, Alister wrote: **Reposting this here seems on topic for both doh and add ** =C2=A0 Oh by the way I noticed this and it seems counter to the claim of DoH only = running on 8.8.8.8. =C2=A0 =C2=A0 To keep it short I=E2=80=99ve removed the SSL setup step from the example. =C2=A0 =C2=A0 $ openssl s_client -connect search.google.com:443 -servername search.google= .com =E2=80=A6 --- =C2=A0 GET /experimental?dns=3DAAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/1= .1 host: dns.google.com =C2=A0 HTTP/1.1 200 OK Strict-Transport-Security: max-age=3D31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Date: Tue, 14 May 2019 13:49:53 GMT Expires: Tue, 14 May 2019 13:49:53 GMT Cache-Control: private, max-age=3D20595 Content-Type: application/dns-message Server: HTTP server (unknown) Content-Length: 49 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: quic=3D":443"; ma=3D2592000; v=3D"46,44,43,39" =C2=A0 ??wwwexamplecom? =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0Ps]??"^C $=C2=A0 =C2=A0 =C2=A0 Tried a few more=C2=A0gmail.google.com, www.youtube.com, news.google.com=C2= =A0 =C2=A0 So I guess it=E2=80=99s their entire web estate =C2=A0 As the obvious thing to test Firefox seems to have no official way to do th= is but I suspect it would be trivial to allow it. Plus malicious applicatio= ns / malware etc don=E2=80=99t care about rules so expect them to be using = this fact already. =C2=A0 -- Alister Winfield. =C2=A0 Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and= delete it from your system. You should not reproduce, distribute, store, r= etransmit, use or disclose its contents to anyone. Please note we reserve t= he right to monitor all e-mail communication through our internal and exter= nal networks. SKY and the SKY marks are trademarks of Sky Limited and Sky I= nternational AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the compa= nies mentioned in this paragraph are incorporated in England and Wales and = share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD ------=_NextPart_15337942.773723218557 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
Google have said that they'll stop this behaviour and = that in future DoH will only be via the 8.8.8.8 address I've not seen any a= nnouncement saying that they've actually made this restriction yet. Just th= at they plan to.

-- 
Robm
873
  "Ask n= ot what I can do for the stupid, 
       = ;  but what the stupid can do for me" - Graeme Garden
=0A

On 17/05/2019 13:54:15, Winfield, Alister <alister.winfiel= d=3D40sky.uk@dmarc.ietf.org> wrote:

=0A
=0A

**Reposting this here see= ms on topic for both doh and add **

=0A

 

=0A

Oh by the way I noticed this and it seems counter to the claim of DoH= only running on 8.8.8.8.

=0A

 

=0A

 

=0A

To keep it short I=E2= =80=99ve removed the SSL setup step from the example.

=0A

 <= o:p>

=0A

 

=0A

$ openssl s_client -connect search.google.com:443 -s= ervername search.google.com

=0A

= =E2=80=A6<= o:p>

=0A

---

=0A

 

=0A

GET /experimental?dns=3DAA= ABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/1.1

= =0A

host: dns.google.com

=0A

&= nbsp;

=0A

HTTP/1.1 200 OK

=0A

Strict-Transport-Security: max-age=3D31536000; include= SubDomains; preload

=0A

Access-Control-All= ow-Origin: *

=0A

Date: Tue, 14 May 2019 13= :49:53 GMT

=0A

Expires: Tue, 14 May 2019 1= 3:49:53 GMT

=0A

Cache-Control: private, ma= x-age=3D20595

=0A

Content-Type: applicatio= n/dns-message

=0A

Server: HTTP server (unk= nown)

=0A

Content-Length: 49

=0A

X-XSS-Protection: 0

=0A

X-Frame-Options: SAMEORIGIN

=0A

Alt-= Svc: quic=3D":443"; ma=3D2592000; v=3D"46,44,43,39"

= =0A

 

=0A

??wwwexamplecom= ?

=0A

          &= nbsp;     Ps]??"^C

=0A

$&nb= sp;

=0A

 =

=0A

 

=0A=

Tried= a few more gmail.google.com, www.y= outube.com, news.google.com 

=0A

 

=0A

So I guess it=E2=80=99s their entire= web estate

=0A

 

=0A

As the obvious thing to test Firefox seems to have no offi= cial way to do this but I suspect it would be trivial to allow it. Plus mal= icious applications / malware etc don=E2=80=99t care about rules so=0A expe= ct them to be using this fact already.

=0A

 =

=0A

--

=0A

Alister W= infield.

=0A

 <= /p>=0A

=0AInformation in this email including any attachments may be p= rivileged, confidential and is intended exclusively for the addressee. The = views expressed may not be official policy, but the personal views of the o= riginator. If you have received it in error, please=0A notify the sender by= return e-mail and delete it from your system. You should not reproduce, di= stribute, store, retransmit, use or disclose its contents to anyone. Please= note we reserve the right to monitor all e-mail communication through our = internal and=0A external networks. SKY and the SKY marks are trademarks of = Sky Limited and Sky International AG and are used under licence.=0A
=0A<= br>=0ASky UK Limited (Registration No. 2906991), Sky-In-Home Service Limite= d (Registration No. 2067075), Sky Subscribers Services Limited (Registratio= n No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or = indirect subsidiaries of Sky Limited (Registration=0A No. 2247735). All of = the companies mentioned in this paragraph are incorporated in England and W= ales and share the same registered office at Grant Way, Isleworth, Middlese= x TW7 5QD=0A
=0A = =0A
------=_NextPart_15337942.773723218557-- From nobody Mon May 20 08:30:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73F3B12008F for ; Mon, 20 May 2019 08:30:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JI1RheWGohzC for ; Mon, 20 May 2019 08:30:20 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BDC651200E5 for ; Mon, 20 May 2019 08:30:20 -0700 (PDT) Received: from dhcp-24-233.ripemtg.ripe.net (dhcp-24-233.ripemtg.ripe.net [193.0.24.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 5E055242109D for ; Mon, 20 May 2019 15:30:17 +0000 (UTC) From: Jim Reid Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <58B2AD17-ABD4-4163-B7F2-13C8C317FAD0@rfc1035.com> Date: Mon, 20 May 2019 16:30:15 +0100 To: add@ietf.org X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] more DoH questions in Parliament X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 May 2019 15:30:22 -0000 A leading MP is has asked 4 questions about DoH in the last week. At = least he didn't mention "obscure technical groups"... = https://www.parliament.uk/business/publications/written-questions-answers-= statements/written-questions-answers/?page=3D1&max=3D20&questiontype=3DAll= Questions&house=3Dcommons&member=3D1463 From nobody Fri May 24 07:49:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D47812003F for ; Fri, 24 May 2019 07:49:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KK2gQVEPjavz for ; Fri, 24 May 2019 07:49:08 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DDD912031E for ; Fri, 24 May 2019 07:48:51 -0700 (PDT) Received: from pps.filterd (m0048276.ppops.net [127.0.0.1]) by m0048276.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4OEmDrS011602 for ; Fri, 24 May 2019 10:48:50 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0048276.ppops.net-00176a04. with ESMTP id 2sjayv6f7n-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Fri, 24 May 2019 10:48:50 -0400 Received: from unknown (HELO potemwp00014.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 24 May 2019 10:46:15 -0400 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Fri, 24 May 2019 08:48:47 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Fri, 24 May 2019 08:48:47 -0600 From: "Deen, Glenn (NBCUniversal)" To: "add@ietf.org" CC: "Deen, Glenn (NBCUniversal)" Thread-Topic: Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcQ== Date: Fri, 24 May 2019 14:48:47 +0000 Message-ID: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [100.124.57.31] x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: multipart/alternative; boundary="_000_182C911959F943FAB1164D45649B74B5nbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-24_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=893 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905240099 Archived-At: Subject: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 14:49:11 -0000 --_000_182C911959F943FAB1164D45649B74B5nbcunicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SEkgZXZlcnlvbmUsDQoNCknigJl2ZSBiZWVuIHRoaW5raW5nIHRob3VnaCBzb21lIG9mIHRoZSBp c3N1ZXMgd2l0aCB0aGUgcHJvcG9zYWwgRG9IIGRlcGxveW1lbnQgaW4gYnJvd3NlcnMuDQoNCkEg YmlnIHBhcnQgb2YgdGhlIHR1ZyBvZiB3YXIgaGVyZSBpcyAgdGhlIGF1dGhvcml0eSBwcmVjZWRl bmNlIGZvciBhZHZhbmNlZCBzZWN1cml0eSBhbmQgbmV0d29yayBzZXR0aW5ncyB0aGF0IHNob3Vs ZCBiZSBmb2xsb3dlZC4NCg0KSGlzdG9yaWNhbGx5LCBpdOKAmXMgYmVlbiBhdCB0aGUgZGV2aWNl IGxldmVsIOKAkyB3aGljaCBtZWFudCB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3IsIHdoaWNoIGNv dWxkIGNob29zZSBkZWxlZ2F0ZSBjaG9pY2VzIHRvIGEgc3BlY2lmaWMgRE5TIHJlc29sdmVyIG9w ZXJhdG9yLCBvciB0byB0aGUgTmV0d29yayBESENQIHByb3ZpZGVkIHNldHRpbmdzLg0KDQpOb3cg dGhlIGJyb3dzZXIgaXMgc2Vla2luZyB0byBhZGRpbmcgaXRzZWxmIGludG8gdGhlIGF1dGhvcml0 eSBjaGFpbiBmb3IgdGhvc2Ugc2V0dGluZ3MuIFRoZSB0cm91YmxlIGJlaW5nIHRoYXQgdGhpcyBp cyBhIG1ham9yIGNoYW5nZSB0byB0aGUgYWRtaW5pc3RyYXRpdmUgdHJ1c3QgbW9kZWwuDQoNClRv IGRhdGUsIGJyb3dzZXIgc2V0dGluZ3MgaGF2ZSBiZWVuIGxpbWl0ZWQgdG8gcmVuZGVyaW5nIG9w dGlvbnMsIHNvbWUgYmFzaWMgY2VydGlmaWNhdGUgb3B0aW9ucywgYWRkb25zLCBhbmQgc2NyaXB0 aW5nIGxhbmd1YWdlIGNob2ljZXMuICAgIEFkdmFuY2Ugc2VjdXJpdHkgYW5kIHRydXN0IGhhcyBy ZW1haW5lZCB3aXRoIHRoZSBkZXZpY2UgYWRtaW5pc3RyYXRvci4gICAgIEFkZGluZyB0aGUgYnJv d3NlciB0byB0aGUgYWRtaW5pc3RyYXRpdmUgY2hhaW4gc28gdGhhdCBpdCBjYW4gY29udHJvbCBh ZHZhbmNlZCBzZWN1cml0eSBhbmQgbmV0d29yayBzZXR0aW5ncyBpbnRyb2R1Y2VzIGEgcHJvYmxl bSBiZWNhdXNlIHRoZSBicm93c2VyIGRvZXMgbm90IGhhdmUgYW4gYWRtaW5pc3RyYXRpdmUgbGV2 ZWwgYXV0aG9yaXR5IHRoYXQgaXMgYXMgaGlnaCBhcyB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3Iu DQoNCkN1cnJlbnQgaGllcmFyY2h5ICh0b3AgaGFzIG1vcmUgYXV0aG9yaXR5KQ0KDQogICAgICAg ICAgICAgIERldmljZSBBZG1pbmlzdHJhdG9yICAgICAgIC0tIGRldmljZSBhdXRob3JpdHkgZm9y IHNlY3VyaXR5LCBuZXR3b3JrLCB0cnVzdCBzZXR0aW5ncw0KICAgICAgICAgICAgICBOZXR3b3Jr IEFkbWluaXN0cmF0b3IgICAgIC0tIHByb3ZpZGVzIHJlY29tbWVuZCBuZXR3b3JrIHNldHRpbmdz IHRvIGRldmljZXMNCiAgICAgICAgICAgICAgUmVzb2x2ZXIgQWRtaW5pc3RyYXRvciAgICAtLSBj YW4gcHJvdmlkZSBmaWx0ZXJpbmcNCiAgICAgICAgICAgICAgQnJvd3NlciAgTWFrZXIgICAgICAg ICAgICAgICAtLSBwcm92aWRlcyBjb3JlIHRydXN0ZWQgY2VydGlmaWNhdGUgbGlzdA0KICAgICAg ICAgICAgICBCcm93c2VyIFVzZXIgICAgICAgICAgICAgICAgICAtLSBjYW4gc2V0IHJlbmRlcmlu ZyBvcHRpb25zLCBjYW4gbWFrZSBsaW1pdGVkIGNlcnRpZmljYXRlIGNob2ljZXMsIHBsdWdpbnMu ICDigJMgSW1wYWN0IGlzIGxpbWl0ZWQgdG8gdGhlIGJyb3dzZXIgc2FuZGJveA0KDQoNClRoZSBw cm9ibGVtIGlzIHRoYXQgc29tZSBvZiB0aGUgYnJvd3NlciBtYWtlcnMgcHJvcG9zYWxzIGFyZSBu b3cgY2hhbmdpbmcgdGhpcyBhZG1pbmlzdHJhdGl2ZSBhdXRob3JpdHkgaGllcmFyY2h5LCBidXQg dGhleSBoYXZlbuKAmXQgZG9uZSB0aGUgZXh0cmEgd29yayBvZiBlc3RhYmxpc2hpbmcgYWRtaW5p c3RyYXRpdmUgdHJ1c3QgYW5kIHdvcmtpbmcgdGhyb3VnaCB0aGUgY29uc2VxdWVuY2VzIG9mIHRo YXQgc3VjaCBhcyBhIGNoaWxkIGJlaW5nIGFibGUgdG8gY2hhbmdlIHRoZSBicm93c2VyIEROUyBz ZXR0aW5ncyBhbmQgYnlwYXNzIGJvdGggcmVzb2x2ZXIsIE5ldHdvcmssIGFuZCBldmVuIE9TIGJh c2VkIHJlc3RyaWN0aW9ucy4NCg0KU28gdGhleSBhcmUgY2hhbmdpbmcgaXQgdG86DQoNCiAgICAg ICAgICAgICAgQnJvd3NlciBNYWtlciAgICAgICAgICAgICAgICAtLSBwcm92aWRlcyBkZWZhdWx0 IEROUyByZXNvbHZlciBhbmQgRE5TIFByb3RvY29sIGNob2ljZXMuDQogICAgICAgICAgICAgIEJy b3dzZXIgVXNlciAgICAgICAgICAgICAgICAgIC0tIGNhbiBzZXQgRE5TIHJlc29sdmVyIGFuZCBE TlMgcHJvdG9jb2wNCiAgICAgICAgICAgICAgRGV2aWNlIEFkbWluaXN0cmF0b3IgICAgICAgLS0g ZGV2aWNlIGF1dGhvcml0eSBmb3Igc2VjdXJpdHksIG5ldHdvcmssIHRydXN0IHNldHRpbmdzDQog ICAgICAgICAgICAgIE5ldHdvcmsgQWRtaW5pc3RyYXRvciAgICAgLS0gcHJvdmlkZXMgcmVjb21t ZW5kIG5ldHdvcmsgc2V0dGluZ3MgdG8gZGV2aWNlcw0KICAgICAgICAgICAgICBSZXNvbHZlciBB ZG1pbmlzdHJhdG9yICAgIC0tIGNhbiBwcm92aWRlIGZpbHRlcmluZw0KDQoNCg0KVGhlIHBhdGgg dG8gZml4aW5nIHRoaXMgbWF5YmUgdG8gc2VlIGlmIHRoZXJlIGlzIGEgd2F5IHRvIGV4cHJlc3Mg dGhlIGFkbWluaXN0cmF0aXZlIGhpZXJhcmNoeSB0aGF0IHJlc3BlY3RzIHRoZSBpbnRlbnRpb25z IG9mIHRoZSBkZXZpY2UgYWRtaW5pc3RyYXRvciBvbiB3aGF0IGhpZXJhcmNoeSB0aGV5IHdhbnQg dG8gYWNjZXB0L2RlbGVnYXRlIGRlY2lzaW9ucyB0by4NCg0KSXQgbWF5YmUgdGhhdCB3aGF04oCZ cyBuZWVkZWQgaXMgYSBtZWFucyB0byBjb21tdW5pY2F0ZSB0byB0aGUgYnJvd3NlciB3aGF0IGF1 dGhvcml0eSB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3Igd2FudHMgaXQgdG8gZm9sbG93LCBzaW5j ZSBpbiB0aGUgZW5kIHRoZSBkZXZpY2Ugb3duZXIgc2hvdWxkIGJlIGluIGNoYXJnZS4NCg0KDQot Z2xlbm4NCg0K --_000_182C911959F943FAB1164D45649B74B5nbcunicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0 ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWls U3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5 OkhlbHZldGljYTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglm b250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0i Izk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2Nv bG9yOmJsYWNrIj5ISSBldmVyeW9uZSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2 ZXRpY2E7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjpibGFjayI+SeKAmXZlIGJlZW4gdGhpbmtpbmcgdGhvdWdoIHNvbWUgb2Yg dGhlIGlzc3VlcyB3aXRoIHRoZSBwcm9wb3NhbCBEb0ggZGVwbG95bWVudCBpbiBicm93c2Vycy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+QSBi aWcgcGFydCBvZiB0aGUgdHVnIG9mIHdhciBoZXJlIGlzICZuYnNwO3RoZSBhdXRob3JpdHkgcHJl Y2VkZW5jZSBmb3IgYWR2YW5jZWQgc2VjdXJpdHkgYW5kIG5ldHdvcmsgc2V0dGluZ3MgdGhhdCBz aG91bGQgYmUgZm9sbG93ZWQuJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5IaXN0b3JpY2FsbHksIGl04oCZcyBiZWVuIGF0IHRo ZSBkZXZpY2UgbGV2ZWwg4oCTIHdoaWNoIG1lYW50IHRoZSBkZXZpY2UgYWRtaW5pc3RyYXRvciwg d2hpY2ggY291bGQgY2hvb3NlIGRlbGVnYXRlIGNob2ljZXMgdG8gYSBzcGVjaWZpYyBETlMgcmVz b2x2ZXIgb3BlcmF0b3IsIG9yIHRvIHRoZSBOZXR3b3JrDQogREhDUCBwcm92aWRlZCBzZXR0aW5n cy4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2E7Y29sb3I6YmxhY2siPk5vdyB0aGUgYnJvd3NlciBpcyBzZWVraW5nIHRvIGFkZGluZyBpdHNl bGYgaW50byB0aGUgYXV0aG9yaXR5IGNoYWluIGZvciB0aG9zZSBzZXR0aW5ncy4gVGhlIHRyb3Vi bGUgYmVpbmcgdGhhdCB0aGlzIGlzIGEgbWFqb3IgY2hhbmdlIHRvIHRoZSBhZG1pbmlzdHJhdGl2 ZSB0cnVzdCBtb2RlbC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6 YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFj ayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNr Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPlRv IGRhdGUsIGJyb3dzZXIgc2V0dGluZ3MgaGF2ZSBiZWVuIGxpbWl0ZWQgdG8gcmVuZGVyaW5nIG9w dGlvbnMsIHNvbWUgYmFzaWMgY2VydGlmaWNhdGUgb3B0aW9ucywgYWRkb25zLCBhbmQgc2NyaXB0 aW5nIGxhbmd1YWdlIGNob2ljZXMuICZuYnNwOyZuYnNwOyZuYnNwO0FkdmFuY2Ugc2VjdXJpdHkg YW5kIHRydXN0IGhhcw0KIHJlbWFpbmVkIHdpdGggdGhlIGRldmljZSBhZG1pbmlzdHJhdG9yLiAm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtBZGRpbmcgdGhlIGJyb3dzZXIgdG8gdGhlIGFkbWluaXN0 cmF0aXZlIGNoYWluIHNvIHRoYXQgaXQgY2FuIGNvbnRyb2wgYWR2YW5jZWQgc2VjdXJpdHkgYW5k IG5ldHdvcmsgc2V0dGluZ3MgaW50cm9kdWNlcyBhIHByb2JsZW0gYmVjYXVzZSB0aGUgYnJvd3Nl ciBkb2VzIG5vdCBoYXZlIGFuIGFkbWluaXN0cmF0aXZlIGxldmVsIGF1dGhvcml0eSB0aGF0IGlz IGFzIGhpZ2gNCiBhcyB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3IuPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5DdXJyZW50IGhpZXJhcmNoeSAodG9wIGhhcyBtb3JlIGF1 dGhvcml0eSk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2si PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5i c3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyBEZXZpY2UgQWRtaW5pc3RyYXRvciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAtLSBkZXZpY2UgYXV0aG9yaXR5IGZvciBzZWN1cml0eSwgbmV0d29yaywg dHJ1c3Qgc2V0dGluZ3M8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6 YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFj ayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE5ldHdvcmsgQWRtaW5pc3RyYXRvciZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAtLSBwcm92aWRlcyByZWNvbW1lbmQgbmV0d29yayBzZXR0aW5ncyB0byBk ZXZpY2VzPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyBSZXNvbHZlciBBZG1pbmlzdHJhdG9yJm5ic3A7ICZuYnNwOyZuYnNw Oy0tIGNhbiBwcm92aWRlIGZpbHRlcmluZzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNh O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQnJvd3NlciAmbmJzcDtNYWtlciZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBwcm92aWRlcyBjb3JlIHRydXN0ZWQgY2VydGlm aWNhdGUgbGlzdDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtCcm93c2VyIFVzZXIgJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7LS0gY2FuIHNldCByZW5kZXJpbmcgb3B0aW9ucywg Y2FuIG1ha2UgbGltaXRlZCBjZXJ0aWZpY2F0ZSBjaG9pY2VzLCBwbHVnaW5zLiZuYnNwOyDigJMg SW1wYWN0IGlzIGxpbWl0ZWQgdG8gdGhlIGJyb3dzZXIgc2FuZGJveDwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2 ZXRpY2E7Y29sb3I6YmxhY2siPlRoZSBwcm9ibGVtIGlzIHRoYXQgc29tZSBvZiB0aGUgYnJvd3Nl ciBtYWtlcnMgcHJvcG9zYWxzIGFyZSBub3cgY2hhbmdpbmcgdGhpcyBhZG1pbmlzdHJhdGl2ZSBh dXRob3JpdHkgaGllcmFyY2h5LCBidXQgdGhleSBoYXZlbuKAmXQgZG9uZSB0aGUgZXh0cmEgd29y ayBvZiBlc3RhYmxpc2hpbmcgYWRtaW5pc3RyYXRpdmUNCiB0cnVzdCBhbmQgd29ya2luZyB0aHJv dWdoIHRoZSBjb25zZXF1ZW5jZXMgb2YgdGhhdCBzdWNoIGFzIGEgY2hpbGQgYmVpbmcgYWJsZSB0 byBjaGFuZ2UgdGhlIGJyb3dzZXIgRE5TIHNldHRpbmdzIGFuZCBieXBhc3MgYm90aCByZXNvbHZl ciwgTmV0d29yaywgYW5kIGV2ZW4gT1MgYmFzZWQgcmVzdHJpY3Rpb25zLjwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+U28gdGhleSBhcmUgY2hhbmdpbmcgaXQgdG86PC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgQnJvd3NlciBNYWtlciZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gcHJvdmlkZXMg ZGVmYXVsdCBETlMgcmVzb2x2ZXIgYW5kIEROUyBQcm90b2NvbCBjaG9pY2VzLjwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDtCcm93c2VyIFVzZXIgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7LS0gY2FuIHNldCBETlMgcmVzb2x2ZXIgYW5kIEROUyBwcm90b2NvbDwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDtEZXZpY2UgQWRtaW5pc3RyYXRvciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAtLSBkZXZpY2UgYXV0aG9yaXR5IGZvciBzZWN1cml0eSwgbmV0d29yaywgdHJ1c3Qgc2V0 dGluZ3M8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IE5ldHdvcmsgQWRtaW5pc3RyYXRvciZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAtLSBwcm92aWRlcyByZWNvbW1lbmQgbmV0d29yayBzZXR0aW5ncyB0byBkZXZpY2VzPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBSZXNvbHZlciBBZG1pbmlzdHJhdG9yJm5ic3A7ICZuYnNwOyZuYnNwOy0tIGNhbiBw cm92aWRlIGZpbHRlcmluZzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xv cjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJs YWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6Ymxh Y2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNw Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5UaGUgcGF0aCB0 byBmaXhpbmcgdGhpcyBtYXliZSB0byBzZWUgaWYgdGhlcmUgaXMgYSB3YXkgdG8gZXhwcmVzcyB0 aGUgYWRtaW5pc3RyYXRpdmUgaGllcmFyY2h5IHRoYXQgcmVzcGVjdHMgdGhlIGludGVudGlvbnMg b2YgdGhlIGRldmljZSBhZG1pbmlzdHJhdG9yIG9uIHdoYXQgaGllcmFyY2h5IHRoZXkNCiB3YW50 IHRvIGFjY2VwdC9kZWxlZ2F0ZSBkZWNpc2lvbnMgdG8uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0 aWNhO2NvbG9yOmJsYWNrIj5JdCBtYXliZSB0aGF0IHdoYXTigJlzIG5lZWRlZCBpcyBhIG1lYW5z IHRvIGNvbW11bmljYXRlIHRvIHRoZSBicm93c2VyIHdoYXQgYXV0aG9yaXR5IHRoZSBkZXZpY2Ug YWRtaW5pc3RyYXRvciB3YW50cyBpdCB0byBmb2xsb3csIHNpbmNlIGluIHRoZSBlbmQgdGhlIGRl dmljZSBvd25lciBzaG91bGQgYmUNCiBpbiBjaGFyZ2UuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0 aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtj b2xvcjpibGFjayI+LWdsZW5uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Nv bG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_182C911959F943FAB1164D45649B74B5nbcunicom_-- From nobody Fri May 24 08:55:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58CBA1202FA for ; Fri, 24 May 2019 08:55:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ritter.vg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xx-TAJJ9AUqL for ; Fri, 24 May 2019 08:55:37 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3847512008A for ; Fri, 24 May 2019 08:55:37 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id i3so9893669wml.4 for ; Fri, 24 May 2019 08:55:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=trM07rTnZ88U7h+FTB5uU6bhe6BWR6dOqOPXeagFvmc=; b=hPnkc78tePgoaPz9J/jasYsvPzR63m3+cm+oh9xLxrX+bEHXDwP2HAer5YTPzpahKn xkenEOAaAww5vm6nphYQPyE+gPMo4THKdeoEjeC9Ao4vYlpCIUb0ritFj2KUQSkgPFD3 HbZZdCG/R9WGhfycsvHIFeynIZrxXLiaL+N2Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=trM07rTnZ88U7h+FTB5uU6bhe6BWR6dOqOPXeagFvmc=; b=qHR6Q9EwS99TH9lyQT75YYVGeImFZzwk37Oifh7WwSdGVHdKe0td3EQ4yGxQ0Rf80w hWKyI5dQ2KNjRb4lWiRuOExZEHcphhok7eOsqo7hhu4fwUt/Usv6FzTT8F9TlkPOBIda Hrs1NCF9kA30rpSEN2uvm5QvQdyGEfUwDrcoO/HbRyv/VqCk2MwzckcmakV1vhtKuX5F tTFiX7KW5AzXgXzyRtzb726K1VZPXti2RRGrHo6oi4MlUbFMP5oSRDKLM0bunosL09gw 2jWKAOdP1KM3xRxj72/oTVOob4hLtQW1kB+WJ6du2QKcKur+wUsThJniSqDMhmEJWERP olcQ== X-Gm-Message-State: APjAAAVxyqBpxwxqX4Ge0YP0HiDgehIeS4BxpCQU8iy64q4tjtiRh3Gr ZSf8x1A2Ns3Q3udPZYIjPvmDvqQZ+8A7nK1c26N+Tg== X-Google-Smtp-Source: APXvYqwPMVkfqrbbDhDzX23fVHHZtidzDx29wuoQfSup28lzcy+CfqIiA5sv1NMxoh09rvptnSQBFDfTgzcHaPm5yFI= X-Received: by 2002:a1c:2109:: with SMTP id h9mr16835601wmh.68.1558713335300; Fri, 24 May 2019 08:55:35 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> From: Tom Ritter Date: Fri, 24 May 2019 10:55:23 -0500 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000a85d250589a43a98" Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 15:55:40 -0000 --000000000000a85d250589a43a98 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable What about the device administrator configuring the browser the way they want it to behave? As far as I know administratively configured browsers cannot be overridden by a local user. -tom On Fri, May 24, 2019, 9:49 AM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > HI everyone, > > > > I=E2=80=99ve been thinking though some of the issues with the proposal Do= H > deployment in browsers. > > > > A big part of the tug of war here is the authority precedence for > advanced security and network settings that should be followed. > > > > Historically, it=E2=80=99s been at the device level =E2=80=93 which meant= the device > administrator, which could choose delegate choices to a specific DNS > resolver operator, or to the Network DHCP provided settings. > > > > Now the browser is seeking to adding itself into the authority chain for > those settings. The trouble being that this is a major change to the > administrative trust model. > > > > To date, browser settings have been limited to rendering options, some > basic certificate options, addons, and scripting language choices. > Advance security and trust has remained with the device administrator. > Adding the browser to the administrative chain so that it can control > advanced security and network settings introduces a problem because the > browser does not have an administrative level authority that is as high a= s > the device administrator. > > > > Current hierarchy (top has more authority) > > > > Device Administrator -- device authority for security= , > network, trust settings > > Network Administrator -- provides recommend network > settings to devices > > Resolver Administrator -- can provide filtering > > Browser Maker -- provides core trusted > certificate list > > Browser User -- can set rendering options, > can make limited certificate choices, plugins. =E2=80=93 Impact is limit= ed to the > browser sandbox > > > > > > The problem is that some of the browser makers proposals are now changing > this administrative authority hierarchy, but they haven=E2=80=99t done th= e extra > work of establishing administrative trust and working through the > consequences of that such as a child being able to change the browser DNS > settings and bypass both resolver, Network, and even OS based restriction= s. > > > > So they are changing it to: > > > > Browser Maker -- provides default DNS > resolver and DNS Protocol choices. > > Browser User -- can set DNS resolver and > DNS protocol > > Device Administrator -- device authority for security= , > network, trust settings > > Network Administrator -- provides recommend network > settings to devices > > Resolver Administrator -- can provide filtering > > > > > > > > The path to fixing this maybe to see if there is a way to express the > administrative hierarchy that respects the intentions of the device > administrator on what hierarchy they want to accept/delegate decisions to= . > > > > It maybe that what=E2=80=99s needed is a means to communicate to the brow= ser what > authority the device administrator wants it to follow, since in the end t= he > device owner should be in charge. > > > > > > -glenn > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a85d250589a43a98 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
What about the device administrator configuring the = browser the way they want it to behave? As far as I know administratively c= onfigured browsers cannot be overridden by a local user.

-tom

On Fri, May 24, 2019, 9:49 = AM Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

HI everyone,

=C2=A0

I=E2=80=99ve been thinking though some of the issues with th= e proposal DoH deployment in browsers.

=C2=A0

A big part of the tug of war here is =C2=A0the authority pre= cedence for advanced security and network settings that should be followed.= =C2=A0=C2=A0=C2=A0=C2=A0

=C2=A0

Historically, it=E2=80=99s been at the device level =E2=80= =93 which meant the device administrator, which could choose delegate choic= es to a specific DNS resolver operator, or to the Network DHCP provided settings.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0

=C2=A0

Now the browser is seeking to adding itself into the authori= ty chain for those settings. The trouble being that this is a major change = to the administrative trust model.

=C2=A0

To date, browser settings have been limited to rendering opt= ions, some basic certificate options, addons, and scripting language choice= s. =C2=A0=C2=A0=C2=A0Advance security and trust has remained with the device administrator. =C2=A0=C2=A0=C2=A0=C2=A0Adding the= browser to the administrative chain so that it can control advanced securi= ty and network settings introduces a problem because the browser does not h= ave an administrative level authority that is as high as the device administrator.

=C2=A0

Current hierarchy (top has more authority)

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Device Administrator=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= -- device authority for security, network, trust settings

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Network Administrator=C2=A0=C2=A0=C2=A0=C2=A0 -- provide= s recommend network settings to devices

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Resolver Administrator=C2=A0 =C2=A0=C2=A0-- can provide = filtering=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Browser =C2=A0Maker=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- provides core trusted c= ertificate list<= u>

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0Browser User =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- can se= t rendering options, can make limited certificate choices, plugins.=C2=A0 = =E2=80=93 Impact is limited to the browser sandbox

=C2=A0

=C2=A0

The problem is that some of the browser makers proposals are= now changing this administrative authority hierarchy, but they haven=E2=80= =99t done the extra work of establishing administrative trust and working through the consequences of that such as a child being a= ble to change the browser DNS settings and bypass both resolver, Network, a= nd even OS based restrictions.

=C2=A0

So they are changing it to:

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Browser Maker=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- provides default DNS resolver= and DNS Protocol choices.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0Browser User =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- can se= t DNS resolver and DNS protocol

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0Device Administrator=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 -- device authority for security, network, trust settings

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Network Administrator=C2=A0=C2=A0=C2=A0=C2=A0 -- provide= s recommend network settings to devices

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Resolver Administrator=C2=A0 =C2=A0=C2=A0-- can provide = filtering=

=C2=A0

=C2=A0

=C2=A0

The path to fixing this maybe to see if there is a way to ex= press the administrative hierarchy that respects the intentions of the devi= ce administrator on what hierarchy they want to accept/delegate decisions to.

=C2=A0

It maybe that what=E2=80=99s needed is a means to communicat= e to the browser what authority the device administrator wants it to follow= , since in the end the device owner should be in charge.

=C2=A0

=C2=A0

-glenn

=C2=A0

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo= /add
--000000000000a85d250589a43a98-- From nobody Fri May 24 08:57:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AAC21202E4 for ; Fri, 24 May 2019 08:57:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eaPMhJIMUlJK for ; Fri, 24 May 2019 08:57:51 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECA3412016F for ; Fri, 24 May 2019 08:57:50 -0700 (PDT) Received: from [172.17.0.10] (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x4OFvnbJ022239 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 24 May 2019 10:57:50 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1558713470; bh=MVZmxJpLYVT78hXYPAFMJNrSAffpZNuLrP6Swb6LqW0=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=itvxXVPVIpKsA2zDH0B9f8tMurvXWa/+N8R2lcTN0XUwdbRK5XQdERAtRiTvZZb/f IaqAPwA1qwDO6hmigLKllW5Sk4X8a1YjcJJ/gGDxfc98xQZjJnHiCUdnG6IVkaTQg/ Icn3FB3lbhVBjqCNy8agTCp7c9ymgm3iMMFn/RW0= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be [172.17.0.10] Content-Type: multipart/alternative; boundary=Apple-Mail-DFFE2BAF-9866-4BAA-A591-BF4AAB6878EA Mime-Version: 1.0 (1.0) From: Adam Roach X-Mailer: iPhone Mail (16E227) In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> Date: Fri, 24 May 2019 10:57:43 -0500 Cc: "add@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> To: "Deen, Glenn (NBCUniversal)" Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 15:57:53 -0000 --Apple-Mail-DFFE2BAF-9866-4BAA-A591-BF4AAB6878EA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This is called =E2=80=9Centerprise policy=E2=80=9D, and =E2=80=94 as far as I= know =E2=80=94 all major browsers honor it.=20 See, e.g., https://support.mozilla.org/en-US/products/firefox-enterprise/pol= icies-customization-enterprise/policies-overview-enterprise /a > On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) wrote: >=20 > HI everyone, > =20 > I=E2=80=99ve been thinking though some of the issues with the proposal DoH= deployment in browsers. > =20 > A big part of the tug of war here is the authority precedence for advance= d security and network settings that should be followed. =20 > =20 > Historically, it=E2=80=99s been at the device level =E2=80=93 which meant t= he device administrator, which could choose delegate choices to a specific D= NS resolver operator, or to the Network DHCP provided settings. =20 > =20 > Now the browser is seeking to adding itself into the authority chain for t= hose settings. The trouble being that this is a major change to the administ= rative trust model. > =20 > To date, browser settings have been limited to rendering options, some bas= ic certificate options, addons, and scripting language choices. Advance s= ecurity and trust has remained with the device administrator. Adding the= browser to the administrative chain so that it can control advanced securit= y and network settings introduces a problem because the browser does not hav= e an administrative level authority that is as high as the device administra= tor. > =20 > Current hierarchy (top has more authority) > =20 > Device Administrator -- device authority for security,= network, trust settings > Network Administrator -- provides recommend network sett= ings to devices > Resolver Administrator -- can provide filtering > Browser Maker -- provides core trusted certif= icate list > Browser User -- can set rendering options, c= an make limited certificate choices, plugins. =E2=80=93 Impact is limited t= o the browser sandbox > =20 > =20 > The problem is that some of the browser makers proposals are now changing t= his administrative authority hierarchy, but they haven=E2=80=99t done the ex= tra work of establishing administrative trust and working through the conseq= uences of that such as a child being able to change the browser DNS settings= and bypass both resolver, Network, and even OS based restrictions. > =20 > So they are changing it to: > =20 > Browser Maker -- provides default DNS resolve= r and DNS Protocol choices. > Browser User -- can set DNS resolver and DN= S protocol > Device Administrator -- device authority for security,= network, trust settings > Network Administrator -- provides recommend network sett= ings to devices > Resolver Administrator -- can provide filtering > =20 > =20 > =20 > The path to fixing this maybe to see if there is a way to express the admi= nistrative hierarchy that respects the intentions of the device administrato= r on what hierarchy they want to accept/delegate decisions to. > =20 > It maybe that what=E2=80=99s needed is a means to communicate to the brows= er what authority the device administrator wants it to follow, since in the e= nd the device owner should be in charge. > =20 > =20 > -glenn > =20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-DFFE2BAF-9866-4BAA-A591-BF4AAB6878EA Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Thi= s is called =E2=80=9Centerprise policy=E2=80=9D, and =E2=80=94 as far as I k= now =E2=80=94 all major browsers honor it. 

<= /div>
See, e.g., https://support.mozilla.org/en-US/products/firefox-en= terprise/policies-customization-enterprise/policies-overview-enterprise<= /div>

/a
On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

<= blockquote type=3D"cite">

HI everyone,

 

I=E2=80=99ve been thinking though some of the issues with the p= roposal DoH deployment in browsers.

 

A big part of the tug of war here is  the authority prece= dence for advanced security and network settings that should be followed.&nb= sp;   

 

Historically, it=E2=80=99s been at the device level =E2=80=93 w= hich meant the device administrator, which could choose delegate choices to a= specific DNS resolver operator, or to the Network DHCP provided settings.     

 

Now the browser is seeking to adding itself into the authority= chain for those settings. The trouble being that this is a major change to t= he administrative trust model.

 

To date, browser settings have been limited to rendering optio= ns, some basic certificate options, addons, and scripting language choices. &= nbsp;  Advance security and trust has remained with the device administrator.     Adding the b= rowser to the administrative chain so that it can control advanced security a= nd network settings introduces a problem because the browser does not have a= n administrative level authority that is as high as the device administrator.

 

Current hierarchy (top has more authority)

 

          &n= bsp;   Device Administrator       --= device authority for security, network, trust settings

          &n= bsp;   Network Administrator     -- provides r= ecommend network settings to devices

          &n= bsp;   Resolver Administrator    -- can provide fil= tering=

          &n= bsp;   Browser  Maker      &nbs= p;        -- provides core trusted certif= icate list

          &n= bsp;   Browser User        = ;          -- can set rend= ering options, can make limited certificate choices, plugins.  =E2=80=93= Impact is limited to the browser sandbox

 

 

The problem is that some of the browser makers proposals are n= ow changing this administrative authority hierarchy, but they haven=E2=80=99= t done the extra work of establishing administrative trust and working through the consequences of that such as a child being ab= le to change the browser DNS settings and bypass both resolver, Network, and= even OS based restrictions.

 

So they are changing it to:

 

          &n= bsp;   Browser Maker        &nb= sp;       -- provides default DNS resolver and= DNS Protocol choices.

          &n= bsp;   Browser User        = ;          -- can set DNS r= esolver and DNS protocol=

          &n= bsp;   Device Administrator     &nbs= p; -- device authority for security, network, trust settings

          &n= bsp;   Network Administrator     -- provides r= ecommend network settings to devices

          &n= bsp;   Resolver Administrator    -- can provide fil= tering=

 

 

 

The path to fixing this maybe to see if there is a way to expr= ess the administrative hierarchy that respects the intentions of the device a= dministrator on what hierarchy they want to accept/delegate decisions to.

 

It maybe that what=E2=80=99s needed is a means to communicate t= o the browser what authority the device administrator wants it to follow, si= nce in the end the device owner should be in charge.

 

 

-glenn

 

= --Apple-Mail-DFFE2BAF-9866-4BAA-A591-BF4AAB6878EA-- From nobody Fri May 24 09:57:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E71481201CF for ; Fri, 24 May 2019 09:57:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w95CpiqUep6j for ; Fri, 24 May 2019 09:57:01 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9EED120186 for ; Fri, 24 May 2019 09:57:00 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 5F6736A30C; Fri, 24 May 2019 18:56:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1558717017; bh=HwVOkrq8suDg7Z0yd+f+ONwwMlxz28L8r7nbRqxsF8I=; h=From:Subject:Date:References:To:In-Reply-To:Cc:From; b=qo2HMaSJ/Znv0b1Rluy7R5JImiomifOiGl9icmsRsIg5mMid/G6+BU0NzCso759x6 cw//k8Aopl8yMn7CQmfYgD31M9sY6rjwDiuI6ZvsbnrVZ2ykzLSvRa3ctj2O6IFndK ytaoUTIwAz3hNAXZxrToOkf6NKSX94+amnNJakUluJmudHcpa05UnPrDUvJoHSwv8o F2aREdLCO3k5E3PvtoqP7yWtjsMWNs5Nb1zcOROmIW8YWjdo6xkkRWAsvrvI/kbGRM rMcIHL4syHYsG+nq4z9SAFR1sBf7zpMz/ReBt1df1IOuyruyEEnpgZEaiaf3Pw89fn cDRWxw9HmsnMQ== Received: from appsuite-gw4.open-xchange.com (appsuite-gw4.open-xchange.com [10.20.28.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4C0603C0316; Fri, 24 May 2019 18:56:57 +0200 (CEST) X-Header: Open-Xchange USM Mailer (USM Version: 7.10.2-2, EAS Version: 7.10.2-1, Build d17f7426766e7d3851e61d3f8794f10d65e74221) Content-Type: multipart/alternative; boundary=Apple-Mail-55556EB4-B3CB-404E-9A8D-EF7E8305FD03 Content-Transfer-Encoding: 7bit From: "Cook, Neil" Mime-Version: 1.0 Message-ID: <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> Date: Fri, 24 May 2019 17:56:56 +0100 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> To: Adam Roach In-Reply-To: <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> Cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" X-Mailer: Open-Xchange Mailer v7.10.2-Rev4 X-Originating-Client: USM-EAS Autocrypt: addr=neil.cook@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFY4uCMBCACanbgJRs8WrxZZmtPZEe1xEEaVXz2g4rs6H898mQ2bsSa3NmeyfHrY/C7cy9iVpOE Al5GQBmKnTx0mYe0Fm8KZYBh895lpGz1OkV8z4N+7fvYpkeiYSUrwmdxGyWm4/Ol4rWieBXUqSpQl1a O9dRC9YUDx6wE2kvUcT35y9PpsYOgZvmzNZ61NsQNemLeVnWCk2dWvF8BC63vRPzKNnnS1KSj7yY12X FiVFqyuuWC4U0w8xgmkw1QEGXi9lEjnq5nh2LP3+MhSS0SQUg4K/NQEFXxoe4Yi9WghC37Yfl58EGxy JSGNHruwJuHTTWjC0xPN6tL/iEg2u8wy7blFSqAlABEBAAG0J0Nvb2ssIE5laWwgPG5laWwuY29va0B vcGVuLXhjaGFuZ2UuY29tPokBQAQTAQIAKgQLCQgHBhUIAgkKCwUWAgMBAAKeAQIbAwWJEswDAAUDAA AAAAWCVji4IwAKCRCqPocTiyIWJ8ifB/4r81q323KtGT/g3UpKXd+WIo5g6P5LRvaHcY0gWaT9RbRlg JfvbjXN2oY9HFE0PQBPpFozBvEVe9dtt0MROW5wWRygntyI5ROvEsD9I91xOIqcrEBpkCEFFeyqbq8+ +Yw5k8+IFIEFduopookBbmO3/gbMxkXFJ/cIh+OUWCIxV/kphlgJCGavwJq00Zo42SzMF42u5C63yHn kfT6zSQU0Y9z26FW/tyq6O1eI9aUAcaiMxLCAyR8pD+Dl8jaFPxbS7hyAk3srrA9dXvuL3mw4w6uEiW FUkuZ6onolSXQhZCUQ6+7y51f2XfbEH/gwWl8uDMc6IlunyZPZljvzEx9buQENBFY4uCMBCACbgNhut /V5nDmAh1sD1fyg1NBK8/NBuv24HhrdlEYuupU0ByS5Y4qhi+8ptu7d5vYNgGTbptZuob8Y4QEZS1BR EI7shZozYjsJjSzmHtnM+A+G0dSsXCaSKoTppsYL67sM1Cs5goZjsHnbIXDJi8SuvXtnTYxgxgGPLpU Rtci4LGKYksGEGy7q+hGvMA3KNSSZAu1OOwwLE71/E12VgXWWW7NuaJs67qLBtXcc3XiyEn2tCHdyTx yIl8ucMieNhkZt0jAkXgH+wAV71OyrjHBOWdsm+giHH70aLeZyz+x5D+FEOgh3inwYnIXASdwEDXT+2 lb+IbqjLhkYx7MoKfajABEBAAGJATEEGAECABsFAlY4uCMCGwwECwkIBwYVCAIJCgsFCRLMAwAACgkQ qj6HE4siFid2cQf9G6sstAGA9CBNOWujVe/8YEFYNOSut5upwIRe50/GcBhEoh6p6sMIesaGEwsvwyh V212cpXyi7pLO//jN+swOjVGazz68CRyFLAx8Z6Uyyp5kbj/tnlC5mqoa6KZL36VZTNF3ow0fEm5qNq VD59BxCpOei8r9mMeM4b7rji0lBJC3f6d5hZos9xmCx9Z6ynvWM8nD/bk6XMUKTUEuXr0ESMTkSIXUe O2RYsDHHyrkolWfrJ3npSFaZ4YI7/vSfsTVKgbcVqGZ7Oz3cGeR4vT+9V2MySL9dJr5TFmubPxCVzyw iFyqDh51hDl/oTgzn0OJ2A98hvdCWJODbATdQzExVQ== Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 16:57:04 -0000 --Apple-Mail-55556EB4-B3CB-404E-9A8D-EF7E8305FD03 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 R2xlbm7igJlzIHBvaW50IGlzIG5vdCBqdXN0IGFib3V0IGVudGVycHJpc2VzLiBJdCBhcHBsaWVz IHRvIGNvbnN1bWVyIHVzZSBjYXNlcyBhcyB3ZWxsLg0KDQpOZWlsDQoNClNlbnQgZnJvbSBteSBp UGhvbmUNCg0KPiBPbiAyNCBNYXkgMjAxOSwgYXQgMTY6NTgsIEFkYW0gUm9hY2ggPGFkYW1Abm9z dHJ1bS5jb20+IHdyb3RlOg0KPiANCj4gVGhpcyBpcyBjYWxsZWQg4oCcZW50ZXJwcmlzZSBwb2xp Y3nigJ0sIGFuZCDigJQgYXMgZmFyIGFzIEkga25vdyDigJQgYWxsIG1ham9yIGJyb3dzZXJzIGhv bm9yIGl0LiANCj4gDQo+IFNlZSwgZS5nLiwgaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2Vu LVVTL3Byb2R1Y3RzL2ZpcmVmb3gtZW50ZXJwcmlzZS9wb2xpY2llcy1jdXN0b21pemF0aW9uLWVu dGVycHJpc2UvcG9saWNpZXMtb3ZlcnZpZXctZW50ZXJwcmlzZQ0KPiANCj4gL2ENCj4gDQo+PiBP biBNYXkgMjQsIDIwMTksIGF0IDA5OjQ4LCBEZWVuLCBHbGVubiAoTkJDVW5pdmVyc2FsKSA8R2xl bm4uRGVlbkBuYmN1bmkuY29tPiB3cm90ZToNCj4+IA0KPj4gSEkgZXZlcnlvbmUsDQo+PiAgDQo+ PiBJ4oCZdmUgYmVlbiB0aGlua2luZyB0aG91Z2ggc29tZSBvZiB0aGUgaXNzdWVzIHdpdGggdGhl IHByb3Bvc2FsIERvSCBkZXBsb3ltZW50IGluIGJyb3dzZXJzLg0KPj4gIA0KPj4gQSBiaWcgcGFy dCBvZiB0aGUgdHVnIG9mIHdhciBoZXJlIGlzICB0aGUgYXV0aG9yaXR5IHByZWNlZGVuY2UgZm9y IGFkdmFuY2VkIHNlY3VyaXR5IGFuZCBuZXR3b3JrIHNldHRpbmdzIHRoYXQgc2hvdWxkIGJlIGZv bGxvd2VkLiAgICANCj4+ICANCj4+IEhpc3RvcmljYWxseSwgaXTigJlzIGJlZW4gYXQgdGhlIGRl dmljZSBsZXZlbCDigJMgd2hpY2ggbWVhbnQgdGhlIGRldmljZSBhZG1pbmlzdHJhdG9yLCB3aGlj aCBjb3VsZCBjaG9vc2UgZGVsZWdhdGUgY2hvaWNlcyB0byBhIHNwZWNpZmljIEROUyByZXNvbHZl ciBvcGVyYXRvciwgb3IgdG8gdGhlIE5ldHdvcmsgREhDUCBwcm92aWRlZCBzZXR0aW5ncy4gICAg IA0KPj4gIA0KPj4gTm93IHRoZSBicm93c2VyIGlzIHNlZWtpbmcgdG8gYWRkaW5nIGl0c2VsZiBp bnRvIHRoZSBhdXRob3JpdHkgY2hhaW4gZm9yIHRob3NlIHNldHRpbmdzLiBUaGUgdHJvdWJsZSBi ZWluZyB0aGF0IHRoaXMgaXMgYSBtYWpvciBjaGFuZ2UgdG8gdGhlIGFkbWluaXN0cmF0aXZlIHRy dXN0IG1vZGVsLg0KPj4gIA0KPj4gVG8gZGF0ZSwgYnJvd3NlciBzZXR0aW5ncyBoYXZlIGJlZW4g bGltaXRlZCB0byByZW5kZXJpbmcgb3B0aW9ucywgc29tZSBiYXNpYyBjZXJ0aWZpY2F0ZSBvcHRp b25zLCBhZGRvbnMsIGFuZCBzY3JpcHRpbmcgbGFuZ3VhZ2UgY2hvaWNlcy4gICAgQWR2YW5jZSBz ZWN1cml0eSBhbmQgdHJ1c3QgaGFzIHJlbWFpbmVkIHdpdGggdGhlIGRldmljZSBhZG1pbmlzdHJh dG9yLiAgICAgQWRkaW5nIHRoZSBicm93c2VyIHRvIHRoZSBhZG1pbmlzdHJhdGl2ZSBjaGFpbiBz byB0aGF0IGl0IGNhbiBjb250cm9sIGFkdmFuY2VkIHNlY3VyaXR5IGFuZCBuZXR3b3JrIHNldHRp bmdzIGludHJvZHVjZXMgYSBwcm9ibGVtIGJlY2F1c2UgdGhlIGJyb3dzZXIgZG9lcyBub3QgaGF2 ZSBhbiBhZG1pbmlzdHJhdGl2ZSBsZXZlbCBhdXRob3JpdHkgdGhhdCBpcyBhcyBoaWdoIGFzIHRo ZSBkZXZpY2UgYWRtaW5pc3RyYXRvci4NCj4+ICANCj4+IEN1cnJlbnQgaGllcmFyY2h5ICh0b3Ag aGFzIG1vcmUgYXV0aG9yaXR5KQ0KPj4gIA0KPj4gICAgICAgICAgICAgICBEZXZpY2UgQWRtaW5p c3RyYXRvciAgICAgICAtLSBkZXZpY2UgYXV0aG9yaXR5IGZvciBzZWN1cml0eSwgbmV0d29yaywg dHJ1c3Qgc2V0dGluZ3MNCj4+ICAgICAgICAgICAgICAgTmV0d29yayBBZG1pbmlzdHJhdG9yICAg ICAtLSBwcm92aWRlcyByZWNvbW1lbmQgbmV0d29yayBzZXR0aW5ncyB0byBkZXZpY2VzDQo+PiAg ICAgICAgICAgICAgIFJlc29sdmVyIEFkbWluaXN0cmF0b3IgICAgLS0gY2FuIHByb3ZpZGUgZmls dGVyaW5nDQo+PiAgICAgICAgICAgICAgIEJyb3dzZXIgIE1ha2VyICAgICAgICAgICAgICAgLS0g cHJvdmlkZXMgY29yZSB0cnVzdGVkIGNlcnRpZmljYXRlIGxpc3QNCj4+ICAgICAgICAgICAgICAg QnJvd3NlciBVc2VyICAgICAgICAgICAgICAgICAgLS0gY2FuIHNldCByZW5kZXJpbmcgb3B0aW9u cywgY2FuIG1ha2UgbGltaXRlZCBjZXJ0aWZpY2F0ZSBjaG9pY2VzLCBwbHVnaW5zLiAg4oCTIElt cGFjdCBpcyBsaW1pdGVkIHRvIHRoZSBicm93c2VyIHNhbmRib3gNCj4+ICANCj4+ICANCj4+IFRo ZSBwcm9ibGVtIGlzIHRoYXQgc29tZSBvZiB0aGUgYnJvd3NlciBtYWtlcnMgcHJvcG9zYWxzIGFy ZSBub3cgY2hhbmdpbmcgdGhpcyBhZG1pbmlzdHJhdGl2ZSBhdXRob3JpdHkgaGllcmFyY2h5LCBi dXQgdGhleSBoYXZlbuKAmXQgZG9uZSB0aGUgZXh0cmEgd29yayBvZiBlc3RhYmxpc2hpbmcgYWRt aW5pc3RyYXRpdmUgdHJ1c3QgYW5kIHdvcmtpbmcgdGhyb3VnaCB0aGUgY29uc2VxdWVuY2VzIG9m IHRoYXQgc3VjaCBhcyBhIGNoaWxkIGJlaW5nIGFibGUgdG8gY2hhbmdlIHRoZSBicm93c2VyIERO UyBzZXR0aW5ncyBhbmQgYnlwYXNzIGJvdGggcmVzb2x2ZXIsIE5ldHdvcmssIGFuZCBldmVuIE9T IGJhc2VkIHJlc3RyaWN0aW9ucy4NCj4+ICANCj4+IFNvIHRoZXkgYXJlIGNoYW5naW5nIGl0IHRv Og0KPj4gIA0KPj4gICAgICAgICAgICAgICBCcm93c2VyIE1ha2VyICAgICAgICAgICAgICAgIC0t IHByb3ZpZGVzIGRlZmF1bHQgRE5TIHJlc29sdmVyIGFuZCBETlMgUHJvdG9jb2wgY2hvaWNlcy4N Cj4+ICAgICAgICAgICAgICAgQnJvd3NlciBVc2VyICAgICAgICAgICAgICAgICAgLS0gY2FuIHNl dCBETlMgcmVzb2x2ZXIgYW5kIEROUyBwcm90b2NvbA0KPj4gICAgICAgICAgICAgICBEZXZpY2Ug QWRtaW5pc3RyYXRvciAgICAgICAtLSBkZXZpY2UgYXV0aG9yaXR5IGZvciBzZWN1cml0eSwgbmV0 d29yaywgdHJ1c3Qgc2V0dGluZ3MNCj4+ICAgICAgICAgICAgICAgTmV0d29yayBBZG1pbmlzdHJh dG9yICAgICAtLSBwcm92aWRlcyByZWNvbW1lbmQgbmV0d29yayBzZXR0aW5ncyB0byBkZXZpY2Vz DQo+PiAgICAgICAgICAgICAgIFJlc29sdmVyIEFkbWluaXN0cmF0b3IgICAgLS0gY2FuIHByb3Zp ZGUgZmlsdGVyaW5nDQo+PiAgDQo+PiAgDQo+PiAgDQo+PiBUaGUgcGF0aCB0byBmaXhpbmcgdGhp cyBtYXliZSB0byBzZWUgaWYgdGhlcmUgaXMgYSB3YXkgdG8gZXhwcmVzcyB0aGUgYWRtaW5pc3Ry YXRpdmUgaGllcmFyY2h5IHRoYXQgcmVzcGVjdHMgdGhlIGludGVudGlvbnMgb2YgdGhlIGRldmlj ZSBhZG1pbmlzdHJhdG9yIG9uIHdoYXQgaGllcmFyY2h5IHRoZXkgd2FudCB0byBhY2NlcHQvZGVs ZWdhdGUgZGVjaXNpb25zIHRvLg0KPj4gIA0KPj4gSXQgbWF5YmUgdGhhdCB3aGF04oCZcyBuZWVk ZWQgaXMgYSBtZWFucyB0byBjb21tdW5pY2F0ZSB0byB0aGUgYnJvd3NlciB3aGF0IGF1dGhvcml0 eSB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3Igd2FudHMgaXQgdG8gZm9sbG93LCBzaW5jZSBpbiB0 aGUgZW5kIHRoZSBkZXZpY2Ugb3duZXIgc2hvdWxkIGJlIGluIGNoYXJnZS4NCj4+ICANCj4+ICAN Cj4+IC1nbGVubg0KPj4gIA0KPj4gLS0gDQo+PiBBZGQgbWFpbGluZyBsaXN0DQo+PiBBZGRAaWV0 Zi5vcmcNCj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkDQo+IC0t IA0KPiBBZGQgbWFpbGluZyBsaXN0DQo+IEFkZEBpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZA0K --Apple-Mail-55556EB4-B3CB-404E-9A8D-EF7E8305FD03 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPkdsZW5u4oCZcyBw b2ludCBpcyBub3QganVzdCBhYm91dCBlbnRlcnByaXNlcy4gSXQgYXBwbGllcyB0byBjb25zdW1l ciB1c2UgY2FzZXMgYXMgd2VsbC48ZGl2Pjxicj48L2Rpdj48ZGl2Pk5laWw8YnI+PGJyPjxkaXYg aWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSIgZGlyPSJsdHIiPlNlbnQgZnJvbSBteSBpUGhvbmU8L2Rp dj48ZGl2IGRpcj0ibHRyIj48YnI+T24gMjQgTWF5IDIwMTksIGF0IDE2OjU4LCBBZGFtIFJvYWNo ICZsdDs8YSBocmVmPSJtYWlsdG86YWRhbUBub3N0cnVtLmNvbSI+YWRhbUBub3N0cnVtLmNvbTwv YT4mZ3Q7IHdyb3RlOjxicj48YnI+PC9kaXY+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdiBk aXI9Imx0ciI+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0L2h0 bWw7IGNoYXJzZXQ9dXRmLTgiPjxkaXYgZGlyPSJsdHIiPjwvZGl2PjxkaXYgZGlyPSJsdHIiPlRo aXMgaXMgY2FsbGVkIOKAnGVudGVycHJpc2UgcG9saWN54oCdLCBhbmQg4oCUIGFzIGZhciBhcyBJ IGtub3cg4oCUIGFsbCBtYWpvciBicm93c2VycyBob25vciBpdC4mbmJzcDs8L2Rpdj48ZGl2IGRp cj0ibHRyIj48YnI+PC9kaXY+PGRpdiBkaXI9Imx0ciI+U2VlLCBlLmcuLCZuYnNwOzxhIGhyZWY9 Imh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZy9lbi1VUy9wcm9kdWN0cy9maXJlZm94LWVudGVy cHJpc2UvcG9saWNpZXMtY3VzdG9taXphdGlvbi1lbnRlcnByaXNlL3BvbGljaWVzLW92ZXJ2aWV3 LWVudGVycHJpc2UiPmh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZy9lbi1VUy9wcm9kdWN0cy9m aXJlZm94LWVudGVycHJpc2UvcG9saWNpZXMtY3VzdG9taXphdGlvbi1lbnRlcnByaXNlL3BvbGlj aWVzLW92ZXJ2aWV3LWVudGVycHJpc2U8L2E+PC9kaXY+PGRpdiBkaXI9Imx0ciI+PGJyPjwvZGl2 PjxkaXYgZGlyPSJsdHIiPi9hPC9kaXY+PGRpdiBkaXI9Imx0ciI+PGJyPk9uIE1heSAyNCwgMjAx OSwgYXQgMDk6NDgsIERlZW4sIEdsZW5uIChOQkNVbml2ZXJzYWwpICZsdDs8YSBocmVmPSJtYWls dG86R2xlbm4uRGVlbkBuYmN1bmkuY29tIj5HbGVubi5EZWVuQG5iY3VuaS5jb208L2E+Jmd0OyB3 cm90ZTo8YnI+PGJyPjwvZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXYgZGlyPSJsdHIi Pg0KDQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg Y2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9Ik1pY3Jvc29m dCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQovKiBGb250IERlZmlu aXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2Ut MTowIDAgMCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJy aWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIFwoQm9keSBDU1wpIjsN CglwYW5vc2UtMToyIDIgNiAzIDUgNCA1IDIgMyA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNv bXBvc2U7DQoJZm9udC1mYW1pbHk6SGVsdmV0aWNhOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9u dC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCi4uTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX b3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCg0KDQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5ISSBldmVyeW9uZSw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+SeKAmXZlIGJlZW4gdGhp bmtpbmcgdGhvdWdoIHNvbWUgb2YgdGhlIGlzc3VlcyB3aXRoIHRoZSBwcm9wb3NhbCBEb0ggZGVw bG95bWVudCBpbiBicm93c2Vycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2E7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZl dGljYTtjb2xvcjpibGFjayI+QSBiaWcgcGFydCBvZiB0aGUgdHVnIG9mIHdhciBoZXJlIGlzICZu YnNwO3RoZSBhdXRob3JpdHkgcHJlY2VkZW5jZSBmb3IgYWR2YW5jZWQgc2VjdXJpdHkgYW5kIG5l dHdvcmsgc2V0dGluZ3MgdGhhdCBzaG91bGQgYmUgZm9sbG93ZWQuJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNw Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5IaXN0b3JpY2Fs bHksIGl04oCZcyBiZWVuIGF0IHRoZSBkZXZpY2UgbGV2ZWwg4oCTIHdoaWNoIG1lYW50IHRoZSBk ZXZpY2UgYWRtaW5pc3RyYXRvciwgd2hpY2ggY291bGQgY2hvb3NlIGRlbGVnYXRlIGNob2ljZXMg dG8gYSBzcGVjaWZpYyBETlMgcmVzb2x2ZXIgb3BlcmF0b3IsIG9yIHRvIHRoZSBOZXR3b3JrDQog REhDUCBwcm92aWRlZCBzZXR0aW5ncy4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPk5vdyB0aGUgYnJvd3NlciBpcyBz ZWVraW5nIHRvIGFkZGluZyBpdHNlbGYgaW50byB0aGUgYXV0aG9yaXR5IGNoYWluIGZvciB0aG9z ZSBzZXR0aW5ncy4gVGhlIHRyb3VibGUgYmVpbmcgdGhhdCB0aGlzIGlzIGEgbWFqb3IgY2hhbmdl IHRvIHRoZSBhZG1pbmlzdHJhdGl2ZSB0cnVzdCBtb2RlbC48L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2 ZXRpY2E7Y29sb3I6YmxhY2siPlRvIGRhdGUsIGJyb3dzZXIgc2V0dGluZ3MgaGF2ZSBiZWVuIGxp bWl0ZWQgdG8gcmVuZGVyaW5nIG9wdGlvbnMsIHNvbWUgYmFzaWMgY2VydGlmaWNhdGUgb3B0aW9u cywgYWRkb25zLCBhbmQgc2NyaXB0aW5nIGxhbmd1YWdlIGNob2ljZXMuICZuYnNwOyZuYnNwOyZu YnNwO0FkdmFuY2Ugc2VjdXJpdHkgYW5kIHRydXN0IGhhcw0KIHJlbWFpbmVkIHdpdGggdGhlIGRl dmljZSBhZG1pbmlzdHJhdG9yLiAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtBZGRpbmcgdGhlIGJy b3dzZXIgdG8gdGhlIGFkbWluaXN0cmF0aXZlIGNoYWluIHNvIHRoYXQgaXQgY2FuIGNvbnRyb2wg YWR2YW5jZWQgc2VjdXJpdHkgYW5kIG5ldHdvcmsgc2V0dGluZ3MgaW50cm9kdWNlcyBhIHByb2Js ZW0gYmVjYXVzZSB0aGUgYnJvd3NlciBkb2VzIG5vdCBoYXZlIGFuIGFkbWluaXN0cmF0aXZlIGxl dmVsIGF1dGhvcml0eSB0aGF0IGlzIGFzIGhpZ2gNCiBhcyB0aGUgZGV2aWNlIGFkbWluaXN0cmF0 b3IuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5DdXJyZW50IGhpZXJh cmNoeSAodG9wIGhhcyBtb3JlIGF1dGhvcml0eSk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZl dGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7 Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBEZXZpY2UgQWRtaW5pc3RyYXRvciZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBkZXZpY2UgYXV0aG9yaXR5IGZv ciBzZWN1cml0eSwgbmV0d29yaywgdHJ1c3Qgc2V0dGluZ3M8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE5ldHdvcmsgQWRt aW5pc3RyYXRvciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBwcm92aWRlcyByZWNvbW1lbmQg bmV0d29yayBzZXR0aW5ncyB0byBkZXZpY2VzPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2E7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBSZXNvbHZlciBBZG1pbmlzdHJh dG9yJm5ic3A7ICZuYnNwOyZuYnNwOy0tIGNhbiBwcm92aWRlIGZpbHRlcmluZzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg QnJvd3NlciAmbmJzcDtNYWtlciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBwcm92aWRl cyBjb3JlIHRydXN0ZWQgY2VydGlmaWNhdGUgbGlzdDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtCcm93c2VyIFVz ZXIgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7LS0gY2FuIHNl dCByZW5kZXJpbmcgb3B0aW9ucywgY2FuIG1ha2UgbGltaXRlZCBjZXJ0aWZpY2F0ZSBjaG9pY2Vz LCBwbHVnaW5zLiZuYnNwOyDigJMgSW1wYWN0IGlzIGxpbWl0ZWQgdG8gdGhlIGJyb3dzZXIgc2Fu ZGJveDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPlRoZSBwcm9ibGVtIGlzIHRo YXQgc29tZSBvZiB0aGUgYnJvd3NlciBtYWtlcnMgcHJvcG9zYWxzIGFyZSBub3cgY2hhbmdpbmcg dGhpcyBhZG1pbmlzdHJhdGl2ZSBhdXRob3JpdHkgaGllcmFyY2h5LCBidXQgdGhleSBoYXZlbuKA mXQgZG9uZSB0aGUgZXh0cmEgd29yayBvZiBlc3RhYmxpc2hpbmcgYWRtaW5pc3RyYXRpdmUNCiB0 cnVzdCBhbmQgd29ya2luZyB0aHJvdWdoIHRoZSBjb25zZXF1ZW5jZXMgb2YgdGhhdCBzdWNoIGFz IGEgY2hpbGQgYmVpbmcgYWJsZSB0byBjaGFuZ2UgdGhlIGJyb3dzZXIgRE5TIHNldHRpbmdzIGFu ZCBieXBhc3MgYm90aCByZXNvbHZlciwgTmV0d29yaywgYW5kIGV2ZW4gT1MgYmFzZWQgcmVzdHJp Y3Rpb25zLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJz cDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+U28gdGhleSBh cmUgY2hhbmdpbmcgaXQgdG86PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Nv bG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6 YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpi bGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNr Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQnJvd3NlciBNYWtlciZuYnNwOyAmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgLS0gcHJvdmlkZXMgZGVmYXVsdCBETlMgcmVzb2x2ZXIgYW5kIEROUyBQcm90b2Nv bCBjaG9pY2VzLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtCcm93c2VyIFVzZXIgJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7LS0gY2FuIHNldCBETlMgcmVzb2x2ZXIgYW5kIERO UyBwcm90b2NvbDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtEZXZpY2UgQWRtaW5pc3RyYXRvciZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBkZXZpY2UgYXV0aG9yaXR5IGZvciBzZWN1cml0 eSwgbmV0d29yaywgdHJ1c3Qgc2V0dGluZ3M8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YTtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE5ldHdvcmsgQWRtaW5pc3RyYXRv ciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBwcm92aWRlcyByZWNvbW1lbmQgbmV0d29yayBz ZXR0aW5ncyB0byBkZXZpY2VzPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Nv bG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6 YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBSZXNvbHZlciBBZG1pbmlzdHJhdG9yJm5ic3A7 ICZuYnNwOyZuYnNwOy0tIGNhbiBwcm92aWRlIGZpbHRlcmluZzwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2Nv bG9yOmJsYWNrIj5UaGUgcGF0aCB0byBmaXhpbmcgdGhpcyBtYXliZSB0byBzZWUgaWYgdGhlcmUg aXMgYSB3YXkgdG8gZXhwcmVzcyB0aGUgYWRtaW5pc3RyYXRpdmUgaGllcmFyY2h5IHRoYXQgcmVz cGVjdHMgdGhlIGludGVudGlvbnMgb2YgdGhlIGRldmljZSBhZG1pbmlzdHJhdG9yIG9uIHdoYXQg aGllcmFyY2h5IHRoZXkNCiB3YW50IHRvIGFjY2VwdC9kZWxlZ2F0ZSBkZWNpc2lvbnMgdG8uPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj5JdCBtYXliZSB0aGF0IHdoYXTi gJlzIG5lZWRlZCBpcyBhIG1lYW5zIHRvIGNvbW11bmljYXRlIHRvIHRoZSBicm93c2VyIHdoYXQg YXV0aG9yaXR5IHRoZSBkZXZpY2UgYWRtaW5pc3RyYXRvciB3YW50cyBpdCB0byBmb2xsb3csIHNp bmNlIGluIHRoZSBlbmQgdGhlIGRldmljZSBvd25lciBzaG91bGQgYmUNCiBpbiBjaGFyZ2UuPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpibGFjayI+LWdsZW5uPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KDQoN CjwvZGl2PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2IGRpcj0ibHRy Ij48c3Bhbj4tLSA8L3NwYW4+PGJyPjxzcGFuPkFkZCBtYWlsaW5nIGxpc3Q8L3NwYW4+PGJyPjxz cGFuPjxhIGhyZWY9Im1haWx0bzpBZGRAaWV0Zi5vcmciPkFkZEBpZXRmLm9yZzwvYT48L3NwYW4+ PGJyPjxzcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v YWRkIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48L3NwYW4+ PGJyPjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PGRpdiBkaXI9Imx0ciI+PHNwYW4+LS0gPC9zcGFuPjxicj48c3Bhbj5BZGQgbWFp bGluZyBsaXN0PC9zcGFuPjxicj48c3Bhbj48YSBocmVmPSJtYWlsdG86QWRkQGlldGYub3JnIj5B ZGRAaWV0Zi5vcmc8L2E+PC9zcGFuPjxicj48c3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9hZGQ8L2E+PC9zcGFuPjxicj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PC9ib2R5 PjwvaHRtbD4= --Apple-Mail-55556EB4-B3CB-404E-9A8D-EF7E8305FD03-- From Jensen.Thomas@microsoft.com Fri May 24 10:37:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3E9B120141 for ; Fri, 24 May 2019 10:37:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.02 X-Spam-Level: X-Spam-Status: No, score=-0.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IEn0fwc2j5qk for ; Fri, 24 May 2019 10:37:50 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0711.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe49::711]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCC30120059 for ; Fri, 24 May 2019 10:37:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=testarcselector01; d=microsoft.com; cv=none; b=RJaqYicyOEt9LPmZyuRtFUtRvPXTYEd3X2n0HmZKuN+dK2f8L+8p2EZGN/F7hM+YgpTYc/FHqbmV/hbM6FquM/wA4v5cmaPH52jg55amX4mAJtmvMV5BEapl5l3dGuS7Je5mrjahN/FzUcLiy88/qi+lVLO1cyMvRUFot63Q2cc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=testarcselector01; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7bTjTB+xjxcWIbKkU55zXiOUXV8/MVt0c+03E5zJGzg=; b=BszUQRUujiDXUF1eDT6HilPXLNHr/m9BUMrtNfSj53e/Q1uB+IE+FupOIhctH8NAu/Qab7wtgsOZb5XEwmShb/429qnYlWnEdC57mayO0L7G64/huoz8b903TKsd2Fw1L9+AT6yrARaERXY88RvTLp27Udl5hLmGfX2wn+wwsyo= ARC-Authentication-Results: i=1; test.office365.com 1;spf=none;dmarc=none;dkim=none;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7bTjTB+xjxcWIbKkU55zXiOUXV8/MVt0c+03E5zJGzg=; b=O6M3eGRex+yAc2Vyq3wjr/ik1TDyLZaO+Im4zjyTNB25PgGO3tFLhSbu65Nbk9vihksiGn3pQ7CyA1g+h/l/3Yuld8lbbVjfBCovsqzz3zYDOzkIl5siPT0DWsCL6SHlVqMSmiFLxX9Ye8F3wEblf68508arg+l5tsilqsFttGU= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (2603:10b6:208:3a::13) by MN2PR21MB1261.namprd21.prod.outlook.com (2603:10b6:208:3c::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.3; Fri, 24 May 2019 17:37:47 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::2583:ea78:45d9:cf2a]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::2583:ea78:45d9:cf2a%7]) with mapi id 15.20.1943.007; Fri, 24 May 2019 17:37:47 +0000 From: Tommy Jensen To: "Cook, Neil" , Adam Roach CC: "add@ietf.org" , "Deen, Glenn (NBCUniversal)" Thread-Topic: [Add] Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcaZ6bliAgAAQiwCAAAj8aA== Date: Fri, 24 May 2019 17:37:47 +0000 Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com>, <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> In-Reply-To: <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.160.81] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6d5b9182-17e8-48cb-934f-08d6e06e897c x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1261; x-ms-traffictypediagnostic: MN2PR21MB1261: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0047BC5ADE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(396003)(136003)(366004)(39860400002)(346002)(199004)(189003)(53754006)(71190400001)(4326008)(71200400001)(33656002)(8990500004)(486006)(476003)(14454004)(561944003)(6246003)(22452003)(110136005)(19627405001)(8936002)(256004)(2906002)(54906003)(10290500003)(478600001)(14444005)(53936002)(966005)(72206003)(73956011)(91956017)(76116006)(66446008)(102836004)(66556008)(64756008)(66946007)(66476007)(76176011)(52536014)(7696005)(53546011)(6506007)(74316002)(25786009)(81166006)(6436002)(8676002)(55016002)(9686003)(236005)(6306002)(54896002)(81156014)(86362001)(99286004)(229853002)(5660300002)(3846002)(6116002)(86612001)(66066001)(52396003)(11346002)(10090500001)(68736007)(66574012)(606006)(7736002)(316002)(26005)(446003)(105004)(186003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1261; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: L5lR/gszrBD7FzCRsRTN/JzTKcju+9qGHz24+rRNmDw4cidOHd5fwtpCXZ+YF4KFOJOgXe46weGNTQlAF6wl6VFCFjJpWKM/ySPyJcNgXXiEJbT0mhAU2r7TZA4ActptODZ+/NjPK2/opVn0UIELgU9qBJRHQjtJ1roXPR1pwfaQOeSa2qpHERqW34B1Lw5oFv11xcUZjQShkOgw35+ElNnbH16Z1jQ0Y6Dmo+RZfO1oz0sAFUuW2zOTna4KopD+aUTBgrjFN0FCp3UwjuCGcDJBZvWw1LS41Ccg/tnzNiVDH0wyBoqeXIylGkBFo5tKvAsF3DVL4O5DPplWQTc67Oc+KRtJqJEr3/W/qMSDDAo5wJAmU0ZGThXIfBQIvUdipt7XzQSSlBFEdSAK/a28ik97lQQFoXfHa5uU7aX/jh0= Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213868D0BC3575C2589B670FA020MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6d5b9182-17e8-48cb-934f-08d6e06e897c X-MS-Exchange-CrossTenant-originalarrivaltime: 24 May 2019 17:37:47.4799 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1261 Archived-At: X-Mailman-Approved-At: Fri, 24 May 2019 10:53:41 -0700 Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 17:39:22 -0000 --_000_MN2PR21MB1213868D0BC3575C2589B670FA020MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Glenn, that was a great write-up. Thanks for sharing. To highlight Neil's point about this not being enterprise only: imagine a p= arent who configures content controls through their ISP. In a world where t= he browser defaults the user into using the browser's own DNS (DoH or other= wise) while bypassing system policies, children have a no effort needed sid= estep to parental controls and it won't be immediately obvious to the paren= t why their controls don't work. I don't think asking the platform and other apps on the platform to all be = aware of one another's policies is scalable. For the same reasons Glenn gav= e, I think apps should defer to the platform, redirecting users to make cha= nges there rather than making changes within their own space. Thanks, Tommy ________________________________ From: Add on behalf of Cook, Neil Sent: Friday, May 24, 2019 9:56 AM To: Adam Roach Cc: add@ietf.org; Deen, Glenn (NBCUniversal) Subject: Re: [Add] Browser Administrative Authority Glenn=92s point is not just about enterprises. It applies to consumer use c= ases as well. Neil Sent from my iPhone On 24 May 2019, at 16:58, Adam Roach > wrote: This is called =93enterprise policy=94, and =97 as far as I know =97 all ma= jor browsers honor it. See, e.g., https://support.mozilla.org/en-US/products/firefox-enterprise/po= licies-customization-enterprise/policies-overview-enterprise /a On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) > wrote: HI everyone, I=92ve been thinking though some of the issues with the proposal DoH deploy= ment in browsers. A big part of the tug of war here is the authority precedence for advanced= security and network settings that should be followed. Historically, it=92s been at the device level =96 which meant the device ad= ministrator, which could choose delegate choices to a specific DNS resolver= operator, or to the Network DHCP provided settings. Now the browser is seeking to adding itself into the authority chain for th= ose settings. The trouble being that this is a major change to the administ= rative trust model. To date, browser settings have been limited to rendering options, some basi= c certificate options, addons, and scripting language choices. Advance s= ecurity and trust has remained with the device administrator. Adding th= e browser to the administrative chain so that it can control advanced secur= ity and network settings introduces a problem because the browser does not = have an administrative level authority that is as high as the device admini= strator. Current hierarchy (top has more authority) Device Administrator -- device authority for security, = network, trust settings Network Administrator -- provides recommend network setti= ngs to devices Resolver Administrator -- can provide filtering Browser Maker -- provides core trusted certifi= cate list Browser User -- can set rendering options, c= an make limited certificate choices, plugins. =96 Impact is limited to the= browser sandbox The problem is that some of the browser makers proposals are now changing t= his administrative authority hierarchy, but they haven=92t done the extra w= ork of establishing administrative trust and working through the consequenc= es of that such as a child being able to change the browser DNS settings an= d bypass both resolver, Network, and even OS based restrictions. So they are changing it to: Browser Maker -- provides default DNS resolver= and DNS Protocol choices. Browser User -- can set DNS resolver and DNS= protocol Device Administrator -- device authority for security, = network, trust settings Network Administrator -- provides recommend network setti= ngs to devices Resolver Administrator -- can provide filtering The path to fixing this maybe to see if there is a way to express the admin= istrative hierarchy that respects the intentions of the device administrato= r on what hierarchy they want to accept/delegate decisions to. It maybe that what=92s needed is a means to communicate to the browser what= authority the device administrator wants it to follow, since in the end th= e device owner should be in charge. -glenn -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_MN2PR21MB1213868D0BC3575C2589B670FA020MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Glenn, that was a great write-up. Thanks for sharing.

To highlight Neil's point about this not being enterprise only: imagine a p= arent who configures content controls through their ISP. In a world where t= he browser defaults the user into using the browser's own DNS (DoH or other= wise) while bypassing system policies, children have a no effort needed sidestep to parental controls and it won'= t be immediately obvious to the parent why their controls don't work. =

I don't think asking the platform and other apps on the platform to all be = aware of one another's policies is scalable. For the same reasons Glenn gav= e, I think apps should defer to the platform, redirecting users to make cha= nges there rather than making changes within their own space. 

Thanks,
Tommy

From: Add <add-bounces@i= etf.org> on behalf of Cook, Neil <neil.cook=3D40open-xchange.com@dmar= c.ietf.org>
Sent: Friday, May 24, 2019 9:56 AM
To: Adam Roach
Cc: add@ietf.org; Deen, Glenn (NBCUniversal)
Subject: Re: [Add] Browser Administrative Authority
 
Glenn=92s point is not just about enterprises. It applies= to consumer use cases as well.

Neil

Sent from my iPhone

On 24 May 2019, at 16:58, Adam Roach <adam@nostrum.com> wrote:

This is called =93enterprise policy=94, and =97 as far as = I know =97 all major browsers honor it. 


/a

On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

HI eve= ryone,

 =

I=92ve= been thinking though some of the issues with the proposal DoH deployment i= n browsers.

 =

A big = part of the tug of war here is  the authority precedence for advanced = security and network settings that should be followed.   &nb= sp;

 =

Histor= ically, it=92s been at the device level =96 which meant the device administ= rator, which could choose delegate choices to a specific DNS resolver opera= tor, or to the Network DHCP provided settings.     = ;

 =

Now th= e browser is seeking to adding itself into the authority chain for those se= ttings. The trouble being that this is a major change to the administrative= trust model.

 =

To dat= e, browser settings have been limited to rendering options, some basic cert= ificate options, addons, and scripting language choices.    = Advance security and trust has remained with the device administrator.     Adding the browser to the ad= ministrative chain so that it can control advanced security and network set= tings introduces a problem because the browser does not have an administrat= ive level authority that is as high as the device administrator.

 =

Curren= t hierarchy (top has more authority)

 =

 =              De= vice Administrator       -- device authority = for security, network, trust settings

 =              Ne= twork Administrator     -- provides recommend network s= ettings to devices

 =              Re= solver Administrator    -- can provide filtering

 =              Br= owser  Maker         &nbs= p;     -- provides core trusted certificate list=

 =             &nb= sp;Browser User           = ;       -- can set rendering options, ca= n make limited certificate choices, plugins.  =96 Impact is limited to= the browser sandbox

 =

 =

The pr= oblem is that some of the browser makers proposals are now changing this ad= ministrative authority hierarchy, but they haven=92t done the extra work of= establishing administrative trust and working through the consequences of that such as a child being able to cha= nge the browser DNS settings and bypass both resolver, Network, and even OS= based restrictions.

 =

So the= y are changing it to:<= /span>

 =

 =              Br= owser Maker           &nb= sp;    -- provides default DNS resolver and DNS Protocol cho= ices.

 =             &nb= sp;Browser User           = ;       -- can set DNS resolver and DNS = protocol

 =             &nb= sp;Device Administrator       -- device autho= rity for security, network, trust settings

 =              Ne= twork Administrator     -- provides recommend network s= ettings to devices

 =              Re= solver Administrator    -- can provide filtering

 =

 =

 =

The pa= th to fixing this maybe to see if there is a way to express the administrat= ive hierarchy that respects the intentions of the device administrator on w= hat hierarchy they want to accept/delegate decisions to.<= /p>

 =

It may= be that what=92s needed is a means to communicate to the browser what autho= rity the device administrator wants it to follow, since in the end the devi= ce owner should be in charge.

 =

 =

-glenn=

 

--_000_MN2PR21MB1213868D0BC3575C2589B670FA020MN2PR21MB1213namp_-- From nobody Fri May 24 12:23:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8895F120314 for ; Fri, 24 May 2019 12:23:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ritter.vg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VxveGq0HUq4J for ; Fri, 24 May 2019 12:23:43 -0700 (PDT) Received: from mail-wm1-x344.google.com (mail-wm1-x344.google.com [IPv6:2a00:1450:4864:20::344]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AAC012030A for ; Fri, 24 May 2019 12:23:43 -0700 (PDT) Received: by mail-wm1-x344.google.com with SMTP id e19so2594484wme.1 for ; Fri, 24 May 2019 12:23:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=a5nN8lD6O40q45ZwqedWK8bec1vcBAMZ3kUnK1gfUJA=; b=K4N4CWRXrw2sK4MVoiGsAMqAB16IMMd/4gyVZx7/9+s8WmhtqkzDIlJI9eVLRo0viF lQA5AiKqrhTjzZ+k70Vk989dbplJTUgVaNEp+R7IR137p82W+CBGfqzvz8XaqSFnnOef ZYC2HyFOw8ufEgr0bM6Vr5OdoQA+twGoEkx7s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=a5nN8lD6O40q45ZwqedWK8bec1vcBAMZ3kUnK1gfUJA=; b=ZmY2Y7HY4OLGt0/HI/qU6Ob7azuGpngyMP3BkEjjy7k3D4FEelQdl/WxfKW69xpHLs smiKZd3PFbKrhRfZpeOUlThb6BJ0mRwkqFHNdLccXyaPZtM6Va6NhBXzIdaCFOmQqvqJ uOtudpNaYie37Q1PX0mnJWYqaSFeUQwGSmzjhldIBcB35Wd/RYHrPPVKnO9CeCZKwbuy FF/afJz3j+TeJege0uar3lQOF2iDzq223SEirqY2isSxizP+1fk0G31h9O6wg/qkc7Ku Z23CnyAGTt62Mb+hB/fz+L/4GPtLBvW3ZRM7Qk3fa72GdZ1oD2DqU1M84uA8zfJ8kBUO op9g== X-Gm-Message-State: APjAAAVJooFor0rDsfU9Dm7qeVqz2RpWkR7iIF1BvL7c12SpuQQdlu1M SBrC5gZ+KExWRLvlTuYoL4GmRboQbwr0x7iUTWI4GPEiZApEVg== X-Google-Smtp-Source: APXvYqwBRjoBDgwn7bln/HrmEiEXBdQ4IwtfMdYqYEIkcVpuUWY/zxjahi39d2fjB4smn6QnfksxPLbVkzf7adKPlNk= X-Received: by 2002:a7b:c936:: with SMTP id h22mr298715wml.71.1558725821552; Fri, 24 May 2019 12:23:41 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> In-Reply-To: From: Tom Ritter Date: Fri, 24 May 2019 19:23:29 +0000 Message-ID: To: Tommy Jensen Cc: "Cook, Neil" , Adam Roach , "add@ietf.org" , "Deen, Glenn (NBCUniversal)" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 19:23:47 -0000 "imagine a parent who configures content controls through their ISP" Okay; but then this isn't a device administrator. This is a network administrator. (And whether it's enterprise or not isn't really relevant, no feature is restricted to enterprise use.) The network should be considered hostile until configured otherwise because... the network usually is hostile. Or at least it's untrusted. Every cellular connection; every coffee shop, every store's free wifi, every friend's network you connect to, every AirBnB wireless, every hotel... Percentage-wise, the number of untrusted networks the average user connects to dwarfs the number of trusted networks (even if the percentage of time spent on untrusted networks is dwarfed by the percentage spent on trusted networks.) Device administration is the appropriate answer here - it's the appropriate trust boundary for users. An administrator of a device is a person or organization the user of that device knows and understands controls it. For the network to be able to override and disable users' security and privacy controls is inappropriate - for example we don't allow networks to strip TLS. UNLESS, of course, the device is configured to allow such activity. -tom On Fri, 24 May 2019 at 17:53, Tommy Jensen wrote: > > Glenn, that was a great write-up. Thanks for sharing. > > To highlight Neil's point about this not being enterprise only: imagine a= parent who configures content controls through their ISP. In a world where= the browser defaults the user into using the browser's own DNS (DoH or oth= erwise) while bypassing system policies, children have a no effort needed s= idestep to parental controls and it won't be immediately obvious to the par= ent why their controls don't work. > > I don't think asking the platform and other apps on the platform to all b= e aware of one another's policies is scalable. For the same reasons Glenn g= ave, I think apps should defer to the platform, redirecting users to make c= hanges there rather than making changes within their own space. > > Thanks, > Tommy > > ________________________________ > From: Add on behalf of Cook, Neil > Sent: Friday, May 24, 2019 9:56 AM > To: Adam Roach > Cc: add@ietf.org; Deen, Glenn (NBCUniversal) > Subject: Re: [Add] Browser Administrative Authority > > Glenn=E2=80=99s point is not just about enterprises. It applies to consum= er use cases as well. > > Neil > > Sent from my iPhone > > On 24 May 2019, at 16:58, Adam Roach wrote: > > This is called =E2=80=9Centerprise policy=E2=80=9D, and =E2=80=94 as far = as I know =E2=80=94 all major browsers honor it. > > See, e.g., https://support.mozilla.org/en-US/products/firefox-enterprise/= policies-customization-enterprise/policies-overview-enterprise > > /a > > On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) wrote: > > HI everyone, > > > > I=E2=80=99ve been thinking though some of the issues with the proposal Do= H deployment in browsers. > > > > A big part of the tug of war here is the authority precedence for advanc= ed security and network settings that should be followed. > > > > Historically, it=E2=80=99s been at the device level =E2=80=93 which meant= the device administrator, which could choose delegate choices to a specifi= c DNS resolver operator, or to the Network DHCP provided settings. > > > > Now the browser is seeking to adding itself into the authority chain for = those settings. The trouble being that this is a major change to the admini= strative trust model. > > > > To date, browser settings have been limited to rendering options, some ba= sic certificate options, addons, and scripting language choices. Advance= security and trust has remained with the device administrator. Adding = the browser to the administrative chain so that it can control advanced sec= urity and network settings introduces a problem because the browser does no= t have an administrative level authority that is as high as the device admi= nistrator. > > > > Current hierarchy (top has more authority) > > > > Device Administrator -- device authority for security= , network, trust settings > > Network Administrator -- provides recommend network set= tings to devices > > Resolver Administrator -- can provide filtering > > Browser Maker -- provides core trusted certi= ficate list > > Browser User -- can set rendering options,= can make limited certificate choices, plugins. =E2=80=93 Impact is limite= d to the browser sandbox > > > > > > The problem is that some of the browser makers proposals are now changing= this administrative authority hierarchy, but they haven=E2=80=99t done the= extra work of establishing administrative trust and working through the co= nsequences of that such as a child being able to change the browser DNS set= tings and bypass both resolver, Network, and even OS based restrictions. > > > > So they are changing it to: > > > > Browser Maker -- provides default DNS resolv= er and DNS Protocol choices. > > Browser User -- can set DNS resolver and D= NS protocol > > Device Administrator -- device authority for security= , network, trust settings > > Network Administrator -- provides recommend network set= tings to devices > > Resolver Administrator -- can provide filtering > > > > > > > > The path to fixing this maybe to see if there is a way to express the adm= inistrative hierarchy that respects the intentions of the device administra= tor on what hierarchy they want to accept/delegate decisions to. > > > > It maybe that what=E2=80=99s needed is a means to communicate to the brow= ser what authority the device administrator wants it to follow, since in th= e end the device owner should be in charge. > > > > > > -glenn > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri May 24 12:37:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 179971200F5 for ; Fri, 24 May 2019 12:37:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zglVw2Ajg2Te for ; Fri, 24 May 2019 12:37:05 -0700 (PDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-eopbgr710099.outbound.protection.outlook.com [40.107.71.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3E8F12007C for ; Fri, 24 May 2019 12:37:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=testarcselector01; d=microsoft.com; cv=none; b=HP6rx8ksrOng7Ybw3xfZEkW/L4+erSs2JHBKxZi1kwoYmhb7P/w3m9fzRukkxKg7PmTGPGSzHAv7w9JDNawx89IAwHGwfX78A9fsD2+dit+Ayzb5FWt/DlxDuVMBRS0a/Aic/96xmDSqzXO+nkSt+beu2VshKT2jr4YP39fGcI4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=testarcselector01; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rISv9qDxSoK+YRUlEBtDc9c2Izcx754Q84XCZLXvXpM=; b=ou8HFBvO53mU6JM5HPNSsYlg01zfHqGspCGe5Dm60Pv0es4F9pXd1s/U3LPpJedXr6PDmSDRbXZOWFYRuFhT0+qQu+BntIio8HB2CAQ+BT/OF1yYPaF/pelXPy4Qjl8MGu3o35Px1BK9jVrDwAyoE5eLmD3s7jkIJgBuwRXAFxk= ARC-Authentication-Results: i=1; test.office365.com 1;spf=none;dmarc=none;dkim=none;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rISv9qDxSoK+YRUlEBtDc9c2Izcx754Q84XCZLXvXpM=; b=GTqEWLydu2pYESC4djgNxE6Ak0pqVLIYDVed9yKvvGKuvXS+0S280mWK8V+KV/UwiiLl7SsK4X5By7RzEoRCjbT+G9150DkVqNX2W16eeUraudgwOxPWyRGxFVnmAu6VdXyhbJyASF1flopkoKikF/1Sz7ZpurxPJIq4x+aLx4A= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (2603:10b6:208:3a::13) by MN2PR21MB1213.namprd21.prod.outlook.com (2603:10b6:208:3a::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.4; Fri, 24 May 2019 19:37:02 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::2583:ea78:45d9:cf2a]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::2583:ea78:45d9:cf2a%7]) with mapi id 15.20.1943.007; Fri, 24 May 2019 19:37:02 +0000 From: Tommy Jensen To: Tom Ritter CC: "Cook, Neil" , Adam Roach , "add@ietf.org" , "Deen, Glenn (NBCUniversal)" Thread-Topic: [Add] Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcaZ6bliAgAAQiwCAAAj8aIAAH/aAgAAAjUk= Date: Fri, 24 May 2019 19:37:02 +0000 Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [73.157.47.180] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b205c56f-8f69-4947-8b4c-08d6e07f3225 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1213; x-ms-traffictypediagnostic: MN2PR21MB1213: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0047BC5ADE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(366004)(396003)(376002)(136003)(346002)(199004)(189003)(53754006)(86362001)(52536014)(25786009)(66574012)(8936002)(14454004)(478600001)(229853002)(5660300002)(561944003)(86612001)(102836004)(14444005)(3846002)(256004)(6116002)(6436002)(55016002)(6506007)(9686003)(53546011)(6246003)(53936002)(236005)(68736007)(966005)(72206003)(4326008)(7736002)(54896002)(6306002)(10290500003)(74316002)(316002)(8676002)(81156014)(71190400001)(7696005)(54906003)(486006)(8990500004)(71200400001)(76176011)(22452003)(33656002)(2906002)(606006)(81166006)(52396003)(91956017)(76116006)(66476007)(73956011)(66946007)(186003)(66066001)(26005)(99286004)(446003)(11346002)(6916009)(10090500001)(476003)(66446008)(66556008)(64756008)(105004)(19627405001); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1213; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8ycAhf8DdDNPUQW7qeIhruLIKG+SwJ8G0eyvaqTvquup84yfBJ1IGJMY26zGixuNPAgoMk3vnHf/Ij2FJ0OvM78G2aeRWP9ED3kSSPObg/v5ftPGqigzXijVmR8qVG/LkPQgWZLHwdPvIahRO0PuF3KITu2DbQGwbK935oPaiD33VY9/mh6xY9de9gLiciGq2P43w6F+971F1oTs4Oi7fVQsmcwIekOwwWhTNX5eFWP+0TpFZoMrOuXKd344FDr4oxDh5w6E2sZYWOrrL/6VE5FevGsLkI6LQEC+XrSd1GdVu3vi0DGrId0qW5QJFF0grjqqOxfjdPHzhhBGAT1kssyzu1UZs2nuvIcyc/w5rgpb+M+A0ZkHns3i/LnyV65iVkDU/S0fSaL5PNlYFkV1owqbj/AYgPCC2hOxeEMkCh0= Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213F859645C1564C6F36B2CFA020MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: b205c56f-8f69-4947-8b4c-08d6e07f3225 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 May 2019 19:37:02.5282 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1213 Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 19:37:09 -0000 --_000_MN2PR21MB1213F859645C1564C6F36B2CFA020MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Good point. I made a leap by connecting network admin with device admin for= a simple reason: today, most platforms do trust their network via their de= fault setting of using the DNS servers recommended by the network. Whether = that's ideal is another topic. To eliminate network trust as a variable in this discussion, let's have the= story be the use of a DNS provider, say CleanBrowsing for example. In this= scenario, the parent as the device admin has manually changed the device's= DNS server settings to point to CleanBrowsing. However, the use of an app = which rolls its own DNS stack by default will bypass this configuration. De= vice authority has been sidestepped in a way the user is not likely to unde= rstand. I agree with your point that device administration is the appropriate answe= r. Apps should defer to (or proactively refer to if they want to suggest ch= anges) device configuration rather than the device needing to be aware of t= he nuances of each app it could be running. Thanks, Tommy ________________________________ From: Tom Ritter Sent: Friday, May 24, 2019 12:23 PM To: Tommy Jensen Cc: Cook, Neil; Adam Roach; add@ietf.org; Deen, Glenn (NBCUniversal) Subject: Re: [Add] Browser Administrative Authority "imagine a parent who configures content controls through their ISP" Okay; but then this isn't a device administrator. This is a network administrator. (And whether it's enterprise or not isn't really relevant, no feature is restricted to enterprise use.) The network should be considered hostile until configured otherwise because... the network usually is hostile. Or at least it's untrusted. Every cellular connection; every coffee shop, every store's free wifi, every friend's network you connect to, every AirBnB wireless, every hotel... Percentage-wise, the number of untrusted networks the average user connects to dwarfs the number of trusted networks (even if the percentage of time spent on untrusted networks is dwarfed by the percentage spent on trusted networks.) Device administration is the appropriate answer here - it's the appropriate trust boundary for users. An administrator of a device is a person or organization the user of that device knows and understands controls it. For the network to be able to override and disable users' security and privacy controls is inappropriate - for example we don't allow networks to strip TLS. UNLESS, of course, the device is configured to allow such activity. -tom On Fri, 24 May 2019 at 17:53, Tommy Jensen wrote: > > Glenn, that was a great write-up. Thanks for sharing. > > To highlight Neil's point about this not being enterprise only: imagine a= parent who configures content controls through their ISP. In a world where= the browser defaults the user into using the browser's own DNS (DoH or oth= erwise) while bypassing system policies, children have a no effort needed s= idestep to parental controls and it won't be immediately obvious to the par= ent why their controls don't work. > > I don't think asking the platform and other apps on the platform to all b= e aware of one another's policies is scalable. For the same reasons Glenn g= ave, I think apps should defer to the platform, redirecting users to make c= hanges there rather than making changes within their own space. > > Thanks, > Tommy > > ________________________________ > From: Add on behalf of Cook, Neil > Sent: Friday, May 24, 2019 9:56 AM > To: Adam Roach > Cc: add@ietf.org; Deen, Glenn (NBCUniversal) > Subject: Re: [Add] Browser Administrative Authority > > Glenn=92s point is not just about enterprises. It applies to consumer use= cases as well. > > Neil > > Sent from my iPhone > > On 24 May 2019, at 16:58, Adam Roach wrote: > > This is called =93enterprise policy=94, and =97 as far as I know =97 all = major browsers honor it. > > See, e.g., https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A= %2F%2Fsupport.mozilla.org%2Fen-US%2Fproducts%2Ffirefox-enterprise%2Fpolicie= s-customization-enterprise%2Fpolicies-overview-enterprise&data=3D02%7C0= 1%7CJensen.Thomas%40microsoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f9= 88bf86f141af91ab2d7cd011db47%7C1%7C0%7C636943226330979994&sdata=3DQx5XX= n2n77kMw9TscJ5Fxexlnju92%2BQtUad%2FqEXU500%3D&reserved=3D0 > > /a > > On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) wrote: > > HI everyone, > > > > I=92ve been thinking though some of the issues with the proposal DoH depl= oyment in browsers. > > > > A big part of the tug of war here is the authority precedence for advanc= ed security and network settings that should be followed. > > > > Historically, it=92s been at the device level =96 which meant the device = administrator, which could choose delegate choices to a specific DNS resolv= er operator, or to the Network DHCP provided settings. > > > > Now the browser is seeking to adding itself into the authority chain for = those settings. The trouble being that this is a major change to the admini= strative trust model. > > > > To date, browser settings have been limited to rendering options, some ba= sic certificate options, addons, and scripting language choices. Advance= security and trust has remained with the device administrator. Adding = the browser to the administrative chain so that it can control advanced sec= urity and network settings introduces a problem because the browser does no= t have an administrative level authority that is as high as the device admi= nistrator. > > > > Current hierarchy (top has more authority) > > > > Device Administrator -- device authority for security= , network, trust settings > > Network Administrator -- provides recommend network set= tings to devices > > Resolver Administrator -- can provide filtering > > Browser Maker -- provides core trusted certi= ficate list > > Browser User -- can set rendering options,= can make limited certificate choices, plugins. =96 Impact is limited to t= he browser sandbox > > > > > > The problem is that some of the browser makers proposals are now changing= this administrative authority hierarchy, but they haven=92t done the extra= work of establishing administrative trust and working through the conseque= nces of that such as a child being able to change the browser DNS settings = and bypass both resolver, Network, and even OS based restrictions. > > > > So they are changing it to: > > > > Browser Maker -- provides default DNS resolv= er and DNS Protocol choices. > > Browser User -- can set DNS resolver and D= NS protocol > > Device Administrator -- device authority for security= , network, trust settings > > Network Administrator -- provides recommend network set= tings to devices > > Resolver Administrator -- can provide filtering > > > > > > > > The path to fixing this maybe to see if there is a way to express the adm= inistrative hierarchy that respects the intentions of the device administra= tor on what hierarchy they want to accept/delegate decisions to. > > > > It maybe that what=92s needed is a means to communicate to the browser wh= at authority the device administrator wants it to follow, since in the end = the device owner should be in charge. > > > > > > -glenn > > > > -- > Add mailing list > Add@ietf.org > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40mic= rosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd01= 1db47%7C1%7C0%7C636943226330979994&sdata=3Dwbq0RiqgNQODZ%2FY%2BCX6Ie1iY= jbG4uw5iRHQ7glreOIk%3D&reserved=3D0 > > -- > Add mailing list > Add@ietf.org > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40mic= rosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd01= 1db47%7C1%7C0%7C636943226330979994&sdata=3Dwbq0RiqgNQODZ%2FY%2BCX6Ie1iY= jbG4uw5iRHQ7glreOIk%3D&reserved=3D0 > > -- > Add mailing list > Add@ietf.org > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40mic= rosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd01= 1db47%7C1%7C0%7C636943226330979994&sdata=3Dwbq0RiqgNQODZ%2FY%2BCX6Ie1iY= jbG4uw5iRHQ7glreOIk%3D&reserved=3D0 --_000_MN2PR21MB1213F859645C1564C6F36B2CFA020MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Good point. I made a leap by connecting network admin with device admin for= a simple reason: today, most platforms do trust their network via their default setting of using the DNS se= rvers recommended by the network. Whether that's ideal is another topic.

To eliminate network trust as a variable in this discussion, let's have the= story be the use of a DNS provider, say CleanBrowsing for example. In this= scenario, the parent as the device admin has manually changed the device's= DNS server settings to point to CleanBrowsing. However, the use of an app which rolls its own DNS stack by= default will bypass this configuration. Device authority has been sidestep= ped in a way the user is not likely to understand.

I agree with your point that device administration is the appropriate answe= r. Apps should defer to (or proactively refer to if they want to suggest ch= anges) device configuration rather than the device needing to be aware of t= he nuances of each app it could be running. 

Thanks,
Tommy
From: Tom Ritter <tom@ri= tter.vg>
Sent: Friday, May 24, 2019 12:23 PM
To: Tommy Jensen
Cc: Cook, Neil; Adam Roach; add@ietf.org; Deen, Glenn (NBCUniversal)=
Subject: Re: [Add] Browser Administrative Authority
 
"imagine a parent who configures content cont= rols through their ISP"

Okay; but then this isn't a device administrator. This is a network
administrator. (And whether it's enterprise or not isn't really
relevant, no feature is restricted to enterprise use.)

The network should be considered hostile until configured otherwise
because... the network usually is hostile. Or at least it's untrusted.
Every cellular connection; every coffee shop, every store's free wifi,
every friend's network you connect to, every AirBnB wireless, every
hotel... Percentage-wise, the number of untrusted networks the average
user connects to dwarfs the number of trusted networks (even if the
percentage of time spent on untrusted networks is dwarfed by the
percentage spent on trusted networks.)

Device administration is the appropriate answer here - it's the
appropriate trust boundary for users. An administrator of a device is
a person or organization the user of that device knows and understands
controls it. For the network to be able to override and disable users'
security and privacy controls is inappropriate - for example we don't
allow networks to strip TLS. UNLESS, of course, the device is
configured to allow such activity.

-tom

On Fri, 24 May 2019 at 17:53, Tommy Jensen
<Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote:
>
> Glenn, that was a great write-up. Thanks for sharing.
>
> To highlight Neil's point about this not being enterprise only: imagin= e a parent who configures content controls through their ISP. In a world wh= ere the browser defaults the user into using the browser's own DNS (DoH or = otherwise) while bypassing system policies, children have a no effort needed sidestep to parental controls and it won'= t be immediately obvious to the parent why their controls don't work.
>
> I don't think asking the platform and other apps on the platform to al= l be aware of one another's policies is scalable. For the same reasons Glen= n gave, I think apps should defer to the platform, redirecting users to mak= e changes there rather than making changes within their own space.
>
> Thanks,
> Tommy
>
> ________________________________
> From: Add <add-bounces@ietf.org> on behalf of Cook, Neil <nei= l.cook=3D40open-xchange.com@dmarc.ietf.org>
> Sent: Friday, May 24, 2019 9:56 AM
> To: Adam Roach
> Cc: add@ietf.org; Deen, Glenn (NBCUniversal)
> Subject: Re: [Add] Browser Administrative Authority
>
> Glenn=92s point is not just about enterprises. It applies to consumer = use cases as well.
>
> Neil
>
> Sent from my iPhone
>
> On 24 May 2019, at 16:58, Adam Roach <adam@nostrum.com> wrote: >
> This is called =93enterprise policy=94, and =97 as far as I know =97 a= ll major browsers honor it.
>
> See, e.g., https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fsupport= .mozilla.org%2Fen-US%2Fproducts%2Ffirefox-enterprise%2Fpolicies-customizati= on-enterprise%2Fpolicies-overview-enterprise&amp;data=3D02%7C01%7CJense= n.Thomas%40microsoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f14= 1af91ab2d7cd011db47%7C1%7C0%7C636943226330979994&amp;sdata=3DQx5XXn2n77= kMw9TscJ5Fxexlnju92%2BQtUad%2FqEXU500%3D&amp;reserved=3D0
>
> /a
>
> On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) <Glenn.Deen@n= bcuni.com> wrote:
>
> HI everyone,
>
>
>
> I=92ve been thinking though some of the issues with the proposal DoH d= eployment in browsers.
>
>
>
> A big part of the tug of war here is  the authority precedence fo= r advanced security and network settings that should be followed.
>
>
>
> Historically, it=92s been at the device level =96 which meant the devi= ce administrator, which could choose delegate choices to a specific DNS res= olver operator, or to the Network DHCP provided settings.
>
>
>
> Now the browser is seeking to adding itself into the authority chain f= or those settings. The trouble being that this is a major change to the adm= inistrative trust model.
>
>
>
> To date, browser settings have been limited to rendering options, some= basic certificate options, addons, and scripting language choices. &n= bsp;  Advance security and trust has remained with the device administ= rator.     Adding the browser to the administrative chain so that it can control advanced security and network settings introd= uces a problem because the browser does not have an administrative level au= thority that is as high as the device administrator.
>
>
>
> Current hierarchy (top has more authority)
>
>
>
>            = ;   Device Administrator       -- d= evice authority for security, network, trust settings
>
>            = ;   Network Administrator     -- provides rec= ommend network settings to devices
>
>            = ;   Resolver Administrator    -- can provide filte= ring
>
>            = ;   Browser  Maker       =         -- provides core trusted certifi= cate list
>
>            = ;   Browser User        &= nbsp;         -- can set rendering = options, can make limited certificate choices, plugins.  =96 Impact is= limited to the browser sandbox
>
>
>
>
>
> The problem is that some of the browser makers proposals are now chang= ing this administrative authority hierarchy, but they haven=92t done the ex= tra work of establishing administrative trust and working through the conse= quences of that such as a child being able to change the browser DNS settings and bypass both resolver, Network,= and even OS based restrictions.
>
>
>
> So they are changing it to:
>
>
>
>            = ;   Browser Maker        =         -- provides default DNS resolver= and DNS Protocol choices.
>
>            = ;   Browser User        &= nbsp;         -- can set DNS resolv= er and DNS protocol
>
>            = ;   Device Administrator       -- d= evice authority for security, network, trust settings
>
>            = ;   Network Administrator     -- provides rec= ommend network settings to devices
>
>            = ;   Resolver Administrator    -- can provide filte= ring
>
>
>
>
>
>
>
> The path to fixing this maybe to see if there is a way to express the = administrative hierarchy that respects the intentions of the device adminis= trator on what hierarchy they want to accept/delegate decisions to.
>
>
>
> It maybe that what=92s needed is a means to communicate to the browser= what authority the device administrator wants it to follow, since in the e= nd the device owner should be in charge.
>
>
>
>
>
> -glenn
>
>
>
> --
> Add mailing list
> Add@ietf.org
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40m= icrosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd= 011db47%7C1%7C0%7C636943226330979994&amp;sdata=3Dwbq0RiqgNQODZ%2FY%2BCX= 6Ie1iYjbG4uw5iRHQ7glreOIk%3D&amp;reserved=3D0
>
> --
> Add mailing list
> Add@ietf.org
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40m= icrosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd= 011db47%7C1%7C0%7C636943226330979994&amp;sdata=3Dwbq0RiqgNQODZ%2FY%2BCX= 6Ie1iYjbG4uw5iRHQ7glreOIk%3D&amp;reserved=3D0
>
> --
> Add mailing list
> Add@ietf.org
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40m= icrosoft.com%7Cac269940328c4cf2713708d6e07d59f9%7C72f988bf86f141af91ab2d7cd= 011db47%7C1%7C0%7C636943226330979994&amp;sdata=3Dwbq0RiqgNQODZ%2FY%2BCX= 6Ie1iYjbG4uw5iRHQ7glreOIk%3D&amp;reserved=3D0
--_000_MN2PR21MB1213F859645C1564C6F36B2CFA020MN2PR21MB1213namp_-- From nobody Fri May 24 12:55:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EB5B1200E9 for ; Fri, 24 May 2019 12:55:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T8XDbpi-SBIk for ; Fri, 24 May 2019 12:55:53 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49C0312008B for ; Fri, 24 May 2019 12:55:53 -0700 (PDT) Received: from pps.filterd (m0048208.ppops.net [127.0.0.1]) by m0048208.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4OJmIct036774 for ; Fri, 24 May 2019 15:55:50 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0048208.ppops.net-00176a04. with ESMTP id 2sjcq5tfq6-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Fri, 24 May 2019 15:55:50 -0400 Received: from unknown (HELO potemwp00028.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 24 May 2019 15:54:36 -0400 Received: from potemwp00030.mail.tfayd.com (100.124.56.54) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Fri, 24 May 2019 13:55:47 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00030.mail.tfayd.com (100.124.56.54) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Fri, 24 May 2019 13:55:46 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Fri, 24 May 2019 13:55:46 -0600 From: "Deen, Glenn (NBCUniversal)" To: Tom Ritter , Tommy Jensen CC: "Cook, Neil" , Adam Roach , "add@ietf.org" , "Deen, Glenn (NBCUniversal)" Thread-Topic: [EXTERNAL] Re: [Add] Browser Administrative Authority Thread-Index: AQHVElduUVk23xOP3E+l0RWVAVU0xKZ7DDuA//+Tq4A= Date: Fri, 24 May 2019 19:55:46 +0000 Message-ID: <03CDC9F1-4F00-449A-B07D-C77380D2F758@nbcuni.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [100.126.25.31] x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="utf-8" Content-ID: <1CC16D32E3591A4B83CCD72BBA97B75E@NBCUNI.COM> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905240129 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 19:55:56 -0000 DQoNCu+7v09uIDUvMjQvMTksIDEyOjIzIFBNLCAiVG9tIFJpdHRlciIgPHRvbUByaXR0ZXIudmc+ IHdyb3RlOg0KDQogICAgImltYWdpbmUgYSBwYXJlbnQgd2hvIGNvbmZpZ3VyZXMgY29udGVudCBj b250cm9scyB0aHJvdWdoIHRoZWlyIElTUCINCiAgICANCiAgICBPa2F5OyBidXQgdGhlbiB0aGlz IGlzbid0IGEgZGV2aWNlIGFkbWluaXN0cmF0b3IuIFRoaXMgaXMgYSBuZXR3b3JrDQogICAgYWRt aW5pc3RyYXRvci4gKEFuZCB3aGV0aGVyIGl0J3MgZW50ZXJwcmlzZSBvciBub3QgaXNuJ3QgcmVh bGx5DQogICAgcmVsZXZhbnQsIG5vIGZlYXR1cmUgaXMgcmVzdHJpY3RlZCB0byBlbnRlcnByaXNl IHVzZS4pDQogICAgDQogICAgVGhlIG5ldHdvcmsgc2hvdWxkIGJlIGNvbnNpZGVyZWQgaG9zdGls ZSB1bnRpbCBjb25maWd1cmVkIG90aGVyd2lzZQ0KICAgIGJlY2F1c2UuLi4gdGhlIG5ldHdvcmsg dXN1YWxseSBpcyBob3N0aWxlLiBPciBhdCBsZWFzdCBpdCdzIHVudHJ1c3RlZC4NCiAgICBFdmVy eSBjZWxsdWxhciBjb25uZWN0aW9uOyBldmVyeSBjb2ZmZWUgc2hvcCwgZXZlcnkgc3RvcmUncyBm cmVlIHdpZmksDQogICAgZXZlcnkgZnJpZW5kJ3MgbmV0d29yayB5b3UgY29ubmVjdCB0bywgZXZl cnkgQWlyQm5CIHdpcmVsZXNzLCBldmVyeQ0KICAgIGhvdGVsLi4uIFBlcmNlbnRhZ2Utd2lzZSwg dGhlIG51bWJlciBvZiB1bnRydXN0ZWQgbmV0d29ya3MgdGhlIGF2ZXJhZ2UNCiAgICB1c2VyIGNv bm5lY3RzIHRvIGR3YXJmcyB0aGUgbnVtYmVyIG9mIHRydXN0ZWQgbmV0d29ya3MgKGV2ZW4gaWYg dGhlDQogICAgcGVyY2VudGFnZSBvZiB0aW1lIHNwZW50IG9uIHVudHJ1c3RlZCBuZXR3b3JrcyBp cyBkd2FyZmVkIGJ5IHRoZQ0KICAgIHBlcmNlbnRhZ2Ugc3BlbnQgb24gdHJ1c3RlZCBuZXR3b3Jr cy4pDQoNCltHRF0gVGhlIHJlYXNvbiB3aHkgSSBwdXQgaXQgYXMgYSBoaWVyYXJjaHkgaXNuJ3Qg dG8gbWFrZSBhbnkganVkZ2VtZW50IG9uIHRoZSBuZXR3b3JrJ3MgaG9zdGlsaXR5IG9yIHRydXN0 d29ydGhpbmVzcy4gICAgDQogICAgICAgICBJdCdzIGFsbCBhYm91dCB0aGUgZGV2aWNlIG93bmVy IG1ha2luZyB0aGUgY2hvaWNlIG9uIGlmIHRoZXkgYWNjZXB0LCBhbmQgdGh1cyBhcmUgY2hvb3Np bmcgdG8gdHJ1c3QsIHNldHRpbmdzIGZyb20gdGhlIG5ldHdvcmsuICAgICAgICANCg0KW0dEXSBp biB0aGUgY2FzZSBvZiAiaW1hZ2luZSBhIHBhcmVudCB3aG8gY29uZmlndXJlcyBjb250ZW50IGNv bnRyb2xzIHRocm91Z2ggdGhlaXIgSVNQIiwgDQogICAgICAgIHRoZXkgcGFyZW50IGlzIG1ha2lu ZyBhIGNob2ljZSB0byBhY2NlcHQgdGhlIHRoZWlyIElTUCBhcyB0cnVzdCB3b3J0aHkuICAgSXQn cyBub3QgdGhhdCB0aGUgDQogICAgICAgIG5ldHdvcmsgaXMgaW1wb3NpbmcgdGhhdCB1cG9uIHRo ZW0sIHRoZXkgYXJlIG1ha2luZyB0aGUgY2hvaWNlIHRvIGFjY2VwdCBhbmQgdHJ1c3QuDQoNCltH RF0gIENvbnRyb2wgSGllcmFyY2h5IENsYXNzaWM6DQogICAgICAgICAgICAgIERldmljZSBBZG1p bmlzdHJhdG9yICAgICAgIC0tIGRldmljZSBhdXRob3JpdHkgZm9yIHNlY3VyaXR5LCBuZXR3b3Jr LCB0cnVzdCBzZXR0aW5ncw0KICAgICAgICAgICAgICBOZXR3b3JrIEFkbWluaXN0cmF0b3IgICAg IC0tIHByb3ZpZGVzIHJlY29tbWVuZCBuZXR3b3JrIHNldHRpbmdzIHRvIGRldmljZXMNCiAgICAg ICAgICAgICAgUmVzb2x2ZXIgQWRtaW5pc3RyYXRvciAgICAtLSBjYW4gcHJvdmlkZSBmaWx0ZXJp bmcNCiAgICAgICAgICAgICAgQnJvd3NlciAgTWFrZXIgICAgICAgICAgICAgICAtLSBwcm92aWRl cyBjb3JlIHRydXN0ZWQgY2VydGlmaWNhdGUgbGlzdA0KICAgICAgICAgICAgICBCcm93c2VyIFVz ZXIgICAgICAgICAgICAgICAgICAtLSBjYW4gc2V0IHJlbmRlcmluZyBvcHRpb25zLCBjYW4gbWFr ZSBsaW1pdGVkIGNlcnRpZmljYXRlIGNob2ljZXMsIHBsdWdpbnMuICDigJMgSW1wYWN0IGlzIGxp bWl0ZWQgdG8gdGhlIGJyb3dzZXIgc2FuZGJveA0KDQogICAgICAgIENvbnRyb2wgSGllcmFyY2h5 IEJlaW5nIFByb3Bvc2VkIGJ5IFNvbWU6IA0KDQogICAgICAgICAgICAgIEJyb3dzZXIgTWFrZXIg ICAgICAgICAgICAgICAgLS0gcHJvdmlkZXMgZGVmYXVsdCBETlMgcmVzb2x2ZXIgYW5kIEROUyBQ cm90b2NvbCBjaG9pY2VzLg0KICAgICAgICAgICAgICBCcm93c2VyIFVzZXIgICAgICAgICAgICAg ICAgICAtLSBjYW4gc2V0IEROUyByZXNvbHZlciBhbmQgRE5TIHByb3RvY29sDQogICAgICAgICAg ICAgIERldmljZSBBZG1pbmlzdHJhdG9yICAgICAgIC0tIGRldmljZSBhdXRob3JpdHkgZm9yIHNl Y3VyaXR5LCBuZXR3b3JrLCB0cnVzdCBzZXR0aW5ncw0KICAgICAgICAgICAgICBOZXR3b3JrIEFk bWluaXN0cmF0b3IgICAgIC0tIHByb3ZpZGVzIHJlY29tbWVuZCBuZXR3b3JrIHNldHRpbmdzIHRv IGRldmljZXMNCiAgICAgICAgICAgICAgUmVzb2x2ZXIgQWRtaW5pc3RyYXRvciAgICAtLSBjYW4g cHJvdmlkZSBmaWx0ZXJpbmcNCiBbL0dEXQ0KICAgIA0KT24gNS8yNC8xOSwgMTI6MjMgUE0sICJU b20gUml0dGVyIiA8dG9tQHJpdHRlci52Zz4gd3JvdGU6DQoNCiAgICBEZXZpY2UgYWRtaW5pc3Ry YXRpb24gaXMgdGhlIGFwcHJvcHJpYXRlIGFuc3dlciBoZXJlIC0gaXQncyB0aGUNCiAgICBhcHBy b3ByaWF0ZSB0cnVzdCBib3VuZGFyeSBmb3IgdXNlcnMuIEFuIGFkbWluaXN0cmF0b3Igb2YgYSBk ZXZpY2UgaXMNCiAgICBhIHBlcnNvbiBvciBvcmdhbml6YXRpb24gdGhlIHVzZXIgb2YgdGhhdCBk ZXZpY2Uga25vd3MgYW5kIHVuZGVyc3RhbmRzDQogICAgY29udHJvbHMgaXQuIEZvciB0aGUgbmV0 d29yayB0byBiZSBhYmxlIHRvIG92ZXJyaWRlIGFuZCBkaXNhYmxlIHVzZXJzJw0KICAgIHNlY3Vy aXR5IGFuZCBwcml2YWN5IGNvbnRyb2xzIGlzIGluYXBwcm9wcmlhdGUgLSBmb3IgZXhhbXBsZSB3 ZSBkb24ndA0KICAgIGFsbG93IG5ldHdvcmtzIHRvIHN0cmlwIFRMUy4gVU5MRVNTLCBvZiBjb3Vy c2UsIHRoZSBkZXZpY2UgaXMNCiAgICBjb25maWd1cmVkIHRvIGFsbG93IHN1Y2ggYWN0aXZpdHku DQoNCltHRF0uIEkgZG9uJ3QgaGVhciBhbnlvbmUgcHJvcG9zaW5nIHRoYXQgdGhlIG5ldHdvcmsg c2hvdWxkIGJlIGluIHRoZSByb2xlIG9mIG92ZXJyaWRpbmcgb3IgZGlzYWJsaW5nIGEgZGV2aWNl J3Mgc2VjdXJpdHkgb3IgcHJpdmFjeSBjb250cm9scy4gICAgDQpMaWtld2lzZSwgbmVpdGhlciBz aG91bGQgYnJvd3NlcnMgYmUgb3ZlcnJpZGluZyBvciBkaXNhYmxpbmcgdGhlIGRldmljZSdzIHNl Y3VyaXR5IG9yIHByaXZhY3kgY29udHJvbHMuLiAgIEl0J3MgdGhlIGRldmljZQ0KQWRtaW5pc3Ry YXRvciB0aGF0IHNob3VsZCBoYXZlIGZpbmFsIGF1dGhvcml0eSBpbiBzdWNoIHRoaW5ncy4gICBU aGUgZW50aXJlIHBhc3QgMzArIHllYXJzIG9mIE9TIGFuZCBzZWN1cml0eSBhcmNoaXRlY3R1cmUg aXMgYnVpbHQNCm9uIHRoYXQgbW9kZWwuICBZZXQsIHNvbWUgb2YgdGhlIHB1YmxpYyBwbGFucyBo YXZlIHByb3Bvc2VkIGRvaW5nIGp1c3QgdGhhdC4NCg0KW0dEXSBUaGUgcXVlc3Rpb24gaXMgaG93 IHRvIHJlc3BlY3QgdGhlIGhpZXJhcmNoeSB3aGVuIGludHJvZHVjaW5nIG5ldyBwcm90b2NvbHMg c28gYXMgdG8gYXZvaWQgaW50cm9kdWNpbmcgdW5kZXNpcmVkIHNpZGUgZWZmZWN0cw0KU3VjaCBh cyBjaGlsZHJlbiBiZWluZyBhYmxlIHRvIHRyaXZpYWxseSBieXBhc3MgcGFyZW50YWwgYW5kIHNj aG9vbCBjaG9pY2VzLg0KDQpbR0RdIFRoaXMgY291bGQgYWxzbyBiZSBzb2x2ZWQgYnkgZG9pbmcg aXQgYXQgdGhlIGRldmljZS9PUyBsYXllciBpbnN0ZWFkIG9mIGluc2lkZSB0aGUgYnJvd3Nlciwg YmVjYXVzZSB0aGVuIGl0IHdvdWxkIGludGVncmF0ZSB3aXRoIHRoZSBkZXZpY2UgDQpBZG1pbmlz dHJhdGlvbiBoaWVyYXJjaHkuICAgIE1ha2luZyBETlMgcmVzb2x2ZXIgYW5kIHByb3RvY29sIGNo b2ljZXMgaW4gdGhlIGFwcGxpY2F0aW9uIGlzIGEgbWFqb3IgY2hhbmdlIHRvIHRoZSB0cmFkaXRp b25hbCByb2xlIG9mIA0KRE5TIGFzIGFuIE9TL2RldmljZSBsZXZlbCBjaG9pY2UuICANCg0KW0dE XSBJbiB0aGUgZW5kICwgZG9pbmcgaXQgaW4gdGhlIGJyb3dzZXIgY3JlYXRlcyAyIEROUyBiZWhh dmlvcnM6ICAoMSkgT25lIGZvciB0aGUgT1MgYW5kIGFwcHM7ICgyKSBhbm90aGVyIHRoYXQncyBk aWZmZXJlbnQgaW4gZWFjaCBicm93c2VyIHRoYXQgb3ZlcnJpZGVzIHRoZSBkZXZpY2UuDQoNCltH RF0gUGVyaGFwcyBEb0ggc2V0dGluZ3MgY291bGQgYmUgYSBkZXZpY2Ugc2V0dGluZyBkb25lIGF0 IHRoZSBPUyBsZXZlbCB0aGF0IHRoZSBicm93c2VycyBjb3VsZCBsb29rIHRvIGluIG9yZGVyIHRv IHVuZGVyc3RhbmQgdGhlIGRldmljZSBhZG1pbmlzdHJhdG9ycyBpbnRlbnQ/ICAgVGhpcyBjb3Vs ZCBldmVuDQpiZSBhIHNldHRpbmcgdGhlIGRldmljZSBhZG1pbmlzdHJhdG9yIGNhbiBjaG9vc2Ug dG8gaW5oZXJpdCBmcm9tIGEgbmV0d29yaywgaWYgYWdhaW4gdGhleSBjaG9vc2UgdG8uDQoNCg0K LWdsZW5uDQogICAgDQoNCg0K From nobody Fri May 24 22:01:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73BD3120316 for ; Fri, 24 May 2019 22:01:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dmRhSAISjcW3 for ; Fri, 24 May 2019 22:01:20 -0700 (PDT) Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC824120048 for ; Fri, 24 May 2019 22:01:20 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id r18so4938371pls.13 for ; Fri, 24 May 2019 22:01:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=pwpGQsLIT3sctwhEF12FVbG1pdL88a5A6748yPaRvYc=; b=cL08krQIcJ/ZVIqBh0V+QW0l+0KdHgKwoGlfVlK/3vLJs5F7R/sx2LSg0k1fDZNBHc QMrXbzRXuaSCjXGJ58XiU40u2HLo8uz0KIwkAzfyGJdAPrEBrnp3M5/xejvQL8P2GiAg BILy5xPnWUHg1agJsawz8rWY18ZqJQvIWat2/KiuAgAOK7VSS+KnyKyHFO2CD7N8ANLd Eyb2kP8F/RZt1S80w2ZLLw5MmXtZi28zIJ8Riraf7G7wPq59Bi/z6sCyAE6ItAfD51ch DFKPrc2TVngXiEoCTfGe7FIn+6WPuEHeUgN+p5iAkd7hCLa3ZMORbttJQiKc+hHPuFYZ Al9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=pwpGQsLIT3sctwhEF12FVbG1pdL88a5A6748yPaRvYc=; b=EjnbLOkKqgG5t/88ctWt+nbTgCbtGIrYrj0z6jTgmI/CMIzkpjGL2t9hlaUMVOBe9h 1ZHm+Wpy8w4+1qdVWVmaj7G8iFeZKIs0B/SyMhIgST4UU1bGLDv+4xGObweWmhK3ZoUN lrMiC5XkNEmWC0dPFdQuRdc99DO44spCdg6AenF/hAbCQ5g039Bt/3Q6tbN5lvM0t80h WmDe/NKtia3RconyTh/EPD/9jBr0yFtMu18J95icru3/kTCsByYkJ85X829uKpp3Maqw aH2OawNVUiwJUjtx4wTyKCSsbOoFEi6HdAwxP6G11CrDjllGT+LFNo2Og+ljy+gMkYb7 k0Ug== X-Gm-Message-State: APjAAAVSKOPcT/4bcu2Qbo48uBDWrBCd22VTQAQDKqQnbMrcX36g9tRq M8Z7lo8y17YBoPAXkGYQ//1lQeKRMA== X-Google-Smtp-Source: APXvYqxG+9fO3P1h2rdygwJiEAWZFIfNNDRktiaZrXVVtE0e0/7HR9eeUrqDBO9rkpnvYeObW8dJ5A== X-Received: by 2002:a17:902:868b:: with SMTP id g11mr29868140plo.183.1558760479769; Fri, 24 May 2019 22:01:19 -0700 (PDT) Received: from aspen.local (63-140-65-22.dynamic.lte.acsalaska.net. [63.140.65.22]) by smtp.gmail.com with ESMTPSA id f67sm4639876pfa.149.2019.05.24.22.01.18 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 24 May 2019 22:01:18 -0700 (PDT) To: add@ietf.org References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> From: Melinda Shore Openpgp: preference=signencrypt Autocrypt: addr=melinda.shore@nomountain.net; prefer-encrypt=mutual; keydata= mQINBFppZ0gBEADFwxAi5szDOsM/6+CH4pbYTX7D+2gjLY4xEE7ydQcAF1WVLvcWXrpZM0GO /eA4N1PJ+OT5o8o9zVr7izMJkiLwcnQmxHdlYgZ9E+Cm8hDtMyEPBQwsYTkE5kpbGCmBAZ+W rHNHjvDg366uZQHzJejenB1/V4+rxMZs1Ak34Az2MVOz9Doecaiadpw3NpH3+1VXY/qilqnM lznINSANqD0ktxB/CVKjxl3/K5JnVnLp0h2kiUqt19hQPX2JmLcgaHzu+Ceb34/HZWhs0CiF c4auhQ3A9PcccOprQh6IGW1xo6RP3OEbeRFqeovgBWS+DIWzMIM0a3G2LDid0889QYwEv0zZ RPDCcF3g15mlkeUUmwKQ6eAagPyTqLtTiOKULqy9bQahyX2eqlySrF+HqlwGeNoG+A4l1Z2Y S7NCBLPIzUk2RuSKMBaKw86ORzvg2Advrw4bdv7kbDkArGzywky61SEB/q+GqR466mekXx2F O+m8RuoSnWrBsKvD/bhELHcneorIBleGz+VL7i5adU0rIydG3jPTfUeXoCZIeNx1LannxnAR ihKdh5+FE26WiiK6VmZWkvFjaPFwWGjvAsi82Pd9QgHhnG/XzINpXw/3HF4wtBTU5nIExMzC +FbJxCPq1kXpqSxJqg7hgUFvD5jUD9lpN5Br/S2dUgJj95bbPQARAQABtCxNZWxpbmRhIFNo b3JlIDxtZWxpbmRhLnNob3JlQG5vbW91bnRhaW4ubmV0PokCVAQTAQoAPgIbAwUJCWdTAAUL CQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBE9oLZMqF5b4IPI0wN+4kXKadtuPBQJaaXRaAAoJ EN+4kXKadtuPVioP/3nVzx33yjiEtqLKTEHwofnLT15CV5wAcGa0DTbqgiomVKzSRkkhbF3Z KIHYrnjVpTcYJuW+PmFSIjNizNVr+vvjNP6ptRqx5orWmK4EBe/B9mrpmIshxUwkYr46uwN4 h06xJS3KCzhfhSsnesH5vlGBkUod0+nQhbSLyLRpxmaKaeAl4dxFSBLU0vUJMLH8PXTZVNof 5Yo+ThqCzu1pwOkBQ8gST2J6zdy4PjU9ENQ9RLAamlAG/6rGHEKLFcnUpEg7Tcu1hSzAsqR8 kjX2Prpu4A9DyLCjTOvfOPQa8WjZy18ZdYOxuPxdrTazeCRVJIvYRflhBCZb744jhMyfAiSW eckwRBVSCnBuvWBJl9Ua1wp8SOUXXhgGI8WGvSkvul6kKSkHQKDggd4cojAhxWLfvmjxn5pz 0BNbvrEBGqgWwO1ZMuJpmv3P8YK5Aytsl85NZoMMUJIDxEQhBUgYz5QTQANBKPi8RsfOntho rhzXLqnPPQcE4Xf9O9XIyy077F0JoyiPx74Zsl1dTxmT73pezpfhKUQR7/QlmJ/FAADpb6SO V0tlgBtR6FAZToBYPDiss57AcKM1zzyJ7sHIZkxQelykYSet6hp2WGcwMXQveWqFMQ4fiGQx XNEPO+KZKNj+0sfINzSLP88O5TniM/l/JrjZZNT/lVAQDTdkCBGyuQINBFppZ0gBEACgZuM1 8ghzSuhuv+n0kWyWCeEWrx9Ey03EgFj5alBt55+OLv3dOsdyBHJxjtd0cZS1XaKZlgr1YZ0O pQNv/Wyy8uSW2BZ6hyG1SKN9/1MmfJLNnjjxaBQP4yaMwDdS3wX7hoWY19IpVPZHYDR35FAg SnG/s6we+IOITM1TJoOJs4+ygeK5dC7LfRoj+lkEHYrTcglYVuwsyK2FNz/sF8kJW1fEZHM6 6phSbhCvwbECWbb4eDGXbKZY92W1RTQ5U5td8DMLXyYipQphrcoeRXpb18DbOnE0WwIQV0yB gc/rTiUt/wVjasd1RrsCPBQC/uJ+ZHknvr2MoxIWBBsRtKYHG66aOL+nDV8X1miuF6j4cztv gmdqrwPHpAKVxhfwd/G4suNBunYw4/kAV9b2+eidX5em3NtPPNl/qNjsmEHQGn/5JKRHRvQs 0yuigXDhN2N0keoHrbGCE8kyA/d83L7E9d95hsf3JxpRzmeaTze+NpcIaX5uXdKOaCBjLtx1 tOrDA4XX7Y3nY+waKZYa3RvC7yulFJiKfYWDSriWeQXcXj06p8H6vF6sy9LeX9xRRjTI7qDH FxwuMQIKGqgufXtxu0pxxcMqXTEUPZnxUWUvuFjjYvEmtO92+Ot/NuotV8JvRPwg2OnYjMJo dU1X7hzEs8djtgZG+t3FEGK3i1EJUQARAQABiQI8BBgBCgAmFiEET2gtkyoXlvgg8jTA37iR cpp2248FAlppZ0gCGwwFCQlnUwAACgkQ37iRcpp2248krg/9H896KtAQCAV0RcV3QqZ75iY5 pCxpRyxAaR0PjE5jiYV5gUHPCKtr9UPZt4Bi+bzNLQ2KJK6Rx4XNf5lQWopEo1IxtOiFPjkr QIpNkYmFWyOGpKpSIDhgsJpswZqxPDLpo+59GNlSUG6v3sMAnx+Gvtvqczkvg6UPDN/JYK75 BIGoCGZMyor1B0EmRYj98LdwjT95dQZXjZvWBDeIx+NxUZKoA7AlR/xgsN3PHGq4SApMLL0R /qbiLIzUPnTPt5sBs0peflVvMrtgIMiZ9FdYPE+VWy5+X2AmeFg6Zl5W76HQUP6eYZQV5abZ +iiW9lY1TmqsqpTIDu/ZMy7pLknxV5E1vQy+wsihluDYydaQ4HWoNaY7QFb+x7TsvjJRi+cH 7By4jxohTWUuaukuMmT0eEaesWJSraAmxsffqJwDpsi0chZskuXjEm9gX6rY7MhzOZl7Vz9F +6MYTtTmT1mpkLAMWf1/JuKUCfnSAHRlDxUOAG6QSJoHWAGqYy3XiF9bN63yQ6xllloSbbMv P9VW0e/iFKMKEIvfIvAg0IrlPcfKAGuuT1axwIU7da/N7LOcXyDDSEUuSzvXL/BkWyjxuLzd LY6eTvC6ZT/fA5iS/PAUj0WbrWNrHQtQ5OY2+al2v6JdLu/w6IZJCBpTosOAOzzmre+31fk1 HKwqd9xRxC8= Message-ID: <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> Date: Fri, 24 May 2019 21:01:15 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="WLNeo8O2zGGetR4XtV339ZQulPRmThdmG" Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 05:01:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --WLNeo8O2zGGetR4XtV339ZQulPRmThdmG Content-Type: multipart/mixed; boundary="3cksCVMh7janVvaxmy21FaJix3I3sUIuD"; protected-headers="v1" From: Melinda Shore To: add@ietf.org Message-ID: <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> Subject: Re: [Add] Browser Administrative Authority References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> --3cksCVMh7janVvaxmy21FaJix3I3sUIuD Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable To be honest I think the framing is perhaps not particularly correct. Right now browser vendors are mediating trust, anyway, through their root programs and other security policy enforcement mechanisms that are not being explicitly chosen by the user or the ISP. I'm really not sure what to make of "The problem is that some of the browser makers proposals are now changing this administrative authority hierarchy, but they haven=E2=80= =99t done the extra work of establishing administrative trust" given the current state of the web PKI. (Allowing, of course, that the current state of the web PKI may be the strongest argument against allowing browser vendors to own trust for name resolution.) I think the notion that they may be choosing a DNS resolver for web applications is not that much of a change from current practice. I don't really love this but it's where we are at the moment. I do, however, think that application authors understand their own security requirements better than ISPs do, and in that sense may be closer to the user's intentions than ISPs are (and indeed, user needs and ISP desires are often in conflict). In the absence of some standard way of allowing applications to discover their security environment I'm pretty good (with reservations) with them choosing their own DNS resolver and DNS transport. Melinda --=20 Melinda Shore melinda.shore@nomountain.net Software longa, hardware brevis --3cksCVMh7janVvaxmy21FaJix3I3sUIuD-- --WLNeo8O2zGGetR4XtV339ZQulPRmThdmG Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEET2gtkyoXlvgg8jTA37iRcpp2248FAlzozBsACgkQ37iRcpp2 2486Cw//VtrXiTq0GMBq/Wf6W7AB9LXxwv/Kop4P0I1zz/o4QNZqajtVAHnht9bd DSnW8VDsobjHInQD88etVr/WCzI8lzLWUnWngGXrstALDyy7VugibP140MPvbXMX Z+AS+b69kUPP7qaIdnsFkfZbz1I/P9j4agHGm/y68b08Up6P/+JKpuEHNJZJ142g doj5/LJWmamKpgo/Wh/nl38XDZdV866TXyjEIwpDvgT7GITdmLkH64ogJscSRDPj A0ZJJ5Q9ujR71/TGpDqWT60MQFTykJ4m7IFyhtG+xls+NlW929GnXYBLp7FkcpiX 200GaJ5qdzmS3+Y7rxB39jVplvFVncz036j2oylOFYsQbRk3r6EYWFlIWD98qLWl M/TSzzmE4syEWOyY9QhJylmp+dZamPIHTjQbSXKWXp6NXN0bvABaoDdwhRZ6e2+K kEe3SC51n2qefnxHaUmQhytJyEZwXurUhQlQLl7B1RlpS3uidgj1bzzYu6EUkdfo /+XgIgJloXXLOSgEc2JpshMLgrhvQbwZWjPlqfp2WHSIouGRo8vpoZ9J7MTjN4f6 iTm9tEJ+ZdKw6XvYjaeu9+GBKs1qu4rdsrVS2L6Kmnpq92U24OnK5vsLTcRewIaO YZwrMUptv7lCAKIC3JHc3jxLxe+ZoFPRRby5ou0C1nZFuGRP2W8= =4nva -----END PGP SIGNATURE----- --WLNeo8O2zGGetR4XtV339ZQulPRmThdmG-- From nobody Sat May 25 01:39:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E413120162 for ; Sat, 25 May 2019 01:39:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wPBxEoPBG4CB for ; Sat, 25 May 2019 01:39:36 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA58712018F for ; Sat, 25 May 2019 01:39:35 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 303206A299; Sat, 25 May 2019 10:39:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1558773573; bh=jZ7UsS17SB7P6ofHqIALqdOwrK7id/KYI9p+q1VUPHg=; h=From:Subject:Date:References:To:In-Reply-To:Cc:From; b=CmD+pNcgM4nqbA8YzA6V7pjJi7X0BEqVD7Cx3coLakA1sxPC8FULyxu9GmRqo7lp5 0V4yzr8vjVYNSyHt6f5o4YeFK0V8QFBcHxeZATZ9jtBGRIeSd15Mxy7PgnFpiiG74w JAZ7/byI8YH79Jl0HkLAE10VmoaPrCoAeu10ln8iZi0XIYk/6pHu5zFBJkJbY5l+Sl EEhFwqgmujCGaM3JBxrP0osvTsB6/OUEQ8ysMdptJQ7kvLI3L9qb9QILC0GtDz93B7 Pl+kKT/uQsXWgLuib8MMSwVU7GyOfeObCqsijLTPFWV2gpW2nTlCkoqT2zrvMYKzzH vw29+OuPGhDbw== Received: from appsuite-gw4.open-xchange.com (appsuite-gw4.open-xchange.com [10.20.28.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 23B4A3C0185; Sat, 25 May 2019 10:39:33 +0200 (CEST) X-Header: Open-Xchange USM Mailer (USM Version: 7.10.2-2, EAS Version: 7.10.2-1, Build d17f7426766e7d3851e61d3f8794f10d65e74221) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 From: "Cook, Neil" Mime-Version: 1.0 Message-ID: <1210679252.1299.1558773573082@appsuite-gw4.open-xchange.com> Date: Sat, 25 May 2019 09:39:32 +0100 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> To: Melinda Shore In-Reply-To: <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> Cc: add@ietf.org X-Mailer: Open-Xchange Mailer v7.10.2-Rev4 X-Originating-Client: USM-EAS Autocrypt: addr=neil.cook@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFY4uCMBCACanbgJRs8WrxZZmtPZEe1xEEaVXz2g4rs6H898mQ2bsSa3NmeyfHrY/C7cy9iVpOE Al5GQBmKnTx0mYe0Fm8KZYBh895lpGz1OkV8z4N+7fvYpkeiYSUrwmdxGyWm4/Ol4rWieBXUqSpQl1a O9dRC9YUDx6wE2kvUcT35y9PpsYOgZvmzNZ61NsQNemLeVnWCk2dWvF8BC63vRPzKNnnS1KSj7yY12X FiVFqyuuWC4U0w8xgmkw1QEGXi9lEjnq5nh2LP3+MhSS0SQUg4K/NQEFXxoe4Yi9WghC37Yfl58EGxy JSGNHruwJuHTTWjC0xPN6tL/iEg2u8wy7blFSqAlABEBAAG0J0Nvb2ssIE5laWwgPG5laWwuY29va0B vcGVuLXhjaGFuZ2UuY29tPokBQAQTAQIAKgQLCQgHBhUIAgkKCwUWAgMBAAKeAQIbAwWJEswDAAUDAA AAAAWCVji4IwAKCRCqPocTiyIWJ8ifB/4r81q323KtGT/g3UpKXd+WIo5g6P5LRvaHcY0gWaT9RbRlg JfvbjXN2oY9HFE0PQBPpFozBvEVe9dtt0MROW5wWRygntyI5ROvEsD9I91xOIqcrEBpkCEFFeyqbq8+ +Yw5k8+IFIEFduopookBbmO3/gbMxkXFJ/cIh+OUWCIxV/kphlgJCGavwJq00Zo42SzMF42u5C63yHn kfT6zSQU0Y9z26FW/tyq6O1eI9aUAcaiMxLCAyR8pD+Dl8jaFPxbS7hyAk3srrA9dXvuL3mw4w6uEiW FUkuZ6onolSXQhZCUQ6+7y51f2XfbEH/gwWl8uDMc6IlunyZPZljvzEx9buQENBFY4uCMBCACbgNhut /V5nDmAh1sD1fyg1NBK8/NBuv24HhrdlEYuupU0ByS5Y4qhi+8ptu7d5vYNgGTbptZuob8Y4QEZS1BR EI7shZozYjsJjSzmHtnM+A+G0dSsXCaSKoTppsYL67sM1Cs5goZjsHnbIXDJi8SuvXtnTYxgxgGPLpU Rtci4LGKYksGEGy7q+hGvMA3KNSSZAu1OOwwLE71/E12VgXWWW7NuaJs67qLBtXcc3XiyEn2tCHdyTx yIl8ucMieNhkZt0jAkXgH+wAV71OyrjHBOWdsm+giHH70aLeZyz+x5D+FEOgh3inwYnIXASdwEDXT+2 lb+IbqjLhkYx7MoKfajABEBAAGJATEEGAECABsFAlY4uCMCGwwECwkIBwYVCAIJCgsFCRLMAwAACgkQ qj6HE4siFid2cQf9G6sstAGA9CBNOWujVe/8YEFYNOSut5upwIRe50/GcBhEoh6p6sMIesaGEwsvwyh V212cpXyi7pLO//jN+swOjVGazz68CRyFLAx8Z6Uyyp5kbj/tnlC5mqoa6KZL36VZTNF3ow0fEm5qNq VD59BxCpOei8r9mMeM4b7rji0lBJC3f6d5hZos9xmCx9Z6ynvWM8nD/bk6XMUKTUEuXr0ESMTkSIXUe O2RYsDHHyrkolWfrJ3npSFaZ4YI7/vSfsTVKgbcVqGZ7Oz3cGeR4vT+9V2MySL9dJr5TFmubPxCVzyw iFyqDh51hDl/oTgzn0OJ2A98hvdCWJODbATdQzExVQ== Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 08:39:45 -0000 TWVsaW5kYSwNCg0KVGhlIHNwZWNpZmljIGV4YW1wbGUgdGhhdOKAmXMgYmVlbiByZWZlcnJlZCB0 byBpcyB1c2VycyAoZS5nLiBoZWFkIG9mIGhvdXNlaG9sZCkgd2hvIGhhdmUgY2hvc2VuIHRvIGVu YWJsZSBtYWx3YXJlIGZpbHRlcmluZyBhbmQvb3IgcGFyZW50YWwgY29udHJvbCBvbiB0aGVpciBi cm9hZGJhbmQgY29ubmVjdGlvbiAodGhpcyBhbHNvIGFwcGxpZXMgdG8gbW9iaWxlIG9yIGluZGVl ZCBvdGhlciB0eXBlcyBvZiBuZXR3b3JrKS4NCg0KVGhpcyBpc27igJl0IHNvIG11Y2ggYWJvdXQg d2hhdCBJU1BzIHdhbnQsIHRoaXMgaXMgYWJvdXQgd2hhdCB1c2VycyB3YW50IChhbmQgaW4gdGhl IHNwZWNpZmljIGNhc2Ugb2YgZmFtaWxpZXMsIGFib3V0IHdoYXQgdGhlIHJlc3BvbnNpYmxlIGFk dWx0IHdhbnRzKS4NCg0KU3VnZ2VzdGluZyB0aGF0IGFwcGxpY2F0aW9uIG1hbnVmYWN0dXJlcnMg aW4gdGhpcyBjYXNlIGFyZSDigJxjbG9zZXIgdG8gdGhlIHVzZXLigJlzIGludGVudGlvbnPigJ0g aXMgY2xlYXJseSBub3QgdHJ1ZSwgaW4gZmFjdCBpdCBpcyBxdWl0ZSB0aGUgb3Bwb3NpdGUuDQoN CkZvciBkZXZpY2VzIHRoYXQgaGF2ZSBhIGxheWVyZWQgYWRtaW4gbW9kZWwsIHRoZSBhZG1pbiBm b3IgdGhhdCBkZXZpY2Ugc2hvdWxkIHN1cmVseSB0YWtlIHByZWNlZGVuY2Ugb3ZlciBpbmRpdmlk dWFsIGFwcGxpY2F0aW9ucyAodGhpcyBiZWNvbWVzIHRyaWNraWVyIHdpdGggZGV2aWNlcyBsaWtl IGlQYWRzIGFuZCBzbWFydHBob25lcyB3aGljaCBvbmx5IGhhdmUgYSBzaW5nbGUgdXNlci9hZG1p bikuDQoNCk5laWwgDQoNClNlbnQgZnJvbSBteSBpUGhvbmUNCg0KPiBPbiAyNSBNYXkgMjAxOSwg YXQgMDY6MDEsIE1lbGluZGEgU2hvcmUgPG1lbGluZGEuc2hvcmVAbm9tb3VudGFpbi5uZXQ+IHdy b3RlOg0KPiANCj4gVG8gYmUgaG9uZXN0IEkgdGhpbmsgdGhlIGZyYW1pbmcgaXMgcGVyaGFwcyBu b3QgcGFydGljdWxhcmx5DQo+IGNvcnJlY3QuICBSaWdodCBub3cgYnJvd3NlciB2ZW5kb3JzIGFy ZSBtZWRpYXRpbmcgdHJ1c3QsIGFueXdheSwNCj4gdGhyb3VnaCB0aGVpciByb290IHByb2dyYW1z IGFuZCBvdGhlciBzZWN1cml0eSBwb2xpY3kgZW5mb3JjZW1lbnQNCj4gbWVjaGFuaXNtcyB0aGF0 IGFyZSBub3QgYmVpbmcgZXhwbGljaXRseSBjaG9zZW4gYnkgdGhlIHVzZXIgb3INCj4gdGhlIElT UC4gIEknbSByZWFsbHkgbm90IHN1cmUgd2hhdCB0byBtYWtlIG9mDQo+IA0KPiAgICAiVGhlIHBy b2JsZW0gaXMgdGhhdCBzb21lIG9mIHRoZSBicm93c2VyIG1ha2VycyBwcm9wb3NhbHMgYXJlIG5v dw0KPiAgICBjaGFuZ2luZyB0aGlzIGFkbWluaXN0cmF0aXZlIGF1dGhvcml0eSBoaWVyYXJjaHks IGJ1dCB0aGV5IGhhdmVu4oCZdA0KPiAgICBkb25lIHRoZSBleHRyYSB3b3JrIG9mIGVzdGFibGlz aGluZyBhZG1pbmlzdHJhdGl2ZSB0cnVzdCINCj4gDQo+IGdpdmVuIHRoZSBjdXJyZW50IHN0YXRl IG9mIHRoZSB3ZWIgUEtJLiAgKEFsbG93aW5nLCBvZiBjb3Vyc2UsDQo+IHRoYXQgdGhlIGN1cnJl bnQgc3RhdGUgb2YgdGhlIHdlYiBQS0kgbWF5IGJlIHRoZSBzdHJvbmdlc3QNCj4gYXJndW1lbnQg YWdhaW5zdCBhbGxvd2luZyBicm93c2VyIHZlbmRvcnMgdG8gb3duIHRydXN0IGZvcg0KPiBuYW1l IHJlc29sdXRpb24uKQ0KPiANCj4gSSB0aGluayB0aGUgbm90aW9uIHRoYXQgdGhleSBtYXkgYmUg Y2hvb3NpbmcgYSBETlMgcmVzb2x2ZXIgZm9yIHdlYg0KPiBhcHBsaWNhdGlvbnMgaXMgbm90IHRo YXQgbXVjaCBvZiBhIGNoYW5nZSBmcm9tIGN1cnJlbnQgcHJhY3RpY2UuICBJDQo+IGRvbid0IHJl YWxseSBsb3ZlIHRoaXMgYnV0IGl0J3Mgd2hlcmUgd2UgYXJlIGF0IHRoZSBtb21lbnQuDQo+IA0K PiBJIGRvLCBob3dldmVyLCB0aGluayB0aGF0IGFwcGxpY2F0aW9uIGF1dGhvcnMgdW5kZXJzdGFu ZCB0aGVpcg0KPiBvd24gc2VjdXJpdHkgcmVxdWlyZW1lbnRzIGJldHRlciB0aGFuIElTUHMgZG8s IGFuZCBpbiB0aGF0IHNlbnNlDQo+IG1heSBiZSBjbG9zZXIgdG8gdGhlIHVzZXIncyBpbnRlbnRp b25zIHRoYW4gSVNQcyBhcmUgKGFuZCBpbmRlZWQsDQo+IHVzZXIgbmVlZHMgYW5kIElTUCBkZXNp cmVzIGFyZSBvZnRlbiBpbiBjb25mbGljdCkuICBJbiB0aGUNCj4gYWJzZW5jZSBvZiBzb21lIHN0 YW5kYXJkIHdheSBvZiBhbGxvd2luZyBhcHBsaWNhdGlvbnMgdG8gZGlzY292ZXINCj4gdGhlaXIg c2VjdXJpdHkgZW52aXJvbm1lbnQgSSdtIHByZXR0eSBnb29kICh3aXRoIHJlc2VydmF0aW9ucykg d2l0aA0KPiB0aGVtIGNob29zaW5nIHRoZWlyIG93biBETlMgcmVzb2x2ZXIgYW5kIEROUyB0cmFu c3BvcnQuDQo+IA0KPiBNZWxpbmRhDQo+IA0KPiAtLSANCj4gTWVsaW5kYSBTaG9yZQ0KPiBtZWxp bmRhLnNob3JlQG5vbW91bnRhaW4ubmV0DQo+IA0KPiBTb2Z0d2FyZSBsb25nYSwgaGFyZHdhcmUg YnJldmlzDQo+IA0KPiAtLSANCj4gQWRkIG1haWxpbmcgbGlzdA0KPiBBZGRAaWV0Zi5vcmcNCj4g aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCg== From nobody Sat May 25 04:42:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C93812001A for ; Sat, 25 May 2019 04:42:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8NIRd1tAaJnd for ; Sat, 25 May 2019 04:42:53 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 016A7120099 for ; Sat, 25 May 2019 04:42:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 1BE4EBE47; Sat, 25 May 2019 12:42:50 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iwObC0ONanZL; Sat, 25 May 2019 12:42:48 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 17F80BE2E; Sat, 25 May 2019 12:42:48 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1558784568; bh=0UWsYX0vmRu7ouSR7QT53tNxShRDH8ecQLXyiJv14vo=; h=To:References:From:Subject:Date:In-Reply-To:From; b=hZIJXuucPAdsu340VMClCEc37Nc55vww4JXfOlnKr6qULoiVHB65xL4sDhk4OwYSm vCd2718jZpsoH0lLJGnRnZvnWxEz45dgdDndkEtvx/FyCBwDobz/GqTjfHJEuoNKD4 72xWof46B3n6pGmDxFzrPpLcOz1BriGUujeGt8fM= To: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> Date: Sat, 25 May 2019 12:42:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="mG7t3fKzEgOsARqtK4Erj4zoOFj0KY3eS" Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 11:42:57 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --mG7t3fKzEgOsARqtK4Erj4zoOFj0KY3eS Content-Type: multipart/mixed; boundary="theaoMy63vXXc8fwpas0GVp4SHdXLvApj"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" Message-ID: <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> Subject: Re: [Add] Browser Administrative Authority References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> In-Reply-To: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> --theaoMy63vXXc8fwpas0GVp4SHdXLvApj Content-Type: multipart/mixed; boundary="------------BA2A23365C677A2C1E075E92" Content-Language: en-GB This is a multi-part message in MIME format. --------------BA2A23365C677A2C1E075E92 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Glenn, On 24/05/2019 15:48, Deen, Glenn (NBCUniversal) wrote: > HI everyone, >=20 > I=E2=80=99ve been thinking though some of the issues with the proposal = DoH > deployment in browsers. > =20 > A big part of the tug of war here is the authority precedence for > advanced security and network settings that should be followed. >=20 > Historically, it=E2=80=99s been at the device level =E2=80=93 which mea= nt the device > administrator, which could choose delegate choices to a specific DNS > resolver operator, or to the Network DHCP provided settings. (Some) VPNs don't match that history. There are probably other examples but those never caused such debate. Main thing is I don't think we can ignore the issue that the scale of the potential (not yet actual) change is part of what's causing angst, and not just the functional/architectural/control change. I think that means that attempts such as yours (which is fair, though I'd quibble a bit about some details) to analyse this functionally are naturally likely to devolve back down to the kind of well-meant whataboutery [1] that we've seen before and are starting to see repeated in this thread. Secondly, while I'd love to see OSes offer new APIs so that applications could e.g. tell if DoT is in use, ISTM that we can't expect that application developers who want better DNS privacy will hold off on use of DoH and wait for such APIs to be offered across the various platforms about which they care. So I'm not sure there's a viable approach that largely preserves the status-quo wrt controls over DNS even though it'd be a great thing if OSes were providing such APIs to applications. I think that means that this debate can't really end up at the status-quo if applications do want to use our DNS privacy mechanisms. That doesn't mean we end up with your "new" hierarchy but it may mean that we have to accept that the "old" hierarchy is going to be changed for sure and that there's little point in trying to fully maintain that. Cheers, S. [1] https://en.wiktionary.org/wiki/whataboutery --------------BA2A23365C677A2C1E075E92 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------BA2A23365C677A2C1E075E92-- --theaoMy63vXXc8fwpas0GVp4SHdXLvApj-- --mG7t3fKzEgOsARqtK4Erj4zoOFj0KY3eS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlzpKjcACgkQWrL68XsX K+rhIBAAo80Gv6irxTyrKqi0jQbd4IpQUn159j5aYCxBbkPnFaolf9Qup86zXa9q 4ca7fJ5ghOxciFTY/L8COxDYPv0KRwWRRC2X9vnhXM8rLAsUXrRjLcqMN/r3ol04 vUXnbSX1q87RpPScvJpCX/cbL7WqouNFo0VLIcWMFyr5edtJqJj6HEnQrOysGbCT KBd51MqeUgDsEDcuZLt4Z4tTbsSkM+53an+czoY0ZUL+YzuI3ttfTDGR76hse4MW gkjZu7gJyAVhFJOFmlJ0dWZAkdmjFnQMll04fgQ5j6QpghdbFGt8/m0krVNP2Jmh fwKxv/yZWRLU5agrAIp4eCKMvbuQjBoQGWna0F4EkeMc5LiES7Ej3x39QJouc/AM 1k1QDyLH4mLnLGG1BHVPXDyRNlltsj0mokFMpLGoBg5z7jAehDEBIlx86yDYp5+O f6geG6EUDGpZoBAF+SZ/eqkZFVx7jXEcYSKVvDbNWSHlKzpk/+LutX/44jCzvbb3 4uZ7Y6pvLe/dUDIJGybq+xvxvDIMOQzby4ZEE9FD9QxpMQWU4GSAcIB3Yndvz6Y0 YgIRs2YKxqoQbi3xLnlUa5JecKZ5RLxaPqInVOg2VHr1aCN98U0MpubQJjl/sWEa RGjXLTJnvIuP9+m7bFQhxGONxxQ2dQoy0vOYyDMlCCHEu9jjHGI= =I6/7 -----END PGP SIGNATURE----- --mG7t3fKzEgOsARqtK4Erj4zoOFj0KY3eS-- From nobody Sat May 25 07:09:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6684012004E for ; Sat, 25 May 2019 07:08:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dit8cF4zOd7L for ; Sat, 25 May 2019 07:08:57 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D93BE120021 for ; Sat, 25 May 2019 07:08:56 -0700 (PDT) Received: from pps.filterd (m0048207.ppops.net [127.0.0.1]) by m0048207.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4PDwHkt021546 for ; Sat, 25 May 2019 10:08:53 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0048207.ppops.net-00176a04. with ESMTP id 2sq0ydm0qq-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Sat, 25 May 2019 10:08:53 -0400 Received: from unknown (HELO potemwp00032.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 25 May 2019 10:06:18 -0400 Received: from potemwp00031.mail.tfayd.com (100.124.56.55) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 25 May 2019 08:08:51 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00031.mail.tfayd.com (100.124.56.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 25 May 2019 08:08:50 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Sat, 25 May 2019 08:08:50 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcaZ8HgiA///EOcU= Date: Sat, 25 May 2019 14:08:50 +0000 Message-ID: <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com>, <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> In-Reply-To: <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-25_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905250099 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 14:09:00 -0000 Hi Stephen, > On May 25, 2019, at 4:42 AM, Stephen Farrell = wrote: >=20 > Some) VPNs don't match that history. There are probably other > examples but those never caused such debate I think one important difference with VPNs is that the device admin likely = chose to install them since many of them require admin authority to install= . In most cases, the user or admin also had to choose to configure and tur= n them on. So it would be working within the classic administrative hierar= chy. I suspect, that many would be very upset, If there was a situation where an= application developer decided on their own to quietly install a user space= VPN and then route all the app=92s traffic through VPN endpoints also chos= en by developer without first getting the users or administrators agreement= and full awareness. =20 Further, if the app and it=92s VPN resulted in a variety of other things br= eaking that were important to the user, such as security and machine config= uration, I suspect the application would soon be the subject of massive deb= ate.=20 Hence the debate this is causing. To be clear, my analysis was not in any way expressing a concern for the Do= H protocol. It was to highlight that the proposed application level change= s were violating a well established security and device management architec= ture and with that choice comes unintended side effects. =20 We have examples of such conscious choices to bypass established hierarchie= s in other contexts - If a network protocol did something similar, we=92d c= all it a layer violation. Programmers have encapsulation violation. =20 With each choice to violate architectural hierarchies, there is often a dri= ving motivation to get something done; For those of us who have crossed the= line and done such things, the lesson of needing to properly and fully dea= l with unintended side effects is something I for one have come to learn an= d respect. I am also worried about the notion that we need just push it through, or th= at we can=92t wait to do it right, because there is a urgent need to deploy= this particular application level change in choice of DNS resolvers and pr= otocol selection. It worries me a for a couple reasons, not the least of= which is it means that time won=92t be taken for studying the possible sid= e effects and dealing with them properly. We=92ve already identified the unintended side effect of breaking filters f= or child protection and things like malware sites. =20 There are and will be others. Going back to VPN example at the start of this note. There is likely uninte= nded side effects with VPNs as they often depend on DNS configurations and = resolver choices in order to work seamlessly. Certainly secure corporate e= nvironments often rely of split DNS for their VPNs. Having a browser level= DNS that resolves address differently than the VPN expects may cause a lot= of unexpected and hard to diagnose behavior for the users. Identifying, understanding, and dealing with unintended side effects seems = like an important consideration for something this impactful. This is not simply a case of let=92s be perfect before doing anything. It = is very much a case of wanting to avoid major disruption for users that we = should have seen coming if we took the time needed.=20 FWIW - My suggestion of an OS or device level means for managing and respec= ting the administrators choice to follow doesn=92t necessarily depend on th= e OS manufacturer to accept changes. Most OSs have the means to have appli= cation level settings that require device administrator privilege to be set= and managed. =20 Regards, Glenn = From nobody Sat May 25 07:40:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BD2412002E for ; Sat, 25 May 2019 07:40:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qgjiQ9wvHbFD for ; Sat, 25 May 2019 07:40:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EAD7120006 for ; Sat, 25 May 2019 07:40:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A94DFBE47; Sat, 25 May 2019 15:40:23 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LGp7LHx8x2qM; Sat, 25 May 2019 15:40:21 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1C5E2BE2E; Sat, 25 May 2019 15:40:21 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1558795221; bh=Hpnqdeps4n9GB9P7+ghcWA4QBdj2kxD+AWPI4wOLEdI=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=TPeRE3YArM3sQOPXor5cx92dbrN1NZfpyH7+eziLCX1vUNN67eGRsTZztGoYxgusv 97F53EiuGmn90b87effBW7cAmr1+qy0LMnJiVxO3Pni7gZIgtLAgvyu6GbczKg1KAF Uz8yQWwxz2s+3nbVAIt527QAzmaWrQ9xw5LPrOF4= To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> Date: Sat, 25 May 2019 15:40:19 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MWcy5uZhmSdfJQKLcTzN2KsKBCZeUDa12" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 14:40:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MWcy5uZhmSdfJQKLcTzN2KsKBCZeUDa12 Content-Type: multipart/mixed; boundary="cxn0akICT0FOv66POxk6l0jvQWnfz7aCD"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" Message-ID: <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> In-Reply-To: <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> --cxn0akICT0FOv66POxk6l0jvQWnfz7aCD Content-Type: multipart/mixed; boundary="------------1449E1518E71849C30DE6180" Content-Language: en-GB This is a multi-part message in MIME format. --------------1449E1518E71849C30DE6180 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Coupla comments and a question at the end... On 25/05/2019 15:08, Deen, Glenn (NBCUniversal) wrote: > Hi Stephen, >=20 >> On May 25, 2019, at 4:42 AM, Stephen Farrell >> wrote: >>=20 >> Some) VPNs don't match that history. There are probably other=20 >> examples but those never caused such debate >=20 > I think one important difference with VPNs is that the device admin > likely chose to install them since many of them require admin > authority to install..=20 Browser installs also do; or if shipped with the device then the device vendor made that choice so I see zero difference there. > In most cases, the user or admin also had to > choose to configure and turn them on. So it would be working within > the classic administrative hierarchy. >=20 > I suspect, that many would be very upset, If there was a situation > where an application developer decided on their own to quietly > install a user space VPN and then route all the app=E2=80=99s traffic t= hrough > VPN endpoints also chosen by developer without first getting the > users or administrators agreement and full awareness. >=20 > Further, if the app and it=E2=80=99s VPN resulted in a variety of other= > things breaking that were important to the user, such as security and > machine configuration, I suspect the application would soon be the > subject of massive debate. >=20 > Hence the debate this is causing. Gotta say I don't agree that the above's that valid. Minor VPN products misbehave all the time in way worse ways and don't cause this level of debate. I think we ought be clear that the volume or traffic and number of users involved is why we're getting this level of debate, not architectural (im)purity. > To be clear, my analysis was not in any way expressing a concern for > the DoH protocol. It was to highlight that the proposed application > level changes were violating a well established security and device > management architecture and with that choice comes unintended side > effects. Sure. >=20 > We have examples of such conscious choices to bypass established > hierarchies in other contexts - If a network protocol did something > similar, we=E2=80=99d call it a layer violation. Programmers have > encapsulation violation. >=20 > With each choice to violate architectural hierarchies,=20 Using terms like "violate" is likely to irritate those in favour of applications making these choices, just like network operators get irritated when folks describe the network as being hostile. Neither term is wrong but it's not particularly useful for us to irritate one another either;-) > there is often > a driving motivation to get something done; For those of us who have > crossed the line and done such things, the lesson of needing to > properly and fully deal with unintended side effects is something I > for one have come to learn and respect. >=20 > I am also worried about the notion that we need just push it through, Push what through? DoH is done as an RFC. What other "it" do think is needed? (That might result from this debate.) Cheers, S. > or that we can=E2=80=99t wait to do it right, because there is a urgent= need > to deploy this particular application level change in choice of DNS > resolvers and protocol selection. It worries me a for a couple > reasons, not the least of which is it means that time won=E2=80=99t be = taken > for studying the possible side effects and dealing with them > properly. >=20 > We=E2=80=99ve already identified the unintended side effect of breaking= > filters for child protection and things like malware sites. >=20 > There are and will be others. >=20 > Going back to VPN example at the start of this note. There is likely > unintended side effects with VPNs as they often depend on DNS > configurations and resolver choices in order to work seamlessly. > Certainly secure corporate environments often rely of split DNS for > their VPNs. Having a browser level DNS that resolves address > differently than the VPN expects may cause a lot of unexpected and > hard to diagnose behavior for the users. >=20 > Identifying, understanding, and dealing with unintended side effects > seems like an important consideration for something this impactful. >=20 > This is not simply a case of let=E2=80=99s be perfect before doing anyt= hing. > It is very much a case of wanting to avoid major disruption for users > that we should have seen coming if we took the time needed. >=20 >=20 >=20 > FWIW - My suggestion of an OS or device level means for managing and > respecting the administrators choice to follow doesn=E2=80=99t necessar= ily > depend on the OS manufacturer to accept changes. Most OSs have the > means to have application level settings that require device > administrator privilege to be set and managed. >=20 > Regards, Glenn >=20 --------------1449E1518E71849C30DE6180 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------1449E1518E71849C30DE6180-- --cxn0akICT0FOv66POxk6l0jvQWnfz7aCD-- --MWcy5uZhmSdfJQKLcTzN2KsKBCZeUDa12 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlzpU9QACgkQWrL68XsX K+qmzw/+Kiv8P/EnH9cKAegzWtAYQmzB6DGlmDr0xZNA8/GcGkUlXdxbAdRv11WC 10I/rh8yAVs+ITX5h3l/LYPogQRfGNSlUd14snJ9wR2+ow3uZASqpE1VhCJGkL8q +BDQIqfwVr2GjnUynLh5DPlYQBeANRtuOZkUP7ut8X5BsEjVCT3Lux6dhJvXu+qG kFxr66xjexuRfDTQta8ypxanoA5XoaVY00keRLYJTi+jLJydQtIoG0kx/JroIwd2 NwHIqF+4zxA3bOn9fukfNfP6mfNp07KtuXUsZh24VRfMVa65oZKg/+kZBcOFN0vo OPFqyTl8pQ5Nxit2ULAmcaRZOVpXJgpkaSMlvCxiL7CgO7IxZbxL3Dqhhgu6AAlz fz1QoZZrfRCJNaukVD/y2chl1t5ctjtkJszVW1PEtVZbsNWKD1gSmFI1QttTQm4u n2IuBfMmtVAEb6xWutCDO42HE57fqj2Y6xUkAc+ZVF4Gk0xQlDPmehTcKm8DOiuK dbPb/i1ku0ottrdMBA2P5NHXNl4I5uV2atuMe4ZmlhKFyyoao8QtnLz2ZLreJ0R5 MCz9ZEPtYrjsifbpzM8Ts6fPACKVuU213sbK6c7EaH9jwi9FlG3CT2rIL1aRhnct AMpUShhw5nyudbAN8HVhvRHDn6oLN2/NvQm2nZPvbStpMADQz4A= =tGBM -----END PGP SIGNATURE----- --MWcy5uZhmSdfJQKLcTzN2KsKBCZeUDa12-- From nobody Sat May 25 07:48:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4633D120006 for ; Sat, 25 May 2019 07:48:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zuPHFIb6h-Ol for ; Sat, 25 May 2019 07:48:46 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 000E3120044 for ; Sat, 25 May 2019 07:48:45 -0700 (PDT) Received: from pps.filterd (m0048207.ppops.net [127.0.0.1]) by m0048207.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4PEmHjt020296 for ; Sat, 25 May 2019 10:48:42 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by m0048207.ppops.net-00176a04. with ESMTP id 2sq0ydma7x-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Sat, 25 May 2019 10:48:41 -0400 Received: from unknown (HELO potemwp00019.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 25 May 2019 07:48:40 -0700 Received: from potemwp00030.mail.tfayd.com (100.124.56.54) by potemwp00017.mail.tfayd.com (100.124.56.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 25 May 2019 08:48:39 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00030.mail.tfayd.com (100.124.56.54) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 25 May 2019 08:48:38 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Sat, 25 May 2019 08:48:38 -0600 From: "Deen, Glenn (NBCUniversal)" To: Melinda Shore CC: "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcaZ7rdiAgAA/iHg= Date: Sat, 25 May 2019 14:48:38 +0000 Message-ID: <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com>, <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> In-Reply-To: <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-25_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=901 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905250104 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 14:48:48 -0000 Hi Melinda, > On May 24, 2019, at 10:01 PM, Melinda Shore wrote: >=20 > To be honest I think the framing is perhaps not particularly > correct. Right now browser vendors are mediating trust, anyway, > through their root programs and other security policy enforcement > mechanisms that are not being explicitly chosen by the user or > the ISP. I'm really not sure what to make of >=20 > "The problem is that some of the browser makers proposals are now > changing this administrative authority hierarchy, but they haven=92t > done the extra work of establishing administrative trust" >=20 I don=92t see this as equivalent to the trust mediation that browser makers= do through their certificate root programs or security settings because th= ose things are very much web application domain choices and are entirely ap= propriate to be controlled in the context of the web browser. Those trust= certificates are for web servers and applications, and so are in exactly t= he right place. DNS has traditionally been a network service and as such it=92s configurati= on and settings have been a network level domain choice made by the device = administrator. While it is possible for the device administrator to choo= se to delegate network choices to the network, it always starts with the de= vice administrator to make the choice. In the case of browsers, there is an established means for the root list to= be maintained securely, and to be update when needed. That=92s fundamenta= l to the trust model working. If it were possible for this root list to be = altered outside of that means and it=92s associated integrity controls, the= n the trust model would be broken because it would be possible for unapprov= ed roots to be installed. By pulling the DNS up into the application settings, it=92s also abandoning= the security model for administration of those settings, the same as if th= e root certificates were pulled out and say placed into a simple file in th= e user=92s file system. =20 It=92s the removal of information from its established management and prote= ction context that causes the problem I pointed out. > given the current state of the web PKI. (Allowing, of course, > that the current state of the web PKI may be the strongest > argument against allowing browser vendors to own trust for > name resolution.) ;) >=20 > I think the notion that they may be choosing a DNS resolver for web > applications is not that much of a change from current practice. I > don't really love this but it's where we are at the moment. >=20 > I do, however, think that application authors understand their > own security requirements better than ISPs do, and in that sense > may be closer to the user's intentions than ISPs are (and indeed, > user needs and ISP desires are often in conflict). In the > absence of some standard way of allowing applications to discover > their security environment I'm pretty good (with reservations) with > them choosing their own DNS resolver and DNS transport. My analysis didn=92t grant any implicit authority unto ISPs. I don=92t se= e this as the root debate here. Instead, it=92s about that authority for ma= king such choices starts with the device administrator, then the user, and = only in cases where the administrator chooses to do so do the network=92s p= rovided settings come into play. Also, when I say network settings I do not simply mean the ISP. In my home= network my router provides DNS settings that I as the router and administr= ator explicitly chose. Yet, each device administrator can choose to set th= eir own. None of that is ISP controlled. So this isn=92t about the ISP vs browser application maker being more conne= cted to the user=92s wants, However, with the current proposals of it being done by default at a browse= r app level using default settings pushed down by the application maker, I= =92m going to be in the position of having to watch the configuration of br= owser apps on each and every device that I manager, or provide support to (= as I=92m the IT support desk at home) to make my home setting desires match= what the browser app uses, and I=92m going to have to do it again and agai= n at each update to ensure that the app didn=92t change them again. That= =92s a lot of work for users who want nothing more than to have their admin= istrative choices respected.=20 Regards,=20 Glenn=20 From nobody Sat May 25 08:10:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C711A1200B1 for ; Sat, 25 May 2019 08:10:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j4weoiGcpHyq for ; Sat, 25 May 2019 08:10:25 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD6A01200A2 for ; Sat, 25 May 2019 08:10:25 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x4PF2sMs034337 for ; Sat, 25 May 2019 11:10:22 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by mx0b-00176a04.pphosted.com with ESMTP id 2sq0ydcfrb-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Sat, 25 May 2019 11:10:22 -0400 Received: from unknown (HELO potemwp00018.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 25 May 2019 08:10:21 -0700 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 25 May 2019 09:10:19 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Sat, 25 May 2019 09:10:19 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: Browser Administrative Authority Thread-Index: AQHVEwfN3+iDxqeQt0KVxhcrUzj4lKZ78d8X Date: Sat, 25 May 2019 15:10:19 +0000 Message-ID: <51A9951E-CC50-4D02-903B-5EFD1691ED32@nbcuni.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com>, <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> In-Reply-To: <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-25_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905250106 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 15:10:28 -0000 Howdy, inline.. > On May 25, 2019, at 7:40 AM, Stephen Farrell = wrote: >=20 >=20 > Hiya, >=20 > Coupla comments and a question at the end... >=20 >> On 25/05/2019 15:08, Deen, Glenn (NBCUniversal) wrote: >> Hi Stephen, >>=20 >>> On May 25, 2019, at 4:42 AM, Stephen Farrell >>> wrote: >>>=20 >>> Some) VPNs don't match that history. There are probably other=20 >>> examples but those never caused such debate >>=20 >> I think one important difference with VPNs is that the device admin >> likely chose to install them since many of them require admin >> authority to install..=20 >=20 > Browser installs also do; or if shipped with the device then > the device vendor made that choice so I see zero difference > there. The difference is in the administrative level needed to make changes, and h= ow that fits with the administrators and user=92s expectations, as well as = expectations of working with the understood administrative model of authori= ty. >=20 >> In most cases, the user or admin also had to >> choose to configure and turn them on. So it would be working within >> the classic administrative hierarchy. >>=20 >> I suspect, that many would be very upset, If there was a situation >> where an application developer decided on their own to quietly >> install a user space VPN and then route all the app=92s traffic through >> VPN endpoints also chosen by developer without first getting the >> users or administrators agreement and full awareness. >>=20 >> Further, if the app and it=92s VPN resulted in a variety of other >> things breaking that were important to the user, such as security and >> machine configuration, I suspect the application would soon be the >> subject of massive debate. >>=20 >> Hence the debate this is causing. >=20 > Gotta say I don't agree that the above's that valid. Minor > VPN products misbehave all the time in way worse ways and > don't cause this level of debate. I think we ought be clear > that the volume or traffic and number of users involved is > why we're getting this level of debate, not architectural > (im)purity. Certainly, the scale of users affected here is raising the level of attenti= on and impact.=20 Some minor VPN not working isn=92t really going to affect many users or cau= se much disruption. But at scale it makes a lot of users unhappy, and can = also cost organizations a lot of money due to support calls and problems. >=20 >> To be clear, my analysis was not in any way expressing a concern for >> the DoH protocol. It was to highlight that the proposed application >> level changes were violating a well established security and device >> management architecture and with that choice comes unintended side >> effects. >=20 > Sure. >=20 >>=20 >> We have examples of such conscious choices to bypass established >> hierarchies in other contexts - If a network protocol did something >> similar, we=92d call it a layer violation. Programmers have >> encapsulation violation. >>=20 >> With each choice to violate architectural hierarchies,=20 >=20 > Using terms like "violate" is likely to irritate those in > favour of applications making these choices, just like > network operators get irritated when folks describe the > network as being hostile. Neither term is wrong but it's > not particularly useful for us to irritate one another > either;-) Sorry, my use of the word =93violate=94 was chosen because it=92s the term = of art for when protocol layers and data encapsulation in objects is bypas= sed or not observed. It was not in anyway meant to irritate. >=20 >> there is often >> a driving motivation to get something done; For those of us who have >> crossed the line and done such things, the lesson of needing to >> properly and fully deal with unintended side effects is something I >> for one have come to learn and respect. >>=20 >> I am also worried about the notion that we need just push it through, >=20 > Push what through? DoH is done as an RFC. What other "it" do think > is needed? (That might result from this debate.) I was responding to your original notes assertions that I read to be about = not getting stuck in a perpetual debate in search of perfection. (Because = the ietf never does that!)=20 My understanding was that this list was being used to additionally discuss = and explore the impacts and consequences of proposed DoH architectural depl= oyment choices. =20 So what I was saying is that I hope the community of internet and web archi= tects and those who build the applications and systems take the time to get= the proposed deployments right because the scale of the impact of the choi= ce of deployment approach is very very large here and it will amplify any u= nintended side effects. -Glenn=20 From nobody Sat May 25 12:17:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2B711200FD for ; Sat, 25 May 2019 12:17:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F7M6rTjcRh-Z for ; Sat, 25 May 2019 12:17:11 -0700 (PDT) Received: from mail-pl1-x629.google.com (mail-pl1-x629.google.com [IPv6:2607:f8b0:4864:20::629]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE0BD1200B6 for ; Sat, 25 May 2019 12:17:11 -0700 (PDT) Received: by mail-pl1-x629.google.com with SMTP id d21so5476590plr.3 for ; Sat, 25 May 2019 12:17:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=QbgsYVQWMaUGgxuoa7HAOI7N8CQIDA5zC6ck2SE6uxU=; b=aMbclumMDV7bLZtn8JFIeGuVinUM/eNgVeiWgbyqAi5cEQMKT+qqIAzwCb4I7y83Sh thwZZn+MsEEgdbz+YWYCGlvCjiL0TtEIpxl/1Op/ZhOCjzz1Jtf52g14RSuS3ApI/bh6 D1Q57Btvr2H2UpE/owvuRoSQrouIGN1cCU68j0kDhn4jOkEAtoCUI9tiHFB0aZzDsDR3 T3NnMm8099H8Y8U95vpXDx3s9d9HsTbxHgqdxy0i1MM4Saf3UFr69a9PFzsNmPsqKCsE 49/Lj1fzeVoG+Hur73JeafvFO0wHzmljLSXzxudRGb/cdMUuDlZokvf7HuTb9rQjLVm+ GAKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=QbgsYVQWMaUGgxuoa7HAOI7N8CQIDA5zC6ck2SE6uxU=; b=lwiMqimZMU6pJPjAI+wFkRvgxrodeJOkMh7yJKNP8D3FqxLxYrutu6ERFRTedAX8R/ WEa3iF4xGajJXk16qDw+HSIDv9M1e2uV/ZPT4RaQd+KbPNoPnWmLnH9U5e1ykpV2qOIV Bfk7qWx1Kz+yP7ZKw5as/tw2Xel7833XlRv/PmkJ4LoVp69RxekRxDADEbU9O4z5Dg5o p1PdIgtUo9LfsNhwc06apW50hS7BkgQxuLD7nIROrK72v82PGQOcVqahmIhHCckQ2nWy W089XpbrYdab1bEs1EqB+hJC0YtHamKlZR7OAMifdkKMia/WfV/KmV8smB69YUryki/X ABvQ== X-Gm-Message-State: APjAAAVd1+c+dFkWGJIdoCGGZIdApWYs+vqNn6KjFa92zQdn1fROUeDD np/Bk212EvTTVEulMgs/A/aJRnV9uQ== X-Google-Smtp-Source: APXvYqxo43YqIzGNYGeNyo1aUWzc10mqFTIJo+18aCo2w1hE9vkyaK61+HmYsdscBdmh/Yq0F1PLHg== X-Received: by 2002:a17:902:a405:: with SMTP id p5mr13471170plq.51.1558811831052; Sat, 25 May 2019 12:17:11 -0700 (PDT) Received: from aspen.local (63-140-65-22.dynamic.lte.acsalaska.net. [63.140.65.22]) by smtp.gmail.com with ESMTPSA id c185sm6774086pfc.64.2019.05.25.12.17.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 25 May 2019 12:17:10 -0700 (PDT) To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> From: Melinda Shore Openpgp: preference=signencrypt Autocrypt: addr=melinda.shore@nomountain.net; prefer-encrypt=mutual; keydata= mQINBFppZ0gBEADFwxAi5szDOsM/6+CH4pbYTX7D+2gjLY4xEE7ydQcAF1WVLvcWXrpZM0GO /eA4N1PJ+OT5o8o9zVr7izMJkiLwcnQmxHdlYgZ9E+Cm8hDtMyEPBQwsYTkE5kpbGCmBAZ+W rHNHjvDg366uZQHzJejenB1/V4+rxMZs1Ak34Az2MVOz9Doecaiadpw3NpH3+1VXY/qilqnM lznINSANqD0ktxB/CVKjxl3/K5JnVnLp0h2kiUqt19hQPX2JmLcgaHzu+Ceb34/HZWhs0CiF c4auhQ3A9PcccOprQh6IGW1xo6RP3OEbeRFqeovgBWS+DIWzMIM0a3G2LDid0889QYwEv0zZ RPDCcF3g15mlkeUUmwKQ6eAagPyTqLtTiOKULqy9bQahyX2eqlySrF+HqlwGeNoG+A4l1Z2Y S7NCBLPIzUk2RuSKMBaKw86ORzvg2Advrw4bdv7kbDkArGzywky61SEB/q+GqR466mekXx2F O+m8RuoSnWrBsKvD/bhELHcneorIBleGz+VL7i5adU0rIydG3jPTfUeXoCZIeNx1LannxnAR ihKdh5+FE26WiiK6VmZWkvFjaPFwWGjvAsi82Pd9QgHhnG/XzINpXw/3HF4wtBTU5nIExMzC +FbJxCPq1kXpqSxJqg7hgUFvD5jUD9lpN5Br/S2dUgJj95bbPQARAQABtCxNZWxpbmRhIFNo b3JlIDxtZWxpbmRhLnNob3JlQG5vbW91bnRhaW4ubmV0PokCVAQTAQoAPgIbAwUJCWdTAAUL CQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBE9oLZMqF5b4IPI0wN+4kXKadtuPBQJaaXRaAAoJ EN+4kXKadtuPVioP/3nVzx33yjiEtqLKTEHwofnLT15CV5wAcGa0DTbqgiomVKzSRkkhbF3Z KIHYrnjVpTcYJuW+PmFSIjNizNVr+vvjNP6ptRqx5orWmK4EBe/B9mrpmIshxUwkYr46uwN4 h06xJS3KCzhfhSsnesH5vlGBkUod0+nQhbSLyLRpxmaKaeAl4dxFSBLU0vUJMLH8PXTZVNof 5Yo+ThqCzu1pwOkBQ8gST2J6zdy4PjU9ENQ9RLAamlAG/6rGHEKLFcnUpEg7Tcu1hSzAsqR8 kjX2Prpu4A9DyLCjTOvfOPQa8WjZy18ZdYOxuPxdrTazeCRVJIvYRflhBCZb744jhMyfAiSW eckwRBVSCnBuvWBJl9Ua1wp8SOUXXhgGI8WGvSkvul6kKSkHQKDggd4cojAhxWLfvmjxn5pz 0BNbvrEBGqgWwO1ZMuJpmv3P8YK5Aytsl85NZoMMUJIDxEQhBUgYz5QTQANBKPi8RsfOntho rhzXLqnPPQcE4Xf9O9XIyy077F0JoyiPx74Zsl1dTxmT73pezpfhKUQR7/QlmJ/FAADpb6SO V0tlgBtR6FAZToBYPDiss57AcKM1zzyJ7sHIZkxQelykYSet6hp2WGcwMXQveWqFMQ4fiGQx XNEPO+KZKNj+0sfINzSLP88O5TniM/l/JrjZZNT/lVAQDTdkCBGyuQINBFppZ0gBEACgZuM1 8ghzSuhuv+n0kWyWCeEWrx9Ey03EgFj5alBt55+OLv3dOsdyBHJxjtd0cZS1XaKZlgr1YZ0O pQNv/Wyy8uSW2BZ6hyG1SKN9/1MmfJLNnjjxaBQP4yaMwDdS3wX7hoWY19IpVPZHYDR35FAg SnG/s6we+IOITM1TJoOJs4+ygeK5dC7LfRoj+lkEHYrTcglYVuwsyK2FNz/sF8kJW1fEZHM6 6phSbhCvwbECWbb4eDGXbKZY92W1RTQ5U5td8DMLXyYipQphrcoeRXpb18DbOnE0WwIQV0yB gc/rTiUt/wVjasd1RrsCPBQC/uJ+ZHknvr2MoxIWBBsRtKYHG66aOL+nDV8X1miuF6j4cztv gmdqrwPHpAKVxhfwd/G4suNBunYw4/kAV9b2+eidX5em3NtPPNl/qNjsmEHQGn/5JKRHRvQs 0yuigXDhN2N0keoHrbGCE8kyA/d83L7E9d95hsf3JxpRzmeaTze+NpcIaX5uXdKOaCBjLtx1 tOrDA4XX7Y3nY+waKZYa3RvC7yulFJiKfYWDSriWeQXcXj06p8H6vF6sy9LeX9xRRjTI7qDH FxwuMQIKGqgufXtxu0pxxcMqXTEUPZnxUWUvuFjjYvEmtO92+Ot/NuotV8JvRPwg2OnYjMJo dU1X7hzEs8djtgZG+t3FEGK3i1EJUQARAQABiQI8BBgBCgAmFiEET2gtkyoXlvgg8jTA37iR cpp2248FAlppZ0gCGwwFCQlnUwAACgkQ37iRcpp2248krg/9H896KtAQCAV0RcV3QqZ75iY5 pCxpRyxAaR0PjE5jiYV5gUHPCKtr9UPZt4Bi+bzNLQ2KJK6Rx4XNf5lQWopEo1IxtOiFPjkr QIpNkYmFWyOGpKpSIDhgsJpswZqxPDLpo+59GNlSUG6v3sMAnx+Gvtvqczkvg6UPDN/JYK75 BIGoCGZMyor1B0EmRYj98LdwjT95dQZXjZvWBDeIx+NxUZKoA7AlR/xgsN3PHGq4SApMLL0R /qbiLIzUPnTPt5sBs0peflVvMrtgIMiZ9FdYPE+VWy5+X2AmeFg6Zl5W76HQUP6eYZQV5abZ +iiW9lY1TmqsqpTIDu/ZMy7pLknxV5E1vQy+wsihluDYydaQ4HWoNaY7QFb+x7TsvjJRi+cH 7By4jxohTWUuaukuMmT0eEaesWJSraAmxsffqJwDpsi0chZskuXjEm9gX6rY7MhzOZl7Vz9F +6MYTtTmT1mpkLAMWf1/JuKUCfnSAHRlDxUOAG6QSJoHWAGqYy3XiF9bN63yQ6xllloSbbMv P9VW0e/iFKMKEIvfIvAg0IrlPcfKAGuuT1axwIU7da/N7LOcXyDDSEUuSzvXL/BkWyjxuLzd LY6eTvC6ZT/fA5iS/PAUj0WbrWNrHQtQ5OY2+al2v6JdLu/w6IZJCBpTosOAOzzmre+31fk1 HKwqd9xRxC8= Message-ID: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> Date: Sat, 25 May 2019 11:17:07 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="pXvGyk6cmVkL21Rw6Oq8n7dA57ryu5vHN" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 19:17:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pXvGyk6cmVkL21Rw6Oq8n7dA57ryu5vHN Content-Type: multipart/mixed; boundary="KuIS6mPMtnZzAHMQfRxM9bXFPVDQdn73w"; protected-headers="v1" From: Melinda Shore To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" Message-ID: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> Subject: Re: [EXTERNAL] Re: [Add] Browser Administrative Authority References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> In-Reply-To: <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> --KuIS6mPMtnZzAHMQfRxM9bXFPVDQdn73w Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 5/25/19 6:48 AM, Deen, Glenn (NBCUniversal) wrote: > I don=92t see this as equivalent to the trust mediation that browser > makers do through their certificate root programs or security > settings because those things are very much web application domain > choices and are entirely appropriate to be controlled in the context > of the web browser. Those trust certificates are for web servers > and applications, and so are in exactly the right place. Yeah, but you can make the same case for name resolution. It's certainly the case that some applications that run in browsers have narrower security requirements around DNS than others do, and right now there's no way for those applications to discover whether or not their DNS queries are protected. But, I think the broader problem is that ISPs are not running recursives that use encrypted transport, and because they're not other folks are stepping up/in. I suppose that in a better world an endpoint would be able to check whether or not they can protect DNS traffic to the default recursive and, if not, fall back to one of {Google, Cloudflare, whomever} but that's not where we are right now. > In the case of browsers, there is an established means for the root > list to be maintained securely, and to be update when needed. That=92s= > fundamental to the trust model working. If it were possible for this > root list to be altered outside of that means and it=92s associated > integrity controls, then the trust model would be broken because it > would be possible for unapproved roots to be installed. It hasn't always been the case that browser root programs had strict entry requirements, or that CAs were audited, or that there were external mechanisms for misissuance detection. Those were added as problems were identified. And, I'll note, that the browsers are occasionally acting unilaterally around PKI issues, as well - this situation with encrypted DNS is neither unique nor isolated. I do think part of the problem here is that for whatever reason our community (the IETF) hasn't come to consensus on problems related to trust in the DNS. If you don't have a trustworthy name resolution system you can't trust much else, either. This relates to both being able to get a correct answer that hasn't been mucked with by a third party, and to privacy protection of queries and responses. It seems unsurprising to me that browsers (and other application vendors) would respond to the default unprotected DNS situation by doing something about it themselves. Melinda --=20 Melinda Shore melinda.shore@nomountain.net Software longa, hardware brevis --KuIS6mPMtnZzAHMQfRxM9bXFPVDQdn73w-- --pXvGyk6cmVkL21Rw6Oq8n7dA57ryu5vHN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEET2gtkyoXlvgg8jTA37iRcpp2248FAlzplLMACgkQ37iRcpp2 24/4SA//QSAF+6/ArBV3iHo28f4AjA+1w6Wv7QYOwpuk/drQgHJyxqzviaFTLdoQ 4TAbP1Nonvdodi/RGDxkOp1Zt35DWV3gTFGTHhMfvLGKWhXt/i8Do30EU4Ea/1W8 fv8E72SpgUVEAe8ZgylhpDnlmOzWSNj4e+wgV5XQIttFNBKkYESrbJc5BFEtd2rY i2+pirgDcGOyGpTAdEjoPzaq3gaZN+2vE83Sr1qMfjxQwXhzl3rwB6DQHaM2RTRE d4RTVA742xWU6or0KWwrDtAmnHumhmtZqDLon2B6WDHl9mfNY7ZgP6DNwNqFPgvj 58LUY2j6pk7TBWwLeIhhPFtwaPliXUngucWxv9bI/W0hf/dmKF1uuqF5b3MD3uHH An2T81X/rlEw+3OGVBQs/gXlKTCGlFApJS8hgm3U2c9MaFrs4qGd2dSYv4Uzo4P6 PGdNCvbs+N/rVYmXuAlaXjJPQSIWK1A7rK4Z+KFEnkmdcsXFm3h/wMknvb5ARLt4 rpw63i1nKE4hCmY/Ytxd9ly05NyQLWAO31rbX2PUUP89sQ8+VnVHXuThXJOM7gja m7Vy4wLvdpJm2F8BOkjIKpIHH/Qs/3kt5l0YJyWy50BH3VWNd9nzoSqaniz1PWaA nvzv6yQ5Lg58VJhfj5RgdEXAMQ5DqbEJTRsX8ulCGQye7TyIuK8= =+BgN -----END PGP SIGNATURE----- --pXvGyk6cmVkL21Rw6Oq8n7dA57ryu5vHN-- From nobody Sat May 25 12:26:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40C531200FD for ; Sat, 25 May 2019 12:26:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ES7l8smWJtol for ; Sat, 25 May 2019 12:26:08 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32683120021 for ; Sat, 25 May 2019 12:26:08 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 313B0374022A; Sat, 25 May 2019 12:26:07 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id AEB7913B68F1; Sat, 25 May 2019 13:25:41 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id AA2CF13B68F0; Sat, 25 May 2019 13:25:41 -0600 (MDT) From: Paul Ebersman To: Melinda Shore cc: add@ietf.org In-reply-to: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> Comments: In-reply-to Melinda Shore message dated "Sat, 25 May 2019 11:17:07 -0800." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <9387.1558812341.1@fafnir.local> Date: Sat, 25 May 2019 13:25:41 -0600 Message-Id: <20190525192541.AEB7913B68F1@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 19:26:09 -0000 melinda> I do think part of the problem here is that for whatever reason melinda> our community (the IETF) hasn't come to consensus on problems melinda> related to trust in the DNS. If you don't have a trustworthy melinda> name resolution system you can't trust much else, either. This melinda> relates to both being able to get a correct answer that hasn't melinda> been mucked with by a third party, and to privacy protection of melinda> queries and responses. It seems unsurprising to me that melinda> browsers (and other application vendors) would respond to the melinda> default unprotected DNS situation by doing something about it melinda> themselves. If you are worried about full end to end data integrity, DoH/DoT isn't it. It's a point to point encryption with no way to know if that recursive you're talking to actually got valid DNS data. DNSSEC solves that problem (end to end data integrity). DoT/DoH solves the confidentiality (snooping the wire) problem but that's all it solves. If you want privacy and validated data, you need both. But that's the technology piece. That still doesn't address user consent vs network policy. Let's not conflate several problems into one big hairball. Glenn laid out some policy and consent issues. That seems something useful to at least enumerate and define clearly so we at least know what problem we're trying to chew on first. From nobody Sat May 25 12:27:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7EB2120103 for ; Sat, 25 May 2019 12:27:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.499 X-Spam-Level: X-Spam-Status: No, score=-9.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=loon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eIGDIygYZBZS for ; Sat, 25 May 2019 12:27:34 -0700 (PDT) Received: from mail-it1-x131.google.com (mail-it1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E64B7120021 for ; Sat, 25 May 2019 12:27:33 -0700 (PDT) Received: by mail-it1-x131.google.com with SMTP id g24so14160449iti.5 for ; Sat, 25 May 2019 12:27:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=loon.com; s=google; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=U648wdRV5QWktMr1pOwhu9QVVw3iP8OLOtwnQetElso=; b=ARokvejnDquCuzvwilkmStl8Wi7dPsrOxOmfD5ukel4cJb3KmhPZjikwxKpk4I7sk/ I4QBu/MIIhfqt4BCuqPbM1iy/LsAzpCF8RzuDGatz/EcQh62P1vYaV7vmUFwtzTDfDKp KU+woZSKtIBdLwnSsefgSlegbx7CFM+EYoslc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=U648wdRV5QWktMr1pOwhu9QVVw3iP8OLOtwnQetElso=; b=L66sVH1uw9A4epx7ZTAOq9TwTT9Nl0hw+6fS2844HEJh+4TR+bJTF0Mc4WF1JQoJ5d W1pq7oje6wkPmfpDtH3+y9ioRZ2Q0QUZ3jvzrbD2eX8AZBTe32r0n3QMOgOxod46Pqkv yRW46KaiXQdBMlFP/oIqy/T5NU1LdxD/5FmSLUMtHSxYFO/tHZJpbL7B+C1LejnWvera yN6fbX5RH1u4YWnt14g6Xg3nn7iqtCrt2qjWzKmC6/NvcY46yJBz4rJ2lFvr93zkGR8L xIz5yByhhQA6pp3JF/VXDfEoFKiqiPrIvajgKo8xkgu1QxVYSma1IipKn+HeCp8Yagcu oR7w== X-Gm-Message-State: APjAAAUQDY1HfoY01UbU5KGJbKYJB45seT7mHpKK3ebtqphBKTEsxLYr Q6sqDkhPlzCUCDRKxeaQNZ8ZnicTNHXW/5sAmiWTQQ== X-Google-Smtp-Source: APXvYqxJpeehRCqid/rLJ36Vxq7ECXrDS7FwYlQJy/XS37oIuzNAXN0ZO7gSDWIupnOCqjygvznVAZCXbdWXd1RhIKI= X-Received: by 2002:a24:7bcc:: with SMTP id q195mr22039073itc.73.1558812452980; Sat, 25 May 2019 12:27:32 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> In-Reply-To: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> Reply-To: ek@loon.com From: Erik Kline Date: Sat, 25 May 2019 12:27:20 -0700 Message-ID: To: Melinda Shore Cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008872450589bb4e90" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 19:27:36 -0000 --0000000000008872450589bb4e90 Content-Type: text/plain; charset="UTF-8" > > > It's certainly the case that some applications that run in > browsers have narrower security requirements around DNS > than others do, and right now there's no way for those > applications to discover whether or not their DNS queries > are protected. > > FWIW, we did try to address this in Android's DoT implementation with LinkProperties#getPrivateDnsServerName() and LinkProperties.html#isPrivateDnsActive() . But that's just the one platform. --0000000000008872450589bb4e90 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

It's certainly= the case that some applications that run in
browsers have narrower security requirements around DNS
than others do, and right now there's no way for those
applications to discover whether or not their DNS queries
are protected.


FWIW, we did try to = address this in Android's DoT implementation with LinkProperties#getPrivateDnsServerName()=C2=A0and=C2=A0LinkProperties.html#isPrivateDnsActive().=C2=A0 = But that's just the one platform.
--0000000000008872450589bb4e90-- From nobody Sat May 25 15:28:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BA0212007C for ; Sat, 25 May 2019 15:28:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fPc17rMdk2Jv for ; Sat, 25 May 2019 15:28:46 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3128120058 for ; Sat, 25 May 2019 15:28:44 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 4F112BE3E; Sat, 25 May 2019 23:28:40 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D0efbSl1Z9c3; Sat, 25 May 2019 23:28:25 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B7D6DBE39; Sat, 25 May 2019 23:28:24 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1558823304; bh=sZ2OkkmuNTl3lYO9FDTDjMJLpzBgO0exCt+mf9wkteI=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Lz1otEbH92nZAcJmIBnLtipwM+1fyb7LRQchcT30Ayd9Wn7xbFJbAy8Qls9ky37ZK rAtePs2MTy64wGjaNy88Byq4VhIqvujjNNsNbeMfx6srohhk6ni+1FeS94MBQhV29W Uc3j7fABzwzthGtM5qHLhHtzWc3Dv+4W2yCotxzU= To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> <51A9951E-CC50-4D02-903B-5EFD1691ED32@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Sat, 25 May 2019 23:28:22 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <51A9951E-CC50-4D02-903B-5EFD1691ED32@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="W7dwtAthMyzZuYprQM7omtiwQU6vuIPMX" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 22:28:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --W7dwtAthMyzZuYprQM7omtiwQU6vuIPMX Content-Type: multipart/mixed; boundary="TFSIrsYZ8w9iSlHpRLbMSMa5uSaUaMwGi"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" Cc: "add@ietf.org" Message-ID: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <94f33685-0356-67a2-0364-849079ba98ed@cs.tcd.ie> <101EC845-8AF9-42BD-8AE8-3D8912EA60F0@nbcuni.com> <78b165af-f459-7d5d-151d-04af74394ecf@cs.tcd.ie> <51A9951E-CC50-4D02-903B-5EFD1691ED32@nbcuni.com> In-Reply-To: <51A9951E-CC50-4D02-903B-5EFD1691ED32@nbcuni.com> --TFSIrsYZ8w9iSlHpRLbMSMa5uSaUaMwGi Content-Type: multipart/mixed; boundary="------------D5CF5F8437C7E1291CECB99C" Content-Language: en-GB This is a multi-part message in MIME format. --------------D5CF5F8437C7E1291CECB99C Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 25/05/2019 16:10, Deen, Glenn (NBCUniversal) wrote: > I was responding to your original notes assertions that I read to be > about not getting stuck in a perpetual debate in search of > perfection. (Because the ietf never does that!) Heh:-) > My understanding was that this list was being used to > additionally di= scuss and explore the impacts and > consequences of proposed DoH architectural deployment > choices. Ah, fair enough. I thought you had some specific end-result in mind. Might be no harm if we started to think about that at some point. (Though I suspect we need the browser folks to figure out what they wanna do about split-horizon before we can get done here.) Cheers, S. --------------D5CF5F8437C7E1291CECB99C Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------D5CF5F8437C7E1291CECB99C-- --TFSIrsYZ8w9iSlHpRLbMSMa5uSaUaMwGi-- --W7dwtAthMyzZuYprQM7omtiwQU6vuIPMX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlzpwYYACgkQWrL68XsX K+qG4A/+Prxg5kHaEsFTy3VnhBo/ag2NltG3cS7VfVEezkaVqeESGTJJNnwWDrid eHZEBF7PFLuX40CZRiODMUmU6GYpnmXx/yBrIv3zDKDmtv7Ugfmcthh4omXslO7t XuYqLgK3s+jH3d0ibmdhEwXy6G2nU8HgP2rerIqS5CVkpip0XWLDAObDSR6DcL2h 6neh15oQqUtrOs15E8KmuJMsY8R68EgS9U9g3mvZqM+sEqvQJIOoqM9WB4h1cGUo JF1E0h1YI4MijC8kI2MipEfwKDC9hRrTXNb2wkkjl0UJ7aSWvefbRoRsgnA0J6F4 HBrZWbkeI46Z/1D3r7x6xdcUd3PTbWLk1nrWlceLMWOAnyymOVUA3lMVCB0+IBTy u+eXGgcfj3ywV8idhRxwa9OMIMPVkWzU4RTaFkkMTvc0HQC5QrlwKYwYAK88qZa8 7ZtjvSjq/x9VGIPV9FleBJbOEkXGS2tJgmxTva5TCMUlft3mpg9faILAglHvkf8J pKeCRoTFnrQsimhreo59kxj+gVzwfWPQePETnEWvovtmNrhUGCQ4YqWf+v1FTvab ppOfQZl/X4UU5msqzS/BjbStXZJfT7d/LXlYc29yzmptby/O0wMo+YICydUZlL8W zG6xmiE77jIP0cpTmwU8zUomwnqTtSomAo1Qv928w7VH1Nz+kpI= =QReC -----END PGP SIGNATURE----- --W7dwtAthMyzZuYprQM7omtiwQU6vuIPMX-- From nobody Sun May 26 20:44:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E02412022A for ; Sun, 26 May 2019 20:44:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tJDE9wsf7e9t for ; Sun, 26 May 2019 20:44:15 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 207F812021F for ; Sun, 26 May 2019 20:44:15 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45C2s84kZtzFNR; Mon, 27 May 2019 05:44:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1558928652; bh=FVL/S/dB+nx8gZVew8MA4Z1oDj+3T6aVWL/WdEzvj88=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=DgqytiJDAr4ukICxi0XcbkrEB20E39F6WWzAYcyzVY/M4OPYs8WKRDKCWa4jJP9T8 8E2Do7jR8tRs1AZEMDiO/19Sz6PqIbCfkAa3rNCkp37/y01U3Mwr2A6L2kRDze22jT ralLqDOPGyNtdoEPEfSKpcWH3JQrcRiBjzUIPtPI= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id cf8mu7W8Se4y; Mon, 27 May 2019 05:44:11 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 27 May 2019 05:44:10 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 3C1ED500231; Sun, 26 May 2019 20:38:54 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 3C1ED500231 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 2F25D40BE935; Sun, 26 May 2019 20:38:54 -0400 (EDT) Date: Sun, 26 May 2019 20:38:54 -0400 (EDT) From: Paul Wouters To: Melinda Shore cc: "add@ietf.org" In-Reply-To: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 03:44:17 -0000 On Sat, 25 May 2019, Melinda Shore wrote: > But, I think the broader problem is that ISPs are not running > recursives that use encrypted transport While from a generic hygiene point of view I agree, but a security point I don't. People are more in need of protection against DNS manipulation from their last mile ISP (malicious and "helpful") than from anyone else. If my local ISP uses encrypted DNS, I still don't trust them. And the second issue is that ISPs sell DNS query data and other private information of their customers to third parties and/or their own affiliates. As a user I cannot determine that if I once google for "canadian contact lenses", who and why and where that info went. All I know is that 60% of ads are suddently about contact lenses across my house, devices and applications. And the only way out is to encrypt everything end to end, with no midle man or ISP seeing anything. > other folks are stepping up/in. I suppose that in a better > world an endpoint would be able to check whether or not they > can protect DNS traffic to the default recursive and, if not, > fall back to one of {Google, Cloudflare, whomever} but that's > not where we are right now. I don't think that solves an interesting problem. At home, systems can be configured to use a third party DNS (and DoT/DoH helps those IPs to not get hijacked by their ISP). But for mobile devices, things are much harder to reconfigure and that's where we need protection the most. Because there my DNS queries are also getting mapped against my location data against my own personal privacy interest. > I do think part of the problem here is that for whatever reason > our community (the IETF) hasn't come to consensus on problems > related to trust in the DNS. If you don't have a trustworthy > name resolution system you can't trust much else, either. This > relates to both being able to get a correct answer that hasn't > been mucked with by a third party, and to privacy protection > of queries and responses. And we are making it worse and worse over time by keeping DNSSEC as an optional part of DNS, instead of saying that the experiment has been successful and we are now moving towards phasing out insecure DNS. > It seems unsurprising to me that > browsers (and other application vendors) would respond to the > default unprotected DNS situation by doing something about it > themselves. It wasn't my impression that the deployment of DoT/DoH by browsers was done primarilly to help the user get a more secure DNS. If that was the case, tls-dnssec-chains would have zoomed through the WG. Instead, it seems browser vendors want a more robust and lower latency DNS. A worthy goal but not a security goal. Also the latency saved will not give the enduser a faster page, but will be spend extending the ad auctions to generate more profit of the end users. Bonus points for encrypting the DNS packets so the competition cannot see them for their own advertisement and search platforms. Transport security is just a side effect of all of this. Paul From nobody Sun May 26 21:34:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0ABDB1201E4 for ; Sun, 26 May 2019 21:34:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id daUjXPO6MM3I for ; Sun, 26 May 2019 21:34:11 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B651E1201E0 for ; Sun, 26 May 2019 21:34:11 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45C3yp1CFKz2fR for ; Mon, 27 May 2019 06:34:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1558931650; bh=ZB8NTgryZ7bivR6rk0rcpHaflIeyXJsCs6WTPaB20zo=; h=Date:From:To:Subject:In-Reply-To:References; b=Us2HlOTLfdME17kqn+zWUPRdgAjqqMFpvnx2j93diqusMmg86aXX+XM4m1J0Pytho FabYGol5sIhzqy9TEpmlpmNm/8HU1cPE/Gd60ZZtzCQiSKB4CMfHZMOqv8kmS8KCsL mIoYiw5xMStp5kR74FJs3DKIpxHSYkHuYfClTOLU= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id bhrraV4JG6wA for ; Mon, 27 May 2019 06:34:09 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS for ; Mon, 27 May 2019 06:34:09 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id C99EC50022C; Sun, 26 May 2019 20:18:55 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca C99EC50022C Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id C0A6D40BE935 for ; Sun, 26 May 2019 20:18:55 -0400 (EDT) Date: Sun, 26 May 2019 20:18:55 -0400 (EDT) From: Paul Wouters To: add@ietf.org In-Reply-To: Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 04:34:13 -0000 > It's certainly the case that some applications that run in > browsers have narrower security requirements around DNS > than others do, and right now there's no way for those > applications to discover whether or not their DNS queries > are protected. Since browsers refuse to use DNSSEC, and thus TLSA, why do browsers have narrower security for some apps? It seem they purposepully present apps with no DNS security. And their runaround now is "let our browsers use transport secured unsafe DNS towards our own trusted DNS infrastructure". That's correcting a mistake with a mistake, and now we all have to take into account that a few browser/DNS vendors will be the choke point for large scale censorship based on DNS. Paul From nobody Sun May 26 21:42:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 058ED12013B for ; Sun, 26 May 2019 21:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.1 X-Spam-Level: X-Spam-Status: No, score=0.1 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9zfSRZs7GojA for ; Sun, 26 May 2019 21:41:59 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4879412007C for ; Sun, 26 May 2019 21:41:59 -0700 (PDT) Received: from [66.113.192.14] (helo=xsmtp02.mail2web.com) by mx63.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1hV7SO-0004kM-E5 for add@ietf.org; Mon, 27 May 2019 06:41:57 +0200 Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp02.mail2web.com with esmtp (Exim 4.63) (envelope-from ) id 1hV7SJ-0000uM-BT for add@ietf.org; Mon, 27 May 2019 00:41:52 -0400 Received: (qmail 30463 invoked from network); 27 May 2019 04:41:46 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.223]) (envelope-sender ) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 27 May 2019 04:41:46 -0000 To: add@ietf.org References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> Date: Sun, 26 May 2019 21:41:47 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Originating-IP: 66.113.192.14 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.192.14 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.192.14@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0fbJ1LThpDP3PaEa+mzHFASpSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4YYKQg2X0o7E0qLLY2BBiZ+k4hYVdSH4ilEX20H0GUoaAEcEjiBN3As8BnF 1k5s2g+Z3JKVmi72ocgY5kMQSjs7M7F7B+H4BOgiABPpiHhZId0M1NgpAM2NwqA2XimSsrj58/mr R3YJqKPtWOxo96AGbE5d/K7AdzmETkpmCtG845uv8+AJAs5OVVdGw7jzTmkPN6zV1i63NRPS95Qa zrdAxHhaG8a6cKotmFuikgQDTaUsT9OFUpjIFjDduQiJ6VhM3iIROxK9avuhN3JnLgS3DkvqOqBJ 9aVrZUoYpWrLEnGcecvnQdm/JLWjfH3wiRVsJe5ihH8+GrMkZTXyCNtMHuUCcH3gfGjK7M5vIGbB 4Ck4xAm9D8KTeKJT7gNACPdf22VzvjZVumvddWyl4okY6Z15kL45NrNm7a+6LGMNFNa2NlMuF0bZ AF6YVuVax2wl9Mf64knTPVmtloZjvQlSB5hQ6nsDvccjqgmDvD9Wh+WR/i26M8i/BRyXA9o1Cprq LJmyBFmzP8/pV+rk1GoSb9tZ+C5yOc2YAGkaEP1NO/Jhg8B4nm3RdGNDa3lYa0pSEPL0KP26CBC8 NaWqPu+i/IZgjNJvtmwmkL57Wgz2PO4Iwb++JRJLsBW/KacFGoNRXxKF5tPxTxfD0dMN+t5ZpLtj 3xz/YVO7dPwX9Na6YCqHrJ+RfComsJFdhSHVgOsJkyP/mhaJPJoo3j/E2HVkRRW2l+1H4O6n35Um 71OcejWV/AGXOg0SkH1AIpdD9myJ+cv73CChOPjKA0/DVd83PCmA5ULvt7VaAji2RhOscFoNJq7X lAj1SApo6dRtXFYwyGTHIAoNFX+jcW7DGmdEmoVd39t86NHFuZHIzn9QZA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 04:42:01 -0000 On 5/26/2019 5:38 PM, Paul Wouters wrote: > As a user I cannot determine that if I once google for "canadian contac= t > lenses", who and why and where that info went. All I know is that 60% > of ads are suddently about contact lenses across my house, devices and > applications. And the only way out is to encrypt everything end to end,= > with no midle man or ISP seeing anything.=20 Paul, I don't like surveillance any more than you do, but look at the example that you just gave. You are asking Google for information about a specific product, presumably over an encrypted connection to their search engine. Your ISP only sees an encrypted connection to "google.com". You may then click on some of the search results, at which point both Google, your ISP and all the trackers on the target web page know that you contacted https://www.contactlensescanada.com/. Then you complain that the surveillance apparatus is bombarding you with ads for contact lenses, and you blame the ISP for that. Seriously? -- Christian Huitema From nobody Mon May 27 02:25:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8354212011B for ; Mon, 27 May 2019 02:25:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jQAeNUKfJ9hm for ; Mon, 27 May 2019 02:25:08 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 295841200FA for ; Mon, 27 May 2019 02:25:07 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 5C44E6A28B; Mon, 27 May 2019 11:25:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1558949104; bh=QO7Le7oPSTFoYH/jAeUYLobnecNhqjQ/zo8miFNSaV8=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=HDu9PIcj9A/LborSDxoD1WZuqUK8xKxoXNEPVBokgBvcXB6qBwcUaR0ep6X/aXa+K fb1+9rbgJcNO5zsyHxQ+p+t5+kSYTN4rvo231VEaZ3dYNERQwHlQ7KeNtV/+/d4wbL H8IFwW218cFJLAdAFKAZOEsLmcyUxdHVpza41MRPq+ufBwUM1bItyxtCHathqXg6Sh 8ImA2CGJ1BtaiT7VZrNgri63lviRG4pFK4lWEHgHm1bUAjwri8g8PuMeqW/XJkkJ+b d7QIIbqpvZ5PFrlO4kN6nKbMuwRgK841WjSeGAR8cByJM51/omMn1tsewiXvYL0oU5 z1SA5JlYnc1iw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4E9273C05BB; Mon, 27 May 2019 11:25:04 +0200 (CEST) Date: Mon, 27 May 2019 11:25:04 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Tom Ritter Cc: "add@ietf.org" Message-ID: <1087980125.22084.1558949104261@appsuite-gw1.open-xchange.com> In-Reply-To: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev4 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 09:25:11 -0000 > Il 24 maggio 2019 21:23 Tom Ritter ha scritto: > > The network should be considered hostile until configured otherwise > because... the network usually is hostile. Or at least it's untrusted. > Every cellular connection; every coffee shop, every store's free wifi, > every friend's network you connect to, every AirBnB wireless, every > hotel... Percentage-wise, the number of untrusted networks the average > user connects to dwarfs the number of trusted networks (even if the > percentage of time spent on untrusted networks is dwarfed by the > percentage spent on trusted networks.) There definitely is a security/privacy issue for people and devices that roam a lot and it's fine to address it, but IMHO this is the view you get from a specific viewpoint and does not represent the full picture or even the best part of it. There are tons of people/devices that do not move and only use the Internet from a single trusted network, usually a home/corporate one, and rely on it for security. As a subset of this, there also is an increasing number of cases in which the user controls the network much more than the device: think of all the IoT stuff that you buy and deploy at home, but which is really a black box to you - unless you can use your local network administrator power to exert at least some control on their traffic. Perhaps this should lead to different control hierarchies and policies for roaming devices (e.g. mobile phones) than those for the rest of the world. More generally, this is what makes the ADD issues hard: different use cases have conflicting requirements. Perhaps, part of the work could be documenting the appropriate control hierarchies in different situations, as Glenn did, and then see if there are ways to reconcile the conflicts - and I suspect these are going to be by policy and user interaction, rather than by technical instruments. Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Mon May 27 02:27:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 059BA12006D for ; Mon, 27 May 2019 02:27:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xuauUXWWm_Qm for ; Mon, 27 May 2019 02:27:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D037120033 for ; Mon, 27 May 2019 02:27:51 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id C77366A28B; Mon, 27 May 2019 11:27:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1558949269; bh=SK7TXq41+T66yX8WavMnO0AYAnibkcOSbUcg6tqrABU=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=ogD6OfFsbXofihP9VNkmVl2FSfMlHnpuE1ZvoO6zhsoeWKp2l0hhen3RFAk4xH9Tq 1Q4sOuRzlL2zJzxD74y7oEkqtwQHaKutyswpJmhehtjAWiNftsQgzJ5PLUXAwgIQ3A FKjLgH4/pPFRDUqwNTcAg7CJjtqtVyFj+gvFHuocOZqnzJro/DQjbrc/QyhHSvUV0M ejO/g4MlR0sp4vNVtbr4gSUtOUrSD0UsDJ2WbM6Y+bkZu24qXRbo+/CQTJ6sHBLDmf 4JKizMXtXAZlEFKKOsuPPNe7P8ZSAiu7uk2RDcUfX6kNlfMNjiI/OIVuHRt1X9IRuG ibOuQVdZHauRQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id BA2C53C05BB; Mon, 27 May 2019 11:27:49 +0200 (CEST) Date: Mon, 27 May 2019 11:27:49 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Melinda Shore Cc: "add@ietf.org" Message-ID: <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> In-Reply-To: <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev4 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 09:27:53 -0000 > Il 25 maggio 2019 21:17 Melinda Shore ha scritto: > > But, I think the broader problem is that ISPs are not running > recursives that use encrypted transport, and because they're not > other folks are stepping up/in. I suppose that in a better > world an endpoint would be able to check whether or not they > can protect DNS traffic to the default recursive and, if not, > fall back to one of {Google, Cloudflare, whomever} but that's > not where we are right now. If there were general agreement that this is the desired final outcome, I think there could be broad support for an industry effort to make it materialize pretty quickly (and it would be a great result of the wake-up call generated by DoH). However, as far as I understand, not everyone in the browser world thinks so. Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Mon May 27 03:42:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9306412013F for ; Mon, 27 May 2019 03:42:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w7ELZ3aMYncJ for ; Mon, 27 May 2019 03:42:52 -0700 (PDT) Received: from mail-it1-x131.google.com (mail-it1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C037A12013C for ; Mon, 27 May 2019 03:42:52 -0700 (PDT) Received: by mail-it1-x131.google.com with SMTP id m141so26141628ita.3 for ; Mon, 27 May 2019 03:42:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=TNuy/uYRuTDCWD8uaIznzLGEazJpsUAYpSLGHuVpwUk=; b=cEaunIPGbQMfOR0bGsClYMGnRD9btj/dNspyKxEBXhUFOoBZSdikCbP5HAVV9iIqAv 5YXYa7v8nk4e7tlDeuVtvVF3CxWNESn2YpVKSPSNFoBonu4fQWcWla190u9sax+e06RT GkF7Gh2NJpx964QNnbdIPBF95hnMYJ/ON4oueieMz3ouSOroPqFdG//cr9qqeiO4RH+I i1wjWwu1jpYOaClJdl6w+qtDWtfSvwwAsJDuZ5EvduhYnN95LHR8cwQj8WWBKbCJMm3Y V7pCAaBSNqirsQfzn0efnYwwZfnxmCgYSOkApLOKzzlcy8E4tQeg1eys/WnYkCmdPE7Z tCPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=TNuy/uYRuTDCWD8uaIznzLGEazJpsUAYpSLGHuVpwUk=; b=BerFIeDHSoOCxPHz0bn69SmQ/80qxpzcAAYJTIACRTSbz1XCZQ+Y2/dyVDnXIHY3ov sydO+pAicxCAcC36xzyNmhSlHUBRr+2BZdHHwySIHZRI05UrJzXc9wkvMZLHh+AHT+Dp pozSyw6gGNLujBZ11m0zbaD35nA7G+/g5ZD6Ff6gn+JuFOlheH79NPToOL0opbF+6Ax7 xhoaeSX7qVmevmuVeMUNqpKGQ5PAvsP6nvfl+D2lqsJy1GHjQbHB/0eybwEBGTWnjeS/ 1IERN7X3uPlsmtxUiAFNj5yh5QRuPEhm7A+GBB7ficyianFiZppQpJHTDQkdv+hG7y2I ZB9g== X-Gm-Message-State: APjAAAXBNiCksltfSrn8iq5XDxMTQV7dOG/clR/tUBPCg58hRepwQT32 8N0MFUs68HKN2z3p0c8WLZoWCvrIMj/l7qJePBb+guAY/sA= X-Google-Smtp-Source: APXvYqzHw/Cbj/+aQQBDQuVpIDkGYTNmUAzVqIXOtFq33MM9hHVzvBknPRZ0cKHfZmxD0DK2zWSqdUm4x04VlYPa4Qc= X-Received: by 2002:a02:241:: with SMTP id 62mr38424720jau.58.1558953771680; Mon, 27 May 2019 03:42:51 -0700 (PDT) MIME-Version: 1.0 References: <155724102324.21181.9479096864924972082.idtracker@ietfa.amsl.com> In-Reply-To: <155724102324.21181.9479096864924972082.idtracker@ietfa.amsl.com> From: tirumal reddy Date: Mon, 27 May 2019 16:12:40 +0530 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000c8483d0589dc35ab" Archived-At: Subject: [Add] Fwd: New Version Notification for draft-reddy-dprive-bootstrap-dns-server-03.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 10:42:55 -0000 --000000000000c8483d0589dc35ab Content-Type: text/plain; charset="UTF-8" Hi all, This draft https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03 explains mechanism to automatically bootstrap endpoints to discover and authenticate DNS-over-(D)TLS and DNS-over-HTTPS servers provided by a local network. The specification discusses : (1) Bootstrapping phase to automatically bootstrap the endpoint devices with authentication domain name (ADN) (defined in [RFC8310]) and associating the DNS server certificate (similar to PKIX-EE(1) defined in DANE). (2) Discovery Phase to discover the privacy-enabling protocols supported by the local DNS server. (3) Connection handshake and DNS server certificate validation. (4) A new privacy certificate extension is defined that identifies the privacy preserving data policy of the DNS server. Comments and suggestions are more than welcome. Cheers, -Tiru ---------- Forwarded message --------- From: Date: Tue, 7 May 2019 at 20:27 Subject: New Version Notification for draft-reddy-dprive-bootstrap-dns-server-03.txt To: Mohamed Boucadair , Tirumaleswar Reddy < kondtir@gmail.com>, Dan Wing , Michael C. Richardson A new version of I-D, draft-reddy-dprive-bootstrap-dns-server-03.txt has been successfully submitted by Tirumaleswar Reddy and posted to the IETF repository. Name: draft-reddy-dprive-bootstrap-dns-server Revision: 03 Title: A Bootstrapping Procedure to Discover and Authenticate DNS-over-(D)TLS and DNS-over-HTTPS Servers Document date: 2019-05-07 Group: Individual Submission Pages: 21 URL: https://www.ietf.org/internet-drafts/draft-reddy-dprive-bootstrap-dns-server-03.txt Status: https://datatracker.ietf.org/doc/draft-reddy-dprive-bootstrap-dns-server/ Htmlized: https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03 Htmlized: https://datatracker.ietf.org/doc/html/draft-reddy-dprive-bootstrap-dns-server Diff: https://www.ietf.org/rfcdiff?url2=draft-reddy-dprive-bootstrap-dns-server-03 Abstract: This document specifies mechanisms to automatically bootstrap endpoints (e.g., hosts, Customer Equipment) to discover and authenticate DNS-over-(D)TLS and DNS-over-HTTPS servers provided by a local network. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --000000000000c8483d0589dc35ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
=C2=A0
This draft=C2=A0https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-se= rver-03=C2=A0explains mechanism to automatically bootstrap endpoints to= discover and authenticate DNS-over-(D)TLS and DNS-over-HTTPS servers provi= ded by a local network.=C2=A0 The specification discusses :=C2=A0

= (1) Bootstrapping phase to automatically bootstrap the endpoint devices wit= h authentication domain name (ADN) (defined in [RFC8310]) and associating = =C2=A0the DNS server certificate (similar to PKIX-EE(1) defined in DANE).(2) Discovery Phase to discover the privacy-enabling protocols supported = by the local DNS server.
(3) Connection handshake and DNS server certifi= cate validation.
(4) A new privacy certificate extension is defined that= identifies the privacy preserving data policy of the DNS server.
=C2=A0=
Comments and suggestions are more than welcome.
=C2=A0
Cheers,-Tiru

---------- Forwarded message ---------
From: <= internet-drafts@ietf.org>= ;
Date: Tue, 7 May 2019 at 20:27
Subject: New Version Notifica= tion for draft-reddy-dprive-bootstrap-dns-server-03.txt
To: Mohamed Bouc= adair <mohamed.boucadair= @orange.com>, Tirumaleswar Reddy <kondtir@gmail.com>, Dan Wing <dwing-ietf@fuggles.com>, Michael C. Richardson <mcr+ietf@sandelman.ca>



A new version of I-D, draft-reddy-dprive-bootstrap-dns-server-03.txt
has been successfully submitted by Tirumaleswar Reddy and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-reddy-dprive-bootstrap-= dns-server
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A003
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 A Bootstrapping Procedure to Disco= ver and Authenticate DNS-over-(D)TLS and DNS-over-HTTPS Servers
Document date:=C2=A0 2019-05-07
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 21
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-red= dy-dprive-bootstrap-dns-server-03.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-reddy-dprive-bootstrap= -dns-server/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-0= 3
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-reddy-dprive-boots= trap-dns-server
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-reddy-dpr= ive-bootstrap-dns-server-03

Abstract:
=C2=A0 =C2=A0This document specifies mechanisms to automatically bootstrap<= br> =C2=A0 =C2=A0endpoints (e.g., hosts, Customer Equipment) to discover and =C2=A0 =C2=A0authenticate DNS-over-(D)TLS and DNS-over-HTTPS servers provid= ed by a
=C2=A0 =C2=A0local network.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--000000000000c8483d0589dc35ab-- From nobody Mon May 27 03:59:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7F3A120136 for ; Mon, 27 May 2019 03:59:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2gvboOXEDBcy for ; Mon, 27 May 2019 03:59:39 -0700 (PDT) Received: from mail-it1-x133.google.com (mail-it1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4C741200B6 for ; Mon, 27 May 2019 03:59:39 -0700 (PDT) Received: by mail-it1-x133.google.com with SMTP id h11so23529867itf.5 for ; Mon, 27 May 2019 03:59:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oost0/opRzOOWezLP38yb4YE2zVQHqFGbko3CUO3iCs=; b=ZishHnfJnYo3hXsdfuMaQz6cBc1aiMGME44ZPTc2U5pFmWaGf4xG5S2pNZeDTgPi2p nzKTbnJyQj0CZTx1Bdh1MnpbT0fU6vRYaRt+sR/QOzENXq4iZZqroBLTjZfFO0eNQxIW GaRzNPp7xXQqFEO3VL8sR2FXpzNrDBm6j+Ur9H1MhcDbpGAaRPHCuVGNROq1oylx4YAA WxqTMPSdBD6x9GFjhRLbKmyBsf2BcRoRveZ2XNe1lwoRcccRVz15Sd95CIjdGvF4wPBB V8G1MNOQH+BTndfwIMoL5jNNVlcsC0ppdlE+l9KkmQ54REJtVqsF2yz3s1+BxUU4axWw duKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oost0/opRzOOWezLP38yb4YE2zVQHqFGbko3CUO3iCs=; b=rAsLr7qBX4KA1qnEduJZwypgOFqvO5cvmM/IVK3VZyYPUUSSg2q2SyFyfxlmu0H+aP XTTU7aUWu6s4bCBq4Gq6N8W54TYQOzi6fvbjd/MEoAH7H8sC+n7EC3nUnaFhGNDT5gVH F79UftqlUe7IWkuixRVKj+QtxDD2CJ29I7dANa+D1Y+GwT/yMLeHYTWNROilckO1knx4 IGnauB74JyFSqUP13chkH75Lg4qZsbZnjuE9b/pXk8m10/4F7nCXlfhtJxB+Tr/nkWJK cH0luoe8oeXA6tCfJot4poq1LnkxX20VG+JDtYQcp1VrTRQuDp+igqo8c5C5loE7bcEj d0Mg== X-Gm-Message-State: APjAAAWlg7RQ/89nF/5HcRSScat3iLVYEk5amtMu4GkEezyk3TlHAVmi bPwtM9grLICMcXzjCvy2yJClylJ+oRePk19rvdoBG4t8nRU= X-Google-Smtp-Source: APXvYqzeNkk4t+cxxuKX9pkNQ2HzRzfe4p9YyHNnjCErmdtgMa9ZucFxYPmzjSf2Sih8YCwsFOIYX+AIiGghXSMP8rE= X-Received: by 2002:a02:9a03:: with SMTP id b3mr9794407jal.35.1558954779062; Mon, 27 May 2019 03:59:39 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> In-Reply-To: <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> From: tirumal reddy Date: Mon, 27 May 2019 16:29:27 +0530 Message-ID: To: Vittorio Bertola Cc: Melinda Shore , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000d3b70f0589dc7173" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 10:59:42 -0000 --000000000000d3b70f0589dc7173 Content-Type: text/plain; charset="UTF-8" On Mon, 27 May 2019 at 14:57, Vittorio Bertola wrote: > > Il 25 maggio 2019 21:17 Melinda Shore ha > scritto: > > > > But, I think the broader problem is that ISPs are not running > > recursives that use encrypted transport, and because they're not > > other folks are stepping up/in. I suppose that in a better > > world an endpoint would be able to check whether or not they > > can protect DNS traffic to the default recursive and, if not, > > fall back to one of {Google, Cloudflare, whomever} but that's > > not where we are right now. > > If there were general agreement that this is the desired final outcome, I > think there could be broad support for an industry effort to make it > materialize pretty quickly (and it would be a great result of the wake-up > call generated by DoH). However, as far as I understand, not everyone in > the browser world thinks so. > If the DOH server provided by the network offers the same level of privacy preserving data policy as the DOH server pre-configured in the browser, Why shouldn't the browser use the network provided DOH server ? -Tiru > > Ciao, > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000d3b70f0589dc7173 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 27 May 2019 at 14:57, Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
> Il = 25 maggio 2019 21:17 Melinda Shore <melinda.shore@nomountain.net> ha scrit= to:
>
> But, I think the broader problem is that ISPs are not running
> recursives that use encrypted transport, and because they're not > other folks are stepping up/in.=C2=A0 I suppose that in a better
> world an endpoint would be able to check whether or not they
> can protect DNS traffic to the default recursive and, if not,
> fall back to one of {Google, Cloudflare, whomever} but that's
> not where we are right now.

If there were general agreement that this is the desired final outcome, I t= hink there could be broad support for an industry effort to make it materia= lize pretty quickly (and it would be a great result of the wake-up call gen= erated by DoH). However, as far as I understand, not everyone in the browse= r world thinks so.

If the DOH server pr= ovided by the network offers the same level of privacy preserving data poli= cy as the DOH server pre-configured in the browser, Why shouldn't the b= rowser use the network provided DOH server ?

-= Tiru

=C2=A0

Ciao,
--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000d3b70f0589dc7173-- From nobody Mon May 27 04:23:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81B7B1200D6 for ; Mon, 27 May 2019 04:23:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OfSh8CbU3LOj for ; Mon, 27 May 2019 04:23:54 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59E0D12004E for ; Mon, 27 May 2019 04:23:54 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 1429E24205E6; Mon, 27 May 2019 11:23:50 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Mon, 27 May 2019 12:23:44 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> To: tirumal reddy X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 11:23:56 -0000 On 27 May 2019, at 11:59, tirumal reddy wrote: >=20 > If the DOH server provided by the network offers the same level of = privacy preserving data policy as the DOH server pre-configured in the = browser, Why shouldn't the browser use the network provided DOH server ? How could the browser tell that both DoH servers have the same policy? How does the browser (or anything else for that matter) know what some = arbitrary DoH server=E2=80=99s privacy preserving data policy is? Where = will this be documented and published in a way that a web-based = application or the end user can understand and then make an informed = choice? Now rinse and repeat that for other server-side policies: data = retention, GDPR compliance, DNS filtering/blocking, TLS session = resumption, ECS behaviour, QNAME minimisation, NXDOMAIN rewriting, = query-related adware, etc, etc. Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D = (say), does the browser or end user simply take that on trust or would = they somehow be expected to verify that for themselves? From nobody Mon May 27 06:12:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60F59120141 for ; Mon, 27 May 2019 06:12:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HNR6ufeUBVg8 for ; Mon, 27 May 2019 06:12:13 -0700 (PDT) Received: from mail-it1-x136.google.com (mail-it1-x136.google.com [IPv6:2607:f8b0:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A63612004B for ; Mon, 27 May 2019 06:12:13 -0700 (PDT) Received: by mail-it1-x136.google.com with SMTP id g23so17342571iti.1 for ; Mon, 27 May 2019 06:12:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+Yb6XmckxyLhf9UzllI2/Rxvei+DE8DrNfQU2hh4g9k=; b=avb5HJ7//wX8sniCwiVeQDnTZACvBSSuYh5qT03VpCd6keThkHbXzrYxFgSWDPpk3H HrZKsUOzUE2Yfq5ssTV36Zi0KVUWCGfBZXvdLC+ESQsf27+G+RcEQnGqM5TzIRFfQFwh kBwR/UckEd2CCcYAuswt+pB2xgHAySD88Wc4eYYXjdGx52HMJJ22zbBF2HY1CIYzE3vy FFQdSqiXAYJx0ZgCI7wN/qHtGFwJwtRkWo/a+Z2DaoSIXQ6o3bQ7ADcFkfd5q2NfBY+E ECUvw535XuhlyYyUzzlcVVFohC+Ej9amba5/OaHhkYhNtZAfXp3LqM1iGN/jmMiSxO9W IJ/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+Yb6XmckxyLhf9UzllI2/Rxvei+DE8DrNfQU2hh4g9k=; b=oFsta094b3TvOkVGgrbMcLK6dc7Yg7rbLDOBd9MaU1Kns/fSyE+EdyBsDAlBqNFxX4 Od9rHmEjdyzTVAoqOnlV0oM7m19D9Yi6hjsZWAwocl60ilhAl+Q4cegPsXbjKU7VpQCr 3LnRBvkXDM/1Ig/pTCvepZpaSe7RmYU/QHH6cubX2xL5jves71yedbUThZmRMe50cFnM QjfKoQrwI9luim/E7zP0Btdth16xcM2lsI5WCN2WCj3oE4eJXAyTdadAG48JTLefXjuQ 2rh9aNsWQg4knDcajxGrUE/+oJ8RLBggwmf0y4Szk+vWMI9wu3I+HW82ewPxm4J9t3M6 1FOg== X-Gm-Message-State: APjAAAW723+awnIhMmObQ9hALwhvG7zbGQJR38VbyjKgXk447M4uYrxO FRbleYuuagP3vRmHUpvPfXHwOmsOqn1DoTG3VMt93n+quP4= X-Google-Smtp-Source: APXvYqzx9jW8ud8u3mm+lExzLTGsqWnme25wFinAOrFiyTBMiqLqMB7TNTau6soWCmgln5UhlgKkua+aODfZT8aMyio= X-Received: by 2002:a24:798a:: with SMTP id z132mr27294999itc.101.1558962732840; Mon, 27 May 2019 06:12:12 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> In-Reply-To: <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> From: tirumal reddy Date: Mon, 27 May 2019 18:42:01 +0530 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e8bad60589de4bc0" Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 13:12:16 -0000 --000000000000e8bad60589de4bc0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 27 May 2019 at 16:53, Jim Reid wrote: > On 27 May 2019, at 11:59, tirumal reddy wrote: > > > > If the DOH server provided by the network offers the same level of > privacy preserving data policy as the DOH server pre-configured in the > browser, Why shouldn't the browser use the network provided DOH server ? > > How could the browser tell that both DoH servers have the same policy? > > How does the browser (or anything else for that matter) know what some > arbitrary DoH server=E2=80=99s privacy preserving data policy is? Where w= ill this > be documented and published in a way that a web-based application or the > end user can understand and then make an informed choice? > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#sect= ion-10 defines a new privacy certificate extension that identifies the privacy preserving data policy of the DNS server, it is in a machine-parsable format. > > Now rinse and repeat that for other server-side policies: data retention, > GDPR compliance, DNS filtering/blocking, TLS session resumption, ECS > behaviour, QNAME minimisation, NXDOMAIN rewriting, query-related adware, > etc, etc. > > Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D= (say), does the > browser or end user simply take that on trust or would they somehow be > expected to verify that for themselves? > End user typically does not trust DOH server in a untrusted network (e.g. public WiFi network) and may only use the DOH server provided by trusted network (e.g. Enterprise, Secure home networks), similar to the way users disable VPN connection in specific networks and enable VPN connection by default in other networks for privacy. In addition, the privacy extension includes a URL that points to the security assessment report of the DNS server by a third party auditor. Cheers, -Tiru --000000000000e8bad60589de4bc0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 27 May 2019 at 16:53, Jim Reid &l= t;jim@rfc1035.com> wrote:
On 27 May 2019, at 11:59, tirumal reddy <kondtir@gmail.com> wrote:
>
> If the DOH server provided by the network offers the same level of pri= vacy preserving data policy as the DOH server pre-configured in the browser= , Why shouldn't the browser use the network provided DOH server ?

How could the browser tell that both DoH servers have the same policy?
<= /blockquote>

How does the browser (or anything else for that matter) know what some arbi= trary DoH server=E2=80=99s privacy preserving data policy is? Where will th= is be documented and published in a way that a web-based application or the= end user can understand and then make an informed choice?
=

https://tools.ietf.org/html/dra= ft-reddy-dprive-bootstrap-dns-server-03#section-10 defines a new privac= y certificate extension that identifies the privacy preserving data policy = of the DNS server, it is in a machine-parsable format.
= =C2=A0

Now rinse and repeat that for other server-side policies: data retention, G= DPR compliance, DNS filtering/blocking, TLS session resumption, ECS behavio= ur, QNAME minimisation, NXDOMAIN rewriting, query-related adware, etc, etc.=

Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D (= say), does the browser or end user simply take that on trust or would they = somehow be expected to verify that for themselves?
End user typically does not trust DOH server in a untrusted net= work (e.g. public WiFi network) and may only use the DOH server provided by= trusted network (e.g. Enterprise, Secure home networks), similar to the w= ay users disable VPN connection in specific networks and enable VPN connect= ion by=C2=A0
default in other networks for privacy. In addition, = the privacy extension includes a URL that points to the security assessment= report of the DNS server by a third party auditor.

Cheers,
-Tiru
--000000000000e8bad60589de4bc0-- From nobody Mon May 27 07:04:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1ABB7120132 for ; Mon, 27 May 2019 07:03:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cta9amh_lawx for ; Mon, 27 May 2019 07:03:57 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E46B120004 for ; Mon, 27 May 2019 07:03:57 -0700 (PDT) Received: from pps.filterd (m0048276.ppops.net [127.0.0.1]) by m0048276.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x4RDvq86004095 for ; Mon, 27 May 2019 10:03:56 -0400 Received: from usushmgip001.mail.tfayd.com ([216.178.109.235]) by m0048276.ppops.net-00176a04. with ESMTP id 2spxmwu2n5-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Mon, 27 May 2019 10:03:56 -0400 Received: from unknown (HELO potemwp00015.mail.tfayd.com) ([10.40.33.204]) by usushmgip001.mail.tfayd.com with ESMTP; 27 May 2019 07:03:56 -0700 Received: from potemwp00026.mail.tfayd.com (100.124.56.50) by potemwp00009.mail.tfayd.com (100.124.56.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Mon, 27 May 2019 08:03:55 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00026.mail.tfayd.com (100.124.56.50) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Mon, 27 May 2019 08:03:54 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Mon, 27 May 2019 08:03:54 -0600 From: "Deen, Glenn (NBCUniversal)" To: Paul Wouters CC: Melinda Shore , "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: Browser Administrative Authority Thread-Index: AQHVFD55kcQmMbOCxUW7Bq14IfS/AaZ/AYw/ Date: Mon, 27 May 2019 14:03:54 +0000 Message-ID: <79261153-13AC-40DE-8A4A-46DEAB712ECF@nbcuni.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-05-27_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1905270099 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 14:03:59 -0000 Hi Paul, > On May 26, 2019, at 8:44 PM, Paul Wouters wrote: >=20 > As a user I cannot determine that if I once google for "canadian contact > lenses", who and why and where that info went. All I know is that 60% > of ads are suddently about contact lenses across my house, devices and > applications. And the only way out is to encrypt everything end to end, > with no midle man or ISP seeing anything. This may not be a good example for use in the current discussion as it=92s = really a web search and web page tracking example and not DNS as everything= in this example can be accounted for entirely by what=92s going on inside = your browser, the search engine, and visited web pages. It=92s well documented that the search engine and linked visited web pages = are all instrumented and mined to track your web visits and correlate them = so that the Ad provider, which is owned and run by search engine, can sell = Ads targeted to you. The cited example is just the web search and advertis= ing technology and business model at work. =20 The hard work needed to turn DNS queries into such actionable target Ads is= n=92t worth doing when the search engine already knows the exact search ter= ms you are looking for and all the subsequent web pages you visit afterward= . =20 The fact that they appear on many devices across your house would suggest t= hat the tracking device infrastructure is also correlating your home activi= ty around the shared NAT address your home uses, and it is then targeting a= ds to any browser activity that comes from that IP address. All of this wi= ll still work the same way even when application and DNS traffic if encrypt= ed end to end. Encryption of DNS or general encryption of all network traffic won=92t help= in the case of tracking web activity by Ad networks since the search engin= e and every web page will still in the see, track, and report everything yo= u do at the web application level. The tracking and advertising technology= and business model that finances much of the web won=92t be affected in an= y way by on the wire encryption. The discussion at hand isn=92t about the web Ads business model, it=92s abo= ut how the deployment architectures of technologies like DoT and DoH might= be best done, what bad consequences may come from poor deployment choices= , and what gaps are still missing in the technologies so as to permit them = to be deployed without also breaking a lot of other important Internet, app= lication, and web infrastructure at the same time. -Glenn = From nobody Mon May 27 19:49:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81C371200CD for ; Mon, 27 May 2019 19:49:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zL_mDPFb6AnN for ; Mon, 27 May 2019 19:49:48 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41C8912006B for ; Mon, 27 May 2019 19:49:48 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45Cdbs1Z6Lz1q6; Tue, 28 May 2019 04:49:45 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1559011785; bh=GAk9GtVkkbxylx2jZQqaxKEvZNw0SX0TROwBg6zIgr8=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=F6cdXft5WdbvuAsFVYB4c8XrrlKkiM/uYZlOpEuRrvj7GVnS4hJ+r6i+OYKbf4ZQI aIipBu5+QiP4cWB7OHch7Vw4rHyLwHE4IwnxSO+n7OgBuZHzWyV4FiXynR3e9z7+8H nmDVjhF7hqe2Lv90I+mqsfBfDAmmtiblaXfwdnPM= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id K5J2CIC9Pbtl; Tue, 28 May 2019 04:49:43 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 28 May 2019 04:49:42 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 7D04A2C40F7; Mon, 27 May 2019 22:49:40 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 7D04A2C40F7 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 6FB1B40D8E84; Mon, 27 May 2019 22:49:40 -0400 (EDT) Date: Mon, 27 May 2019 22:49:40 -0400 (EDT) From: Paul Wouters To: Christian Huitema cc: add@ietf.org In-Reply-To: <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 02:49:51 -0000 On Sun, 26 May 2019, Christian Huitema wrote: >> As a user I cannot determine that if I once google for "canadian contact >> lenses", who and why and where that info went. All I know is that 60% >> of ads are suddently about contact lenses across my house, devices and >> applications. And the only way out is to encrypt everything end to end, >> with no midle man or ISP seeing anything. > I don't like surveillance any more than you do, but look at the example > that you just gave. You are asking Google for information about a > specific product, presumably over an encrypted connection to their > search engine. Your ISP only sees an encrypted connection to > "google.com". You may then click on some of the search results, at which > point both Google, your ISP and all the trackers on the target web page > know that you contacted https://www.contactlensescanada.com/. Then you > complain that the surveillance apparatus is bombarding you with ads for > contact lenses, and you blame the ISP for that. Seriously? I should have restrictd by last sentence a bit. I cannot determine who is sharing my desire for contact lenses. It could be the ad platform, google, facebook trackers, or anyone monitoring my DNS queries, such as my ISP. Arguably, I would have a better idea who is sharing that information if my last mile was not getting a free look at all my DNS queries, as in that case only a few https endpoints could know this information. Anyway, my point was that the ISP (carrier of hotspot) only uses their view of my DNS to my detriment. Sending them encrypted to the ISP gains me nothing. (exception for RBL enhanced DNS servers, but as long as they are breaking DNSSEC, they cannot be distinguished from a malicious attack) Paul From nobody Tue May 28 00:56:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 994BA120119 for ; Tue, 28 May 2019 00:56:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5rS0F_UM-8tO for ; Tue, 28 May 2019 00:56:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C1FC12004A for ; Tue, 28 May 2019 00:56:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 16BFB6A28B; Tue, 28 May 2019 09:56:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1559030207; bh=N54Yw6Wjbui2g8mXzehsf0CScc6kvJRKJgy9LC5yP1E=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=aYabRpesT+87OM2uTZhTGr1OUuy/WJ508rPRq3oCPpDnmVKI9obA1EeARtIftNmi+ GU4t8BkZAW650A0JeSzZxbM7++50ZOGpH0ebOHVtvYDEMumyuiLi/Wwntfxs/z5VS2 gTXLLajwJBIV6quZYcCvtuTezVWk1jFJdqNTwx/icXkiZjjLgsqODKLwqNhvDIde4G b1TtrZtzEJZzdS5ixlIa8J8AJqT9QPWjEpZBLdVkMcOtaPF+J4y+nCdslIax8SLLHc INSr38gUFTRCxV1qFj0eyukXaMhOOBe3DZKqgPJvXk+0OFZT9gb33aN/k26AROkAVu AX42+mxKg09PQ== Received: from [10.242.2.5] (unknown [10.242.2.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id C60703C0116; Tue, 28 May 2019 09:56:46 +0200 (CEST) From: Neil Cook Message-Id: <2DD6080A-686C-4B00-9171-630DCFBF3270@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_68948824-E31E-4419-8CB1-F1D115ADF755" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Tue, 28 May 2019 08:57:56 +0100 In-Reply-To: Cc: add@ietf.org To: Paul Wouters References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 07:56:54 -0000 --Apple-Mail=_68948824-E31E-4419-8CB1-F1D115ADF755 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 28 May 2019, at 03:49, Paul Wouters wrote: >=20 > Anyway, my point was that the ISP (carrier of hotspot) only uses their > view of my DNS to my detriment. Sending them encrypted to the ISP = gains > me nothing. (exception for RBL enhanced DNS servers, but as long as = they > are breaking DNSSEC, they cannot be distinguished from a malicious > attack) >=20 I don=E2=80=99t know the case of your particular ISP, but IMO saying = things like "the ISP (carrier of hotspot) only uses their view of my DNS = to my detriment=E2=80=9D is not very helpful. All the ISPs I know and work with spend a great deal of time trying to = ensure that DNS works well for their customers, including things = minimising latency, and spending a lot of money and time on hosting CDN = nodes in their network that are close to their customers (since DNS is = often/usually used to send customers to their closest content node). Maybe that=E2=80=99s not true everywhere, but equally so is the =E2=80=9CI= SPs are evil and do nothing for me=E2=80=9D point of view. Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_68948824-E31E-4419-8CB1-F1D115ADF755 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = 28 May 2019, at 03:49, Paul Wouters <paul@nohats.ca> wrote:

Anyway, my point was that the ISP (carrier of = hotspot) only uses their
view of my DNS to my detriment. = Sending them encrypted to the ISP gains
me nothing. = (exception for RBL enhanced DNS servers, but as long as they
are breaking DNSSEC, they cannot be distinguished from a = malicious
attack)


I = don=E2=80=99t know the case of your particular ISP, but IMO saying = things like "the ISP (carrier of hotspot) only uses their view of my DNS = to my detriment=E2=80=9D is not very helpful.

All the ISPs I know and work with spend a great = deal of time trying to ensure that DNS works well for their customers, = including things minimising latency, and spending a lot of money and = time on hosting CDN nodes in their network that are close to their = customers (since DNS is often/usually used to send customers to their = closest content node).

Maybe = that=E2=80=99s not true everywhere, but equally so is the =E2=80=9CISPs = are evil and do nothing for me=E2=80=9D point of view.

Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_68948824-E31E-4419-8CB1-F1D115ADF755-- From nobody Tue May 28 03:15:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0201120178 for ; Tue, 28 May 2019 03:15:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zmqVJ-2zaEbf for ; Tue, 28 May 2019 03:15:51 -0700 (PDT) Received: from mail-it1-x12d.google.com (mail-it1-x12d.google.com [IPv6:2607:f8b0:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2B001200B5 for ; Tue, 28 May 2019 03:15:50 -0700 (PDT) Received: by mail-it1-x12d.google.com with SMTP id m140so3058644itg.2 for ; Tue, 28 May 2019 03:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=M8+F7IoNY4J7B4rFMYUciwHMVppWYWBuS67AjWb29Lc=; b=t7zO1PJ75cKMJ0GG6qZpi1Pd7nZ8n/+536Fjh3WrRw+sF+J7u7sb0F8Nd0a6V/k9FS oNHanYa1oKEDn/2ZmXzTzcZUdJE1PS3aLCMad3N3Ewxk4vkotHRh6BwFOQUkZ4tPIvh4 8pRvxDi+tPW9R7ABYlAnQFgnvYTdr3QmJ+ewQvIUCpGkZvaiVoJwXFbRZ2zyBjwbQETv 41nSzkZIixwnteaA2ZRU1TYCoYBgg4MPZ9c1Kx0RFXXQ25qlq2NFw3BMsnFvVCl5PA8q g99EG029doAoCmnPnPtZVyahOY+ifUF4DnRjH3+DLcbG141ZtPkUq6Bs4yK4ukuxbb0f XEKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=M8+F7IoNY4J7B4rFMYUciwHMVppWYWBuS67AjWb29Lc=; b=gvt0HVJxjcACnA4uXLVWYLJ28Jbz0tNUhxcpvNMkJl78KXcsJ/JiUQnIM3jjUBvnaz 8lonVKujCGxXhj5o17w4gdMKAQqpjVKpyr009A3MdjjNyXCHLdGhX9Uhg4oT1s+yRFzq iV15gEmfVvKkK3Tz2SEE02Mb4NyJzr/ttBRaMRLUKhsFt6ULj+ZRZRaYYDhpZqJeQgSD C1H067qez7WituoU0I/d/ctR1a/XCqOghekFHqXYQ4BZEAbJw4QBo1XZO8iPPLMWT7i8 bGjJzTBwLjm8N0ds+7IIFvInzd4nG4kloYp0JyCdN65dNEYoTwHH/VDQO96jaL1B2Y3L 0i6w== X-Gm-Message-State: APjAAAWktL62B8qRfcVlexZDFf39u9tCXxuuz1hZgeBCu0GE4jLL5YkY kbk7l2LILOinqX9FnL+uH6eTYr3e+vQfjMs2mTk= X-Google-Smtp-Source: APXvYqxUcr7tNswdDEskNt56rBSeJtNdYRgokSDtuuC0Dx+lujfOsk9pZZ4VGWpMZ7QEDvrpfG7J0wmfvjDB6g6z4m8= X-Received: by 2002:a05:660c:546:: with SMTP id w6mr2444712itk.27.1559038550026; Tue, 28 May 2019 03:15:50 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> In-Reply-To: From: tirumal reddy Date: Tue, 28 May 2019 15:45:37 +0530 Message-ID: To: Paul Wouters Cc: Christian Huitema , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f72f180589eff285" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 10:15:53 -0000 --000000000000f72f180589eff285 Content-Type: text/plain; charset="UTF-8" On Tue, 28 May 2019 at 08:20, Paul Wouters wrote: > On Sun, 26 May 2019, Christian Huitema wrote: > > >> As a user I cannot determine that if I once google for "canadian contact > >> lenses", who and why and where that info went. All I know is that 60% > >> of ads are suddently about contact lenses across my house, devices and > >> applications. And the only way out is to encrypt everything end to end, > >> with no midle man or ISP seeing anything. > > > I don't like surveillance any more than you do, but look at the example > > that you just gave. You are asking Google for information about a > > specific product, presumably over an encrypted connection to their > > search engine. Your ISP only sees an encrypted connection to > > "google.com". You may then click on some of the search results, at which > > point both Google, your ISP and all the trackers on the target web page > > know that you contacted https://www.contactlensescanada.com/. Then you > > complain that the surveillance apparatus is bombarding you with ads for > > contact lenses, and you blame the ISP for that. Seriously? > > I should have restrictd by last sentence a bit. I cannot determine who is > sharing my desire for contact lenses. It could be the ad platform, google, > facebook trackers, or anyone monitoring my DNS queries, such as my ISP. > > Arguably, I would have a better idea who is sharing that information if > my last mile was not getting a free look at all my DNS queries, as in > that case only a few https endpoints could know this information. > > Anyway, my point was that the ISP (carrier of hotspot) only uses their > view of my DNS to my detriment. Sending them encrypted to the ISP gains > me nothing. (exception for RBL enhanced DNS servers, but as long as they > are breaking DNSSEC, they cannot be distinguished from a malicious > attack) > Network security functions (NSF) are also deployed by ISPs to protect home networks and mobile subscribers, for instance NSF can perform DNS filtering to block malicious domains. You may want to look into the work happening in I2SNF https://datatracker.ietf.org/wg/i2nsf/about/ and SFC https://datatracker.ietf.org/wg/sfc/about/. Cheers, -Tiru > > Paul > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f72f180589eff285 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 May 2019 at 08:20, Paul Wouter= s <paul@nohats.ca> wrote:
On Sun, 26 May 2019, Christian Huitema wrote:

>> As a user I cannot determine that if I once google for "canad= ian contact
>> lenses", who and why and where that info went. All I know is = that 60%
>> of ads are suddently about contact lenses across my house, devices= and
>> applications. And the only way out is to encrypt everything end to= end,
>> with no midle man or ISP seeing anything.

> I don't like surveillance any more than you do, but look at the ex= ample
> that you just gave. You are asking Google for information about a
> specific product, presumably over an encrypted connection to their
> search engine. Your ISP only sees an encrypted connection to
> "google.com". You may then click on some of the search results, = at which
> point both Google, your ISP and all the trackers on the target web pag= e
> know that you contacted https://www.contactlensescanada.com= /. Then you
> complain that the surveillance apparatus is bombarding you with ads fo= r
> contact lenses, and you blame the ISP for that. Seriously?

I should have restrictd by last sentence a bit. I cannot determine who is sharing my desire for contact lenses. It could be the ad platform, google,<= br> facebook trackers, or anyone monitoring my DNS queries, such as my ISP.

Arguably, I would have a better idea who is sharing that information if
my last mile was not getting a free look at all my DNS queries, as in
that case only a few https endpoints could know this information.

Anyway, my point was that the ISP (carrier of hotspot) only uses their
view of my DNS to my detriment. Sending them encrypted to the ISP gains
me nothing. (exception for RBL enhanced DNS servers, but as long as they are breaking DNSSEC, they cannot be distinguished from a malicious
attack)

Network security functions (NSF= ) are also deployed by ISPs to protect home networks and mobile subscribers= , for instance NSF can perform DNS filtering to block malicious domains. Yo= u may want to look into the work happening in I2SNF=C2=A0https://datatracker.ietf.org/wg/i2ns= f/about/ and SFC=C2=A0https://datatracker.ietf.org/wg/sfc/about/.=C2=A0

<= /div>
Cheers,
-Tiru
=C2=A0

Paul

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000f72f180589eff285-- From nobody Tue May 28 07:40:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FF0F120073 for ; Tue, 28 May 2019 07:40:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XsP6qACyIuFM for ; Tue, 28 May 2019 07:40:48 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74C6912004B for ; Tue, 28 May 2019 07:40:48 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45CxNG1Jd7zFPy; Tue, 28 May 2019 16:40:46 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1559054446; bh=UzRhC9iK8YsrpAUQ++FtgtsrZ/UHMI0dh5sU6a1uR2I=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=RR9XY2n0kOIXEGG9SqQLz0qaDl6fCH5shfXtMBurT4nuw6za8RhOUMG2sr4zrxhND ZRGVYhPJeq+SJyxEg1I6iC5hyGqL6quHuJADfLMQ8o2DM815e1waaCWgcfXZVq5W2M zlXp8liG1mJliKOylXAh1xmFTiL1i50nbsp8sK7w= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id Buba1EW57UJB; Tue, 28 May 2019 16:40:44 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 28 May 2019 16:40:43 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 2ACF5322DFC; Tue, 28 May 2019 10:40:42 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 2ACF5322DFC Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 1E7FB40D8E84; Tue, 28 May 2019 10:40:42 -0400 (EDT) Date: Tue, 28 May 2019 10:40:42 -0400 (EDT) From: Paul Wouters To: Neil Cook cc: add@ietf.org In-Reply-To: <2DD6080A-686C-4B00-9171-630DCFBF3270@open-xchange.com> Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> <2DD6080A-686C-4B00-9171-630DCFBF3270@open-xchange.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 14:40:51 -0000 On Tue, 28 May 2019, Neil Cook wrote: > I don’t know the case of your particular ISP, but IMO saying things like "the ISP (carrier of hotspot) only uses their view of my DNS to my detriment” is not very > helpful. I meant, either they don't interfere or resell DNS data, in which case the last mile is safe because no one else has access to it, or they do interfere or resell DNS data, in which case encryption to the same ISP does not help defend against the attack. But perhaps my view was a bit too simplistic with multi-tenant deployments. I would hope my ISP, that uses Bell for their last mile, would encrypt all data between my modem and their network, so Bell couldn't see anything, but that is not likely to be the case. Note also that I meant that ISP's can be coerced to mangle DNS, such as for the recent mandated porn filter in the UK. I did not mean to say mangling at the ISP level is always the ISPs fault. It could be a government fault. Paul From nobody Tue May 28 08:40:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 360C1120226 for ; Tue, 28 May 2019 08:40:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZQ472Lh6kKFZ for ; Tue, 28 May 2019 08:40:23 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5496A120115 for ; Tue, 28 May 2019 08:40:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1559058013; x=2422971613; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=4etLfi8WTgTfh42eKsX/KPRelCjazM811dtbai/n0zc=; b=u/KEZ8hjNZMIpOsw+dGbDQArCFHOx7YZNoqM+I1SFOB//V6394mTvwU08L3wDpFt 7yhViqm6BIYsE0k6/ovO05ZhiCagjOfhEHM4fhTBjXt42+WSkCZnrj7yf1RT9Tlt LJckqH7WtUP8Y915UcbqkI2OjL1+sd3FdwrUmd+Ox49SMNbEYB41Ydtlm/Gf/m/o IznlpJbLfaSSeCnZd7q62LZMmqAglzmLLuQ+hYIk28JYuVn1pMRKfrp/XFF4Kxvg fUWQ2cBGqqjIzlCIcYtSsUaTEhgPSIWBG+MXRF0FNDuDGTeVGnwG1eYmUYGlTokY nFXd24iiPEAlAIYHBBANjg==; X-AuditID: a2962c47-cebff70000021564-32-5ced5657485f Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 82.09.05476.7565DEC5; Tue, 28 May 2019 09:40:07 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 28 May 2019 11:40:15 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Tue, 28 May 2019 11:40:15 -0400 From: "Livingood, Jason" To: "add@ietf.org" Thread-Topic: [FYI] How Comcast Handles DNS Information Thread-Index: AQHVEKfjeVSP5/NgUk6KgkVLHxwQZKaAtfqA Date: Tue, 28 May 2019 15:40:15 +0000 Message-ID: References: <87D8BAF1-9EF5-4DF4-9F67-571201F8D906@cable.comcast.com> In-Reply-To: <87D8BAF1-9EF5-4DF4-9F67-571201F8D906@cable.comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [68.87.29.7] Content-Type: multipart/alternative; boundary="_000_A2BBC5A927F148828D392BAF28B29D5Ecablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrEIsWRmVeSWpSXmKPExsWSUDRnsm542NsYg0VbbCz+n17H5sDosWTJ T6YAxqhwm6LU4tKk3MwSheLUorLM5FRbpeTEYiU7LgUMAFSak5pYnOqYXJKZn1esj6HGRh9m mF1CeMaKY6dYC7q8Kk5NvMPcwNjo0cXIySEhYCIxu/0oM4gtJHCESWLaljwIu4VJYsM+wy5G LiD7NKPEj/Y+dpAEm4CZxN2FV8AaRAQUJRo33mEEsYVBBn07yQQRt5SYvPkBVI2RxNNJv8Bq WARUJe5862IDsXkFXCR+zD/NArHMRWLp8Raw+ZwCrhL3nn0GsxkFxCS+n1oDNpNZQFzi1pP5 TBBHC0gs2XOeGcIWlXj5+B8riC0qoC/xY/tNNoi4nMTc1/dYIHrTJa5vewi1V1Di5MwnLBA1 4hKHj+xgncAoNgvJillIWmYhaZnFyAEU15RYv0sfokRRYkr3Q3YIW0Oidc5cKNtK4teEVhZk NQsYOVYx8hqaGekZmhromZjomRtuYgSmhEXTdNx3MH44H3uIUYCDUYmH92HQ2xgh1sSy4src Q4wSHMxKIry2U97ECPGmJFZWpRblxxeV5qQWH2KU5mBREudlWvksRkggPbEkNTs1tSC1CCbL xMEp1cAo5a7ffv4bf5nVHZGgHJ0Qk1iNjVFVi8xXmF5brlG+TeWw99Vd7y0v5j/r85tWfPj2 Qm6fYAm/L75PV0jMnOPKqSZ/6u/M/4fyvoRkLLFIWhZwKD2H8QxzGqNuwaLTAmp1yvueZ2Y/ 5i4rWB60zL74dlTzn60/jrusqLDcErF0taLwzucHbuQpsRRnJBpqMRcVJwIAfjLiAQUDAAA= Archived-At: Subject: [Add] [FYI] How Comcast Handles DNS Information X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 15:40:25 -0000 --_000_A2BBC5A927F148828D392BAF28B29D5Ecablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2luY2UgdGhlcmXigJlzIHNvbWUgQUREIGxpc3QgZGlzY3Vzc2lvbiBvZiByZXNvbHZlciBwb2xp Y2llcyDigJMgRllJIG9uIGJlbG93Lg0KDQpGcm9tOiBKYXNvbiBMaXZpbmdvb2QgPEphc29uX0xp dmluZ29vZEBjYWJsZS5jb21jYXN0LmNvbT4NCkRhdGU6IFdlZG5lc2RheSwgTWF5IDIyLCAyMDE5 IGF0IDEwOjA4IEFNDQpUbzogRG9IIFdHIDxkb2hAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRllJXSBI b3cgQ29tY2FzdCBIYW5kbGVzIEROUyBJbmZvcm1hdGlvbg0KDQpBdCB0aGUgcmVjZW50IERvSCBt ZWV0aW5nIGF0IElFVEYtMTA0LCBhbmQgYWxzbyBpbiB0aGUgc2lkZSBtZWV0aW5nIHRoYXQgU3TD qXBoYW5lIG9yZ2FuaXplZCwgdGhlcmUgd2FzIG11Y2ggZGlzY3Vzc2lvbiBhYm91dCBob3cgYSBw cmltYXJ5IG1vdGl2YXRpb24gZm9yIGNlbnRyYWxpemVkIERvSCB3YXMgSVNQIEROUyBwcmFjdGlj ZXM6IHNwZWNpZmljYWxseSwgTlhET01BSU4gcmVkaXJlY3Rpb24gYW5kIEROUyBkYXRhIGNvbGxl Y3Rpb24gYW5kIHByaXZhY3kuDQoNCkkgdGhvdWdodCBJ4oCZZCB0YWtlIGEgbW9tZW50IGhlcmUg dG8gY29uZmlybSBDb21jYXN04oCZcyBwb3NpdGlvbiBvbiB0aGVzZSBpc3N1ZXMuIEZpcnN0LCB3 ZSBkb27igJl0IGRvIE5YRE9NQUlOIHJlZGlyZWN0aW9uIChzZWUgaHR0cHM6Ly9jb3Jwb3JhdGUu Y29tY2FzdC5jb20vY29tY2FzdC12b2ljZXMvY29tY2FzdC1kb21haW4taGVscGVyLXNodXRzLWRv d24pLiAgU2Vjb25kLCBvdXIgbG9uZ3N0YW5kaW5nIHBvbGljeSByZWdhcmRpbmcgY3VzdG9tZXIg RE5TIHF1ZXJpZXMgaXMgc2ltcGxlOiB3ZSBkbyBub3QgdHJhY2sgY3VzdG9tZXJz4oCZIEROUyBk YXRhLCBzZWxsIGl0LCBvciB1c2UgaXQgZm9yIGFkdmVydGlzaW5nIG9yIG1hcmtldGluZy4gIEFu ZCBldmVuIHRob3VnaCBDb21jYXN0IHByb2Nlc3NlcyBtb3JlIHRoYW4gNTUwIGJpbGxpb24gcmVj dXJzaXZlIEROUyBxdWVyaWVzIHBlciBkYXksIGl0IGlzIG91ciBzdGFuZGFyZCBwb2xpY3kgdG8g ZGVsZXRlIGFsbCBETlMgcXVlcmllcyBmcm9tIG91ciBzeXN0ZW1z4oCZIGxvZ3MgZXZlcnkgMjQg aG91cnMsIHVubGVzcyB3ZSBuZWVkIHRvIHJlc2VhcmNoIGFuZCByZXNvbHZlIHNwZWNpZmljIHNl Y3VyaXR5IG9yIG5ldHdvcmsgcGVyZm9ybWFuY2UgaXNzdWVzLg0KDQpXZSB0YWtlIEROUyBzZWN1 cml0eSB2ZXJ5IHNlcmlvdXNseSBhbmQgd2Ugd2VyZSB0aGUgZmlyc3QgbGFyZ2UgSVNQIGluIHRo ZSBVbml0ZWQgU3RhdGVzIHRvIGZ1bGx5IGltcGxlbWVudCBETlNTRUMgdmFsaWRhdGlvbiAoc2Vl IGh0dHBzOi8vY29ycG9yYXRlLmNvbWNhc3QuY29tL2NvbWNhc3Qtdm9pY2VzL2NvbWNhc3QtY29t cGxldGVzLWRuc3NlYy1kZXBsb3ltZW50KS4gV2hldGhlciBpdCBpcyBETlNTRUMgb3Igb3VyIGVh cmx5IGltcGxlbWVudGF0aW9uIG9mIElQdjYsIHdl4oCZcmUgYWx3YXlzIGludGVyZXN0ZWQgaW4g ZGVwbG95aW5nIHZhbHVhYmxlIG5ldyBzdGFuZGFyZHMgYW5kLCBqdXN0IGFzIG1hbnkgb3RoZXIg SVNQcyBhcmUgbm93IGRvaW5nLCB3ZSBjb250aW51ZSB0byBzdHVkeSBob3cgYW5kIHdoZW4gdG8g ZGVwbG95IERvSCBhbmQgRG9UIGluIGEgbWFubmVyIHRoYXQgd2lsbCBtaW5pbWl6ZSBjb25zdW1l ciBkaXNydXB0aW9ucyB3aGlsZSBlbnN1cmluZyBjb250aW51ZWQgY29uc3VtZXIgcHJpdmFjeSAm IHNlY3VyaXR5Lg0KDQpSZWdhcmRzLA0KSmFzb24gTGl2aW5nb29kDQpWaWNlIFByZXNpZGVudCDi gJMgVGVjaG5vbG9neSBQb2xpY3kgJiBTdGFuZGFyZHMNCkNvbWNhc3QNCg0K --_000_A2BBC5A927F148828D392BAF28B29D5Ecablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1 NjNDMTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3 MjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9y bWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1t YXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29y ZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8 Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTQuMHB0Ij5TaW5jZSB0aGVyZeKAmXMgc29tZSBBREQgbGlzdCBkaXNjdXNzaW9u IG9mIHJlc29sdmVyIHBvbGljaWVzIOKAkyBGWUkgb24gYmVsb3cuDQo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBw dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Gcm9t OiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+SmFzb24gTGl2aW5nb29kICZs dDtKYXNvbl9MaXZpbmdvb2RAY2FibGUuY29tY2FzdC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9i PldlZG5lc2RheSwgTWF5IDIyLCAyMDE5IGF0IDEwOjA4IEFNPGJyPg0KPGI+VG86IDwvYj5Eb0gg V0cgJmx0O2RvaEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+W0ZZSV0gSG93IENv bWNhc3QgSGFuZGxlcyBETlMgSW5mb3JtYXRpb24gPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+QXQgdGhlIHJlY2VudCBEb0ggbWVldGluZyBhdCBJRVRGLTEwNCwgYW5kIGFsc28g aW4gdGhlIHNpZGUgbWVldGluZyB0aGF0DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ U3TDqXBoYW5lJm5ic3A7b3JnYW5pemVkLCB0aGVyZSB3YXMgbXVjaCBkaXNjdXNzaW9uIGFib3V0 IGhvdyBhIHByaW1hcnkgbW90aXZhdGlvbiBmb3IgY2VudHJhbGl6ZWQgRG9IIHdhcyBJU1AgRE5T IHByYWN0aWNlczogc3BlY2lmaWNhbGx5LCBOWERPTUFJTiByZWRpcmVjdGlvbiBhbmQgRE5TIGRh dGEgY29sbGVjdGlvbiBhbmQgcHJpdmFjeS4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+SSB0aG91Z2h0IEnigJlkIHRha2UgYSBtb21lbnQgaGVyZSB0byBjb25m aXJtIENvbWNhc3TigJlzIHBvc2l0aW9uIG9uIHRoZXNlIGlzc3Vlcy4gRmlyc3QsIHdlIGRvbuKA mXQgZG8gTlhET01BSU4gcmVkaXJlY3Rpb24gKHNlZQ0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8v Y29ycG9yYXRlLmNvbWNhc3QuY29tL2NvbWNhc3Qtdm9pY2VzL2NvbWNhc3QtZG9tYWluLWhlbHBl ci1zaHV0cy1kb3duIj5odHRwczovL2NvcnBvcmF0ZS5jb21jYXN0LmNvbS9jb21jYXN0LXZvaWNl cy9jb21jYXN0LWRvbWFpbi1oZWxwZXItc2h1dHMtZG93bjwvYT4pLiZuYnNwOyBTZWNvbmQsIG91 ciBsb25nc3RhbmRpbmcgcG9saWN5IHJlZ2FyZGluZyBjdXN0b21lciBETlMgcXVlcmllcyBpcyBz aW1wbGU6IHdlDQogZG8gbm90IHRyYWNrIGN1c3RvbWVyc+KAmSBETlMgZGF0YSwgc2VsbCBpdCwg b3IgdXNlIGl0IGZvciBhZHZlcnRpc2luZyBvciBtYXJrZXRpbmcuJm5ic3A7IEFuZCBldmVuIHRo b3VnaCBDb21jYXN0IHByb2Nlc3NlcyBtb3JlIHRoYW4gNTUwIGJpbGxpb24gcmVjdXJzaXZlIERO UyBxdWVyaWVzIHBlciBkYXksIGl0IGlzIG91ciBzdGFuZGFyZCBwb2xpY3kgdG8gZGVsZXRlIGFs bCBETlMgcXVlcmllcyBmcm9tIG91ciBzeXN0ZW1z4oCZIGxvZ3MgZXZlcnkgMjQgaG91cnMsDQog dW5sZXNzIHdlIG5lZWQgdG8gcmVzZWFyY2ggYW5kIHJlc29sdmUgc3BlY2lmaWMgc2VjdXJpdHkg b3IgbmV0d29yayBwZXJmb3JtYW5jZSBpc3N1ZXMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldl IHRha2UgRE5TIHNlY3VyaXR5IHZlcnkgc2VyaW91c2x5IGFuZCB3ZSB3ZXJlIHRoZSBmaXJzdCBs YXJnZSBJU1AgaW4gdGhlIFVuaXRlZCBTdGF0ZXMgdG8gZnVsbHkgaW1wbGVtZW50IEROU1NFQyB2 YWxpZGF0aW9uIChzZWUNCjxhIGhyZWY9Imh0dHBzOi8vY29ycG9yYXRlLmNvbWNhc3QuY29tL2Nv bWNhc3Qtdm9pY2VzL2NvbWNhc3QtY29tcGxldGVzLWRuc3NlYy1kZXBsb3ltZW50Ij4NCmh0dHBz Oi8vY29ycG9yYXRlLmNvbWNhc3QuY29tL2NvbWNhc3Qtdm9pY2VzL2NvbWNhc3QtY29tcGxldGVz LWRuc3NlYy1kZXBsb3ltZW50PC9hPikuIFdoZXRoZXIgaXQgaXMgRE5TU0VDIG9yIG91ciBlYXJs eSBpbXBsZW1lbnRhdGlvbiBvZiBJUHY2LCB3ZeKAmXJlIGFsd2F5cyBpbnRlcmVzdGVkIGluIGRl cGxveWluZyB2YWx1YWJsZSBuZXcgc3RhbmRhcmRzIGFuZCwganVzdCBhcyBtYW55IG90aGVyIElT UHMgYXJlIG5vdyBkb2luZywgd2UgY29udGludWUNCiB0byBzdHVkeSBob3cgYW5kIHdoZW4gdG8g ZGVwbG95IERvSCBhbmQgRG9UIGluIGEgbWFubmVyIHRoYXQgd2lsbCBtaW5pbWl6ZSBjb25zdW1l ciBkaXNydXB0aW9ucyB3aGlsZSBlbnN1cmluZyBjb250aW51ZWQgY29uc3VtZXIgcHJpdmFjeSAm YW1wOyBzZWN1cml0eS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkcyw8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkphc29uIExpdmluZ29vZDxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VmljZSBQcmVzaWRlbnQg4oCTIFRlY2hub2xvZ3kgUG9s aWN5ICZhbXA7IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Q29tY2FzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A2BBC5A927F148828D392BAF28B29D5Ecablecomcastcom_-- From nobody Tue May 28 08:43:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4FBD120234 for ; Tue, 28 May 2019 08:43:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rSO7c3mdawTV for ; Tue, 28 May 2019 08:43:38 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A191012017A for ; Tue, 28 May 2019 08:43:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1559058216; x=2422971816; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=mUbDaCvF8OILHzwbUg+kwwjGLZg/63XuCg1vCM1zmgI=; b=qSAker3DvKqFKJI6xXkghUdJM5mVqXoQgqHprt6cfyaAgf23c3dPa5wc88tnjEpz yTEedJfDqvR2G3f5AI8RTkt8kzoRb3ZXHdRrAGDzPL29hugs6HWdvaNTvoeYoB/X glmd4TRYaqpo7hSbC8GC54tTRrmHi/BIeGVysVKp93cXyWxBtYaLGY8lDCbzxcPW klh2S7wT4l5pgvGMcl/poQwYbllBbCw9kYWSQjxxjytV6gKQKiYbAvZ/FsW4YfwQ mPmK5s8kYgKcxDzadP8A4Dt6zVgKyuhdQL8jIpKa2tftoZY9ZRmMy/Pfwi/MR3ig PqcoHJKdVaNefWRBbAxKDA==; X-AuditID: 60729ed4-f1dff7000000add3-bf-5ced5720c1dd Received: from COPDCEXC35.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id E1.0F.44499.0275DEC5; Tue, 28 May 2019 09:43:29 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC35.cable.comcast.com (147.191.125.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 28 May 2019 11:43:27 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Tue, 28 May 2019 11:43:27 -0400 From: "Livingood, Jason" To: tirumal reddy , Jim Reid CC: ADD Mailing list Thread-Topic: [Add] publication of DoH Resolver policies Thread-Index: AQHVFH6zxAwDXyjgakumk62/WZupBaZ/NZuAgAF5loA= Date: Tue, 28 May 2019 15:43:27 +0000 Message-ID: <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [68.87.29.7] Content-Type: multipart/alternative; boundary="_000_254F5605B3464AE1A1A36D27AB76B18Fcablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprIKsWRmVeSWpSXmKPExsWSUDRnsq5i+NsYg147i/+n17FZnHuWYHFu 5RNmB2aPnbPusnssWfKTyeP01VfMAcxR4TZFqcWlSbmZJQrFqUVlmcmptkrJicVKdlwKGACo NCc1sTjVMbkkMz+vWB9DjY0+zDC7hPCMowdfMRXMi61YOPchUwPj1aguRk4OCQETiXdt99i7 GLk4hASOMEkcP/obymlhkti6+RwThHOaUWLm4lXsIC1sAmYSdxdeYQaxRQQcJXpufmMCsZkF lCVantwFiwsLmEvMnX+WEaLGQuLhn/msELaVxN1fS4BsDg4WAVWJBd3CIGFeAReJY/Pns0Hs esIsMWnFFrCZnAKBEkuOtbCA2IwCYhLfT62B2iUucevJfCaIFwQkluw5zwxhi0q8fPwPbJeo gL7Ej+032SDichJzX99jAdnLLJAusf2IBMReQYmTM5+wQJSISxw+soN1AqP4LCQbZiF0zELS ARHWlFi/Sx+iWlFiSvdDdghbQ6J1zlwo20pia89RNmQ1Cxg5VjHyWZrpGRqa6BmaWugZGRpt YgQnlHlXdjBenu5xiFGAg1GJhzcu6G2MEGtiWXFl7iFGCQ5mJRFe2ylvYoR4UxIrq1KL8uOL SnNSiw8xSnOwKInzOs17FiMkkJ5YkpqdmlqQWgSTZeLglGpgnNffe0xm7uaq5T8NFhefc16u 4jN9wXfB+uWRxxcELVrBl1vkcmFfSSLnNLWpN4OuvpoXH9W3dnf/3bPFx6O+vHlR9mC/9741 odNvrLxQM5Fl9p8c1o/WYas9K4VrvO7qVrP+Wnbk5PoJsQGGnw67tuZ/2MB+c9fkuMxWnp2S 7krH7hRa9Mt5WSmxFGckGmoxFxUnAgCAtudoJAMAAA== Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 15:43:41 -0000 --_000_254F5605B3464AE1A1A36D27AB76B18Fcablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Rmlyc3Qg4oCTIHRoYW5rcyBmb3IgdGhlIHBvaW50ZXIhDQoNCkNvbW1lbnQg4oCTIHRoaW5ncyBs aWtlIOKAmGxvZ2dpbmfigJkgc2VlbSB2ZXJ5IGJpbmFyeS4gV2hhdCBhYm91dCBkZWZhdWx0IGxv Z2dpbmcgPSBubyBleGNlcHQgaWYgRlFETiA9IG1hbHdhcmUgQyZDLCBpbiB3aGljaCBjYXNlIHll cyAodG8gc3VwcG9ydCBub3RpZnlpbmcgdGhlIGVuZCB1c2VyIG9mIGluZmVjdGlvbik/DQoNCkZy b206IEFkZCA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiB0aXJ1bWFsIHJlZGR5 IDxrb25kdGlyQGdtYWlsLmNvbT4NCkRhdGU6IE1vbmRheSwgTWF5IDI3LCAyMDE5IGF0IDk6MTIg QU0NClRvOiBKaW0gUmVpZCA8amltQHJmYzEwMzUuY29tPg0KQ2M6IEFERCBNYWlsaW5nIGxpc3Qg PGFkZEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbQWRkXSBwdWJsaWNhdGlvbiBvZiBEb0ggUmVz b2x2ZXIgcG9saWNpZXMNCg0KT24gTW9uLCAyNyBNYXkgMjAxOSBhdCAxNjo1MywgSmltIFJlaWQg PGppbUByZmMxMDM1LmNvbTxtYWlsdG86amltQHJmYzEwMzUuY29tPj4gd3JvdGU6DQpPbiAyNyBN YXkgMjAxOSwgYXQgMTE6NTksIHRpcnVtYWwgcmVkZHkgPGtvbmR0aXJAZ21haWwuY29tPG1haWx0 bzprb25kdGlyQGdtYWlsLmNvbT4+IHdyb3RlOg0KPg0KPiBJZiB0aGUgRE9IIHNlcnZlciBwcm92 aWRlZCBieSB0aGUgbmV0d29yayBvZmZlcnMgdGhlIHNhbWUgbGV2ZWwgb2YgcHJpdmFjeSBwcmVz ZXJ2aW5nIGRhdGEgcG9saWN5IGFzIHRoZSBET0ggc2VydmVyIHByZS1jb25maWd1cmVkIGluIHRo ZSBicm93c2VyLCBXaHkgc2hvdWxkbid0IHRoZSBicm93c2VyIHVzZSB0aGUgbmV0d29yayBwcm92 aWRlZCBET0ggc2VydmVyID8NCg0KSG93IGNvdWxkIHRoZSBicm93c2VyIHRlbGwgdGhhdCBib3Ro IERvSCBzZXJ2ZXJzIGhhdmUgdGhlIHNhbWUgcG9saWN5Pw0KDQpIb3cgZG9lcyB0aGUgYnJvd3Nl ciAob3IgYW55dGhpbmcgZWxzZSBmb3IgdGhhdCBtYXR0ZXIpIGtub3cgd2hhdCBzb21lIGFyYml0 cmFyeSBEb0ggc2VydmVy4oCZcyBwcml2YWN5IHByZXNlcnZpbmcgZGF0YSBwb2xpY3kgaXM/IFdo ZXJlIHdpbGwgdGhpcyBiZSBkb2N1bWVudGVkIGFuZCBwdWJsaXNoZWQgaW4gYSB3YXkgdGhhdCBh IHdlYi1iYXNlZCBhcHBsaWNhdGlvbiBvciB0aGUgZW5kIHVzZXIgY2FuIHVuZGVyc3RhbmQgYW5k IHRoZW4gbWFrZSBhbiBpbmZvcm1lZCBjaG9pY2U/DQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1yZWRkeS1kcHJpdmUtYm9vdHN0cmFwLWRucy1zZXJ2ZXItMDMjc2VjdGlvbi0x MCBkZWZpbmVzIGEgbmV3IHByaXZhY3kgY2VydGlmaWNhdGUgZXh0ZW5zaW9uIHRoYXQgaWRlbnRp ZmllcyB0aGUgcHJpdmFjeSBwcmVzZXJ2aW5nIGRhdGEgcG9saWN5IG9mIHRoZSBETlMgc2VydmVy LCBpdCBpcyBpbiBhIG1hY2hpbmUtcGFyc2FibGUgZm9ybWF0Lg0KDQoNCk5vdyByaW5zZSBhbmQg cmVwZWF0IHRoYXQgZm9yIG90aGVyIHNlcnZlci1zaWRlIHBvbGljaWVzOiBkYXRhIHJldGVudGlv biwgR0RQUiBjb21wbGlhbmNlLCBETlMgZmlsdGVyaW5nL2Jsb2NraW5nLCBUTFMgc2Vzc2lvbiBy ZXN1bXB0aW9uLCBFQ1MgYmVoYXZpb3VyLCBRTkFNRSBtaW5pbWlzYXRpb24sIE5YRE9NQUlOIHJl d3JpdGluZywgcXVlcnktcmVsYXRlZCBhZHdhcmUsIGV0YywgZXRjLg0KDQpPaCwgYW5kIGlmIHNv bWUgRG9IIHNlcnZlciBzYXlzIOKAnEkgZG8gUU5BTUUgbWluaW1pc2F0aW9u4oCdIChzYXkpLCBk b2VzIHRoZSBicm93c2VyIG9yIGVuZCB1c2VyIHNpbXBseSB0YWtlIHRoYXQgb24gdHJ1c3Qgb3Ig d291bGQgdGhleSBzb21laG93IGJlIGV4cGVjdGVkIHRvIHZlcmlmeSB0aGF0IGZvciB0aGVtc2Vs dmVzPw0KDQpFbmQgdXNlciB0eXBpY2FsbHkgZG9lcyBub3QgdHJ1c3QgRE9IIHNlcnZlciBpbiBh IHVudHJ1c3RlZCBuZXR3b3JrIChlLmcuIHB1YmxpYyBXaUZpIG5ldHdvcmspIGFuZCBtYXkgb25s eSB1c2UgdGhlIERPSCBzZXJ2ZXIgcHJvdmlkZWQgYnkgdHJ1c3RlZCBuZXR3b3JrIChlLmcuIEVu dGVycHJpc2UsIFNlY3VyZSBob21lIG5ldHdvcmtzKSwgc2ltaWxhciB0byB0aGUgd2F5IHVzZXJz IGRpc2FibGUgVlBOIGNvbm5lY3Rpb24gaW4gc3BlY2lmaWMgbmV0d29ya3MgYW5kIGVuYWJsZSBW UE4gY29ubmVjdGlvbiBieQ0KZGVmYXVsdCBpbiBvdGhlciBuZXR3b3JrcyBmb3IgcHJpdmFjeS4g SW4gYWRkaXRpb24sIHRoZSBwcml2YWN5IGV4dGVuc2lvbiBpbmNsdWRlcyBhIFVSTCB0aGF0IHBv aW50cyB0byB0aGUgc2VjdXJpdHkgYXNzZXNzbWVudCByZXBvcnQgb2YgdGhlIEROUyBzZXJ2ZXIg YnkgYSB0aGlyZCBwYXJ0eSBhdWRpdG9yLg0KDQpDaGVlcnMsDQotVGlydQ0K --_000_254F5605B3464AE1A1A36D27AB76B18Fcablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWww LCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdp bi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxNC4wcHQiPkZpcnN0IOKAkyB0aGFua3MgZm9yIHRoZSBwb2ludGVyITxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+Q29tbWVudCDigJMgdGhpbmdz IGxpa2Ug4oCYbG9nZ2luZ+KAmSBzZWVtIHZlcnkgYmluYXJ5LiBXaGF0IGFib3V0IGRlZmF1bHQg bG9nZ2luZyA9IG5vIGV4Y2VwdCBpZiBGUUROID0gbWFsd2FyZSBDJmFtcDtDLCBpbiB3aGljaCBj YXNlIHllcyAodG8gc3VwcG9ydCBub3RpZnlpbmcgdGhlIGVuZCB1c2VyIG9mIGluZmVjdGlvbik/ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYu b3JnJmd0OyBvbiBiZWhhbGYgb2YgdGlydW1hbCByZWRkeSAmbHQ7a29uZHRpckBnbWFpbC5jb20m Z3Q7PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRheSwgTWF5IDI3LCAyMDE5IGF0IDk6MTIgQU08YnI+ DQo8Yj5UbzogPC9iPkppbSBSZWlkICZsdDtqaW1AcmZjMTAzNS5jb20mZ3Q7PGJyPg0KPGI+Q2M6 IDwvYj5BREQgTWFpbGluZyBsaXN0ICZsdDthZGRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVj dDogPC9iPlJlOiBbQWRkXSBwdWJsaWNhdGlvbiBvZiBEb0ggUmVzb2x2ZXIgcG9saWNpZXM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBNb24sIDI3IE1heSAyMDE5IGF0IDE2OjUzLCBKaW0gUmVpZCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmppbUByZmMxMDM1LmNvbSI+amltQHJmYzEwMzUuY29tPC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGlu IDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gMjcgTWF5IDIwMTksIGF0IDExOjU5LCB0aXJ1bWFsIHJlZGR5ICZsdDs8YSBo cmVmPSJtYWlsdG86a29uZHRpckBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5rb25kdGlyQGdt YWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDsgPGJyPg0KJmd0OyBJZiB0aGUgRE9IIHNl cnZlciBwcm92aWRlZCBieSB0aGUgbmV0d29yayBvZmZlcnMgdGhlIHNhbWUgbGV2ZWwgb2YgcHJp dmFjeSBwcmVzZXJ2aW5nIGRhdGEgcG9saWN5IGFzIHRoZSBET0ggc2VydmVyIHByZS1jb25maWd1 cmVkIGluIHRoZSBicm93c2VyLCBXaHkgc2hvdWxkbid0IHRoZSBicm93c2VyIHVzZSB0aGUgbmV0 d29yayBwcm92aWRlZCBET0ggc2VydmVyID88YnI+DQo8YnI+DQpIb3cgY291bGQgdGhlIGJyb3dz ZXIgdGVsbCB0aGF0IGJvdGggRG9IIHNlcnZlcnMgaGF2ZSB0aGUgc2FtZSBwb2xpY3k/PG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdDttYXJnaW46MC4uOGV4Ij4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCkhvdyBkb2VzIHRoZSBicm93c2VyIChvciBhbnl0aGlu ZyBlbHNlIGZvciB0aGF0IG1hdHRlcikga25vdyB3aGF0IHNvbWUgYXJiaXRyYXJ5IERvSCBzZXJ2 ZXLigJlzIHByaXZhY3kgcHJlc2VydmluZyBkYXRhIHBvbGljeSBpcz8gV2hlcmUgd2lsbCB0aGlz IGJlIGRvY3VtZW50ZWQgYW5kIHB1Ymxpc2hlZCBpbiBhIHdheSB0aGF0IGEgd2ViLWJhc2VkIGFw cGxpY2F0aW9uIG9yIHRoZSBlbmQgdXNlciBjYW4gdW5kZXJzdGFuZCBhbmQgdGhlbiBtYWtlIGFu DQogaW5mb3JtZWQgY2hvaWNlPzxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1yZWRkeS1kcHJpdmUtYm9vdHN0cmFwLWRucy1zZXJ2ZXItMDMjc2Vj dGlvbi0xMCI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXJlZGR5LWRwcml2ZS1i b290c3RyYXAtZG5zLXNlcnZlci0wMyNzZWN0aW9uLTEwPC9hPiBkZWZpbmVzIGEgbmV3IHByaXZh Y3kgY2VydGlmaWNhdGUgZXh0ZW5zaW9uIHRoYXQgaWRlbnRpZmllcw0KIHRoZSBwcml2YWN5IHBy ZXNlcnZpbmcgZGF0YSBwb2xpY3kgb2YgdGhlIEROUyBzZXJ2ZXIsIGl0IGlzIGluIGEgbWFjaGlu ZS1wYXJzYWJsZSBmb3JtYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdDttYXJnaW46MC4uOGV4Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCk5vdyBy aW5zZSBhbmQgcmVwZWF0IHRoYXQgZm9yIG90aGVyIHNlcnZlci1zaWRlIHBvbGljaWVzOiBkYXRh IHJldGVudGlvbiwgR0RQUiBjb21wbGlhbmNlLCBETlMgZmlsdGVyaW5nL2Jsb2NraW5nLCBUTFMg c2Vzc2lvbiByZXN1bXB0aW9uLCBFQ1MgYmVoYXZpb3VyLCBRTkFNRSBtaW5pbWlzYXRpb24sIE5Y RE9NQUlOIHJld3JpdGluZywgcXVlcnktcmVsYXRlZCBhZHdhcmUsIGV0YywgZXRjLjxicj4NCjxi cj4NCk9oLCBhbmQgaWYgc29tZSBEb0ggc2VydmVyIHNheXMg4oCcSSBkbyBRTkFNRSBtaW5pbWlz YXRpb27igJ0gKHNheSksIGRvZXMgdGhlIGJyb3dzZXIgb3IgZW5kIHVzZXIgc2ltcGx5IHRha2Ug dGhhdCBvbiB0cnVzdCBvciB3b3VsZCB0aGV5IHNvbWVob3cgYmUgZXhwZWN0ZWQgdG8gdmVyaWZ5 IHRoYXQgZm9yIHRoZW1zZWx2ZXM/PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FbmQgdXNlciB0eXBpY2FsbHkgZG9lcyBub3QgdHJ1 c3QgRE9IIHNlcnZlciBpbiBhIHVudHJ1c3RlZCBuZXR3b3JrIChlLmcuIHB1YmxpYyBXaUZpIG5l dHdvcmspIGFuZCBtYXkgb25seSB1c2UgdGhlIERPSCBzZXJ2ZXIgcHJvdmlkZWQgYnkgdHJ1c3Rl ZCBuZXR3b3JrIChlLmcuIEVudGVycHJpc2UsIFNlY3VyZSBob21lIG5ldHdvcmtzKSwgc2ltaWxh ciB0byB0aGUgd2F5IHVzZXJzIGRpc2FibGUgVlBOIGNvbm5lY3Rpb24NCiBpbiBzcGVjaWZpYyBu ZXR3b3JrcyBhbmQgZW5hYmxlIFZQTiBjb25uZWN0aW9uIGJ5Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5kZWZhdWx0IGluIG90aGVyIG5l dHdvcmtzIGZvciBwcml2YWN5LiBJbiBhZGRpdGlvbiwgdGhlIHByaXZhY3kgZXh0ZW5zaW9uIGlu Y2x1ZGVzIGEgVVJMIHRoYXQgcG9pbnRzIHRvIHRoZSBzZWN1cml0eSBhc3Nlc3NtZW50IHJlcG9y dCBvZiB0aGUgRE5TIHNlcnZlciBieSBhIHRoaXJkIHBhcnR5IGF1ZGl0b3IuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1UaXJ1PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt bD4NCg== --_000_254F5605B3464AE1A1A36D27AB76B18Fcablecomcastcom_-- From nobody Tue May 28 09:36:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62FBE12019F for ; Tue, 28 May 2019 09:36:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.02 X-Spam-Level: X-Spam-Status: No, score=-0.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QcEI8Rrvlegk for ; Tue, 28 May 2019 09:36:09 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80049.outbound.protection.outlook.com [40.107.8.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03899120198 for ; Tue, 28 May 2019 09:36:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2l4tCWaTDEnfEnT9eNkUcqJFlxtyHfgA5fLltS/mB6Q=; b=UfpQ6dIrLkGG3DhTINwh0neQIHLpDQiv+0zQnn8C+4dgphXU7kH28Ivi/VZYAG03ZSuBJr+tqEspV6WOXxA6HxzyEUQ2g5SUNlKmpbCMqDIL82BwOcaVn4yntNLbkDgTjVgNpF+6XqtP6UPVU0nstumzscbAgsBP6DJTl5skbsA= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2038.eurprd06.prod.outlook.com (10.168.57.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.22; Tue, 28 May 2019 16:36:06 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5%8]) with mapi id 15.20.1922.021; Tue, 28 May 2019 16:36:06 +0000 From: "Winfield, Alister" To: ADD Mailing list Thread-Topic: [Add] publication of DoH Resolver policies Thread-Index: AQHVFWwndNASf9AAW0ug5KjFkEe7HKaAzM0A Date: Tue, 28 May 2019 16:36:06 +0000 Message-ID: <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> In-Reply-To: <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e2db:2400:ccca:2259:318a:fd97] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b5f46d94-b1d7-4b97-53e3-08d6e38a94ef x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0601MB2038; x-ms-traffictypediagnostic: DB6PR0601MB2038: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 00514A2FE6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(346002)(39860400002)(136003)(51914003)(199004)(189003)(86362001)(476003)(2616005)(486006)(83716004)(8936002)(36756003)(6916009)(446003)(11346002)(74482002)(8676002)(58126008)(5660300002)(66574012)(81156014)(71200400001)(102836004)(46003)(71190400001)(82746002)(256004)(81166006)(5024004)(14444005)(53546011)(6506007)(6116002)(33656002)(186003)(6512007)(7736002)(66476007)(66946007)(73956011)(66556008)(14454004)(68736007)(66446008)(6246003)(6486002)(99286004)(6436002)(76116006)(91956017)(64756008)(478600001)(25786009)(2906002)(606006)(53936002)(76176011)(316002)(72206003)(966005)(6306002)(54896002)(229853002)(236005); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2038; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 2PnCz6kI2d2TcnJonxg3dDSkv0iuVhdEPyxWd+Lla5WUh7kyrR7JxKndpS7mXFQHGz65FWb7rwoW+sxwbQ0+UGAk0PwZqv/kjJvxo8GJdhxnuLGVxzYYnSET2qOud6lFxbv5RfFWxngqtFxHEnfVa/ymBsdqoAsFWBEhJOL+XZwukJ2zvNXwZ910ms7Tb9AH+ZsOis848fva72xZa/ckAYsBt9/Sf49ktgU5KogSShgkhqGM7ECJkjk+auqpV7rTwbzYYcnuwDhq+GIZyoDBQmk2HNDtjGXLA4vvNm/MT8qCykpbtUYS0qpFOyxPO6m9QAWXIiLl3lPN2tC8LJvDLdMTq/6BKK0kxT7hMht/5c92J1DCNNz7MnTLMjwvC3VWtna88iT8Uf7lxQEL64qqUOu55KlVF/s3AS1drRvjQDw= Content-Type: multipart/alternative; boundary="_000_1DC2682D1A1F4B5BBB49B2DAAD8E7E7Dskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: b5f46d94-b1d7-4b97-53e3-08d6e38a94ef X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2019 16:36:06.2547 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: alister.winfield@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2038 Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 16:36:13 -0000 --_000_1DC2682D1A1F4B5BBB49B2DAAD8E7E7Dskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXQgd291bGQgYmUgd29uZGVyZnVsIGlmIGV2ZXJ5IG1hbGljaW91cyBkb21haW4gd2FzIGtub3du IHByaW9yIHRvIGl0cyB1c2UsIHNhZGx5IGV4Y2VwdCB3aGVyZSBhIERHQSBpcyBrbm93biB0aGF0 4oCZcyBub3QgdGhlIGNhc2UuIFNvIGl0IGNhbiBiZSB1c2VmdWwgdG8gaGF2ZSBhIGxpdHRsZSBo aXN0b3JpYyBpbmZvcm1hdGlvbiB0byBzZWUgdGhlIGV4dGVudCBvZiB0aGUgaXNzdWUgb25jZSBp dOKAmXMgYmVjb21lIGtub3duLg0KDQpJdOKAmXMgYWxzbyB0cnVlIHRoYXQgd2l0aCBwZXJmb3Jt YW5jZSBpc3N1ZXMgdW5sZXNzIHRoZXkgYXJlIHZlcnkgb2J2aW91cyAoZWcgaW1wYWN0aW5nIHNh eSBGYWNlYm9vaywgR29vZ2xlLCBBbWF6b24gZXRjKSwgb3BlcmF0b3JzIG5lY2Vzc2FyaWx5IHJl bHkgb24gYW5hbHl0aWNzIG9yIGN1c3RvbWVycyB0byBjb21wbGFpbi4gR2l2ZW4gaXNzdWVzIGNh biBiZSB0cmFuc2llbnQgb3IgcGVyaW9kaWMgb25seSBhIGhpc3RvcmljIHJlY29yZCBjYW4gcHJv dmlkZSBpbnNpZ2h0IGludG8gdGhlIHJvb3QgY2F1c2UuDQoNCkFsaXN0ZXINCg0KRnJvbTogQWRk IDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mICJMaXZpbmdvb2QsIEphc29uIiA8 SmFzb25fTGl2aW5nb29kQGNvbWNhc3QuY29tPg0KRGF0ZTogVHVlc2RheSwgMjggTWF5IDIwMTkg YXQgMTY6NDMNClRvOiB0aXJ1bWFsIHJlZGR5IDxrb25kdGlyQGdtYWlsLmNvbT4sIEppbSBSZWlk IDxqaW1AcmZjMTAzNS5jb20+DQpDYzogQUREIE1haWxpbmcgbGlzdCA8YWRkQGlldGYub3JnPg0K U3ViamVjdDogUmU6IFtBZGRdIHB1YmxpY2F0aW9uIG9mIERvSCBSZXNvbHZlciBwb2xpY2llcw0K DQpGaXJzdCDigJMgdGhhbmtzIGZvciB0aGUgcG9pbnRlciENCg0KQ29tbWVudCDigJMgdGhpbmdz IGxpa2Ug4oCYbG9nZ2luZ+KAmSBzZWVtIHZlcnkgYmluYXJ5LiBXaGF0IGFib3V0IGRlZmF1bHQg bG9nZ2luZyA9IG5vIGV4Y2VwdCBpZiBGUUROID0gbWFsd2FyZSBDJkMsIGluIHdoaWNoIGNhc2Ug eWVzICh0byBzdXBwb3J0IG5vdGlmeWluZyB0aGUgZW5kIHVzZXIgb2YgaW5mZWN0aW9uKT8NCg0K RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIHRpcnVtYWwgcmVk ZHkgPGtvbmR0aXJAZ21haWwuY29tPg0KRGF0ZTogTW9uZGF5LCBNYXkgMjcsIDIwMTkgYXQgOTox MiBBTQ0KVG86IEppbSBSZWlkIDxqaW1AcmZjMTAzNS5jb20+DQpDYzogQUREIE1haWxpbmcgbGlz dCA8YWRkQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBZGRdIHB1YmxpY2F0aW9uIG9mIERvSCBS ZXNvbHZlciBwb2xpY2llcw0KDQpPbiBNb24sIDI3IE1heSAyMDE5IGF0IDE2OjUzLCBKaW0gUmVp ZCA8amltQHJmYzEwMzUuY29tPG1haWx0bzpqaW1AcmZjMTAzNS5jb20+PiB3cm90ZToNCk9uIDI3 IE1heSAyMDE5LCBhdCAxMTo1OSwgdGlydW1hbCByZWRkeSA8a29uZHRpckBnbWFpbC5jb208bWFp bHRvOmtvbmR0aXJAZ21haWwuY29tPj4gd3JvdGU6DQo+DQo+IElmIHRoZSBET0ggc2VydmVyIHBy b3ZpZGVkIGJ5IHRoZSBuZXR3b3JrIG9mZmVycyB0aGUgc2FtZSBsZXZlbCBvZiBwcml2YWN5IHBy ZXNlcnZpbmcgZGF0YSBwb2xpY3kgYXMgdGhlIERPSCBzZXJ2ZXIgcHJlLWNvbmZpZ3VyZWQgaW4g dGhlIGJyb3dzZXIsIFdoeSBzaG91bGRuJ3QgdGhlIGJyb3dzZXIgdXNlIHRoZSBuZXR3b3JrIHBy b3ZpZGVkIERPSCBzZXJ2ZXIgPw0KDQpIb3cgY291bGQgdGhlIGJyb3dzZXIgdGVsbCB0aGF0IGJv dGggRG9IIHNlcnZlcnMgaGF2ZSB0aGUgc2FtZSBwb2xpY3k/DQoNCkhvdyBkb2VzIHRoZSBicm93 c2VyIChvciBhbnl0aGluZyBlbHNlIGZvciB0aGF0IG1hdHRlcikga25vdyB3aGF0IHNvbWUgYXJi aXRyYXJ5IERvSCBzZXJ2ZXLigJlzIHByaXZhY3kgcHJlc2VydmluZyBkYXRhIHBvbGljeSBpcz8g V2hlcmUgd2lsbCB0aGlzIGJlIGRvY3VtZW50ZWQgYW5kIHB1Ymxpc2hlZCBpbiBhIHdheSB0aGF0 IGEgd2ViLWJhc2VkIGFwcGxpY2F0aW9uIG9yIHRoZSBlbmQgdXNlciBjYW4gdW5kZXJzdGFuZCBh bmQgdGhlbiBtYWtlIGFuIGluZm9ybWVkIGNob2ljZT8NCg0KaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LXJlZGR5LWRwcml2ZS1ib290c3RyYXAtZG5zLXNlcnZlci0wMyNzZWN0aW9u LTEwPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LXJlZGR5LWRwcml2ZS1i b290c3RyYXAtZG5zLXNlcnZlci0wMyUyM3NlY3Rpb24tMTAmZGF0YT0wMiU3QzAxJTdDYWxpc3Rl ci53aW5maWVsZCU0MHNreS51ayU3Q2QzNmU4NjMyZWY3NzRhNjNlNzU2MDhkNmUzODM0ODNmJTdD NjhiODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjk0NjU1MDM0MDIy MDgxMCZzZGF0YT04JTJGa2RhMCUyQjlxb1IlMkZsakRvam9FS3UlMkZHUXBvbCUyQmhKbDBQdHVJ d0FTS1BVWSUzRCZyZXNlcnZlZD0wPiBkZWZpbmVzIGEgbmV3IHByaXZhY3kgY2VydGlmaWNhdGUg ZXh0ZW5zaW9uIHRoYXQgaWRlbnRpZmllcyB0aGUgcHJpdmFjeSBwcmVzZXJ2aW5nIGRhdGEgcG9s aWN5IG9mIHRoZSBETlMgc2VydmVyLCBpdCBpcyBpbiBhIG1hY2hpbmUtcGFyc2FibGUgZm9ybWF0 Lg0KDQoNCk5vdyByaW5zZSBhbmQgcmVwZWF0IHRoYXQgZm9yIG90aGVyIHNlcnZlci1zaWRlIHBv bGljaWVzOiBkYXRhIHJldGVudGlvbiwgR0RQUiBjb21wbGlhbmNlLCBETlMgZmlsdGVyaW5nL2Js b2NraW5nLCBUTFMgc2Vzc2lvbiByZXN1bXB0aW9uLCBFQ1MgYmVoYXZpb3VyLCBRTkFNRSBtaW5p bWlzYXRpb24sIE5YRE9NQUlOIHJld3JpdGluZywgcXVlcnktcmVsYXRlZCBhZHdhcmUsIGV0Yywg ZXRjLg0KDQpPaCwgYW5kIGlmIHNvbWUgRG9IIHNlcnZlciBzYXlzIOKAnEkgZG8gUU5BTUUgbWlu aW1pc2F0aW9u4oCdIChzYXkpLCBkb2VzIHRoZSBicm93c2VyIG9yIGVuZCB1c2VyIHNpbXBseSB0 YWtlIHRoYXQgb24gdHJ1c3Qgb3Igd291bGQgdGhleSBzb21laG93IGJlIGV4cGVjdGVkIHRvIHZl cmlmeSB0aGF0IGZvciB0aGVtc2VsdmVzPw0KDQpFbmQgdXNlciB0eXBpY2FsbHkgZG9lcyBub3Qg dHJ1c3QgRE9IIHNlcnZlciBpbiBhIHVudHJ1c3RlZCBuZXR3b3JrIChlLmcuIHB1YmxpYyBXaUZp IG5ldHdvcmspIGFuZCBtYXkgb25seSB1c2UgdGhlIERPSCBzZXJ2ZXIgcHJvdmlkZWQgYnkgdHJ1 c3RlZCBuZXR3b3JrIChlLmcuIEVudGVycHJpc2UsIFNlY3VyZSBob21lIG5ldHdvcmtzKSwgc2lt aWxhciB0byB0aGUgd2F5IHVzZXJzIGRpc2FibGUgVlBOIGNvbm5lY3Rpb24gaW4gc3BlY2lmaWMg bmV0d29ya3MgYW5kIGVuYWJsZSBWUE4gY29ubmVjdGlvbiBieQ0KZGVmYXVsdCBpbiBvdGhlciBu ZXR3b3JrcyBmb3IgcHJpdmFjeS4gSW4gYWRkaXRpb24sIHRoZSBwcml2YWN5IGV4dGVuc2lvbiBp bmNsdWRlcyBhIFVSTCB0aGF0IHBvaW50cyB0byB0aGUgc2VjdXJpdHkgYXNzZXNzbWVudCByZXBv cnQgb2YgdGhlIEROUyBzZXJ2ZXIgYnkgYSB0aGlyZCBwYXJ0eSBhdWRpdG9yLg0KDQpDaGVlcnMs DQotVGlydQ0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1l bnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1 c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUg b2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9y LiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ug c2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ug b3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2 ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBv dXIgaW50ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3Mg YXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFu ZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0 aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUx MzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQg KFJlZ2lzdHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25l ZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVz IGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3 b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCg== --_000_1DC2682D1A1F4B5BBB49B2DAAD8E7E7Dskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <8468825AE071034785C4D8080BEBBD54@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OiJcQE1hbGd1biBHb3RoaWMiO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28t c3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2lu LXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDow Y207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4u RW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERl ZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9 DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcy LjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGlu az0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SXQgd291bGQgYmUgd29uZGVyZnVsIGlmIGV2ZXJ5IG1hbGljaW91 cyBkb21haW4gd2FzIGtub3duIHByaW9yIHRvIGl0cyB1c2UsIHNhZGx5IGV4Y2VwdCB3aGVyZSBh IERHQSBpcyBrbm93biB0aGF04oCZcyBub3QgdGhlIGNhc2UuIFNvIGl0IGNhbiBiZSB1c2VmdWwg dG8gaGF2ZSBhIGxpdHRsZSBoaXN0b3JpYyBpbmZvcm1hdGlvbiB0byBzZWUgdGhlIGV4dGVudCBv ZiB0aGUgaXNzdWUgb25jZSBpdOKAmXMgYmVjb21lDQoga25vd24uIDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5JdOKAmXMgYWxzbyB0cnVlIHRoYXQgd2l0aCBwZXJmb3JtYW5jZSBpc3N1ZXMgdW5s ZXNzIHRoZXkgYXJlIHZlcnkgb2J2aW91cyAoZWcgaW1wYWN0aW5nIHNheSBGYWNlYm9vaywgR29v Z2xlLCBBbWF6b24gZXRjKSwgb3BlcmF0b3JzIG5lY2Vzc2FyaWx5IHJlbHkgb24gYW5hbHl0aWNz IG9yIGN1c3RvbWVycyB0byBjb21wbGFpbi4gR2l2ZW4gaXNzdWVzIGNhbiBiZSB0cmFuc2llbnQg b3IgcGVyaW9kaWMgb25seSBhDQogaGlzdG9yaWMgcmVjb3JkIGNhbiBwcm92aWRlIGluc2lnaHQg aW50byB0aGUgcm9vdCBjYXVzZS4gPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsaXN0ZXI8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkFkZCAmbHQ7YWRkLWJvdW5j ZXNAaWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBvZiAmcXVvdDtMaXZpbmdvb2QsIEphc29uJnF1b3Q7 ICZsdDtKYXNvbl9MaXZpbmdvb2RAY29tY2FzdC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1 ZXNkYXksIDI4IE1heSAyMDE5IGF0IDE2OjQzPGJyPg0KPGI+VG86IDwvYj50aXJ1bWFsIHJlZGR5 ICZsdDtrb25kdGlyQGdtYWlsLmNvbSZndDssIEppbSBSZWlkICZsdDtqaW1AcmZjMTAzNS5jb20m Z3Q7PGJyPg0KPGI+Q2M6IDwvYj5BREQgTWFpbGluZyBsaXN0ICZsdDthZGRAaWV0Zi5vcmcmZ3Q7 PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbQWRkXSBwdWJsaWNhdGlvbiBvZiBEb0ggUmVzb2x2 ZXIgcG9saWNpZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPkZpcnN0IOKAkyB0aGFua3Mg Zm9yIHRoZSBwb2ludGVyITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBw dCI+Q29tbWVudCDigJMgdGhpbmdzIGxpa2Ug4oCYbG9nZ2luZ+KAmSBzZWVtIHZlcnkgYmluYXJ5 LiBXaGF0IGFib3V0IGRlZmF1bHQgbG9nZ2luZyA9IG5vIGV4Y2VwdCBpZiBGUUROID0gbWFsd2Fy ZSBDJmFtcDtDLCBpbiB3aGljaCBjYXNlIHllcyAodG8gc3VwcG9ydCBub3RpZnlpbmcgdGhlIGVu ZCB1c2VyIG9mIGluZmVjdGlvbik/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1 QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8 L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BZGQg Jmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgdGlydW1hbCByZWRkeSAm bHQ7a29uZHRpckBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRheSwgTWF5IDI3 LCAyMDE5IGF0IDk6MTIgQU08YnI+DQo8Yj5UbzogPC9iPkppbSBSZWlkICZsdDtqaW1AcmZjMTAz NS5jb20mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5BREQgTWFpbGluZyBsaXN0ICZsdDthZGRAaWV0Zi5v cmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbQWRkXSBwdWJsaWNhdGlvbiBvZiBEb0gg UmVzb2x2ZXIgcG9saWNpZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIDI3IE1heSAyMDE5IGF0IDE2OjUz LCBKaW0gUmVpZCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmppbUByZmMxMDM1LmNvbSI+amltQHJmYzEw MzUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIDI3IE1heSAyMDE5LCBhdCAxMTo1OSwgdGlydW1hbCByZWRkeSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmtvbmR0aXJAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+a29uZHRpckBn bWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDsgSWYgdGhlIERPSCBz ZXJ2ZXIgcHJvdmlkZWQgYnkgdGhlIG5ldHdvcmsgb2ZmZXJzIHRoZSBzYW1lIGxldmVsIG9mIHBy aXZhY3kgcHJlc2VydmluZyBkYXRhIHBvbGljeSBhcyB0aGUgRE9IIHNlcnZlciBwcmUtY29uZmln dXJlZCBpbiB0aGUgYnJvd3NlciwgV2h5IHNob3VsZG4ndCB0aGUgYnJvd3NlciB1c2UgdGhlIG5l dHdvcmsgcHJvdmlkZWQgRE9IIHNlcnZlciA/PGJyPg0KPGJyPg0KSG93IGNvdWxkIHRoZSBicm93 c2VyIHRlbGwgdGhhdCBib3RoIERvSCBzZXJ2ZXJzIGhhdmUgdGhlIHNhbWUgcG9saWN5PzxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luOjAuLjhleCI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpIb3cgZG9lcyB0aGUgYnJvd3NlciAob3IgYW55dGhp bmcgZWxzZSBmb3IgdGhhdCBtYXR0ZXIpIGtub3cgd2hhdCBzb21lIGFyYml0cmFyeSBEb0ggc2Vy dmVy4oCZcyBwcml2YWN5IHByZXNlcnZpbmcgZGF0YSBwb2xpY3kgaXM/IFdoZXJlIHdpbGwgdGhp cyBiZSBkb2N1bWVudGVkIGFuZCBwdWJsaXNoZWQgaW4gYSB3YXkgdGhhdCBhIHdlYi1iYXNlZCBh cHBsaWNhdGlvbiBvciB0aGUgZW5kIHVzZXIgY2FuIHVuZGVyc3RhbmQgYW5kIHRoZW4gbWFrZSBh bg0KIGluZm9ybWVkIGNob2ljZT88bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwczovL2V1cjAxLnNh ZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0b29scy5p ZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1yZWRkeS1kcHJpdmUtYm9vdHN0cmFwLWRucy1zZXJ2ZXIt MDMlMjNzZWN0aW9uLTEwJmFtcDtkYXRhPTAyJTdDMDElN0NhbGlzdGVyLndpbmZpZWxkJTQwc2t5 LnVrJTdDZDM2ZTg2MzJlZjc3NGE2M2U3NTYwOGQ2ZTM4MzQ4M2YlN0M2OGI4NjVkNWNmMTg0YjJi ODJhNGE0ZWRkYjljNTIzNyU3QzAlN0MwJTdDNjM2OTQ2NTUwMzQwMjIwODEwJmFtcDtzZGF0YT04 JTJGa2RhMCUyQjlxb1IlMkZsakRvam9FS3UlMkZHUXBvbCUyQmhKbDBQdHVJd0FTS1BVWSUzRCZh bXA7cmVzZXJ2ZWQ9MCI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXJlZGR5LWRw cml2ZS1ib290c3RyYXAtZG5zLXNlcnZlci0wMyNzZWN0aW9uLTEwPC9hPg0KIGRlZmluZXMgYSBu ZXcgcHJpdmFjeSBjZXJ0aWZpY2F0ZSBleHRlbnNpb24gdGhhdCBpZGVudGlmaWVzIHRoZSBwcml2 YWN5IHByZXNlcnZpbmcgZGF0YSBwb2xpY3kgb2YgdGhlIEROUyBzZXJ2ZXIsIGl0IGlzIGluIGEg bWFjaGluZS1wYXJzYWJsZSBmb3JtYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LWJvdHRvbTo1LjBwdDttYXJnaW46MC4uOGV4Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4N Ck5vdyByaW5zZSBhbmQgcmVwZWF0IHRoYXQgZm9yIG90aGVyIHNlcnZlci1zaWRlIHBvbGljaWVz OiBkYXRhIHJldGVudGlvbiwgR0RQUiBjb21wbGlhbmNlLCBETlMgZmlsdGVyaW5nL2Jsb2NraW5n LCBUTFMgc2Vzc2lvbiByZXN1bXB0aW9uLCBFQ1MgYmVoYXZpb3VyLCBRTkFNRSBtaW5pbWlzYXRp b24sIE5YRE9NQUlOIHJld3JpdGluZywgcXVlcnktcmVsYXRlZCBhZHdhcmUsIGV0YywgZXRjLjxi cj4NCjxicj4NCk9oLCBhbmQgaWYgc29tZSBEb0ggc2VydmVyIHNheXMg4oCcSSBkbyBRTkFNRSBt aW5pbWlzYXRpb27igJ0gKHNheSksIGRvZXMgdGhlIGJyb3dzZXIgb3IgZW5kIHVzZXIgc2ltcGx5 IHRha2UgdGhhdCBvbiB0cnVzdCBvciB3b3VsZCB0aGV5IHNvbWVob3cgYmUgZXhwZWN0ZWQgdG8g dmVyaWZ5IHRoYXQgZm9yIHRoZW1zZWx2ZXM/PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FbmQgdXNlciB0eXBpY2FsbHkgZG9lcyBu b3QgdHJ1c3QgRE9IIHNlcnZlciBpbiBhIHVudHJ1c3RlZCBuZXR3b3JrIChlLmcuIHB1YmxpYyBX aUZpIG5ldHdvcmspIGFuZCBtYXkgb25seSB1c2UgdGhlIERPSCBzZXJ2ZXIgcHJvdmlkZWQgYnkg dHJ1c3RlZCBuZXR3b3JrIChlLmcuIEVudGVycHJpc2UsIFNlY3VyZSBob21lIG5ldHdvcmtzKSwg c2ltaWxhciB0byB0aGUgd2F5IHVzZXJzIGRpc2FibGUgVlBOIGNvbm5lY3Rpb24NCiBpbiBzcGVj aWZpYyBuZXR3b3JrcyBhbmQgZW5hYmxlIFZQTiBjb25uZWN0aW9uIGJ5Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5kZWZhdWx0IGluIG90 aGVyIG5ldHdvcmtzIGZvciBwcml2YWN5LiBJbiBhZGRpdGlvbiwgdGhlIHByaXZhY3kgZXh0ZW5z aW9uIGluY2x1ZGVzIGEgVVJMIHRoYXQgcG9pbnRzIHRvIHRoZSBzZWN1cml0eSBhc3Nlc3NtZW50 IHJlcG9ydCBvZiB0aGUgRE5TIHNlcnZlciBieSBhIHRoaXJkIHBhcnR5IGF1ZGl0b3IuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1UaXJ1 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCkluZm9ybWF0 aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmls ZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFk ZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwg YnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVj ZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZQ0KIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBl LW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXBy b2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRz IGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8g bW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5k DQogZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJr cyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVu ZGVyIGxpY2VuY2UuDQo8YnI+DQo8YnI+DQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8u IDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1 OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJl Z2lzdHJhdGlvbg0KIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVk IGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMg YW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdv cnRoLCBNaWRkbGVzZXggVFc3IDVRRA0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_1DC2682D1A1F4B5BBB49B2DAAD8E7E7Dskyuk_-- From nobody Tue May 28 11:57:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44BBA12023D for ; Tue, 28 May 2019 11:57:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQfM7k9-t8AK for ; Tue, 28 May 2019 11:57:38 -0700 (PDT) Received: from mail-lf1-x132.google.com (mail-lf1-x132.google.com [IPv6:2a00:1450:4864:20::132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 180EF1200CC for ; Tue, 28 May 2019 11:57:38 -0700 (PDT) Received: by mail-lf1-x132.google.com with SMTP id b11so9027570lfa.5 for ; Tue, 28 May 2019 11:57:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=hRYuAn1rRe3I8mxpWmL8tT1NuoIILplyk79DuYqjFO8=; b=p5FczRp2I96YurafL0QgYwbZ6QfIZ4rDSaDO6OCTAxjoAUBbBLfHwadiuO6zKuY7e3 AAYQax1T6ocGp3B4H0qBA41keYsAXAi91DWgIgXsWhTWTWmRbbbpiDEqv6aEq854KpIb sFc89tMU+jorhNKTbyukfvkme5YzJd45q1HhA/hlk1BT4NIfyLBvKulFkkmPblJr1OyR EFwK+ip7qeV+nQzY7krznk4W+02wjycP1ZOzjiWBtavYEFuiibfOyKBTpXsJJUdPCtFZ 98YkH6tZx2hWKfL6iKGCvNIdERKa1pwbnLi0r3nHjVQtwNoICWk8IODpEgMt/mcfzVpq YqzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=hRYuAn1rRe3I8mxpWmL8tT1NuoIILplyk79DuYqjFO8=; b=VrCXGFf+mqGAsCYu+R1wXIsO+n+NG2fl7leBQQH/70UslouE5AUpDULUdbcysDb+yk i6xUTfZ7jVsXRw72wLjdRQ6dmBZ87I/fe8wcheu+L4boytAKR4luAnI1U3nNUH4HpUha eU9xVCwRsKW8v+JhaJbfMdRALj5kCnBt3KldnRb6SkaH94MT/L9zDYfbu9b1E+4HSZi+ hPB2ev05L92S64lhzRRaw1icaAvqFUJLqVoZzZlKP67QMVFvkWfQ/bJ4C0B2dGpmCnZd +PWc50Wuqxk4z08dYzkEWMBiCI0o0GQJoMu7vHxvbqOoxuQvRx2I8A44Jr/jqX5T+rvr q21w== X-Gm-Message-State: APjAAAWDA4BDs2P6/KEjDLLEV1S8LTg27LN0bTxfEwhUINUcYUnDHO2g pknJR4FKBeF8m5v9m+F5KMsZLUqH7VSghAiocLQahg== X-Google-Smtp-Source: APXvYqzWmvpM9IUZxgeyVgLgiE+C1v7R0OTzx8e8DkPv1xwi7qPxlR54uQZfDhh77OlgqzTV55q1aFfEppth5asYa/8= X-Received: by 2002:a19:c20e:: with SMTP id l14mr19370273lfc.5.1559069854683; Tue, 28 May 2019 11:57:34 -0700 (PDT) MIME-Version: 1.0 From: Brian Dickson Date: Tue, 28 May 2019 11:57:21 -0700 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000de57420589f73c5b" Archived-At: Subject: [Add] Three degrees of (administrative) separation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 18:57:44 -0000 --000000000000de57420589f73c5b Content-Type: text/plain; charset="UTF-8" I'm putting this into a new thread, so: (a) it doesn't get mis-threaded; (b) its distinct set of issues don't get conflated; (c) it's easy to find in the archives. The three degrees of (administrative) separation are: 1. Network (including ACLs, firewall policies, RPZs, etc.) 2. Host administration (including network configuration and resolver configuration -- I place DHCP use of offered DNS as host rather than network, although one config choice is to defer to Network) 3. User/App administration (user preferences) The reason I am highlighting this hierarchy (which under DoH/ADD is potentially traditional/historical), is for the following issue: Security policy which relies SOLELY on the host, is fatally flawed. Security policy which replies SOLELY on the app, is doubly flawed. Host compromise (whether at the app level or at the privileged user level) in such a system, affects the only place where security policy is implemented. This in turn means a compromised host which does not have other mechanisms for enforcing policy, is unrestricted in what it can do. In some environments, for example (but not limited to) Enterprise networks, a "belt and suspenders" approach is common. E.g. hosts may be managed via automated systems, but network and/or DNS policies may provide redundant protection, or even a greater level of protection. In these environments, host/app level protections are typically using static sets of protection metadata which is updated periodically (daily or weekly). However, DNS level protections are frequently implemented with "live" feeds, that are capable of updating metadata about "bad" sites at very-near-realtime. Given the very nature of HTTPS (on port 443), where name-based-hosting is used and end-to-end encryption occurs prior to the HTTP headers, the current best practice is to implement DNS-based mechanisms for handling the network enforcement. Here are the reasons for using DNS-based filtering for HTTPS traffic, explained in pedantic fashion: - It is not possible to use IP-only filtering, since IP addresses may contain vast numbers of unrelated name-based hosting on web servers - It is cost-prohibitive and insecure to employ MITM techniques which require the decryption and re-encryption of traffic at a session level - Host connections on the basis of name, require DNS resolution before connections can be established - Thus, use of DNS-based schemes to block HTTP(s) connections are effective, and cost-effective - Enforcement of DNS resolver usage via network-level ACLs on port 53 and/or 853 ensures DNS resolution mechanisms cannot be bypassed - Without the ability to bypass DNS resolver choice (and presuming the non-existence of DoH), a compromised app or host would need to implement its own DNS scheme, which: - would require use of an outside agent (since it cannot directly contact DNS authorities if port 53 is blocked - would require a hard-coded server (name or IP) - at least potentially be detected in DNS logs (if it used name-based connection resolution), or - at least potentially be detected by the absence of DNS lookups (if it used a hard-coded IP address). In contrast, DoT usage at least provides the dedicated (IP, port) combination that is detectable and filterable, allowing the continued use of DNS-resolver selection enforcement, and the continued use of DNS-based mechanisms. Since DoT offers all of the same privacy protections as DoH, I am of the opinion that implementing DoH in a way that bypasses both host administration and network administration, is fundamentally incompatible with enterprise usage. On the other hand, I believe that use of DoT, either directly in the browser, or over a system-level API/proxy, is not incompatible with the enterprise use case. (There are other deployment considerations that need further discussion, but DoT is the starting point for those discussions.) Since the user population consists of a significantly non-negligible proportion of users whose networks employ such mechanisms (including home networks using third party DNS forwarders for filtered DNS), it may be time to discuss ways to prevent deployment of browsers doing DoH, or to discuss public resolver operators requiring that browsers use only DoT, possibly with a very limited set of exception mechanisms (the "dissident" use case), such as limiting that use case to incognito-mode, non-slit-tunnel VPN service over HTTPS, enforced by the public resolver operator. Brian (speaking for myself) --000000000000de57420589f73c5b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm putting this into a new thread, so: (a) it doesn&#= 39;t get mis-threaded; (b) its distinct set of issues don't get conflat= ed; (c) it's easy to find in the archives.

The three= degrees of (administrative) separation are:
  1. Network (inc= luding ACLs, firewall policies, RPZs, etc.)
  2. Host administration (in= cluding network configuration and resolver configuration -- I place DHCP us= e of offered DNS as host rather than network, although one config choice is= to defer to Network)
  3. User/App administration (user preferences)
The reason I am highlighting this hierarchy (which under DoH/AD= D is potentially traditional/historical), is for the following issue:
=
= Security policy which relies SOLELY on the host, is fatally flawed.=C2=A0
Security policy which replies SOLELY on the app, is doubly flawe= d.
Host compromise (whether at the app level or at the privileg= ed user level) in such a system, affects the only place where security poli= cy is implemented.
This in turn means a compromised host which = does not have other mechanisms for enforcing policy, is unrestricted in wha= t it can do.

In some environments, for exa= mple (but not limited to) Enterprise networks, a "belt and suspenders&= quot; approach is common.
E.g. hosts may be managed via automated syste= ms, but network and/or DNS policies may provide redundant protection, or ev= en a greater level of protection.

In these environ= ments, host/app level protections are typically using static sets of protec= tion metadata which is updated periodically (daily or weekly).
Ho= wever, DNS level protections are frequently implemented with "live&quo= t; feeds, that are capable of updating metadata about "bad" sites= at very-near-realtime.

Given the very nature of H= TTPS (on port 443), where name-based-hosting is used and end-to-end encrypt= ion occurs prior to the HTTP headers, the current best practice is to imple= ment DNS-based mechanisms for handling the network enforcement.
H= ere are the reasons for using DNS-based filtering for HTTPS traffic, explai= ned in pedantic fashion:=C2=A0
  • It is not possible to use = IP-only filtering, since IP addresses may contain vast numbers of unrelated= name-based hosting on web servers
  • It is cost-prohibitive and insec= ure to employ MITM techniques which require the decryption and re-encryptio= n of traffic at a session level
  • Host connections on the basis of na= me, require DNS resolution before connections can be established
  • Th= us, use of DNS-based schemes to block HTTP(s) connections are effective, an= d cost-effective
  • Enforcement of DNS resolver usage via network-leve= l ACLs on port 53 and/or 853 ensures DNS resolution mechanisms cannot be by= passed
  • Without the ability to bypass DNS resolver choice (and presu= ming the non-existence of DoH), a compromised app or host would need to imp= lement its own DNS scheme, which:
    • would require use of an outsi= de agent (since it cannot directly contact DNS authorities if port 53 is bl= ocked
    • would require a hard-coded server (name or IP)=C2=A0
    • = at least potentially be detected in DNS logs (if it used name-based connect= ion resolution), or=C2=A0
    • at least potentially be detected by the a= bsence of DNS lookups (if it used a hard-coded IP address).
<= div>In contrast, DoT usage at least provides the dedicated (IP, port) combi= nation that is detectable and filterable, allowing the continued use of DNS= -resolver selection enforcement, and the continued use of DNS-based mechani= sms.

Since DoT offers all of the same privacy prot= ections as DoH, I am of the opinion that implementing DoH in a way that byp= asses both host administration and network administration, is fundamentally= incompatible with enterprise usage.

On the other = hand, I believe that use of DoT, either directly in the browser, or over a = system-level API/proxy, is not incompatible with the enterprise use case. (= There are other deployment considerations that need further discussion, but= DoT is the starting point for those discussions.)

Since the user population consists of a significantly non-negligible propo= rtion of users whose networks employ such mechanisms (including home networ= ks using third party DNS forwarders for filtered DNS), it may be time to di= scuss ways to prevent deployment of browsers doing DoH, or to discuss publi= c resolver operators requiring that browsers use only DoT, possibly with a = very limited set of exception mechanisms (the "dissident" use cas= e), such as limiting that use case to incognito-mode, non-slit-tunnel VPN s= ervice over HTTPS, enforced by the public resolver operator.

=
Brian (speaking for myself)
--000000000000de57420589f73c5b-- From nobody Tue May 28 12:46:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B5481200CC for ; Tue, 28 May 2019 12:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dLD903zkvU1T for ; Tue, 28 May 2019 12:46:40 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CC65120047 for ; Tue, 28 May 2019 12:46:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B305EBE53; Tue, 28 May 2019 20:46:38 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RLEF_5LHgFL7; Tue, 28 May 2019 20:46:35 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B8181BE39; Tue, 28 May 2019 20:46:35 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1559072795; bh=yCnPLTjdw3QpkSWox0YtFR0sc43cHLRvU+sEeUGAWQc=; h=Subject:To:References:From:Date:In-Reply-To:From; b=CppFv/B8+8XBUST/q7/hE0Y9wAUZgfmuf7cIGHv5K8sQpwKijLuBa4BDqXgP5Y3iq JYpJ3vZdCcilzGYuv0FCyrjyfdY7xRwDDPmBluqpnzwxOV+w6VNoS9bBLUqk4/oWLG gam0WrKRUW2nozZxQ91ENf1h2uaWckvXbwgw+HwQ= To: Brian Dickson , add@ietf.org References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 28 May 2019 20:46:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AXnxZPA80yne8oQmtAjT3Rc077Q5OTIlj" Archived-At: Subject: Re: [Add] Three degrees of (administrative) separation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 19:46:43 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AXnxZPA80yne8oQmtAjT3Rc077Q5OTIlj Content-Type: multipart/mixed; boundary="YUW9KRa09fwuysGlMuBkRNTVkAPjS1dBI"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson , add@ietf.org Message-ID: Subject: Re: [Add] Three degrees of (administrative) separation References: In-Reply-To: --YUW9KRa09fwuysGlMuBkRNTVkAPjS1dBI Content-Type: multipart/mixed; boundary="------------06ECED2FFFC5CEB911E859BB" Content-Language: en-GB This is a multi-part message in MIME format. --------------06ECED2FFFC5CEB911E859BB Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Just on one point. On 28/05/2019 19:57, Brian Dickson wrote: > Since DoT offers all of the same privacy protections as DoH, That is not correct as described in the DoH RFC itself. [1] The differences are subtle but real and not irrelevant for these discussions. S. [1] https://tools.ietf.org/html/rfc8484#section-8 --------------06ECED2FFFC5CEB911E859BB Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------06ECED2FFFC5CEB911E859BB-- --YUW9KRa09fwuysGlMuBkRNTVkAPjS1dBI-- --AXnxZPA80yne8oQmtAjT3Rc077Q5OTIlj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlztkBoACgkQWrL68XsX K+olwBAAqzTfog6bZse058Zxlio0bw5SFDncToLInQqZ/9Yx4CN8Agl1Jtmk+K22 t3k1VyrwJx9HuPM1SIDpmdIUe3tVvkTgoDXfjlBl7FhHvawf42WLCVddlkwiodHC RSYCLGMkTenkLs/n5kRfJmC31ZYkfhdk7lWIfyBSmMrak8MO7J1tkoIVGdcm7L+F dXqzbrk9k7LOkg80xKsdCaXfvyJgpuTkJtDv6yTlOToBTYrg6qaDgE2R23PMeuKu y44d1yt0FqE9wI9ngAkHenat2eNUgXi6E2W0fm3QbEQWKgHzvYgpdJv497z/KcUl /ROltgoHoKhKbBdJDmRdm9vbPrQ1Y7w5zkzFnftOxNDC3zSOJio5lC3cosxCyixQ SBiYfKlp0BymA9V9NoP8IGRwBQl/wRJ+Rzi0nT9j8U3l1H3UQb5Be58znA5bq1lt ywwTKFv8+638EK2GlghOYPpd7FvdLlp3BOIr6sS1/HK+D9Y9kRpmf5WRT2oC+eh+ 4uMAhLSqhNIzbtnOArfL43EndGKcsfx6IGWGb7RsJ0C0qgsZ9Tjten6kgeK4nxYU BwtzznC8PZsXz2X2FRR7Ov79Uz9ZIPpZI1kKSebLKP4omikrwLiv1jJMtX7fv6L+ aoi8KEzNZGU89ns5K1j/bE8PbxGt39ZvG/Y2Zr0EDjHxIhDFRzI= =umTJ -----END PGP SIGNATURE----- --AXnxZPA80yne8oQmtAjT3Rc077Q5OTIlj-- From nobody Tue May 28 22:53:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B4F31200F9 for ; Tue, 28 May 2019 22:53:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s4U2lYXXCZmT for ; Tue, 28 May 2019 22:53:24 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 2FE2012008B for ; Tue, 28 May 2019 22:53:24 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 98B015F40A34; Wed, 29 May 2019 07:53:22 +0200 (CEST) Received: from [172.19.152.102] (p4FC21BEB.dip0.t-ipconnect.de [79.194.27.235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id CF5965F4027C; Wed, 29 May 2019 07:53:21 +0200 (CEST) From: "Ralf Weber" To: "Stephen Farrell" Cc: "Brian Dickson" , add@ietf.org Date: Wed, 29 May 2019 07:53:21 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Three degrees of (administrative) separation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 05:53:25 -0000 Moin! On 28 May 2019, at 21:46, Stephen Farrell wrote: > Just on one point. > > On 28/05/2019 19:57, Brian Dickson wrote: >> Since DoT offers all of the same privacy protections as DoH, > > That is not correct as described in the DoH RFC itself. [1] > The differences are subtle but real and not irrelevant for > these discussions. You should not have quoted Brian out of context. For the enterprise use case where you don’t want users to leak DNS data DoT has the same privacy properties as DoH. The section you refer to is the reason we are having this discussion here, trying to somehow close the pandoras box opened there for use cases like enterprises or network based parental controls. So long -Ralf —-- Ralf Weber From nobody Wed May 29 01:13:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 831F7120074 for ; Wed, 29 May 2019 01:13:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.019 X-Spam-Level: X-Spam-Status: No, score=-6.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pt7gRzlp_OuI for ; Wed, 29 May 2019 01:13:40 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F7FC1200F6 for ; Wed, 29 May 2019 01:13:39 -0700 (PDT) Received: from pc-cznic19.fit.vutbr.cz (ws-eduroam-91.cesnet.cz [195.113.238.91]) by mail.nic.cz (Postfix) with ESMTPSA id A91F161288 for ; Wed, 29 May 2019 10:13:35 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1559117615; bh=wLHHfqg7+iRsMKmh04odOX6ZTm212HoKVL8Mb8RFuJk=; h=To:From:Date; b=KiQsWsTxsW8upEMjPfsDEh8ubkrj5snvPp5Mw7UovmGYnPU18ks9G0vnE0DqQU+69 SU8gBHJk/w1zE2hvRZvfYr23jK1mtiWB6m1k7C9cfrgiV/eZG0ejQAkVtlLZffmPqW zNAle3r/wuJYDkCA03FJy3kIj6zUHzkWXA1c7gG4= To: add@ietf.org References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= mQINBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABtCBQZXRyIFNwYWNl ayA8cGV0ci5zcGFjZWtAbmljLmN6PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBL4m67nL4FmzkQyjW86N1qGlCiHkBQJcEOXhBQkFp4LgAAoJEM6N1qGlCiHkxNwQ ALFyQ7Rrghf0rM9GN2+kgP92Qvot21h8/Je3bRTvoLyhYUXcAMRmODZQ/0EsjExFc+pRwn+E 0GD2TpiorDnRMpJYEmHqenYGIrZ5TE0lHwwu0fi/X3evDY4j68OFlim5Q6+7pHOlZWaRsSm5 T6blSwIaNDFYtBhI0X1ZXTGqbXIUBFuGxolo/xEgUkeDy+6D4R8yT17CTHkuGYYrfUYnoBTr j3xMVil/lNMievaklAL8kRNVl0It4M8VzHTyEdMq7pG0CJ0CfU8COizCsu4+zy8dsxMVE0Su hju05LSsClZ9X1csxSK9HjKq+TG1Hx2qciFHRB1qC2mNIvWTm10Gkj4tLTWcJp3k2Wyv+1K2 sLFxreGOwbx0uR7XtIIBTiiZAiVsjBH0D39qG2ZLz+bJkQvlTDZQuXzsMS51wROvTVxPYcXX p069hON2+/QqJasmpOHhOydGkB3uokA0crqvMOnK+EcueKQQspvdLGiFLefJPuM8VVyR9fFZ YjnX2vfGZbE+MxY8wG4mDbhgxsUORAEtNUH/G0dvTv66fzKpl5q9GIZs7el+1IU31w7KivgS 7fsWcOsdzq4KzZzNBRJtEDoxX4b9lQ8P6ttMlPi7PnQ+iN0OUxKSnAnKQiqKMFRO1zH22vn7 iiF4JMO32//0HcpsyV8oEdjDkSJsFRnDfLW2uQINBFhri/0BEADFp4ZfxSoKTAad0IkFK9CV oZ6XKywYLFNPPhzw++gbvHL2EX7QqhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQo u0FeSNnzRGb607U8OFOPQ+ei92Mm1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkh wtWU/6yo+RZs7cFRuihuLl8FuoP0A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAw GDtjWkBVawpoHWwq58OQSx5piwyOCnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdW Jw5OV9BoA7UTHG95xVHV5QiEm6q6igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8 mmKyS8E+mSh3djmqdJNHF1pJqKxAxPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03d uzocyU95DfP/lwNJr5SH918Vf1t7WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkS eXNoMlHJOIqbqm7N414I0HytbENf7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw 3f3Gn3+PDzGEHI9sfQv/mYvO77oRSGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6If ZZ0OIWKLSRa/DQARAQABiQI8BBgBCAAmAhsMFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAlwQ 5fcFCQWngvoACgkQzo3WoaUKIeTg+w/9Gyp5EcB4AoR3vKVxP0SAh1zBher3bh9uGaKTAWt0 +0v8fyZYGEPqZr//9rkodPnXbQnr9ogzjJmZpsPvGPyRZikWjYIwkfM2Vb4BCyr5wQ9++9KB kob5zCQmUw2o7s/gISpFsCC5B0eYusArVDnrCyrroyaxbN6MpUb5lzVMEOCzYljtdrPRAXPL FKRm3ijLV0RcYPzJJVOPV5EzUfCtGsGTXXRI9Y9O/7lFaJ+iWnwygo/Xoi0IgBHvOAj9Gp3Q 0BY+sI6Rgzm9dbddm8gYJ4+FjfZivI7fbdfSubTWvrtFmFdHovIPJYLvXK7hUG22ww4CneIF D4oZSVy9xUoqJf0qQNruzEqTr7y7lbZIzxgPCSVmH0jpgJ1po6RLaJllNA+ZklOQ76fCMiaD 5yQuJluwD5w+acPWTbmZX6DijGHPZSjzeUkiMKctYSRqVUo6JmK0dgwwm3l1/Orb4D3YsLVP QDa4ZrCfSldrGC3zkEJ8iCVSYQwlc0JfIxyn8C3LLxToPYeFv/bQTeDYBjaV7a0SQ/xKUdpg RFzrGrxj7CM2WHcpxCLVK0agobuUO7YXoufHRM6y0rfMwT10baDjh+hLKMshxTqsP55lWvtM SleSGjheVTiZChb3jK0rUPCC4Rg3gDTEQsptC3TgN48PtLpmhsNc4JPm64zlrreInZQ= Organization: CZ.NIC Message-ID: <01a959b4-4038-5a74-46c0-e3b120276d1f@nic.cz> Date: Wed, 29 May 2019 10:14:38 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> Content-Type: text/plain; charset=utf-8 Content-Language: cs Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 08:13:44 -0000 On 28. 05. 19 18:36, Winfield, Alister wrote: > It would be wonderful if every malicious domain was known prior to its > use, sadly except where a DGA is known that’s not the case. So it can be > useful to have a little historic information to see the extent of the > issue once it’s become known. > >   > > It’s also true that with performance issues unless they are very obvious > (eg impacting say Facebook, Google, Amazon etc), operators necessarily > rely on analytics or customers to complain. Given issues can be > transient or periodic only a historic record can provide insight into > the root cause. I disagree, it is not corrent to claim that blacklists are not useful becuse the black list needs to be filled in first. For example e-mail spam lists often get domains blacklisted in _minutes_ from beginning of spam campain. Sure, it takes some time to get bad domains on blacklists so naturally there is a window of opportunity for attackers, but security is not binary at all and closing the window as early as possible is the very nature of Internet security. Once domains is blacklisted it is useful to block it at various levels (or just log it for a while), depending on situation. Petr Špaček @ CZ.NIC > >   > > Alister > >   > > *From: *Add on behalf of "Livingood, Jason" > > *Date: *Tuesday, 28 May 2019 at 16:43 > *To: *tirumal reddy , Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > >   > > First – thanks for the pointer! > >   > > Comment – things like ‘logging’ seem very binary. What about default > logging = no except if FQDN = malware C&C, in which case yes (to support > notifying the end user of infection)? > >   > > *From: *Add on behalf of tirumal reddy > > *Date: *Monday, May 27, 2019 at 9:12 AM > *To: *Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > >   > > On Mon, 27 May 2019 at 16:53, Jim Reid > wrote: > > On 27 May 2019, at 11:59, tirumal reddy > wrote: > > > > If the DOH server provided by the network offers the same level of > privacy preserving data policy as the DOH server pre-configured in > the browser, Why shouldn't the browser use the network provided DOH > server ? > > How could the browser tell that both DoH servers have the same policy? > > > How does the browser (or anything else for that matter) know what > some arbitrary DoH server’s privacy preserving data policy is? Where > will this be documented and published in a way that a web-based > application or the end user can understand and then make an informed > choice? > >   > > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#section-10 > > defines a new privacy certificate extension that identifies the privacy > preserving data policy of the DNS server, it is in a machine-parsable > format. > >   > > > Now rinse and repeat that for other server-side policies: data > retention, GDPR compliance, DNS filtering/blocking, TLS session > resumption, ECS behaviour, QNAME minimisation, NXDOMAIN rewriting, > query-related adware, etc, etc. > > Oh, and if some DoH server says “I do QNAME minimisation” (say), > does the browser or end user simply take that on trust or would they > somehow be expected to verify that for themselves? > >   > > End user typically does not trust DOH server in a untrusted network > (e.g. public WiFi network) and may only use the DOH server provided by > trusted network (e.g. Enterprise, Secure home networks), similar to the > way users disable VPN connection in specific networks and enable VPN > connection by  > > default in other networks for privacy. In addition, the privacy > extension includes a URL that points to the security assessment report > of the DNS server by a third party auditor. > >   > > Cheers, > > -Tiru > > Information in this email including any attachments may be privileged, > confidential and is intended exclusively for the addressee. The views > expressed may not be official policy, but the personal views of the > originator. If you have received it in error, please notify the sender > by return e-mail and delete it from your system. You should not > reproduce, distribute, store, retransmit, use or disclose its contents > to anyone. Please note we reserve the right to monitor all e-mail > communication through our internal and external networks. SKY and the > SKY marks are trademarks of Sky Limited and Sky International AG and are > used under licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited > (Registration No. 2067075), Sky Subscribers Services Limited > (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) > are direct or indirect subsidiaries of Sky Limited (Registration No. > 2247735). All of the companies mentioned in this paragraph are > incorporated in England and Wales and share the same registered office > at Grant Way, Isleworth, Middlesex TW7 5QD From nobody Wed May 29 03:29:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 282E912018B for ; Wed, 29 May 2019 03:29:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DJdD2ZXz4n9G for ; Wed, 29 May 2019 03:29:38 -0700 (PDT) Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E22C12018C for ; Wed, 29 May 2019 03:29:38 -0700 (PDT) Received: by mail-it1-x129.google.com with SMTP id m141so2843325ita.3 for ; Wed, 29 May 2019 03:29:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=W2ADfjJI6zqXOspUgG4tdoT8tY5R7KW7b9vW6rjVVBg=; b=KtWTMSMzFF71igCEwvnT95Cs8CIKZz4G6VRzHP5TxmqSppSCuu0eiP3rf0hdPgYKss gT3/LRWisSTbvffFAs2QQSCVezm9QIjz5OegDSqhZ6MTDUioyzky9PaTGL6BjOKe8CoO tzoDtD9342zvMkalBGxpPFBc53nhK5YvJVy+/1a5mDyKhuT5rvLOJ6vn1UDYDKhU8CYo qoT1FEaqOUs9mJhIXA7MDLjnIqE/NH34lg+DuoUHwOCjuNMpy25n2kAlUsDM6hyzbnMx vaPQgsEen4lWxbGBzjlTtUID+GhQE/F/7OmosKycHecj55/DcskyK9IBe14/KtGOrVh/ emxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=W2ADfjJI6zqXOspUgG4tdoT8tY5R7KW7b9vW6rjVVBg=; b=fKRny0HYVfcEAFPBKe3wzofj1YPvKD9IxHR3HTwycDOECQltw6rO8PlQFHzanbY44B dN7Sxt7VsPI3pIniyoYjVK2WAWf0YcCDKO7hNJJnFEtFAUxVp3yuVkcozXaBLb2GcIh7 lIUyk8/pED9Koy4LRHWQ4lfzooyDbrvsZHVw2e+Vw8MyeiwzTg5O+2IZsKyfSEEQcCeb kWRAEm/bhY+bcNyEB+JGwh5Nw4qe/Q7zk0ubSmOAEliKcLir7FWQkRyMGtZYBMDC7DCl DM58dVDxPt9XMbjq8sj5jvMZjm8z17ZWYW0jE6hrXZ3vVmJP0150uSY4InQar1sfWSAp kJEw== X-Gm-Message-State: APjAAAU/Go8PAtotqgY9wZPCwK4KwanAder2N+L4wjiNdMD3ny5Gv9TO ue3m6LEUyj1E3vVA6ECeP/oUluzWNaQXysMXHjg= X-Google-Smtp-Source: APXvYqzW4m7tpRcb/1PuIRXH6Kp9KyfIWIGw2e8wR+WDSdmVhChNyyGB2GAXd1lL17raE1rNM7/4MYUckR21z2lv0Og= X-Received: by 2002:a24:1d8f:: with SMTP id 137mr1454305itj.66.1559125777088; Wed, 29 May 2019 03:29:37 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> In-Reply-To: <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> From: tirumal reddy Date: Wed, 29 May 2019 15:59:24 +0530 Message-ID: To: "Livingood, Jason" Cc: Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001a840b058a044286" Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 10:29:47 -0000 --0000000000001a840b058a044286 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 28 May 2019 at 21:13, Livingood, Jason wrote: > First =E2=80=93 thanks for the pointer! > > > > Comment =E2=80=93 things like =E2=80=98logging=E2=80=99 seem very binary.= What about default > logging =3D no except if FQDN =3D malware C&C, in which case yes (to supp= ort > notifying the end user of infection)? > If access to malicious domains is logged, logging the client IP address to notify the user is PII, and if client IP address is logged, it is either stored in temporary or permanent logs. Cheers, -Tiru > > *From: *Add on behalf of tirumal reddy < > kondtir@gmail.com> > *Date: *Monday, May 27, 2019 at 9:12 AM > *To: *Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > > > > On Mon, 27 May 2019 at 16:53, Jim Reid wrote: > > On 27 May 2019, at 11:59, tirumal reddy wrote: > > > > If the DOH server provided by the network offers the same level of > privacy preserving data policy as the DOH server pre-configured in the > browser, Why shouldn't the browser use the network provided DOH server ? > > How could the browser tell that both DoH servers have the same policy? > > > How does the browser (or anything else for that matter) know what some > arbitrary DoH server=E2=80=99s privacy preserving data policy is? Where w= ill this > be documented and published in a way that a web-based application or the > end user can understand and then make an informed choice? > > > > > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#se= ction-10 > defines a new privacy certificate extension that identifies the privacy > preserving data policy of the DNS server, it is in a machine-parsable > format. > > > > > Now rinse and repeat that for other server-side policies: data retention, > GDPR compliance, DNS filtering/blocking, TLS session resumption, ECS > behaviour, QNAME minimisation, NXDOMAIN rewriting, query-related adware, > etc, etc. > > Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D= (say), does the > browser or end user simply take that on trust or would they somehow be > expected to verify that for themselves? > > > > End user typically does not trust DOH server in a untrusted network (e.g. > public WiFi network) and may only use the DOH server provided by trusted > network (e.g. Enterprise, Secure home networks), similar to the way users > disable VPN connection in specific networks and enable VPN connection by > > default in other networks for privacy. In addition, the privacy extension > includes a URL that points to the security assessment report of the DNS > server by a third party auditor. > > > > Cheers, > > -Tiru > --0000000000001a840b058a044286 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 May 2019 at 21:13, Livingood, = Jason <Jason_Livingood@co= mcast.com> wrote:

First =E2=80=93 thank= s for the pointer!

=C2=A0<= /span>

Comment =E2=80=93 thi= ngs like =E2=80=98logging=E2=80=99 seem very binary. What about default log= ging =3D no except if FQDN =3D malware C&C, in which case yes (to suppo= rt notifying the end user of infection)?


If access to malicious domains is logged, logging the = client IP address to notify the user is PII, and if client IP address is lo= gged, it is either stored in temporary or permanent logs.=C2=A0
<= br>
Cheers,
-Tiru


=C2=A0

From: = Add <add-bounces@ietf.org> o= n behalf of tirumal reddy <kondtir@gmail.com>
Date: Monday, May 27, 2019 at 9:12 AM
To: Jim Reid <jim@rfc1035.com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] publication of DoH Resolver policies

=C2=A0

On Mon, 27 May 2019 at 16:53, Jim Reid <jim@rfc1035.com> wrote= :

On 27 May 2019, at 11:59, tirumal reddy <kondtir@gmail.com> w= rote:
>
> If the DOH server provided by the network offers the same level of pri= vacy preserving data policy as the DOH server pre-configured in the browser= , Why shouldn't the browser use the network provided DOH server ?

How could the browser tell that both DoH servers have the same policy?


How does the browser (or anything else for that matter) know what some arbi= trary DoH server=E2=80=99s privacy preserving data policy is? Where will th= is be documented and published in a way that a web-based application or the= end user can understand and then make an informed choice?

=C2=A0

https://tools.i= etf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#section-10 defi= nes a new privacy certificate extension that identifies the privacy preserving data policy of the DNS server, it is in a machine-p= arsable format.

=C2=A0


Now rinse and repeat that for other server-side policies: data retention, G= DPR compliance, DNS filtering/blocking, TLS session resumption, ECS behavio= ur, QNAME minimisation, NXDOMAIN rewriting, query-related adware, etc, etc.=

Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D (= say), does the browser or end user simply take that on trust or would they = somehow be expected to verify that for themselves?

=C2=A0

End user typically does not trust DOH server in a un= trusted network (e.g. public WiFi network) and may only use the DOH server = provided by trusted network (e.g. Enterprise, Secure home networks), simila= r to the way users disable VPN connection in specific networks and enable VPN connection by=C2=A0

default in other networks for privacy. In addition, = the privacy extension includes a URL that points to the security assessment= report of the DNS server by a third party auditor.

=C2=A0

Cheers,

-Tiru

--0000000000001a840b058a044286-- From nobody Wed May 29 03:54:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87A1B1200C1 for ; Wed, 29 May 2019 03:54:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3ElaRk_nSwvX for ; Wed, 29 May 2019 03:54:44 -0700 (PDT) Received: from mail-it1-x12a.google.com (mail-it1-x12a.google.com [IPv6:2607:f8b0:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47DD8120072 for ; Wed, 29 May 2019 03:54:44 -0700 (PDT) Received: by mail-it1-x12a.google.com with SMTP id j17so5172280itk.0 for ; Wed, 29 May 2019 03:54:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GUtXNO7ZSlyuoTyIEoO0WCXK0UcPXXYiqRjcjLY/ILs=; b=qp0cvhEfz4iRV+OSHTgAFSxtaufo9l6fO1FT5Q8huwc6ehAqjZLUOUsoqGn2l+FSU1 bpZvv+ZBhW0ZXg1+/2tlztpzqkaX7dHCaQgN+ROhtecHURl/aNdw1zWOEK+peVAuKkE5 MFgiyCwv1GaIJFuCavcKjxGWApXKZVFNGYSDVzkPmNV5LQohtjX8lvaq73KrSjCm4R/F waRAgYbqXNqgA/8dSUsZoE8Pa6Nc3LPYVr2FZEc0iPs33zWqF0kuumNTrOe4ikTWYHvN HGG70CUIJ+fpFplwg7zhYP4oct0LS4UJZvCbrE94dbj3gXnTvXXLu7IOboh1juiEvuPb wmTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GUtXNO7ZSlyuoTyIEoO0WCXK0UcPXXYiqRjcjLY/ILs=; b=uh3l2sF7FGiZGZ1f6WCY5bLO3hqGKGlxdCpSOP88tRpUJWQY2YvjoSIq6Jo3YJ5RJF pCJ07XTBjvZ9s2AOwvZyYAuLiH2PYr1/RIKTWQ3lVK8AM1KSI2xTeYtjPTUscYi5/JSn Vrz4rTUDQmFofZkfJ3SvFEpSsVG+EHoW6DE5xgoYZ92iUJr2d2pnGQ89YIGfURb95kP6 nt/XIkLAK+WvMGeqwZFOSaOo5nq6uYwA+vRQfUP5NEW8aLZcw1XIela1GXDF5i5e9DNF 1a/sWiyaBWi2AU81buch1h1L0FHRYFlwENC1GH9jzyFdTxZwAIeyrA7kcmj290mi5iVe lvbw== X-Gm-Message-State: APjAAAVmGjqBuLH0Aw9U+yHSma3jf612e9y2I9zXZKjYLkHH9jmYGhx5 wDH+ypEYfLPw3AtW1IHTAry8Xm6aIYkZsBRJyt8= X-Google-Smtp-Source: APXvYqwdZxxCxCBQ7MUioBKsWsf0RAdd7SwvIslOHWQiGo2W1q/8w6SIFaGOlM0p2SWRp+SY+SwOKz4mmtJi6c6Insg= X-Received: by 2002:a24:798a:: with SMTP id z132mr6528725itc.101.1559127283518; Wed, 29 May 2019 03:54:43 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> In-Reply-To: <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> From: tirumal reddy Date: Wed, 29 May 2019 16:24:30 +0530 Message-ID: To: "Winfield, Alister" Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e4d14d058a049b10" Archived-At: Subject: Re: [Add] publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 10:54:49 -0000 --000000000000e4d14d058a049b10 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 28 May 2019 at 22:06, Winfield, Alister wrote: > It would be wonderful if every malicious domain was known prior to its > use, sadly except where a DGA is known that=E2=80=99s not the case. So it= can be > useful to have a little historic information to see the extent of the iss= ue > once it=E2=80=99s become known. > DGA is just one technique, malicious domains like C&C domains can possibly be identified by inspecting TXT records (used to send commands to the compromised host), fast flux service network etc. Cheers, -Tiru > > > It=E2=80=99s also true that with performance issues unless they are very = obvious > (eg impacting say Facebook, Google, Amazon etc), operators necessarily re= ly > on analytics or customers to complain. Given issues can be transient or > periodic only a historic record can provide insight into the root cause. > > > > Alister > > > > *From: *Add on behalf of "Livingood, Jason" < > Jason_Livingood@comcast.com> > *Date: *Tuesday, 28 May 2019 at 16:43 > *To: *tirumal reddy , Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > > > > First =E2=80=93 thanks for the pointer! > > > > Comment =E2=80=93 things like =E2=80=98logging=E2=80=99 seem very binary.= What about default > logging =3D no except if FQDN =3D malware C&C, in which case yes (to supp= ort > notifying the end user of infection)? > > > > *From: *Add on behalf of tirumal reddy < > kondtir@gmail.com> > *Date: *Monday, May 27, 2019 at 9:12 AM > *To: *Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > > > > On Mon, 27 May 2019 at 16:53, Jim Reid wrote: > > On 27 May 2019, at 11:59, tirumal reddy wrote: > > > > If the DOH server provided by the network offers the same level of > privacy preserving data policy as the DOH server pre-configured in the > browser, Why shouldn't the browser use the network provided DOH server ? > > How could the browser tell that both DoH servers have the same policy? > > > How does the browser (or anything else for that matter) know what some > arbitrary DoH server=E2=80=99s privacy preserving data policy is? Where w= ill this > be documented and published in a way that a web-based application or the > end user can understand and then make an informed choice? > > > > > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#se= ction-10 > > defines a new privacy certificate extension that identifies the privacy > preserving data policy of the DNS server, it is in a machine-parsable > format. > > > > > Now rinse and repeat that for other server-side policies: data retention, > GDPR compliance, DNS filtering/blocking, TLS session resumption, ECS > behaviour, QNAME minimisation, NXDOMAIN rewriting, query-related adware, > etc, etc. > > Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D= (say), does the > browser or end user simply take that on trust or would they somehow be > expected to verify that for themselves? > > > > End user typically does not trust DOH server in a untrusted network (e.g. > public WiFi network) and may only use the DOH server provided by trusted > network (e.g. Enterprise, Secure home networks), similar to the way users > disable VPN connection in specific networks and enable VPN connection by > > default in other networks for privacy. In addition, the privacy extension > includes a URL that points to the security assessment report of the DNS > server by a third party auditor. > > > > Cheers, > > -Tiru > Information in this email including any attachments may be privileged, > confidential and is intended exclusively for the addressee. The views > expressed may not be official policy, but the personal views of the > originator. If you have received it in error, please notify the sender by > return e-mail and delete it from your system. You should not reproduce, > distribute, store, retransmit, use or disclose its contents to anyone. > Please note we reserve the right to monitor all e-mail communication > through our internal and external networks. SKY and the SKY marks are > trademarks of Sky Limited and Sky International AG and are used under > licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited > (Registration No. 2067075), Sky Subscribers Services Limited (Registratio= n > No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or > indirect subsidiaries of Sky Limited (Registration No. 2247735). All of t= he > companies mentioned in this paragraph are incorporated in England and Wal= es > and share the same registered office at Grant Way, Isleworth, Middlesex T= W7 > 5QD > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000e4d14d058a049b10 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 May 2019 at 22:06, Winfield, A= lister <Alister.Winfield=3D40= sky.uk@dmarc.ietf.org> wrote:

It would be wonderful if every malicious domain was = known prior to its use, sadly except where a DGA is known that=E2=80=99s no= t the case. So it can be useful to have a little historic information to se= e the extent of the issue once it=E2=80=99s become known.


DGA is just one tec= hnique, malicious domains like C&C domains can possibly be identified b= y inspecting TXT records (used to send commands to the compromised host), f= ast flux service network etc.

Cheers,
-T= iru
=C2=A0

=C2=A0

It=E2=80=99s also true that with performance issues = unless they are very obvious (eg impacting say Facebook, Google, Amazon etc= ), operators necessarily rely on analytics or customers to complain. Given = issues can be transient or periodic only a historic record can provide insight into the root cause.

=C2=A0

Alister

=C2=A0

From: = Add <add-bounces@ietf.org> o= n behalf of "Livingood, Jason" <Jason_Livingood@comcast.com>
Date: Tuesday, 28 May 2019 at 16:43
To: tirumal reddy <kondtir@gmail.com>, Jim Reid <jim@rfc1035.com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] publication of DoH Resolver policies

=C2=A0

First =E2=80=93 thank= s for the pointer!

=C2=A0<= u>

Comment =E2=80=93 thi= ngs like =E2=80=98logging=E2=80=99 seem very binary. What about default log= ging =3D no except if FQDN =3D malware C&C, in which case yes (to suppo= rt notifying the end user of infection)?

=C2=A0<= u>

From: = Add <add-bounces@ietf.org> o= n behalf of tirumal reddy <kondtir@gmail.com>
Date: Monday, May 27, 2019 at 9:12 AM
To: Jim Reid <jim@rfc1035.com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] publication of DoH Resolver policies

=C2=A0

On Mon, 27 May 2019 at 16:53, Jim Reid <jim@rfc1035.com> wrote= :

On 27 May 2019, at 11:59, tirumal reddy <kondtir@gmail.com> w= rote:
>
> If the DOH server provided by the network offers the same level of pri= vacy preserving data policy as the DOH server pre-configured in the browser= , Why shouldn't the browser use the network provided DOH server ?

How could the browser tell that both DoH servers have the same policy?


How does the browser (or anything else for that matter) know what some arbi= trary DoH server=E2=80=99s privacy preserving data policy is? Where will th= is be documented and published in a way that a web-based application or the= end user can understand and then make an informed choice?

=C2=A0

https://tools.iet= f.org/html/draft-reddy-dprive-bootstrap-dns-server-03#section-10 defines a new privacy certificate extension that identifies the privacy pr= eserving data policy of the DNS server, it is in a machine-parsable format.=

=C2=A0


Now rinse and repeat that for other server-side policies: data retention, G= DPR compliance, DNS filtering/blocking, TLS session resumption, ECS behavio= ur, QNAME minimisation, NXDOMAIN rewriting, query-related adware, etc, etc.=

Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D (= say), does the browser or end user simply take that on trust or would they = somehow be expected to verify that for themselves?

=C2=A0

End user typically does not trust DOH server in a un= trusted network (e.g. public WiFi network) and may only use the DOH server = provided by trusted network (e.g. Enterprise, Secure home networks), simila= r to the way users disable VPN connection in specific networks and enable VPN connection by=C2=A0

default in other networks for privacy. In addition, = the privacy extension includes a URL that points to the security assessment= report of the DNS server by a third party auditor.

=C2=A0

Cheers,

-Tiru

Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and delete it from your system. You sho= uld not reproduce, distribute, store, retransmit, use or disclose its conte= nts to anyone. Please note we reserve the right to monitor all e-mail commu= nication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and= Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorpo= rated in England and Wales and share the same registered office at Grant Wa= y, Isleworth, Middlesex TW7 5QD
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000e4d14d058a049b10-- From nobody Wed May 29 04:16:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C2511201A0 for ; Wed, 29 May 2019 04:16:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.021 X-Spam-Level: X-Spam-Status: No, score=-0.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6PUU82uPSIfx for ; Wed, 29 May 2019 04:16:30 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150070.outbound.protection.outlook.com [40.107.15.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E60A1200FF for ; Wed, 29 May 2019 04:16:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ChEDV+P/oV4xLEqdl4jTH0wCHjdcp3bznrIMGxZRiaQ=; b=Fi36A//3Kphxmr6IFPlNrVCAdgSW6yTU9lDsUldc2/UW6wr3zSz+u7w+5vVTbqlmf2EoDNqW9c7SavuOj4ztnvg7gPSNtUS/RBsrGUsscca5a0mcs9Pw6bSmMAEU2O5Mg14xM5K6iKmeCgtVCdFOjxDsJtWuVDzW4ulngyl9Xoc= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2246.eurprd06.prod.outlook.com (10.169.211.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.18; Wed, 29 May 2019 11:16:27 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5%8]) with mapi id 15.20.1922.021; Wed, 29 May 2019 11:16:27 +0000 From: "Winfield, Alister" To: tirumal reddy CC: ADD Mailing list Thread-Topic: [EXTERNAL] Re: [Add] publication of DoH Resolver policies Thread-Index: AQHVFWwndNASf9AAW0ug5KjFkEe7HKaAzM0AgAEiIgCAABblAA== Date: Wed, 29 May 2019 11:16:27 +0000 Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 10618783-7431-4ff1-7a78-08d6e42717f1 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0601MB2246; x-ms-traffictypediagnostic: DB6PR0601MB2246: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0052308DC6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(366004)(136003)(346002)(39860400002)(396003)(189003)(51914003)(199004)(6506007)(6512007)(66066001)(53546011)(6246003)(102836004)(6916009)(76176011)(33656002)(72206003)(11346002)(8676002)(446003)(81156014)(606006)(2616005)(54896002)(53936002)(8936002)(1411001)(3846002)(6116002)(2906002)(236005)(229853002)(476003)(7736002)(6306002)(86362001)(81166006)(64756008)(66476007)(66446008)(4326008)(71190400001)(71200400001)(5024004)(14444005)(256004)(486006)(26005)(5660300002)(186003)(14454004)(99286004)(58126008)(36756003)(66574012)(478600001)(66946007)(6436002)(82746002)(316002)(68736007)(966005)(83716004)(66556008)(91956017)(74482002)(25786009)(76116006)(6486002)(73956011); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2246; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Yb8mvq8qeTydBxDx6ldah8k1mxaqpJBp3K4urOqsTfQcZXKevdWYXxmoeXEfXvLrkNy3eHLO16ytYQjR2+HdPei3d12xpODV0s+HZg0gS5omuF7UDHimrnX0xP4zfXdsP+H18/ulnWyIXgctptUS0f3kON/AOuJqWp4ZmJYAIAHA4o+zD+D+j8CSwAyWWhd+E+47ocy9Yd1mT+CUcyfNE+9Rzu5QB+bujQsNPcuenu/vDaXnrUgymaKMN26hwZrADpiEgOK/pQ3baSxLlH4WpUoMlAHaqaly3wIQsAfP/wGxBmMjco8zwmHNooiKYzzYUPWJyrRlHhOd0Pk3TXErvwwTcsQwBkM1m3zNwep7ODvgPnzIlHUJ19P0HSO9v8EcKWhiw+aVmwgvSLcV7lB+pXfXyJQ0FQFez2cGxTV7Wf8= Content-Type: multipart/alternative; boundary="_000_B5D02F73C1D448BA963BF7D2BD2EAF3Fskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 10618783-7431-4ff1-7a78-08d6e42717f1 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 May 2019 11:16:27.5031 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: alister.winfield@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2246 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 11:16:47 -0000 --_000_B5D02F73C1D448BA963BF7D2BD2EAF3Fskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RmFpciBlbm91Z2gsIEnigJltIGp1c3Qgc3RhdGluZyB0aGF0IG5vdCBhbGwgcXVlcmllcy9yZXNw b25zZXMgYXJlIGtub3duIGFzIHBvdGVudGlhbGx5IGJhZCAobWFsd2FyZSAvIHBoaXNoaW5nKSB1 bnRpbCBhZnRlciB0aGUgZmFjdC4gVGhhdCBzaW1wbGUgZmFjdCBpcyB0aGUgcmVhc29uIHNvbWUg RE5TIHByb3ZpZGVycyBjaG9vc2UgdG8gaG9sZCBsb2dzLg0KDQpDaGVlcnMNCkFsaXN0ZXINCg0K RnJvbTogdGlydW1hbCByZWRkeSA8a29uZHRpckBnbWFpbC5jb20+DQpEYXRlOiBXZWRuZXNkYXks IDI5IE1heSAyMDE5IGF0IDExOjU0DQpUbzogIldpbmZpZWxkLCBBbGlzdGVyIiA8QWxpc3Rlci5X aW5maWVsZEBza3kudWs+DQpDYzogQUREIE1haWxpbmcgbGlzdCA8YWRkQGlldGYub3JnPg0KU3Vi amVjdDogW0VYVEVSTkFMXSBSZTogW0FkZF0gcHVibGljYXRpb24gb2YgRG9IIFJlc29sdmVyIHBv bGljaWVzDQoNCk9uIFR1ZSwgMjggTWF5IDIwMTkgYXQgMjI6MDYsIFdpbmZpZWxkLCBBbGlzdGVy IDxBbGlzdGVyLldpbmZpZWxkPTQwc2t5LnVrQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MHNreS51 a0BkbWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KSXQgd291bGQgYmUgd29uZGVyZnVsIGlmIGV2ZXJ5 IG1hbGljaW91cyBkb21haW4gd2FzIGtub3duIHByaW9yIHRvIGl0cyB1c2UsIHNhZGx5IGV4Y2Vw dCB3aGVyZSBhIERHQSBpcyBrbm93biB0aGF04oCZcyBub3QgdGhlIGNhc2UuIFNvIGl0IGNhbiBi ZSB1c2VmdWwgdG8gaGF2ZSBhIGxpdHRsZSBoaXN0b3JpYyBpbmZvcm1hdGlvbiB0byBzZWUgdGhl IGV4dGVudCBvZiB0aGUgaXNzdWUgb25jZSBpdOKAmXMgYmVjb21lIGtub3duLg0KDQpER0EgaXMg anVzdCBvbmUgdGVjaG5pcXVlLCBtYWxpY2lvdXMgZG9tYWlucyBsaWtlIEMmQyBkb21haW5zIGNh biBwb3NzaWJseSBiZSBpZGVudGlmaWVkIGJ5IGluc3BlY3RpbmcgVFhUIHJlY29yZHMgKHVzZWQg dG8gc2VuZCBjb21tYW5kcyB0byB0aGUgY29tcHJvbWlzZWQgaG9zdCksIGZhc3QgZmx1eCBzZXJ2 aWNlIG5ldHdvcmsgZXRjLg0KDQpDaGVlcnMsDQotVGlydQ0KDQoNCkl04oCZcyBhbHNvIHRydWUg dGhhdCB3aXRoIHBlcmZvcm1hbmNlIGlzc3VlcyB1bmxlc3MgdGhleSBhcmUgdmVyeSBvYnZpb3Vz IChlZyBpbXBhY3Rpbmcgc2F5IEZhY2Vib29rLCBHb29nbGUsIEFtYXpvbiBldGMpLCBvcGVyYXRv cnMgbmVjZXNzYXJpbHkgcmVseSBvbiBhbmFseXRpY3Mgb3IgY3VzdG9tZXJzIHRvIGNvbXBsYWlu LiBHaXZlbiBpc3N1ZXMgY2FuIGJlIHRyYW5zaWVudCBvciBwZXJpb2RpYyBvbmx5IGEgaGlzdG9y aWMgcmVjb3JkIGNhbiBwcm92aWRlIGluc2lnaHQgaW50byB0aGUgcm9vdCBjYXVzZS4NCg0KQWxp c3Rlcg0KDQpGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphZGQtYm91bmNl c0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiAiTGl2aW5nb29kLCBKYXNvbiIgPEphc29uX0xpdmlu Z29vZEBjb21jYXN0LmNvbTxtYWlsdG86SmFzb25fTGl2aW5nb29kQGNvbWNhc3QuY29tPj4NCkRh dGU6IFR1ZXNkYXksIDI4IE1heSAyMDE5IGF0IDE2OjQzDQpUbzogdGlydW1hbCByZWRkeSA8a29u ZHRpckBnbWFpbC5jb208bWFpbHRvOmtvbmR0aXJAZ21haWwuY29tPj4sIEppbSBSZWlkIDxqaW1A cmZjMTAzNS5jb208bWFpbHRvOmppbUByZmMxMDM1LmNvbT4+DQpDYzogQUREIE1haWxpbmcgbGlz dCA8YWRkQGlldGYub3JnPG1haWx0bzphZGRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtBZGRd IHB1YmxpY2F0aW9uIG9mIERvSCBSZXNvbHZlciBwb2xpY2llcw0KDQpGaXJzdCDigJMgdGhhbmtz IGZvciB0aGUgcG9pbnRlciENCg0KQ29tbWVudCDigJMgdGhpbmdzIGxpa2Ug4oCYbG9nZ2luZ+KA mSBzZWVtIHZlcnkgYmluYXJ5LiBXaGF0IGFib3V0IGRlZmF1bHQgbG9nZ2luZyA9IG5vIGV4Y2Vw dCBpZiBGUUROID0gbWFsd2FyZSBDJkMsIGluIHdoaWNoIGNhc2UgeWVzICh0byBzdXBwb3J0IG5v dGlmeWluZyB0aGUgZW5kIHVzZXIgb2YgaW5mZWN0aW9uKT8NCg0KRnJvbTogQWRkIDxhZGQtYm91 bmNlc0BpZXRmLm9yZzxtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2Yg dGlydW1hbCByZWRkeSA8a29uZHRpckBnbWFpbC5jb208bWFpbHRvOmtvbmR0aXJAZ21haWwuY29t Pj4NCkRhdGU6IE1vbmRheSwgTWF5IDI3LCAyMDE5IGF0IDk6MTIgQU0NClRvOiBKaW0gUmVpZCA8 amltQHJmYzEwMzUuY29tPG1haWx0bzpqaW1AcmZjMTAzNS5jb20+Pg0KQ2M6IEFERCBNYWlsaW5n IGxpc3QgPGFkZEBpZXRmLm9yZzxtYWlsdG86YWRkQGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBb QWRkXSBwdWJsaWNhdGlvbiBvZiBEb0ggUmVzb2x2ZXIgcG9saWNpZXMNCg0KT24gTW9uLCAyNyBN YXkgMjAxOSBhdCAxNjo1MywgSmltIFJlaWQgPGppbUByZmMxMDM1LmNvbTxtYWlsdG86amltQHJm YzEwMzUuY29tPj4gd3JvdGU6DQpPbiAyNyBNYXkgMjAxOSwgYXQgMTE6NTksIHRpcnVtYWwgcmVk ZHkgPGtvbmR0aXJAZ21haWwuY29tPG1haWx0bzprb25kdGlyQGdtYWlsLmNvbT4+IHdyb3RlOg0K Pg0KPiBJZiB0aGUgRE9IIHNlcnZlciBwcm92aWRlZCBieSB0aGUgbmV0d29yayBvZmZlcnMgdGhl IHNhbWUgbGV2ZWwgb2YgcHJpdmFjeSBwcmVzZXJ2aW5nIGRhdGEgcG9saWN5IGFzIHRoZSBET0gg c2VydmVyIHByZS1jb25maWd1cmVkIGluIHRoZSBicm93c2VyLCBXaHkgc2hvdWxkbid0IHRoZSBi cm93c2VyIHVzZSB0aGUgbmV0d29yayBwcm92aWRlZCBET0ggc2VydmVyID8NCg0KSG93IGNvdWxk IHRoZSBicm93c2VyIHRlbGwgdGhhdCBib3RoIERvSCBzZXJ2ZXJzIGhhdmUgdGhlIHNhbWUgcG9s aWN5Pw0KDQpIb3cgZG9lcyB0aGUgYnJvd3NlciAob3IgYW55dGhpbmcgZWxzZSBmb3IgdGhhdCBt YXR0ZXIpIGtub3cgd2hhdCBzb21lIGFyYml0cmFyeSBEb0ggc2VydmVy4oCZcyBwcml2YWN5IHBy ZXNlcnZpbmcgZGF0YSBwb2xpY3kgaXM/IFdoZXJlIHdpbGwgdGhpcyBiZSBkb2N1bWVudGVkIGFu ZCBwdWJsaXNoZWQgaW4gYSB3YXkgdGhhdCBhIHdlYi1iYXNlZCBhcHBsaWNhdGlvbiBvciB0aGUg ZW5kIHVzZXIgY2FuIHVuZGVyc3RhbmQgYW5kIHRoZW4gbWFrZSBhbiBpbmZvcm1lZCBjaG9pY2U/ DQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yZWRkeS1kcHJpdmUtYm9vdHN0 cmFwLWRucy1zZXJ2ZXItMDMjc2VjdGlvbi0xMDxodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90 ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0b29scy5pZXRmLm9yZyUyRmh0 bWwlMkZkcmFmdC1yZWRkeS1kcHJpdmUtYm9vdHN0cmFwLWRucy1zZXJ2ZXItMDMlMjNzZWN0aW9u LTEwJmRhdGE9MDIlN0MwMSU3Q0FsaXN0ZXIuV2luZmllbGQlNDBza3kudWslN0MxMmQ2MWE4ZGQw ZWU0NjBlMGFjMzA4ZDZlNDI0MTQyNSU3QzY4Yjg2NWQ1Y2YxODRiMmI4MmE0YTRlZGRiOWM1MjM3 JTdDMCU3QzAlN0M2MzY5NDcyNDA5NDMxMzIwMDUmc2RhdGE9bWVReGpHaGFDMmhabVZGcGlhdlFl THE3WEs2bzgzV3pIZ2hzQ0l5aVBTWSUzRCZyZXNlcnZlZD0wPiBkZWZpbmVzIGEgbmV3IHByaXZh Y3kgY2VydGlmaWNhdGUgZXh0ZW5zaW9uIHRoYXQgaWRlbnRpZmllcyB0aGUgcHJpdmFjeSBwcmVz ZXJ2aW5nIGRhdGEgcG9saWN5IG9mIHRoZSBETlMgc2VydmVyLCBpdCBpcyBpbiBhIG1hY2hpbmUt cGFyc2FibGUgZm9ybWF0Lg0KDQoNCk5vdyByaW5zZSBhbmQgcmVwZWF0IHRoYXQgZm9yIG90aGVy IHNlcnZlci1zaWRlIHBvbGljaWVzOiBkYXRhIHJldGVudGlvbiwgR0RQUiBjb21wbGlhbmNlLCBE TlMgZmlsdGVyaW5nL2Jsb2NraW5nLCBUTFMgc2Vzc2lvbiByZXN1bXB0aW9uLCBFQ1MgYmVoYXZp b3VyLCBRTkFNRSBtaW5pbWlzYXRpb24sIE5YRE9NQUlOIHJld3JpdGluZywgcXVlcnktcmVsYXRl ZCBhZHdhcmUsIGV0YywgZXRjLg0KDQpPaCwgYW5kIGlmIHNvbWUgRG9IIHNlcnZlciBzYXlzIOKA nEkgZG8gUU5BTUUgbWluaW1pc2F0aW9u4oCdIChzYXkpLCBkb2VzIHRoZSBicm93c2VyIG9yIGVu ZCB1c2VyIHNpbXBseSB0YWtlIHRoYXQgb24gdHJ1c3Qgb3Igd291bGQgdGhleSBzb21laG93IGJl IGV4cGVjdGVkIHRvIHZlcmlmeSB0aGF0IGZvciB0aGVtc2VsdmVzPw0KDQpFbmQgdXNlciB0eXBp Y2FsbHkgZG9lcyBub3QgdHJ1c3QgRE9IIHNlcnZlciBpbiBhIHVudHJ1c3RlZCBuZXR3b3JrIChl LmcuIHB1YmxpYyBXaUZpIG5ldHdvcmspIGFuZCBtYXkgb25seSB1c2UgdGhlIERPSCBzZXJ2ZXIg cHJvdmlkZWQgYnkgdHJ1c3RlZCBuZXR3b3JrIChlLmcuIEVudGVycHJpc2UsIFNlY3VyZSBob21l IG5ldHdvcmtzKSwgc2ltaWxhciB0byB0aGUgd2F5IHVzZXJzIGRpc2FibGUgVlBOIGNvbm5lY3Rp b24gaW4gc3BlY2lmaWMgbmV0d29ya3MgYW5kIGVuYWJsZSBWUE4gY29ubmVjdGlvbiBieQ0KZGVm YXVsdCBpbiBvdGhlciBuZXR3b3JrcyBmb3IgcHJpdmFjeS4gSW4gYWRkaXRpb24sIHRoZSBwcml2 YWN5IGV4dGVuc2lvbiBpbmNsdWRlcyBhIFVSTCB0aGF0IHBvaW50cyB0byB0aGUgc2VjdXJpdHkg YXNzZXNzbWVudCByZXBvcnQgb2YgdGhlIEROUyBzZXJ2ZXIgYnkgYSB0aGlyZCBwYXJ0eSBhdWRp dG9yLg0KDQpDaGVlcnMsDQotVGlydQ0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRp bmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlz IGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVz c2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9m IHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNl IG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlv dXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCBy ZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNl IG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmlj YXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5k IHRoZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRl cm5hdGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRl ZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVk IChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGlt aXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lz dHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMg b2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29t cGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVu Z2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBH cmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCi0tDQpBZGQgbWFpbGluZyBs aXN0DQpBZGRAaWV0Zi5vcmc8bWFpbHRvOkFkZEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vYWRkPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4l MkZsaXN0aW5mbyUyRmFkZCZkYXRhPTAyJTdDMDElN0NBbGlzdGVyLldpbmZpZWxkJTQwc2t5LnVr JTdDMTJkNjFhOGRkMGVlNDYwZTBhYzMwOGQ2ZTQyNDE0MjUlN0M2OGI4NjVkNWNmMTg0YjJiODJh NGE0ZWRkYjljNTIzNyU3QzAlN0MwJTdDNjM2OTQ3MjQwOTQzMTQyMDEzJnNkYXRhPXFVME1MZFRq WCUyRm1zakxFcWN5OE9DWXNLWEpSbEdRTHhBN2U3JTJCNmVubzFvJTNEJnJlc2VydmVkPTA+DQot LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLQ0KVGhpcyBlbWFpbCBpcyBmcm9tIGFuIGV4dGVybmFsIHNvdXJjZS4gUGxlYXNl IGRvIG5vdCBvcGVuIGF0dGFjaG1lbnRzIG9yIGNsaWNrIGxpbmtzIGZyb20gYW4gdW5rbm93biBv ciBzdXNwaWNpb3VzIG9yaWdpbi4gUGhpc2hpbmcgYXR0ZW1wdHMgY2FuIGJlIHJlcG9ydGVkIGJ5 IHNlbmRpbmcgdGhlbSB0byBwaGlzaGluZ0Bza3kudWsgYXMgYXR0YWNobWVudHMuIFRoYW5rIHlv dQ0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0NCg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55 IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVu ZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1h eSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBv cmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlm eSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lz dGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5z bWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUg d2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24g dGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBT S1kgbWFya3MgYXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlv bmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVn aXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdp c3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAo UmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlv biBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5 IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVz IG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQg YW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBX YXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCg== --_000_B5D02F73C1D448BA963BF7D2BD2EAF3Fskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <0B70BE9243C3684DA293CDA75E2D41F7@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OiJcQE1hbGd1biBHb3RoaWMiO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28t c3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2lu LXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDow Y207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0K CW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i RU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZhaXIgZW5vdWdoLCBJ4oCZbSBqdXN0IHN0YXRp bmcgdGhhdCBub3QgYWxsIHF1ZXJpZXMvcmVzcG9uc2VzIGFyZSBrbm93biBhcyBwb3RlbnRpYWxs eSBiYWQgKG1hbHdhcmUgLyBwaGlzaGluZykgdW50aWwgYWZ0ZXIgdGhlIGZhY3QuIFRoYXQgc2lt cGxlIGZhY3QgaXMgdGhlIHJlYXNvbiBzb21lIEROUyBwcm92aWRlcnMgY2hvb3NlIHRvIGhvbGQg bG9ncy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DaGVlcnM8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkFsaXN0ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29s b3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Y29sb3I6YmxhY2siPnRpcnVtYWwgcmVkZHkgJmx0O2tvbmR0aXJAZ21haWwuY29tJmd0Ozxicj4N CjxiPkRhdGU6IDwvYj5XZWRuZXNkYXksIDI5IE1heSAyMDE5IGF0IDExOjU0PGJyPg0KPGI+VG86 IDwvYj4mcXVvdDtXaW5maWVsZCwgQWxpc3RlciZxdW90OyAmbHQ7QWxpc3Rlci5XaW5maWVsZEBz a3kudWsmZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5BREQgTWFpbGluZyBsaXN0ICZsdDthZGRAaWV0Zi5v cmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPltFWFRFUk5BTF0gUmU6IFtBZGRdIHB1YmxpY2F0 aW9uIG9mIERvSCBSZXNvbHZlciBwb2xpY2llczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgMjggTWF5IDIw MTkgYXQgMjI6MDYsIFdpbmZpZWxkLCBBbGlzdGVyICZsdDtBbGlzdGVyLldpbmZpZWxkPTxhIGhy ZWY9Im1haWx0bzo0MHNreS51a0BkbWFyYy5pZXRmLm9yZyI+NDBza3kudWtAZG1hcmMuaWV0Zi5v cmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3Bh ZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBj bSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SXQgd291bGQgYmUgd29u ZGVyZnVsIGlmIGV2ZXJ5IG1hbGljaW91cyBkb21haW4gd2FzIGtub3duIHByaW9yIHRvIGl0cyB1 c2UsIHNhZGx5IGV4Y2VwdCB3aGVyZSBhIERHQSBpcyBrbm93biB0aGF04oCZcyBub3QgdGhlIGNh c2UuIFNvIGl0IGNhbiBiZSB1c2VmdWwgdG8gaGF2ZSBhIGxpdHRsZSBoaXN0b3JpYw0KIGluZm9y bWF0aW9uIHRvIHNlZSB0aGUgZXh0ZW50IG9mIHRoZSBpc3N1ZSBvbmNlIGl04oCZcyBiZWNvbWUg a25vd24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+REdBIGlzIGp1c3Qgb25lIHRlY2huaXF1ZSwgbWFs aWNpb3VzIGRvbWFpbnMgbGlrZSBDJmFtcDtDIGRvbWFpbnMgY2FuIHBvc3NpYmx5IGJlIGlkZW50 aWZpZWQgYnkgaW5zcGVjdGluZyBUWFQgcmVjb3JkcyAodXNlZCB0byBzZW5kIGNvbW1hbmRzIHRv IHRoZSBjb21wcm9taXNlZCBob3N0KSwgZmFzdCBmbHV4IHNlcnZpY2UgbmV0d29yayBldGMuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVy cyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1U aXJ1PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+SXTigJlzIGFsc28gdHJ1ZSB0aGF0IHdpdGggcGVyZm9ybWFuY2UgaXNzdWVz IHVubGVzcyB0aGV5IGFyZSB2ZXJ5IG9idmlvdXMgKGVnIGltcGFjdGluZyBzYXkgRmFjZWJvb2ss IEdvb2dsZSwgQW1hem9uIGV0YyksIG9wZXJhdG9ycyBuZWNlc3NhcmlseSByZWx5IG9uIGFuYWx5 dGljcyBvciBjdXN0b21lcnMgdG8NCiBjb21wbGFpbi4gR2l2ZW4gaXNzdWVzIGNhbiBiZSB0cmFu c2llbnQgb3IgcGVyaW9kaWMgb25seSBhIGhpc3RvcmljIHJlY29yZCBjYW4gcHJvdmlkZSBpbnNp Z2h0IGludG8gdGhlIHJvb3QgY2F1c2UuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkFs aXN0ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0 REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOg0K PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+QWRk ICZsdDs8YSBocmVmPSJtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5hZGQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiAmcXVvdDtMaXZpbmdv b2QsIEphc29uJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86SmFzb25fTGl2aW5nb29kQGNvbWNh c3QuY29tIiB0YXJnZXQ9Il9ibGFuayI+SmFzb25fTGl2aW5nb29kQGNvbWNhc3QuY29tPC9hPiZn dDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgMjggTWF5IDIwMTkgYXQgMTY6NDM8YnI+DQo8 Yj5UbzogPC9iPnRpcnVtYWwgcmVkZHkgJmx0OzxhIGhyZWY9Im1haWx0bzprb25kdGlyQGdtYWls LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmtvbmR0aXJAZ21haWwuY29tPC9hPiZndDssIEppbSBSZWlk ICZsdDs8YSBocmVmPSJtYWlsdG86amltQHJmYzEwMzUuY29tIiB0YXJnZXQ9Il9ibGFuayI+amlt QHJmYzEwMzUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPkFERCBNYWlsaW5nIGxpc3QgJmx0 OzxhIGhyZWY9Im1haWx0bzphZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hZGRAaWV0Zi5v cmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0FkZF0gcHVibGljYXRpb24gb2Yg RG9IIFJlc29sdmVyIHBvbGljaWVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+Rmly c3Qg4oCTIHRoYW5rcyBmb3IgdGhlIHBvaW50ZXIhPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjE0LjBwdCI+Q29tbWVudCDigJMgdGhpbmdzIGxpa2Ug4oCYbG9nZ2luZ+KA mSBzZWVtIHZlcnkgYmluYXJ5LiBXaGF0IGFib3V0IGRlZmF1bHQgbG9nZ2luZyA9IG5vIGV4Y2Vw dCBpZiBGUUROID0gbWFsd2FyZSBDJmFtcDtDLCBpbiB3aGljaCBjYXNlIHllcyAodG8gc3VwcG9y dCBub3RpZnlpbmcNCiB0aGUgZW5kIHVzZXIgb2YgaW5mZWN0aW9uKT88L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQu MHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOmJsYWNrIj5Gcm9tOg0KPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtjb2xvcjpibGFjayI+QWRkICZsdDs8YSBocmVmPSJtYWlsdG86YWRkLWJvdW5jZXNA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hZGQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9u IGJlaGFsZiBvZiB0aXJ1bWFsIHJlZGR5ICZsdDs8YSBocmVmPSJtYWlsdG86a29uZHRpckBnbWFp bC5jb20iIHRhcmdldD0iX2JsYW5rIj5rb25kdGlyQGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ RGF0ZTogPC9iPk1vbmRheSwgTWF5IDI3LCAyMDE5IGF0IDk6MTIgQU08YnI+DQo8Yj5UbzogPC9i PkppbSBSZWlkICZsdDs8YSBocmVmPSJtYWlsdG86amltQHJmYzEwMzUuY29tIiB0YXJnZXQ9Il9i bGFuayI+amltQHJmYzEwMzUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPkFERCBNYWlsaW5n IGxpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzphZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5h ZGRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0FkZF0gcHVibGlj YXRpb24gb2YgRG9IIFJlc29sdmVyIHBvbGljaWVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgMjcg TWF5IDIwMTkgYXQgMTY6NTMsIEppbSBSZWlkICZsdDs8YSBocmVmPSJtYWlsdG86amltQHJmYzEw MzUuY29tIiB0YXJnZXQ9Il9ibGFuayI+amltQHJmYzEwMzUuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYu MHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gMjcgTWF5IDIw MTksIGF0IDExOjU5LCB0aXJ1bWFsIHJlZGR5ICZsdDs8YSBocmVmPSJtYWlsdG86a29uZHRpckBn bWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5rb25kdGlyQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3Rl Ojxicj4NCiZndDsgPGJyPg0KJmd0OyBJZiB0aGUgRE9IIHNlcnZlciBwcm92aWRlZCBieSB0aGUg bmV0d29yayBvZmZlcnMgdGhlIHNhbWUgbGV2ZWwgb2YgcHJpdmFjeSBwcmVzZXJ2aW5nIGRhdGEg cG9saWN5IGFzIHRoZSBET0ggc2VydmVyIHByZS1jb25maWd1cmVkIGluIHRoZSBicm93c2VyLCBX aHkgc2hvdWxkbid0IHRoZSBicm93c2VyIHVzZSB0aGUgbmV0d29yayBwcm92aWRlZCBET0ggc2Vy dmVyID88YnI+DQo8YnI+DQpIb3cgY291bGQgdGhlIGJyb3dzZXIgdGVsbCB0aGF0IGJvdGggRG9I IHNlcnZlcnMgaGF2ZSB0aGUgc2FtZSBwb2xpY3k/PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJyPg0KSG93IGRvZXMgdGhlIGJyb3dzZXIg KG9yIGFueXRoaW5nIGVsc2UgZm9yIHRoYXQgbWF0dGVyKSBrbm93IHdoYXQgc29tZSBhcmJpdHJh cnkgRG9IIHNlcnZlcuKAmXMgcHJpdmFjeSBwcmVzZXJ2aW5nIGRhdGEgcG9saWN5IGlzPyBXaGVy ZSB3aWxsIHRoaXMgYmUgZG9jdW1lbnRlZCBhbmQgcHVibGlzaGVkIGluIGEgd2F5IHRoYXQgYSB3 ZWItYmFzZWQgYXBwbGljYXRpb24gb3IgdGhlIGVuZCB1c2VyIGNhbiB1bmRlcnN0YW5kIGFuZCB0 aGVuIG1ha2UgYW4NCiBpbmZvcm1lZCBjaG9pY2U/PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Imh0 dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LXJlZGR5LWRwcml2ZS1ib290c3Ry YXAtZG5zLXNlcnZlci0wMyUyM3NlY3Rpb24tMTAmYW1wO2RhdGE9MDIlN0MwMSU3Q0FsaXN0ZXIu V2luZmllbGQlNDBza3kudWslN0MxMmQ2MWE4ZGQwZWU0NjBlMGFjMzA4ZDZlNDI0MTQyNSU3QzY4 Yjg2NWQ1Y2YxODRiMmI4MmE0YTRlZGRiOWM1MjM3JTdDMCU3QzAlN0M2MzY5NDcyNDA5NDMxMzIw MDUmYW1wO3NkYXRhPW1lUXhqR2hhQzJoWm1WRnBpYXZRZUxxN1hLNm84M1d6SGdoc0NJeWlQU1kl M0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtcmVkZHktZHByaXZlLWJvb3RzdHJhcC1kbnMtc2VydmVyLTAzI3NlY3Rpb24t MTA8L2E+DQogZGVmaW5lcyBhIG5ldyBwcml2YWN5IGNlcnRpZmljYXRlIGV4dGVuc2lvbiB0aGF0 IGlkZW50aWZpZXMgdGhlIHByaXZhY3kgcHJlc2VydmluZyBkYXRhIHBvbGljeSBvZiB0aGUgRE5T IHNlcnZlciwgaXQgaXMgaW4gYSBtYWNoaW5lLXBhcnNhYmxlIGZvcm1hdC48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxicj4NCk5v dyByaW5zZSBhbmQgcmVwZWF0IHRoYXQgZm9yIG90aGVyIHNlcnZlci1zaWRlIHBvbGljaWVzOiBk YXRhIHJldGVudGlvbiwgR0RQUiBjb21wbGlhbmNlLCBETlMgZmlsdGVyaW5nL2Jsb2NraW5nLCBU TFMgc2Vzc2lvbiByZXN1bXB0aW9uLCBFQ1MgYmVoYXZpb3VyLCBRTkFNRSBtaW5pbWlzYXRpb24s IE5YRE9NQUlOIHJld3JpdGluZywgcXVlcnktcmVsYXRlZCBhZHdhcmUsIGV0YywgZXRjLjxicj4N Cjxicj4NCk9oLCBhbmQgaWYgc29tZSBEb0ggc2VydmVyIHNheXMg4oCcSSBkbyBRTkFNRSBtaW5p bWlzYXRpb27igJ0gKHNheSksIGRvZXMgdGhlIGJyb3dzZXIgb3IgZW5kIHVzZXIgc2ltcGx5IHRh a2UgdGhhdCBvbiB0cnVzdCBvciB3b3VsZCB0aGV5IHNvbWVob3cgYmUgZXhwZWN0ZWQgdG8gdmVy aWZ5IHRoYXQgZm9yIHRoZW1zZWx2ZXM/PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+RW5kIHVzZXIgdHlwaWNhbGx5IGRvZXMg bm90IHRydXN0IERPSCBzZXJ2ZXIgaW4gYSB1bnRydXN0ZWQgbmV0d29yayAoZS5nLiBwdWJsaWMg V2lGaSBuZXR3b3JrKSBhbmQgbWF5IG9ubHkgdXNlIHRoZSBET0ggc2VydmVyIHByb3ZpZGVkIGJ5 IHRydXN0ZWQgbmV0d29yayAoZS5nLiBFbnRlcnByaXNlLCBTZWN1cmUNCiBob21lIG5ldHdvcmtz KSwgc2ltaWxhciB0byB0aGUgd2F5IHVzZXJzIGRpc2FibGUgVlBOIGNvbm5lY3Rpb24gaW4gc3Bl Y2lmaWMgbmV0d29ya3MgYW5kIGVuYWJsZSBWUE4gY29ubmVjdGlvbiBieSZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5kZWZhdWx0IGlu IG90aGVyIG5ldHdvcmtzIGZvciBwcml2YWN5LiBJbiBhZGRpdGlvbiwgdGhlIHByaXZhY3kgZXh0 ZW5zaW9uIGluY2x1ZGVzIGEgVVJMIHRoYXQgcG9pbnRzIHRvIHRoZSBzZWN1cml0eSBhc3Nlc3Nt ZW50IHJlcG9ydCBvZiB0aGUgRE5TIHNlcnZlciBieSBhIHRoaXJkIHBhcnR5IGF1ZGl0b3IuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5D aGVlcnMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPi1UaXJ1PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluZm9ybWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5n IGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBp bnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3Nl ZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0 aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQNCiBpdCBpbiBlcnJvciwgcGxlYXNl IG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlv dXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCBy ZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNl IG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmlj YXRpb24gdGhyb3VnaA0KIG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBh bmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IElu dGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQo8YnI+DQo8YnI+DQpT a3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2Vy dmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMg U2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExp bWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBz dWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbg0KIE5vLiAyMjQ3NzM1KS4g QWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNv cnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVy ZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0KPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tIDxicj4NCkFkZCBt YWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWRkQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+QWRkQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vZXVyMDEuc2FmZWxp bmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9y ZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFkZCZhbXA7ZGF0YT0wMiU3QzAxJTdDQWxpc3Rlci5X aW5maWVsZCU0MHNreS51ayU3QzEyZDYxYThkZDBlZTQ2MGUwYWMzMDhkNmU0MjQxNDI1JTdDNjhi ODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjk0NzI0MDk0MzE0MjAx MyZhbXA7c2RhdGE9cVUwTUxkVGpYJTJGbXNqTEVxY3k4T0NZc0tYSlJsR1FMeEE3ZTclMkI2ZW5v MW8lM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRl ciIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO3RleHQtYWxpZ246Y2VudGVyIj4NCjxiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTwvc3Bhbj48L2I+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87dGV4dC1hbGlnbjpj ZW50ZXIiPg0KPGI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMiPlRoaXMgZW1haWwgaXMgZnJvbSBhbiBleHRlcm5hbCBzb3VyY2UuIFBsZWFzZSBk byBub3Qgb3BlbiBhdHRhY2htZW50cyBvciBjbGljayBsaW5rcyBmcm9tIGFuIHVua25vd24gb3Ig c3VzcGljaW91cyBvcmlnaW4uIFBoaXNoaW5nIGF0dGVtcHRzIGNhbiBiZSByZXBvcnRlZCBieSBz ZW5kaW5nIHRoZW0gdG8gcGhpc2hpbmdAc2t5LnVrIGFzIGF0dGFjaG1lbnRzLg0KIFRoYW5rIHlv dTwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0i Y2VudGVyIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87dGV4dC1hbGlnbjpjZW50ZXIiPg0KPGI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjwvYj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55 IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVu ZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1h eSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBv cmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlDQogbm90 aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBz eXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJh bnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90 ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlv biB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQNCiBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0 aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJu YXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCjxicj4NCjxicj4NClNreSBV SyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNl IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2 aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRl ZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNp ZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uDQogTm8uIDIyNDc3MzUpLiBBbGwg b2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9y YXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBv ZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_B5D02F73C1D448BA963BF7D2BD2EAF3Fskyuk_-- From nobody Wed May 29 06:09:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86D9612008A for ; Wed, 29 May 2019 06:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BYX0DZ9tFolN for ; Wed, 29 May 2019 06:09:05 -0700 (PDT) Received: from mail-it1-x12b.google.com (mail-it1-x12b.google.com [IPv6:2607:f8b0:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D51E12006D for ; Wed, 29 May 2019 06:09:05 -0700 (PDT) Received: by mail-it1-x12b.google.com with SMTP id m3so3669647itl.1 for ; Wed, 29 May 2019 06:09:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6w6au0AZO4O/fnvt8VLrm8P9t7CIV1CIRY2mfCZkJ8s=; b=fi2t/aCBZTFwyN1pl/ztpw0nqAh9lNm2kWQnanzCRJmyTQf+faQMRwaU3GrDWL7l+5 ea8tl2EUNSoUbqKqsZ6iCPvMwylm8yfqPHA65oZoq8geuxKJF8AVrgjglf1OYCk625BT hJRNt6EY35eWdAKhm0tEnvQFYN9BJxofIX/bNeLzpus3NudvKEojG5BkWCxoHjkQ2O8+ kpCsLB24R6u+7Mp9JI2+cyGSlA6WMIQOA2SS4/mNJNyng2IEV6tmWt+BkLSN+cioOGqE 4Sso8/RuofNZJ15RCq0N6bGW2xQ47rrpYgrDhn80p5KfnuMNnNl1RrKnEoCbsNgduwls GtMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6w6au0AZO4O/fnvt8VLrm8P9t7CIV1CIRY2mfCZkJ8s=; b=QeziRcoFQZYuiHYE4wbuZGLgTFwn63MCojbvEfwL5RKKUdzlcb/m8rkYxaE7eAh5ZA 20PgwQzqGJeE3T94RzUX4+aso4YGXH9g0XQiEDhFa/DVkkPtHtBC5d3gkcWvn3sJZKvy EbDB+newcg5hCUSniCc6iDPi6CaoOGKOBR1z2wqcDwUeS9AarUe+WlwC7Tn7E+EEyDwN EaHsEeIYl438aPnsnXP/DsI2+kdcEB89vgirllG4KzpIhXQXzJSI1a0Laxu/R6aByetw uRcCbbPm+oSEYO1quCiaawbYBMIjBLSh/2Yni8Rx968DlCmt7lFqBiGpn51L8+pleXT9 LfEg== X-Gm-Message-State: APjAAAUTxhWxSG1rwP09Y0MkacO5UKeLBJcLdbWpZEnULiLsCajFngxc ibvlK5r50X0jW5M51CArYd6vMLElZhE7p/AvNcY= X-Google-Smtp-Source: APXvYqx2fGmwGltjoRTDblxrwLYfMwzIaopjeN7UtEJIbhe+t2bNp7klqLSjESdqFjFK2PjYGWIVW0O4MQw9BuPrM9c= X-Received: by 2002:a24:1d8f:: with SMTP id 137mr1965216itj.66.1559135343855; Wed, 29 May 2019 06:09:03 -0700 (PDT) MIME-Version: 1.0 References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> <11C1E629-A2AE-468E-99B3-C2BBF9E4AE7C@rfc1035.com> <254F5605-B346-4AE1-A1A3-6D27AB76B18F@cable.comcast.com> <1DC2682D-1A1F-4B5B-BB49-B2DAAD8E7E7D@sky.uk> In-Reply-To: From: tirumal reddy Date: Wed, 29 May 2019 18:38:50 +0530 Message-ID: To: "Winfield, Alister" Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000053cc12058a067cad" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: publication of DoH Resolver policies X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 13:09:07 -0000 --00000000000053cc12058a067cad Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 29 May 2019 at 16:46, Winfield, Alister wrote: > Fair enough, I=E2=80=99m just stating that not all queries/responses are = known as > potentially bad (malware / phishing) until after the fact. That simple fa= ct > is the reason some DNS providers choose to hold logs. > Agreed, policy analysis by Sara https://dnsprivacy.org/wiki/display/DP/Comparison+of+policy+and+privacy+sta= tements shows most DNS providers clear the transaction data and do not store client IP address. -Tiru > > > Cheers > > Alister > > > > *From: *tirumal reddy > *Date: *Wednesday, 29 May 2019 at 11:54 > *To: *"Winfield, Alister" > *Cc: *ADD Mailing list > *Subject: *[EXTERNAL] Re: [Add] publication of DoH Resolver policies > > > > On Tue, 28 May 2019 at 22:06, Winfield, Alister 40sky.uk@dmarc.ietf.org> wrote: > > It would be wonderful if every malicious domain was known prior to its > use, sadly except where a DGA is known that=E2=80=99s not the case. So it= can be > useful to have a little historic information to see the extent of the iss= ue > once it=E2=80=99s become known. > > > > DGA is just one technique, malicious domains like C&C domains can possibl= y > be identified by inspecting TXT records (used to send commands to the > compromised host), fast flux service network etc. > > > > Cheers, > > -Tiru > > > > > > It=E2=80=99s also true that with performance issues unless they are very = obvious > (eg impacting say Facebook, Google, Amazon etc), operators necessarily re= ly > on analytics or customers to complain. Given issues can be transient or > periodic only a historic record can provide insight into the root cause. > > > > Alister > > > > *From: *Add on behalf of "Livingood, Jason" < > Jason_Livingood@comcast.com> > *Date: *Tuesday, 28 May 2019 at 16:43 > *To: *tirumal reddy , Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > > > > First =E2=80=93 thanks for the pointer! > > > > Comment =E2=80=93 things like =E2=80=98logging=E2=80=99 seem very binary.= What about default > logging =3D no except if FQDN =3D malware C&C, in which case yes (to supp= ort > notifying the end user of infection)? > > > > *From: *Add on behalf of tirumal reddy < > kondtir@gmail.com> > *Date: *Monday, May 27, 2019 at 9:12 AM > *To: *Jim Reid > *Cc: *ADD Mailing list > *Subject: *Re: [Add] publication of DoH Resolver policies > > > > On Mon, 27 May 2019 at 16:53, Jim Reid wrote: > > On 27 May 2019, at 11:59, tirumal reddy wrote: > > > > If the DOH server provided by the network offers the same level of > privacy preserving data policy as the DOH server pre-configured in the > browser, Why shouldn't the browser use the network provided DOH server ? > > How could the browser tell that both DoH servers have the same policy? > > > How does the browser (or anything else for that matter) know what some > arbitrary DoH server=E2=80=99s privacy preserving data policy is? Where w= ill this > be documented and published in a way that a web-based application or the > end user can understand and then make an informed choice? > > > > > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-03#se= ction-10 > > defines a new privacy certificate extension that identifies the privacy > preserving data policy of the DNS server, it is in a machine-parsable > format. > > > > > Now rinse and repeat that for other server-side policies: data retention, > GDPR compliance, DNS filtering/blocking, TLS session resumption, ECS > behaviour, QNAME minimisation, NXDOMAIN rewriting, query-related adware, > etc, etc. > > Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D= (say), does the > browser or end user simply take that on trust or would they somehow be > expected to verify that for themselves? > > > > End user typically does not trust DOH server in a untrusted network (e.g. > public WiFi network) and may only use the DOH server provided by trusted > network (e.g. Enterprise, Secure home networks), similar to the way users > disable VPN connection in specific networks and enable VPN connection by > > default in other networks for privacy. In addition, the privacy extension > includes a URL that points to the security assessment report of the DNS > server by a third party auditor. > > > > Cheers, > > -Tiru > > Information in this email including any attachments may be privileged, > confidential and is intended exclusively for the addressee. The views > expressed may not be official policy, but the personal views of the > originator. If you have received it in error, please notify the sender by > return e-mail and delete it from your system. You should not reproduce, > distribute, store, retransmit, use or disclose its contents to anyone. > Please note we reserve the right to monitor all e-mail communication > through our internal and external networks. SKY and the SKY marks are > trademarks of Sky Limited and Sky International AG and are used under > licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited > (Registration No. 2067075), Sky Subscribers Services Limited (Registratio= n > No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or > indirect subsidiaries of Sky Limited (Registration No. 2247735). All of t= he > companies mentioned in this paragraph are incorporated in England and Wal= es > and share the same registered office at Grant Way, Isleworth, Middlesex T= W7 > 5QD > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > *--------------------------------------------------------------------* > > *This email is from an external source. Please do not open attachments or > click links from an unknown or suspicious origin. Phishing attempts can b= e > reported by sending them to phishing@sky.uk as > attachments. Thank you* > > *--------------------------------------------------------------------* > > > Information in this email including any attachments may be privileged, > confidential and is intended exclusively for the addressee. The views > expressed may not be official policy, but the personal views of the > originator. If you have received it in error, please notify the sender by > return e-mail and delete it from your system. You should not reproduce, > distribute, store, retransmit, use or disclose its contents to anyone. > Please note we reserve the right to monitor all e-mail communication > through our internal and external networks. SKY and the SKY marks are > trademarks of Sky Limited and Sky International AG and are used under > licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited > (Registration No. 2067075), Sky Subscribers Services Limited (Registratio= n > No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or > indirect subsidiaries of Sky Limited (Registration No. 2247735). All of t= he > companies mentioned in this paragraph are incorporated in England and Wal= es > and share the same registered office at Grant Way, Isleworth, Middlesex T= W7 > 5QD > --00000000000053cc12058a067cad Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 29 May 2019 at 16:46, Winfield, A= lister <Alister.Winfield@sky.= uk> wrote:

Fair enough, I=E2=80=99m just stating that not all q= ueries/responses are known as potentially bad (malware / phishing) until af= ter the fact. That simple fact is the reason some DNS providers choose to h= old logs.


Agreed, policy an= alysis by Sara=C2=A0https://dnsprivacy.org/wiki/display= /DP/Comparison+of+policy+and+privacy+statements=C2=A0shows most DNS pro= viders clear the transaction data and do not store client IP address.=C2=A0=

-Tiru
=C2=A0

=C2=A0

Cheers

Alister

=C2=A0

From: = tirumal reddy <kondtir@gmail.com&g= t;
Date: Wednesday, 29 May 2019 at 11:54
To: "Winfield, Alister" <Alister.Winfield@sky.uk>
Cc: ADD Mailing list <add@ietf.org>
Subject: [EXTERNAL] Re: [Add] publication of DoH Resolver policies

=C2=A0

On Tue, 28 May 2019 at 22:06, Winfield, Alister <= Alister.Winfield=3D40sky.uk@dmarc.ietf.org> wrote:

It would be wonderful if every malicious domain was = known prior to its use, sadly except where a DGA is known that=E2=80=99s no= t the case. So it can be useful to have a little historic information to see the extent of the issue once it=E2=80=99s become known.=

=C2=A0

DGA is just one technique, malicious domains like C&= amp;C domains can possibly be identified by inspecting TXT records (used to= send commands to the compromised host), fast flux service network etc.<= /u>

=C2=A0

Cheers,

-Tiru

=C2=A0

=C2=A0

It=E2=80=99s also true that with performance issues = unless they are very obvious (eg impacting say Facebook, Google, Amazon etc= ), operators necessarily rely on analytics or customers to complain. Given issues can be transient or periodic only a historic record= can provide insight into the root cause.

=C2=A0

Alister

=C2=A0

From: Add <add-bounces@ietf.org> o= n behalf of "Livingood, Jason" <Jason_Livingood@comcast.com>
Date: Tuesday, 28 May 2019 at 16:43
To: tirumal reddy <kondtir@gmail.com>, Jim Reid <jim@rfc1035.com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] publication of DoH Resolver policies

=C2=A0

First =E2=80=93 thank= s for the pointer!

=C2=A0<= u>

Comment =E2=80=93 thi= ngs like =E2=80=98logging=E2=80=99 seem very binary. What about default log= ging =3D no except if FQDN =3D malware C&C, in which case yes (to suppo= rt notifying the end user of infection)?

=C2=A0<= u>

From: Add <add-bounces@ietf.org> o= n behalf of tirumal reddy <kondtir@gmail.com>
Date: Monday, May 27, 2019 at 9:12 AM
To: Jim Reid <jim@rfc1035.com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] publication of DoH Resolver policies

=C2=A0

On Mon, 27 May 2019 at 16:53, Jim Reid <jim@rfc1035.com> wrote= :

On 27 May 2019, at 11:59, tirumal reddy <kondtir@gmail.com> w= rote:
>
> If the DOH server provided by the network offers the same level of pri= vacy preserving data policy as the DOH server pre-configured in the browser= , Why shouldn't the browser use the network provided DOH server ?

How could the browser tell that both DoH servers have the same policy?


How does the browser (or anything else for that matter) know what some arbi= trary DoH server=E2=80=99s privacy preserving data policy is? Where will th= is be documented and published in a way that a web-based application or the= end user can understand and then make an informed choice?

=C2=A0

https://tools.ietf.org/html= /draft-reddy-dprive-bootstrap-dns-server-03#section-10 defines a new privacy certificate extension that identifies the privacy pr= eserving data policy of the DNS server, it is in a machine-parsable format.=

=C2=A0


Now rinse and repeat that for other server-side policies: data retention, G= DPR compliance, DNS filtering/blocking, TLS session resumption, ECS behavio= ur, QNAME minimisation, NXDOMAIN rewriting, query-related adware, etc, etc.=

Oh, and if some DoH server says =E2=80=9CI do QNAME minimisation=E2=80=9D (= say), does the browser or end user simply take that on trust or would they = somehow be expected to verify that for themselves?

=C2=A0

End user typically does not trust DOH server in a un= trusted network (e.g. public WiFi network) and may only use the DOH server = provided by trusted network (e.g. Enterprise, Secure home networks), similar to the way users disable VPN connection in specifi= c networks and enable VPN connection by=C2=A0

default in other networks for privacy. In addition, = the privacy extension includes a URL that points to the security assessment= report of the DNS server by a third party auditor.

=C2=A0

Cheers,

-Tiru

Information in this email including any attachments = may be privileged, confidential and is intended exclusively for the address= ee. The views expressed may not be official policy, but the personal views = of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from = your system. You should not reproduce, distribute, store, retransmit, use o= r disclose its contents to anyone. Please note we reserve the right to moni= tor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks o= f Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorpo= rated in England and Wales and share the same registered office at Grant Wa= y, Isleworth, Middlesex TW7 5QD

--
Add mailing list
Add@ietf.org
https://www= .ietf.org/mailman/listinfo/add

-----------------------------------= ---------------------------------

This email is from an external sour= ce. Please do not open attachments or click links from an unknown or suspic= ious origin. Phishing attempts can be reported by sending them to phishing@sky.uk as attach= ments. Thank you

-----------------------------------= ---------------------------------

=C2=A0

Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and delete it from your system. You sho= uld not reproduce, distribute, store, retransmit, use or disclose its conte= nts to anyone. Please note we reserve the right to monitor all e-mail commu= nication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and= Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorpo= rated in England and Wales and share the same registered office at Grant Wa= y, Isleworth, Middlesex TW7 5QD
--00000000000053cc12058a067cad-- From nobody Wed May 29 08:13:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C61D1201D3 for ; Wed, 29 May 2019 08:13:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LkIVJRYts5rN for ; Wed, 29 May 2019 08:13:25 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 974631201C7 for ; Wed, 29 May 2019 08:13:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1559142804; x=2423056404; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=iw+vMEkTrRxa3V/+619WvEaAjU+UJyo5TJZZ8dWor8M=; b=aKdb10O8eXH9mZH6aFzTZw9yP2vTzZZhJ95m5iosK2w8kLnx00J6eULcZCRSMYgp d246UiUs3dMLNsMqRLHNRjvuEWpEtJc+J40aEq46VGpIh7TEmN9TQ2kSzOz7Jcm+ I4kDuAiMGp4/HjQbkVh+6TSPYKcG4PUb/HhifsZ8nJ3WuUjWPdVbQZdTI3GhJDkB ifeqs2OrQsdc6LVO7l46T7zwB9mxWlvkFDnI42CnFZ/GvPvUdVu4KyRWpWvh2L1H qWW/ZcF6FfGKvynxXeO+FuQfQGQcdQB2csb8uJiyMAvnY2nsdtIB7BxNJaR8CM9E 9nAVoCkfLhsPqTzWEz2OJA==; X-AuditID: 60729ed4-f1dff7000000add3-59-5ceea1942c73 Received: from copdcexc33.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 1B.6E.44499.491AEEC5; Wed, 29 May 2019 09:13:24 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc33.cable.comcast.com (147.191.125.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 29 May 2019 11:13:23 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Wed, 29 May 2019 11:13:23 -0400 From: "Livingood, Jason" To: Vittorio Bertola , Tom Ritter CC: "add@ietf.org" Thread-Topic: [Add] Browser Administrative Authority Thread-Index: AQHVEj/KCszQjrP3dE6V1AF0CU4zcaZ6sWaAgAAQiwCAAAtqgIAAHYmAgAQPzACAA0LtgA== Date: Wed, 29 May 2019 15:13:23 +0000 Message-ID: <02980E2E-2144-4DED-9DCA-F648D61727A7@cable.comcast.com> References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <07A89E54-2DFC-4B5A-9784-610BBE7D2BB2@nostrum.com> <125917581.1152.1558717017241@appsuite-gw4.open-xchange.com> <1087980125.22084.1558949104261@appsuite-gw1.open-xchange.com> In-Reply-To: <1087980125.22084.1558949104261@appsuite-gw1.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [96.115.73.252] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrEKsWRmVeSWpSXmKPExsWSUDRnsu6Uhe9iDC5MMrL4f3odm8W6Y8cZ LV6d3MnuwOyxZMlPJo9Zjyeye7x82cIWwBzVwGhTklGUmljikpqWmlecaselgAFsklLT8otS XROLciqDUnNSE7ErA6lMSc3JLEst0sdqjD5WcxK6mDJ6JtoWbFComPvsHVsD4xH5LkZODgkB E4mZT76ydTFycQgJHGGSOH16LzuE08IkcennXlYI5zSjxKOtC9lBWtgEzCTuLrzCDGKLCIRJ 7Fz1ig3EZhZQlHg55QdYjbCAsUTr4hlsEDUmEh3LbrHD1F8+9pgRxGYRUJV4OnMx2BxeAReJ zQ+Wg9UICfQwS/xeagpicwp4S/xongpWwyggJvH91BomiF3iEreezGeCeEFAYsme88wQtqjE y8f/WEFsUQF9iR/bb7JBxBUl/s1ez9LFyAHUqymxfpc+xBgrifVP3jDDnD+l+yE7xDmCEidn PmGBaBWXOHxkB+sERslZSDbPQpg0C8mkWUgmzUIyaQEj6ypGPkszPUNDEz1DUws9I0OjTYzg lDTvyg7Gy9M9DjEKcDAq8fCKdbyLEWJNLCuuzD3EKMHBrCTCazvlTYwQb0piZVVqUX58UWlO avEhRmkOFiVxXqd5z2KEBNITS1KzU1MLUotgskwcnFINjJMV208YbHok3lrJtqHoubxifL1X f8hlgfOLz/abvFp51/Va5moui8a5yy6/NJhr7Zu0stxs0Uy10tsBt+deOr688GzMmcIio+K2 y+tlTq3iuVuUe/CtML/2xhI2ua36bEopJktf7Lq09v+lBFXv7zUGqllPJ1QEn3fXDkzcNytQ lvvQgpiAb0osxRmJhlrMRcWJAKDrVbJFAwAA Archived-At: Subject: Re: [Add] Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 15:13:29 -0000 QWRkaW5nIHRvIHdoYXQgVml0dG9yaW8gc2FpZCwgc29tZSByZXNlYXJjaCBJIGhhdmUgc2VlbiBz dWdnZXN0cyB0aGF0IHBlb3BsZSdzIG1vdmVtZW50cyBhcmUgbXVjaCBsZXNzIHZhcmlhYmxlIHRo YXQgeW91IG1heSB0aGluayAtIHdlIGFyZSBjcmVhdHVyZXMgb2YgaGFiaXQuIE1vc3QgcGVvcGxl IG1heSBvbmx5IGJlIG9uIHRoZWlyIGhvbWUgbmV0d29yaywgdGhlaXIgd29yayBuZXR3b3JrLCB0 aGVpciA0Ry81RyBuZXR3b3JrLCBhbmQgbWF5YmUgMSBvdGhlciBXaUZpIG5ldHdvcmsgKGUuZy4g Y29mZmVlIHNob3ApIG9uIHRoZSBhdmVyYWdlIGRheS4gSW4gc2l0dWF0aW9ucyBsaWtlIHRoZSBj b2ZmZWUgc2hvcCAtIG9yIGEgcmFuZG9tIGFpcnBvcnQgV2lGaSAtIHRoZXkgd291bGQga25vdyB0 cnVzdCBpcyBsb3dlciBhbmQgY2FuIG9wdGlvbmFsbHkgdXNlIGEgVlBOIC0tIG9yIGF0IGxlYXN0 IGZlZWwgc2FmZSBpbiB0aGUga25vd2xlZGdlIHRoYXQgdGhlaXIgd2ViIHRyYW5zYWN0aW9uIGlz IGxpa2VseSBlbmNyeXB0ZWQgKHdoaWNoIGlzID45MCUgb2YgdXNlciB0aW1lIG9uIHRoZSB3ZWIg dGhlc2UgZGF5cyBJSVJDKS4NCg0KSkwNCg0KDQoNCu+7v09uIDUvMjcvMTksIDU6MjUgQU0sICJB ZGQgb24gYmVoYWxmIG9mIFZpdHRvcmlvIEJlcnRvbGEiIDxhZGQtYm91bmNlc0BpZXRmLm9yZyBv biBiZWhhbGYgb2Ygdml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0 Zi5vcmc+IHdyb3RlOg0KDQogICAgPiBJbCAyNCBtYWdnaW8gMjAxOSAyMToyMyBUb20gUml0dGVy IDx0b21Acml0dGVyLnZnPiBoYSBzY3JpdHRvOg0KICAgID4gDQogICAgPiBUaGUgbmV0d29yayBz aG91bGQgYmUgY29uc2lkZXJlZCBob3N0aWxlIHVudGlsIGNvbmZpZ3VyZWQgb3RoZXJ3aXNlDQog ICAgPiBiZWNhdXNlLi4uIHRoZSBuZXR3b3JrIHVzdWFsbHkgaXMgaG9zdGlsZS4gT3IgYXQgbGVh c3QgaXQncyB1bnRydXN0ZWQuDQogICAgPiBFdmVyeSBjZWxsdWxhciBjb25uZWN0aW9uOyBldmVy eSBjb2ZmZWUgc2hvcCwgZXZlcnkgc3RvcmUncyBmcmVlIHdpZmksDQogICAgPiBldmVyeSBmcmll bmQncyBuZXR3b3JrIHlvdSBjb25uZWN0IHRvLCBldmVyeSBBaXJCbkIgd2lyZWxlc3MsIGV2ZXJ5 DQogICAgPiBob3RlbC4uLiBQZXJjZW50YWdlLXdpc2UsIHRoZSBudW1iZXIgb2YgdW50cnVzdGVk IG5ldHdvcmtzIHRoZSBhdmVyYWdlDQogICAgPiB1c2VyIGNvbm5lY3RzIHRvIGR3YXJmcyB0aGUg bnVtYmVyIG9mIHRydXN0ZWQgbmV0d29ya3MgKGV2ZW4gaWYgdGhlDQogICAgPiBwZXJjZW50YWdl IG9mIHRpbWUgc3BlbnQgb24gdW50cnVzdGVkIG5ldHdvcmtzIGlzIGR3YXJmZWQgYnkgdGhlDQog ICAgPiBwZXJjZW50YWdlIHNwZW50IG9uIHRydXN0ZWQgbmV0d29ya3MuKQ0KICAgIA0KICAgIFRo ZXJlIGRlZmluaXRlbHkgaXMgYSBzZWN1cml0eS9wcml2YWN5IGlzc3VlIGZvciBwZW9wbGUgYW5k IGRldmljZXMgdGhhdCByb2FtIGEgbG90IGFuZCBpdCdzIGZpbmUgdG8gYWRkcmVzcyBpdCwgYnV0 IElNSE8gdGhpcyBpcyB0aGUgdmlldyB5b3UgZ2V0IGZyb20gYSBzcGVjaWZpYyB2aWV3cG9pbnQg YW5kIGRvZXMgbm90IHJlcHJlc2VudCB0aGUgZnVsbCBwaWN0dXJlIG9yIGV2ZW4gdGhlIGJlc3Qg cGFydCBvZiBpdC4gVGhlcmUgYXJlIHRvbnMgb2YgcGVvcGxlL2RldmljZXMgdGhhdCBkbyBub3Qg bW92ZSBhbmQgb25seSB1c2UgdGhlIEludGVybmV0IGZyb20gYSBzaW5nbGUgdHJ1c3RlZCBuZXR3 b3JrLCB1c3VhbGx5IGEgaG9tZS9jb3Jwb3JhdGUgb25lLCBhbmQgcmVseSBvbiBpdCBmb3Igc2Vj dXJpdHkuIEFzIGEgc3Vic2V0IG9mIHRoaXMsIHRoZXJlIGFsc28gaXMgYW4gaW5jcmVhc2luZyBu dW1iZXIgb2YgY2FzZXMgaW4gd2hpY2ggdGhlIHVzZXIgY29udHJvbHMgdGhlIG5ldHdvcmsgbXVj aCBtb3JlIHRoYW4gdGhlIGRldmljZTogdGhpbmsgb2YgYWxsIHRoZSBJb1Qgc3R1ZmYgdGhhdCB5 b3UgYnV5IGFuZCBkZXBsb3kgYXQgaG9tZSwgYnV0IHdoaWNoIGlzIHJlYWxseSBhIGJsYWNrIGJv eCB0byB5b3UgLSB1bmxlc3MgeW91IGNhbiB1c2UgeW91ciBsb2NhbCBuZXR3b3JrIGFkbWluaXN0 cmF0b3IgcG93ZXIgdG8gZXhlcnQgYXQgbGVhc3Qgc29tZSBjb250cm9sIG9uIHRoZWlyIHRyYWZm aWMuDQogICAgDQogICAgUGVyaGFwcyB0aGlzIHNob3VsZCBsZWFkIHRvIGRpZmZlcmVudCBjb250 cm9sIGhpZXJhcmNoaWVzIGFuZCBwb2xpY2llcyBmb3Igcm9hbWluZyBkZXZpY2VzIChlLmcuIG1v YmlsZSBwaG9uZXMpIHRoYW4gdGhvc2UgZm9yIHRoZSByZXN0IG9mIHRoZSB3b3JsZC4gTW9yZSBn ZW5lcmFsbHksIHRoaXMgaXMgd2hhdCBtYWtlcyB0aGUgQUREIGlzc3VlcyBoYXJkOiBkaWZmZXJl bnQgdXNlIGNhc2VzIGhhdmUgY29uZmxpY3RpbmcgcmVxdWlyZW1lbnRzLiBQZXJoYXBzLCBwYXJ0 IG9mIHRoZSB3b3JrIGNvdWxkIGJlIGRvY3VtZW50aW5nIHRoZSBhcHByb3ByaWF0ZSBjb250cm9s IGhpZXJhcmNoaWVzIGluIGRpZmZlcmVudCBzaXR1YXRpb25zLCBhcyBHbGVubiBkaWQsIGFuZCB0 aGVuIHNlZSBpZiB0aGVyZSBhcmUgd2F5cyB0byByZWNvbmNpbGUgdGhlIGNvbmZsaWN0cyAtIGFu ZCBJIHN1c3BlY3QgdGhlc2UgYXJlIGdvaW5nIHRvIGJlIGJ5IHBvbGljeSBhbmQgdXNlciBpbnRl cmFjdGlvbiwgcmF0aGVyIHRoYW4gYnkgdGVjaG5pY2FsIGluc3RydW1lbnRzLg0KICAgIA0KICAg IENpYW8sDQogICAgLS0gDQogICAgIA0KICAgIFZpdHRvcmlvIEJlcnRvbGEgfCBIZWFkIG9mIFBv bGljeSAmIElubm92YXRpb24sIE9wZW4tWGNoYW5nZQ0KICAgIHZpdHRvcmlvLmJlcnRvbGFAb3Bl bi14Y2hhbmdlLmNvbSANCiAgICBPZmZpY2UgQCBWaWEgVHJldmlzbyAxMiwgMTAxNDQgVG9yaW5v LCBJdGFseQ0KICAgIA0KICAgIC0tIA0KICAgIEFkZCBtYWlsaW5nIGxpc3QNCiAgICBBZGRAaWV0 Zi5vcmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZA0KICAg IA0KDQo= From nobody Wed May 29 08:17:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1EB4120113 for ; Wed, 29 May 2019 08:17:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KCwzSfWMHQ09 for ; Wed, 29 May 2019 08:17:30 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C86B12010C for ; Wed, 29 May 2019 08:17:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1559143039; x=2423056639; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=+plfyyjuuDtE9zX2cw9b75oewoSrD8L9DZkSMAHDgPQ=; b=FV7lK5FZ4g9CvsxEEbJTz7rp4I52QwIbC74P4OwBN2Wrl8PAoVaZwDi7DmOhMPb1 U1+qEaJzMfH5PzCo9l2p9lErC3909sCldZLbZBCtLy/6iYf7fOGTkia6NM8u4yJw B7hh5tCWs25x2fiKPhvvhyUJolrEmjhml4ivPuA1cNsVrZXgfx/lBvGTYbNpEw1F 2QxbvgV4g/X2ARV5vUu+Jos8u4rqRoIWTCX16wTyAxXAB6tBaawCbWSPNih5ldUW PZJtUguGvto5YQ0OQALgu4YnVljHme5y9EA7dLIEvMe67DOxHJzNr+5i+kWtidZe Lo83KYuxTPJ5Psr5J0gD/A==; X-AuditID: a2962c47-cebff70000021564-a9-5ceea27fb32e Received: from copdcexc34.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 9C.C8.05476.F72AEEC5; Wed, 29 May 2019 09:17:19 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc34.cable.comcast.com (147.191.125.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 29 May 2019 11:17:27 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Wed, 29 May 2019 11:17:27 -0400 From: "Livingood, Jason" To: Vittorio Bertola , Melinda Shore CC: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: Browser Administrative Authority Thread-Index: AQHVFG55wa3Igz/1AE+Y9kIyvAMxaqaCOmKA Date: Wed, 29 May 2019 15:17:27 +0000 Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> In-Reply-To: <525969024.22086.1558949269703@appsuite-gw1.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [68.87.29.9] Content-Type: text/plain; charset="utf-8" Content-ID: <7BBBCD8E5F7E634686AEA95197A9EF75@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrEKsWRmVeSWpSXmKPExsWSUDRnsm79oncxBuvuWFn8P72OzeL9oiWM Fq9O7mR3YPZYsuQnk8e7OVPZPWY9nsgewBzVwGhTklGUmljikpqWmlecaselgAFsklLT8otS XROLciqDUnNSE7ErA6lMSc3JLEst0sdqjD5WcxK6mDLe3l/AUrCHo6Ll7nPGBsYFHF2MnBwS AiYSDw90MHYxcnEICRxhkjiysYsJwmlhkujfs4gdwjnNKDHrxz92kBY2ATOJuwuvMIPYIgIZ Em+mt7KB2MwCihIvp/wAqxEWcJI4d2UxI0SNs8SUsytZIGwjiXtnVwP1cnCwCKhK3P8hDRLm FXCR6N+9jBli10ImibUfToH1cgp4SVy7dJcJxGYUEJP4fmoNE8QucYlbT+YzQbwgILFkz3lm CFtU4uXjf6wgtqiAvsSP7TfZIOJyEst+3gHbyyygKbF+lz7EGCuJc5tgRipKTOl+yA5xj6DE yZlPWCBaxSUOH9nBOoFRchaSzbMQJs1CMmkWkkmzkExawMi6ipHX0MxIz9DUQM/ERM/ccBMj MCUtmqbjvoPxw/nYQ4wCHIxKPLyabe9ihFgTy4orcw8xSnAwK4nw2k55EyPEm5JYWZValB9f VJqTWnyIUZqDRUmcl2nlsxghgfTEktTs1NSC1CKYLBMHp1QDo50mc8EH739fnhifsxbQLVdt +cxonek2l/lvhtGmf9E9qxccmD7V99Ehv4g37csuPF28/JXcrGj5Z1snKc8vi73u8ORV9vF1 FW9/PmAT+BH5OeZeQo07g+yBpY+u2ZRMfzT5x8+Q2uQf1d8KH/x4vuDoa+WZW5N/qp8WkTvE Uevg9WDmrd7ju2cosRRnJBpqMRcVJwIAzc3s20UDAAA= Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 15:17:32 -0000 ICAgID4gSWwgMjUgbWFnZ2lvIDIwMTkgMjE6MTcgTWVsaW5kYSBTaG9yZSA8bWVsaW5kYS5zaG9y ZUBub21vdW50YWluLm5ldD4gaGEgc2NyaXR0bzoNCiAgICA+IA0KICAgID4gQnV0LCBJIHRoaW5r IHRoZSBicm9hZGVyIHByb2JsZW0gaXMgdGhhdCBJU1BzIGFyZSBub3QgcnVubmluZw0KICAgID4g cmVjdXJzaXZlcyB0aGF0IHVzZSBlbmNyeXB0ZWQgdHJhbnNwb3J0LCBhbmQgYmVjYXVzZSB0aGV5 J3JlIG5vdA0KICAgID4gb3RoZXIgZm9sa3MgYXJlIHN0ZXBwaW5nIHVwL2luDQoNCkkgYW0gc2tl cHRpY2FsIG9mIHRoaXMuIEluIHRoZSBncmFuZCBzY2hlbWUgb2YgdGhpbmdzIERvSCB3YXMgc3Rh bmRhcmRpemVkIHJhdGhlciBxdWlja2x5LiBJdCB0YWtlcyB0aW1lIHRvIGJlIGltcGxlbWVudGVk IGluIGEgdmFyaWV0eSBvZiBzeXN0ZW1zLCBhbmQgdGhpcyBpcyBzdGFydGluZyB0byBoYXBwZW4g bm93LiBJIHRoaW5rIHJhdGhlciB0aGF0IGluIHRoaXMgY2FzZSB0aGUgb3RoZXIgZm9sa3MgdG9v ayBwcmUtZW1wdGl2ZSBhY3Rpb24sIGFuZCB0aGlzIGlzIHRoZSBzb3VyY2Ugb2Ygc29tZSBvZiB0 aGUgdGVuc2lvbiBoZXJlLiBJbiBhbnkgY2FzZSwgdGhlIG9wZW4gc291cmNlIGFuZCBjb21tZXJj aWFsIEROUyBzb2Z0d2FyZSBwbGF0Zm9ybXMgYXJlIG5vdyBhZGRpbmcgc3VwcG9ydCBmb3IgRG9I IGFuZCBEb1QsIHdoaWNoIGlzIHRoZSBlbmFibGVyIGZvciBJU1BzIGJlZ2lubmluZyB0ZWNobmlj YWwgdHJpYWxzIChhbmQgZXZlbnR1YWwgZGVwbG95bWVudCkuIA0KDQpKTA0KIA0KDQo= From nobody Wed May 29 09:25:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5606812017A for ; Wed, 29 May 2019 09:25:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pfs9kfumuyCV for ; Wed, 29 May 2019 09:25:05 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 354D712015F for ; Wed, 29 May 2019 09:24:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1559147086; x=2423060686; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=DvkIm95DwQOgjt8G7w+r3GvWFfYEk0TjFvIlsMtPmtE=; b=j+3Z9H0hZ+mjqVs+/J4S2Idsev9Vl2bRIndTpHooiYPV1Q7VCm75a7G0opiP6mnW D/TObP3/oyWZLksCUS0QDnbC8nn8D8kdFheKnXtBemYBchIOQBoshioWcQv2r9UQ mhOSzGxhUOCL5lFc4gGsgPfEsj3X5OhJJub3+lVrK6Ado4oWrZDkhxQw7EIJ0CZt 6ij4nPZQhNHnDKD8rS7XzK57iBM10vAzqoh9nEA3/G/gSIlsnkBO9BohqDfeGqmD Kfu8f0GZQ0m3tqWRBNb1ZFt0Ru4OdAsoOzl3Y/HC4s1/m5EAU+ieAWfCahrdlHhl dI4G7Y1Of/e/AMud68zAtQ==; X-AuditID: a2962c47-cebff70000021564-24-5ceeb24ea53a Received: from copdcexc39.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 76.F0.05476.E42BEEC5; Wed, 29 May 2019 10:24:46 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc39.cable.comcast.com (147.191.125.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 29 May 2019 12:24:54 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Wed, 29 May 2019 12:24:54 -0400 From: "Livingood, Jason" To: Paul Wouters , Christian Huitema CC: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: Browser Administrative Authority Thread-Index: AQHVFEaK56Ko1xvDU0uTcQmg//CfvaaAGn4AgAIzDIA= Date: Wed, 29 May 2019 16:24:54 +0000 Message-ID: References: <182C9119-59F9-43FA-B116-4D45649B74B5@nbcuni.com> <410f4e4d-aee0-d679-b454-6576de90b21a@nomountain.net> <76EF5603-618C-4A73-A4F9-7489B73B0757@nbcuni.com> <9ad7aa89-d751-e4c6-dede-e9c22faf6d20@nomountain.net> <3f2b3225-ad2e-75c8-0cd7-32679e20ebf7@huitema.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [96.114.156.7] Content-Type: text/plain; charset="utf-8" Content-ID: <4A7442AA4AAC0E42A420829755178E77@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrPKsWRmVeSWpSXmKPExsWSUDRnsq7fpncxBq9XG1j8P72OzWJy42x2 i/e3LjE5MHvcmnGKxWPJkp9MHt/nMQUwRzUw2pRkFKUmlrikpqXmFafacSlgAJuk1LT8olTX xKKcyqDUnNRE7MpAKlNSczLLUov0sRqjj9WchC6mjPWPXzIWPOKpaP30hK2BcQdPFyMnh4SA icSbo9/Zuhi5OIQEjjBJTHm4lhXCaWGS+LhtOTNIlZDAaUaJdeslQGw2ATOJuwuvAMU5OEQE vCQWLcsDCTMLKEq8nPKDHcQWFnCSOHdlMSOILSLgLDHl7EoWCNtKonnlY1YQm0VAVWLmmolg NbwCLhKH+0/D7GWWOPjpIyPIfE4BR4kdeypBahgFxCS+n1rDBLFLXOLWk/lMEA8ISCzZc54Z whaVePn4H9h8UQF9iR/bb7JBxBUkeiZMBzuZWUBTYv0ufYgxVhJn159ngzl/SvdDdohzBCVO znzCAtEqLnH4yA7WCYySs5BsnoUwaRaSSbOQTJqFZNICRtZVjLyGZkZ6hqYGeiYmeuaGmxiB yWjRNB33HYwfzsceYhTgYFTi4dVsexcjxJpYVlyZe4hRgoNZSYT353KgEG9KYmVValF+fFFp TmrxIUZpDhYlcV6mlc9ihATSE0tSs1NTC1KLYLJMHJxSDYyZc9LuTJB+fDwhz//XytVcD5Pn LaxsuFzuoCgX61cnrOP8abLpG9GfFgp7TJmcZpTvaOi2m87dF3zhr4NHuFEEV5BxSpvGgjV1 potfbptQ8+lc25WkpJKdn1TzZ715yJ7vekgmOqxCf2O1q4uV5Fk7kZvR06Zb75u+R7Ptx3MT RvXuvsCztUosxRmJhlrMRcWJAL+gTMZCAwAA Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Browser Administrative Authority X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 16:25:07 -0000 T24gNS8yNy8xOSwgMTA6NTAgUE0sICJBZGQgb24gYmVoYWxmIG9mIFBhdWwgV291dGVycyIgPGFk ZC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBwYXVsQG5vaGF0cy5jYT4gd3JvdGU6DQo+ ICAgIEkgc2hvdWxkIGhhdmUgcmVzdHJpY3RkIGJ5IGxhc3Qgc2VudGVuY2UgYSBiaXQuIEkgY2Fu bm90IGRldGVybWluZSB3aG8gaXMNCiAgICBzaGFyaW5nIG15IGRlc2lyZSBmb3IgY29udGFjdCBs ZW5zZXMuIEl0IGNvdWxkIGJlIHRoZSBhZCBwbGF0Zm9ybSwgZ29vZ2xlLA0KICAgIGZhY2Vib29r IHRyYWNrZXJzLCBvciBhbnlvbmUgbW9uaXRvcmluZyBteSBETlMgcXVlcmllcywgc3VjaCBhcyBt eSBJU1AuDQo+IEFyZ3VhYmx5LCBJIHdvdWxkIGhhdmUgYSBiZXR0ZXIgaWRlYSB3aG8gaXMgc2hh cmluZyB0aGF0IGluZm9ybWF0aW9uIGlmDQogICAgbXkgbGFzdCBtaWxlIHdhcyBub3QgZ2V0dGlu ZyBhIGZyZWUgbG9vayBhdCBhbGwgbXkgRE5TIHF1ZXJpZXMsIGFzIGluDQogICAgdGhhdCBjYXNl IG9ubHkgYSBmZXcgaHR0cHMgZW5kcG9pbnRzIGNvdWxkIGtub3cgdGhpcyBpbmZvcm1hdGlvbi4N Cg0KVG9kYXkncyBkb21pbmFudCByZWFsLXRpbWUgYWQgYXVjdGlvbiBzeXN0ZW1zIGRvbid0IGFw cGVhciB0byBkZXBlbmQgb24gRE5TIGxvb2t1cHMgYXQgYWxsLiBUaGVzZSBhZHMgYWxsIGRlcGVu ZCBvbiBIVFRQLWxheWVyIHRyYWNraW5nIGxpa2UgY29va2llcyBhbmQgdHJhY2tpbmcgcGl4ZWxz LiBTb21lIGdvb2QgcmVhZGluZyBtYXRlcmlhbHM6IGh0dHBzOi8vaW5zdGFwYWdlLmNvbS9ibG9n L2ZhY2Vib29rLXJldGFyZ2V0aW5nLXBpeGVsLCBodHRwczovL2Jsb2cudHJ5YWRoYXdrLmNvbS9n b29nbGUtYWR3b3Jkcy9ob3ctZ29vZ2xlLWFkd29yZHMtd29ya3MvLCBodHRwczovL3d3dy5pYWIu Y29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE1LzA2L0lBQi1OYXRpdmUtQWR2ZXJ0aXNpbmctUGxh eWJvb2syLnBkZiwgaHR0cHM6Ly93d3cuaWFiLmNvbS9pbnNpZ2h0cy91c2VyLWdlbmVyYXRlZC1j b250ZW50LWZvci1tYXJrZXRpbmctYW5kLWFkdmVydGlzaW5nLXB1cnBvc2VzLywgaHR0cHM6Ly93 d3cuaWFiLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAxOS8wNS9GdWxsLVllYXItMjAxOC1JQUIt SW50ZXJuZXQtQWR2ZXJ0aXNpbmctUmV2ZW51ZS1SZXBvcnQucGRmDQoNCkpMDQogDQoNCg== From nobody Wed May 29 13:43:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DA621201D0 for ; Wed, 29 May 2019 13:43:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NjWW0mCM0vXg for ; Wed, 29 May 2019 13:43:35 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 437D312012D for ; Wed, 29 May 2019 13:43:35 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id h1so4353517qtp.1 for ; Wed, 29 May 2019 13:43:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=scu1UcevQeq+jyjPpt1BY6DkhPbu6Vrkl8rO50Fa4uA=; b=TAYpCz3W0XPBJ/KYTVkCC4X2taO6ZNjNdPqcaRc2rmpj79dqXQYlr/ChWt76xF8ALM ovwBnbZygcQHgkP9/956pw9kd2vo/7suyT+Kk0Q6tpJEww9/A56gkBTaBaKEjuHYXhcb 3yI3U8pKDOVTnFaLd+mHfsk30NShVTqkbquNgwkm60QYqIJS3gd7x9vnNRz8sB28z0Pl eneDVEp/wgGxqR/dKzYgdvQ1in+E3ZaVbvf9fwJudAIYjAqAkouHPN1XAh+KeqIpdjYH im9I4coenEBobF2021QLpFbS3Q1ZqZpCkDFafn/qJJIVMD++yMLsfUivNAuhnaWR6f5E 0bMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=scu1UcevQeq+jyjPpt1BY6DkhPbu6Vrkl8rO50Fa4uA=; b=llMwMVS7HC2E380h/iWzQI8ksPMeRrysllguPtU+DXAsJyk3tYMq09Y8opF12+pbgo yPCIKACUhGhL1fmtV+GCQW39fMU3spF6SjvwTStTARBoZYfGE/7LJLY29a5JnhkSvEeU SbOqw9xc/aO6kPFGNDC7mVy938FXU1NS7vu/aZlsi1vVkaTJvgRNo9mnBmOsTkGMu0kA Y5ufZ3WtEVO9dGv7YDdMUG4BFp66EpvSr4p0LsZUvV63uisw6V2YiCwpMtvp7MVoD+LV jAticFOM3u4RsxLGU84f3VdNMlZ2qPSS1nCH2fMuSwp+cyJyT/Zpfn7A2SRczQEn/MKZ XzFg== X-Gm-Message-State: APjAAAWJRaSxfjg79Q4Hnotl9yK66Gsp/OJDptruSs2rfWstrU9EbrVm MpIhF2qdVFJxhrBaosWxCk2IAhbSh0djbs9BcmcsiQ== X-Google-Smtp-Source: APXvYqwSqZUYD+aqLh7w8956zeWjcdBFFN216kYTAUUY3SI/VvaCa2ma5EuDkBWDZ0x3hU6RUdXukymC//7WV0/RKPg= X-Received: by 2002:ac8:5485:: with SMTP id h5mr36186qtq.253.1559162613835; Wed, 29 May 2019 13:43:33 -0700 (PDT) MIME-Version: 1.0 From: Brian Dickson Date: Wed, 29 May 2019 13:43:22 -0700 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000beac29058a0cd524" Archived-At: Subject: [Add] DNS visibility, malware C&C, exfiltration, etc. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 20:43:38 -0000 --000000000000beac29058a0cd524 Content-Type: text/plain; charset="UTF-8" I'll preface this with an observation: If you are reading this, you very likely work in the Internet industry. If not, there's a good chance you rely on the Internet in some way for your livelihood, or things that are important to you. Please keep this in mind, in considerations for the impact of deployment of DoH/DoT. One problem with DNS over HTTPS, is that it interferes with passive DNS monitoring by authorized parties in the DC/Enterprise use case. A quick survey of blog posts and academic papers on identification and response to malware command and control (C&C), shows that these detection/mitigation systems are heavily reliant on DNS, either directly or indirectly. In particular, DGA (domain generation algorithms) in malware typically can only be observed via their DNS queries, and takedown and/or interception requires that DNS visibility. In some cases, the visibility is local to the victim; in other cases, victims rely on feeds of domain names or IP addresses, to thwart or contain malware activity. The feeds ultimately can be traced back to some third party having the visibility into a DNS monitor. The privacy offered by DoH is a multi-pronged problem. If malware uses DoH, it can do "validation" of the cert for the DoH server it wants to try using, and refuse to use a spoofed replacement, preventing direct intervention as a method of obtaining DNS queries. And if the DoH traffic is going to an attacker-controlled server, the DNS queries are not visible. The second prong is, that if all DNS traffic is going over DoH, there is no way to identify legitimate query names. All HTTPS traffic looks the same, at that point, with no ability to differentiate DoH from regular HTTPS traffic, and no ability to detect change of DoH provider in use. If/when SNI encryption is employed, there is no visibility into names used on HTTPS connections, and it all looks like encrypted traffic to arbitrary IP addresses. Without this visibility, malware infections on user machines inside enterprise networks may go undetected. This can lead to deeper penetration into protected parts of such networks. The inability to block this DoH traffic is (IMHO) the crux of the problem. If DoT is used in its place, then enterprise networks can enforce DNS resolver choice at the network level, including via deployment of internal DoT resolvers which could still protect user privacy (modulo specific enterprises' policies). DoT or Do53 service to resolvers operated by the enterprise, enables the current visibility to be maintained, independent of the presence or absence of TLS to protect those connections. The existence of browsers which support DoH is the underlying problem. Even if DoH is not enabled by default, so long as user-input resolver choice is available, and so long as DoH can be enabled by unprivileged users, all of the above problems continue to exist, i.e. the ability for a user, or malware, to evade detection by DNS monitoring systems. A reasonable compromise might look like: - admin-only enabling of DoH/DoT (which can be a policy pushed to managed systems) - a hardcoded TRR list for DoH/DoT - a default-off configuration - the use of DoT exclusively (instead of DoH) for any non-TRR resolver entry Doing all of these may be enough to mitigate the risk posed by DoH. Doing anything less would not be, and would pose an existential threat to the security of enterprise and DC networks and hosts. (I'm still opposed to DoH generally, but I realize it has valid use cases -- it just needs to be restricted to ONLY those actual use cases to be seen as useful and legitimate.) Brian --000000000000beac29058a0cd524 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
<meta-comment>
I'll preface this with = an observation:
If you are reading this, you very likely work in the In= ternet industry.
If not, there's a good chance you rely on th= e Internet in some way for your livelihood, or things that are important to= you.
Please keep this in mind, in considerations for the impact = of deployment of DoH/DoT.
</meta-comment>
<= div>
One problem with DNS over HTTPS, is that it interferes w= ith passive DNS monitoring by authorized parties in the DC/Enterprise use c= ase.

A quick survey of blog posts and academic pap= ers on identification and response to malware command and control (C&C)= , shows that these detection/mitigation systems are heavily reliant on DNS,= either directly or indirectly.

In particular, DGA= (domain generation algorithms) in malware typically can only be observed v= ia their DNS queries, and takedown and/or interception requires that DNS vi= sibility.

In some cases, the visibility is local t= o the victim; in other cases, victims rely on feeds of domain names or IP a= ddresses, to thwart or contain malware activity. The feeds ultimately can b= e traced back to some third party having the visibility into a DNS monitor.=

The privacy offered by DoH is a multi-pronged pro= blem. If malware uses DoH, it can do "validation" of the cert for= the DoH server it wants to try using, and refuse to use a spoofed replacem= ent, preventing direct intervention as a method of obtaining DNS queries. A= nd if the DoH traffic is going to an attacker-controlled server, the DNS qu= eries are not visible.

The second prong is, that i= f all DNS traffic is going over DoH, there is no way to identify legitimate= query names. All HTTPS traffic looks the same, at that point, with no abil= ity to differentiate DoH from regular HTTPS traffic, and no ability to dete= ct change of DoH provider in use. If/when SNI encryption is employed, there= is no visibility into names used on HTTPS connections, and it all looks li= ke encrypted traffic to arbitrary IP addresses.

Wi= thout this visibility, malware infections on user machines inside enterpris= e networks may go undetected. This can lead to deeper penetration into prot= ected parts of such networks.

The inability to blo= ck this DoH traffic is (IMHO) the crux of the problem. If DoT is used in it= s place, then enterprise networks can enforce DNS resolver choice at the ne= twork level, including via deployment of internal DoT resolvers which could= still protect user privacy (modulo specific enterprises' policies). Do= T or Do53 service to resolvers operated by the enterprise, enables the curr= ent visibility to be maintained, independent of the presence or absence of = TLS to protect those connections.

The existence of= browsers which support DoH is the underlying problem. Even if DoH is not e= nabled by default, so long as user-input resolver choice is available, and = so long as DoH can be enabled by unprivileged users, all of the above probl= ems continue to exist, i.e. the ability for a user, or malware, to evade de= tection by DNS monitoring systems.

A reasonable co= mpromise might look like:
  • admin-only enabling of DoH/DoT = (which can be a policy pushed to managed systems)
  • a hardcoded TRR l= ist for DoH/DoT
  • a default-off configuration
  • the use of DoT = exclusively (instead of DoH) for any non-TRR resolver entry
Doing = all of these may be enough to mitigate the risk posed by DoH.=C2=A0
Doing anything less would not be, and would pose an existential threat t= o the security of enterprise and DC networks and hosts.

(I'm still opposed to DoH generally, but I realize it has valid u= se cases -- it just needs to be restricted to ONLY those actual use cases t= o be seen as useful and legitimate.)

Brian
--000000000000beac29058a0cd524-- From nobody Wed May 29 14:03:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2747A1201DB for ; Wed, 29 May 2019 14:03:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ritter.vg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sd5YM_GS6chd for ; Wed, 29 May 2019 14:03:16 -0700 (PDT) Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCBA0120096 for ; Wed, 29 May 2019 14:03:15 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id f8so2743961wrt.1 for ; Wed, 29 May 2019 14:03:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DYlKivuhJ7tNrbGGehg1megiogbWk58xd0PX2evrG3k=; b=xbDNGcKWVPNuMzqhSHESYCskPM1JVo5fotc8KJNYE0W3rdWXULoxoJLKiXvF42CDSz qtxhvVFipn8AquxwuO1NKVB3WshhfosU+r3vrU5/6TAsKOpNa2ENtOmpwr1NToeCPDaZ CAvYv0Y8U9sDVN3tTf5veDJSpFMpnKyiybblM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DYlKivuhJ7tNrbGGehg1megiogbWk58xd0PX2evrG3k=; b=hRPim7oTcx3ChtVldfQADbBSAcqGeYFfZvMEAOk04TfDbZCyKqHoNreQrbQJ1VQn9t nFm/5GcTQ7snK3Ro04zaWV8GRTK8IK2thDABcg2XA3zoEc1579TtSSpB0nWGq3XDKhYb mZIDlWp6dmNOhRLOVU1aF3AQiTsjAwN6/N3hcbBHv18jSAbYwdo3LJows33l60/vEOnf l4gyXwSENksGABeZQ/Ar8j+bkE7iMiZ2P5YDzpbEM28DOewl/UnjinzusIq8LQ1N14R4 iRB/gCxdSeOk8Nts31zdHRXQssUbWnA/bQ3fRsFWNwt90BHJmueFWFT/pedy45i0ksON +dOw== X-Gm-Message-State: APjAAAVPUxPMOpXpdLYut4IVd877dSyj5tm2ydEKcxuseEv6lb6t3Tzi BuuhRS2EYzIOEazCi3NgTDzIGlWTPxmbDmZ+Piq+pem8sXU= X-Google-Smtp-Source: APXvYqzV70cgR9SQF5O4CSKYraz41D4aEXUcpTLtickLnmVo2eCKwxXrr1EddRtXUQDUjJCxSjqzcAYijMZpad9tMvc= X-Received: by 2002:a5d:5283:: with SMTP id c3mr57886wrv.268.1559163794306; Wed, 29 May 2019 14:03:14 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Tom Ritter Date: Wed, 29 May 2019 21:03:02 +0000 Message-ID: To: Brian Dickson Cc: add@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] DNS visibility, malware C&C, exfiltration, etc. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 21:03:18 -0000 On Wed, 29 May 2019 at 20:43, Brian Dickson wrote: > admin-only enabling of DoH/DoT (which can be a policy pushed to managed systems) > a hardcoded TRR list for DoH/DoT Sure; I think these are perfectly reasonable enterprise policies to support. Ex: https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps -tom From nobody Thu May 30 02:14:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75B79120112 for ; Thu, 30 May 2019 02:14:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wKSRyRGoxFTv for ; Thu, 30 May 2019 02:14:48 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150074.outbound.protection.outlook.com [40.107.15.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72903120044 for ; Thu, 30 May 2019 02:14:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JJmIDPHuOcSKjdi8h28Zvu+thpNdi+pS6sEcMNLi6rI=; b=GvRMfSG4fT3QbVi5k6mAdb0J23wew/CL2cClwN4x6xZZ486XRTGH/xh5fNEUGadNPsHrb4ReF0CBW+modys50/K2IR6oI3D2hR4etsKpr6r42q/KwhGRNyqrhQFy8bsO76NPExPX7TuOuqvNDCj28fm7QTOytj+4vy42iI3F2+o= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2581.eurprd06.prod.outlook.com (10.168.82.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.21; Thu, 30 May 2019 09:14:45 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::410:431d:7a2f:a9b5%8]) with mapi id 15.20.1922.021; Thu, 30 May 2019 09:14:45 +0000 From: "Winfield, Alister" To: Tom Ritter , Brian Dickson CC: "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] DNS visibility, malware C&C, exfiltration, etc. Thread-Index: AQHVFmH3C5w4CHhpRkWlo1MWE9KSXKaDdD6A Date: Thu, 30 May 2019 09:14:45 +0000 Message-ID: <75437220-22EC-4012-A767-6A6F53BF23A8@sky.uk> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e2db:2400:ac8c:be08:9416:c057] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 849258eb-0c52-44bb-b71e-08d6e4df422b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DB6PR0601MB2581; x-ms-traffictypediagnostic: DB6PR0601MB2581: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4941; x-forefront-prvs: 00531FAC2C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(396003)(376002)(39860400002)(366004)(199004)(189003)(64756008)(81166006)(8676002)(81156014)(6486002)(14454004)(74482002)(8936002)(2906002)(66446008)(66556008)(66476007)(6512007)(305945005)(72206003)(76116006)(73956011)(58126008)(5660300002)(102836004)(91956017)(86362001)(316002)(110136005)(66946007)(478600001)(5024004)(14444005)(82746002)(25786009)(256004)(11346002)(6116002)(229853002)(53546011)(446003)(6436002)(186003)(4326008)(7736002)(76176011)(6506007)(476003)(53936002)(33656002)(99286004)(6246003)(46003)(71190400001)(83716004)(486006)(36756003)(2616005)(71200400001)(68736007); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2581; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: U8IrPk0neKa4mj97uuYHJHb7QiRZUiq+rMHXpM41dP4nw4oLkz/5ZQ3wwvainmweJ8VvisTZMDZWWGFtwRhyth0dVjRl5G8jA7XOTA0kGbX2+Hn7bTZjGhnpl3NOm6wDCzLwEheGBZlXjM6k8PJOEdYpI69yus0B7aw42XUtkCbsOVB5VNBPlWRxefWSkMaymnIlkFSOYQUHyiVM9Dhs1el+KDSZZw5jfgTK5I/E7bC6YLO5MQHU1B0cAG2V/7UHH3gN7tSILUXbCvQD17t+xlcexEIU09mJ6hLGpshyFn2rn+PLk4WxjPx4QG1ZDMXApswDrYO8Gq+R3fZAm2A1i4O7htoG6bLn74SgOhWavlG8L0mKE39vRNCo6/GVh4PDSgpEXyawM37CFCWzX8QmErUPA8YjXb/L98sqjzTGb38= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 849258eb-0c52-44bb-b71e-08d6e4df422b X-MS-Exchange-CrossTenant-originalarrivaltime: 30 May 2019 09:14:45.8134 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: alister.winfield@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2581 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: DNS visibility, malware C&C, exfiltration, etc. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 May 2019 09:14:52 -0000 T24gMjkvMDUvMjAxOSwgMjI6MDMsICJBZGQgb24gYmVoYWxmIG9mIFRvbSBSaXR0ZXIiIDxhZGQt Ym91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgdG9tQHJpdHRlci52Zz4gd3JvdGU6DQoNCiAg ICBPbiBXZWQsIDI5IE1heSAyMDE5IGF0IDIwOjQzLCBCcmlhbiBEaWNrc29uDQogICAgPGJyaWFu LnBldGVyLmRpY2tzb25AZ21haWwuY29tPiB3cm90ZToNCiAgICA+IGFkbWluLW9ubHkgZW5hYmxp bmcgb2YgRG9IL0RvVCAod2hpY2ggY2FuIGJlIGEgcG9saWN5IHB1c2hlZCB0byBtYW5hZ2VkIHN5 c3RlbXMpDQogICAgPiBhIGhhcmRjb2RlZCBUUlIgbGlzdCBmb3IgRG9IL0RvVA0KDQogICAgU3Vy ZTsgSSB0aGluayB0aGVzZSBhcmUgcGVyZmVjdGx5IHJlYXNvbmFibGUgZW50ZXJwcmlzZSBwb2xp Y2llcyB0byBzdXBwb3J0Lg0KDQoNCkkgdGhpbmsgdGhleSBhcmUgc2ltaWxhciB0byB3aGF0IG1h bnkgaG91c2Vob2xkcyB3YW50IHRvby4NCg0KQWxpc3RlciBXaW5maWVsZC4NCg0KDQoNCkluZm9y bWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJp dmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhl IGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGlj eSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUg cmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXR1cm4g ZS1tYWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91IHNob3VsZCBub3QgcmVw cm9kdWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0 cyBjb250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRv IG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91Z2ggb3VyIGludGVybmFsIGFu ZCBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtz IG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5k ZXIgbGljZW5jZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSks IFNreS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwg U2t5IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1 MCkgYW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJl Y3Qgb3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJh Z3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhl IHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNl eCBUVzcgNVFEDQo=